# HG changeset patch
# User wenzelm
# Date 1518696276 -3600
# Node ID 560fbd6bc0474b6ed75b685ecd11b0ff556d371b
# Parent  e4e57da0583a28808e0d84fc6c6ae331d1a91128# Parent  ce654b0e6d69c3afb4b6c20470807eb5e9647b3e
merged

diff -r e4e57da0583a -r 560fbd6bc047 src/Benchmarks/Quickcheck_Benchmark/Needham_Schroeder_Base.thy
--- a/src/Benchmarks/Quickcheck_Benchmark/Needham_Schroeder_Base.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Benchmarks/Quickcheck_Benchmark/Needham_Schroeder_Base.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -49,7 +49,7 @@
   | Fst:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> X \<in> analz H"
   | Snd:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> Y \<in> analz H"
   | Decrypt [dest]: 
-             "[|Crypt K X \<in> analz H; Key(invKey K): analz H|] ==> X \<in> analz H"
+             "[|Crypt K X \<in> analz H; Key(invKey K) \<in> analz H|] ==> X \<in> analz H"
 
 inductive_set
   synth :: "msg set => msg set"
@@ -168,7 +168,7 @@
 
 lemma [code]:
   "analz H = (let
-     H' = H \<union> (\<Union>((%m. case m of \<lbrace>X, Y\<rbrace> => {X, Y} | Crypt K X => if Key (invKey K) : H then {X} else {} | _ => {}) ` H))
+     H' = H \<union> (\<Union>((%m. case m of \<lbrace>X, Y\<rbrace> => {X, Y} | Crypt K X => if Key (invKey K) \<in> H then {X} else {} | _ => {}) ` H))
    in if H' = H then H else analz H')"
 sorry
 
@@ -180,7 +180,7 @@
 
 definition synth' :: "msg set => msg => bool"
 where
-  "synth' H m = (m : synth H)"
+  "synth' H m = (m \<in> synth H)"
 
 lemmas [code_pred_intro] = synth.intros[folded synth'_def]
 
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Prog_Prove/Isar.thy
--- a/src/Doc/Prog_Prove/Isar.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Prog_Prove/Isar.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -332,7 +332,7 @@
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
-(*<*)lemma "ALL x. P x" proof-(*>*)
+(*<*)lemma "\<forall>x. P x" proof-(*>*)
 show "\<forall>x. P(x)"
 proof
   fix x
@@ -346,7 +346,7 @@
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
-(*<*)lemma "EX x. P(x)" proof-(*>*)
+(*<*)lemma "\<exists>x. P(x)" proof-(*>*)
 show "\<exists>x. P(x)"
 proof
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
@@ -370,7 +370,7 @@
 How to reason forward from \noquotes{@{prop[source] "\<exists>x. P(x)"}}:
 \end{isamarkuptext}%
 \<close>
-(*<*)lemma True proof- assume 1: "EX x. P x"(*>*)
+(*<*)lemma True proof- assume 1: "\<exists>x. P x"(*>*)
 have "\<exists>x. P(x)" (*<*)by(rule 1)(*>*)text_raw\<open>\ \isasymproof\\\<close>
 then obtain x where p: "P(x)" by blast
 (*<*)oops(*>*)
@@ -1066,7 +1066,7 @@
 reasoning backwards: by which rules could some given fact have been proved?
 For the inductive definition of @{const ev}, rule inversion can be summarized
 like this:
-@{prop[display]"ev n \<Longrightarrow> n = 0 \<or> (EX k. n = Suc(Suc k) \<and> ev k)"}
+@{prop[display]"ev n \<Longrightarrow> n = 0 \<or> (\<exists>k. n = Suc(Suc k) \<and> ev k)"}
 The realisation in Isabelle is a case analysis.
 A simple example is the proof that @{prop"ev n \<Longrightarrow> ev (n - 2)"}. We
 already went through the details informally in \autoref{sec:Logic:even}. This
@@ -1223,7 +1223,7 @@
 
 \begin{exercise}
 Define a recursive function @{text "elems ::"} @{typ"'a list \<Rightarrow> 'a set"}
-and prove @{prop "x : elems xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> elems ys"}.
+and prove @{prop "x \<in> elems xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> elems ys"}.
 \end{exercise}
 
 \begin{exercise}
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Prog_Prove/Logic.thy
--- a/src/Doc/Prog_Prove/Logic.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Prog_Prove/Logic.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -97,7 +97,7 @@
 \noquotes{@{term[source] "{t | x y. P}"}}\index{$IMP042@@{text"{t |x. P}"}},
 where @{text "x y"} are those free variables in @{text t}
 that occur in @{text P}.
-This is just a shorthand for @{term"{v. EX x y. v = t \<and> P}"}, where
+This is just a shorthand for @{term"{v. \<exists>x y. v = t \<and> P}"}, where
 @{text v} is a new variable. For example, @{term"{x+y|x. x \<in> A}"}
 is short for \noquotes{@{term[source]"{v. \<exists>x. v = x+y \<and> x \<in> A}"}}.
 \end{warn}
@@ -111,8 +111,8 @@
 @{text "\<inter>"} & \texttt{\char`\\\char`\<inter>} & \texttt{Int}
 \end{tabular}
 \end{center}
-Sets also allow bounded quantifications @{prop"ALL x : A. P"} and
-@{prop"EX x : A. P"}.
+Sets also allow bounded quantifications @{prop"\<forall>x \<in> A. P"} and
+@{prop"\<exists>x \<in> A. P"}.
 
 For the more ambitious, there are also @{text"\<Union>"}\index{$HOLSet6@\isasymUnion}
 and @{text"\<Inter>"}\index{$HOLSet7@\isasymInter}:
@@ -703,7 +703,7 @@
 that maps a binary predicate to another binary predicate: if @{text r} is of
 type @{text"\<tau> \<Rightarrow> \<tau> \<Rightarrow> bool"} then @{term "star r"} is again of type @{text"\<tau> \<Rightarrow>
 \<tau> \<Rightarrow> bool"}, and @{prop"star r x y"} means that @{text x} and @{text y} are in
-the relation @{term"star r"}. Think @{term"r^*"} when you see @{term"star
+the relation @{term"star r"}. Think @{term"r\<^sup>*"} when you see @{term"star
 r"}, because @{text"star r"} is meant to be the reflexive transitive closure.
 That is, @{prop"star r x y"} is meant to be true if from @{text x} we can
 reach @{text y} in finitely many @{text r} steps. This concept is naturally
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Prog_Prove/Types_and_funs.thy
--- a/src/Doc/Prog_Prove/Types_and_funs.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Prog_Prove/Types_and_funs.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -525,7 +525,7 @@
 simplify to @{const True}.
 
 We can split case-expressions similarly. For @{text nat} the rule looks like this:
-@{prop[display,margin=65,indent=4]"P(case e of 0 \<Rightarrow> a | Suc n \<Rightarrow> b n) = ((e = 0 \<longrightarrow> P a) & (ALL n. e = Suc n \<longrightarrow> P(b n)))"}
+@{prop[display,margin=65,indent=4]"P(case e of 0 \<Rightarrow> a | Suc n \<Rightarrow> b n) = ((e = 0 \<longrightarrow> P a) \<and> (\<forall>n. e = Suc n \<longrightarrow> P(b n)))"}
 Case expressions are not split automatically by @{text simp}, but @{text simp}
 can be instructed to do so:
 \begin{quote}
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Sugar/Sugar.thy
--- a/src/Doc/Sugar/Sugar.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Sugar/Sugar.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -55,7 +55,7 @@
 
 \subsection{Logic}
 
-The formula @{prop[source]"\<not>(\<exists>x. P x)"} is typeset as @{prop"~(EX x. P x)"}.
+The formula @{prop[source]"\<not>(\<exists>x. P x)"} is typeset as @{prop"\<not>(\<exists>x. P x)"}.
 
 The predefined constructs @{text"if"}, @{text"let"} and
 @{text"case"} are set in sans serif font to distinguish them from
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/CTL/CTL.thy
--- a/src/Doc/Tutorial/CTL/CTL.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/CTL/CTL.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -153,7 +153,7 @@
 done
 
 text\<open>\noindent
-We assume the negation of the conclusion and prove @{term"s : lfp(af A)"}.
+We assume the negation of the conclusion and prove @{term"s \<in> lfp(af A)"}.
 Unfolding @{const lfp} once and
 simplifying with the definition of @{const af} finishes the proof.
 
@@ -214,14 +214,14 @@
 txt\<open>\noindent
 After simplification, the base case boils down to
 @{subgoals[display,indent=0,margin=70,goals_limit=1]}
-The conclusion looks exceedingly trivial: after all, @{term t} is chosen such that @{prop"(s,t):M"}
+The conclusion looks exceedingly trivial: after all, @{term t} is chosen such that @{prop"(s,t)\<in>M"}
 holds. However, we first have to show that such a @{term t} actually exists! This reasoning
 is embodied in the theorem @{thm[source]someI2_ex}:
 @{thm[display,eta_contract=false]someI2_ex}
 When we apply this theorem as an introduction rule, @{text"?P x"} becomes
-@{prop"(s, x) : M & Q x"} and @{text"?Q x"} becomes @{prop"(s,x) : M"} and we have to prove
-two subgoals: @{prop"EX a. (s, a) : M & Q a"}, which follows from the assumptions, and
-@{prop"(s, x) : M & Q x ==> (s,x) : M"}, which is trivial. Thus it is not surprising that
+@{prop"(s, x) \<in> M \<and> Q x"} and @{text"?Q x"} becomes @{prop"(s,x) \<in> M"} and we have to prove
+two subgoals: @{prop"\<exists>a. (s, a) \<in> M \<and> Q a"}, which follows from the assumptions, and
+@{prop"(s, x) \<in> M \<and> Q x \<Longrightarrow> (s,x) \<in> M"}, which is trivial. Thus it is not surprising that
 @{text fast} can prove the base case quickly:
 \<close>
 
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/CTL/PDL.thy
--- a/src/Doc/Tutorial/CTL/PDL.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/CTL/PDL.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -129,7 +129,7 @@
 forward direction. Fortunately the converse induction theorem
 @{thm[source]converse_rtrancl_induct} already exists:
 @{thm[display,margin=60]converse_rtrancl_induct[no_vars]}
-It says that if @{prop"(a,b):r\<^sup>*"} and we know @{prop"P b"} then we can infer
+It says that if @{prop"(a,b)\<in>r\<^sup>*"} and we know @{prop"P b"} then we can infer
 @{prop"P a"} provided each step backwards from a predecessor @{term z} of
 @{term b} preserves @{term P}.
 \<close>
@@ -176,7 +176,7 @@
 \footnote{We cannot use the customary @{text EX}: it is reserved
 as the \textsc{ascii}-equivalent of @{text"\<exists>"}.}
 with the intended semantics
-@{prop[display]"(s \<Turnstile> EN f) = (EX t. (s,t) : M & t \<Turnstile> f)"}
+@{prop[display]"(s \<Turnstile> EN f) = (\<exists>t. (s,t) \<in> M \<and> t \<Turnstile> f)"}
 Fortunately, @{term"EN f"} can already be expressed as a PDL formula. How?
 
 Show that the semantics for @{term EF} satisfies the following recursion equation:
@@ -190,7 +190,7 @@
 apply(auto simp add: EF_lemma)
 done
 
-lemma aux: "s \<Turnstile> f = (s : mc f)"
+lemma aux: "s \<Turnstile> f = (s \<in> mc f)"
 apply(simp add: main)
 done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Ifexpr/Ifexpr.thy
--- a/src/Doc/Tutorial/Ifexpr/Ifexpr.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Ifexpr/Ifexpr.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -201,7 +201,7 @@
      (case b of CIF b => False | VIF x => True | IF x y z => False))"
 
 lemma [simp]:
-  "ALL t e. valif (normif2 b t e) env = valif (IF b t e) env"
+  "\<forall>t e. valif (normif2 b t e) env = valif (IF b t e) env"
 apply(induct b)
 by(auto)
 
@@ -209,7 +209,7 @@
 apply(induct b)
 by(auto)
 
-lemma [simp]: "ALL t e. normal2 t & normal2 e --> normal2(normif2 b t e)"
+lemma [simp]: "\<forall>t e. normal2 t & normal2 e --> normal2(normif2 b t e)"
 apply(induct b)
 by(auto)
 
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Inductive/Mutual.thy
--- a/src/Doc/Tutorial/Inductive/Mutual.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Inductive/Mutual.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -67,7 +67,7 @@
 
 text\<open>\noindent Everything works as before, except that
 you write \commdx{inductive} instead of \isacommand{inductive\_set} and
-@{prop"evn n"} instead of @{prop"n : Even"}.
+@{prop"evn n"} instead of @{prop"n \<in> Even"}.
 When defining an n-ary relation as a predicate, it is recommended to curry
 the predicate: its type should be \mbox{@{text"\<tau>\<^sub>1 \<Rightarrow> \<dots> \<Rightarrow> \<tau>\<^sub>n \<Rightarrow> bool"}}
 rather than
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Inductive/Star.thy
--- a/src/Doc/Tutorial/Inductive/Star.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Inductive/Star.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -77,7 +77,7 @@
 is what we want, it is merely due to the order in which the assumptions occur
 in the subgoal, which it is not good practice to rely on. As a result,
 @{text"?xb"} becomes @{term x}, @{text"?xa"} becomes
-@{term y} and @{text"?P"} becomes @{term"%u v. (u,z) : r*"}, thus
+@{term y} and @{text"?P"} becomes @{term"\<lambda>u v. (u,z) \<in> r*"}, thus
 yielding the above subgoal. So what went wrong?
 
 When looking at the instantiation of @{text"?P"} we see that it does not
@@ -85,7 +85,7 @@
 goal, of the pair @{term"(x,y)"} only @{term x} appears also in the
 conclusion, but not @{term y}. Thus our induction statement is too
 general. Fortunately, it can easily be specialized:
-transfer the additional premise @{prop"(y,z):r*"} into the conclusion:\<close>
+transfer the additional premise @{prop"(y,z)\<in>r*"} into the conclusion:\<close>
 (*<*)oops(*>*)
 lemma rtc_trans[rule_format]:
   "(x,y) \<in> r* \<Longrightarrow> (y,z) \<in> r* \<longrightarrow> (x,z) \<in> r*"
@@ -157,7 +157,7 @@
 
 \begin{exercise}\label{ex:converse-rtc-step}
 Show that the converse of @{thm[source]rtc_step} also holds:
-@{prop[display]"[| (x,y) : r*; (y,z) : r |] ==> (x,z) : r*"}
+@{prop[display]"[| (x,y) \<in> r*; (y,z) \<in> r |] ==> (x,z) \<in> r*"}
 \end{exercise}
 \begin{exercise}
 Repeat the development of this section, but starting with a definition of
@@ -166,7 +166,7 @@
 \end{exercise}
 \<close>
 (*<*)
-lemma rtc_step2[rule_format]: "(x,y) : r* \<Longrightarrow> (y,z) : r --> (x,z) : r*"
+lemma rtc_step2[rule_format]: "(x,y) \<in> r* \<Longrightarrow> (y,z) \<in> r \<longrightarrow> (x,z) \<in> r*"
 apply(erule rtc.induct)
  apply blast
 apply(blast intro: rtc_step)
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Misc/Plus.thy
--- a/src/Doc/Tutorial/Misc/Plus.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Misc/Plus.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,7 +10,7 @@
 
 text\<open>\noindent and prove\<close>
 (*<*)
-lemma [simp]: "!m. add m n = m+n"
+lemma [simp]: "\<forall>m. add m n = m+n"
 apply(induct_tac n)
 by(auto)
 (*>*)
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Misc/Tree2.thy
--- a/src/Doc/Tutorial/Misc/Tree2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Misc/Tree2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -14,7 +14,7 @@
 
 text\<open>\noindent and prove\<close>
 (*<*)
-lemma [simp]: "!xs. flatten2 t xs = flatten t @ xs"
+lemma [simp]: "\<forall>xs. flatten2 t xs = flatten t @ xs"
 apply(induct_tac t)
 by(auto)
 (*>*)
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Misc/prime_def.thy
--- a/src/Doc/Tutorial/Misc/prime_def.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Misc/prime_def.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -7,12 +7,12 @@
 A common mistake when writing definitions is to introduce extra free
 variables on the right-hand side.  Consider the following, flawed definition
 (where @{text"dvd"} means ``divides''):
-@{term[display,quotes]"prime(p) == 1 < p & (m dvd p --> (m=1 | m=p))"}
+@{term[display,quotes]"prime(p) \<equiv> 1 < p \<and> (m dvd p \<longrightarrow> (m=1 \<or> m=p))"}
 \par\noindent\hangindent=0pt
 Isabelle rejects this ``definition'' because of the extra @{term"m"} on the
 right-hand side, which would introduce an inconsistency (why?). 
 The correct version is
-@{term[display,quotes]"prime(p) == 1 < p & (!m. m dvd p --> (m=1 | m=p))"}
+@{term[display,quotes]"prime(p) \<equiv> 1 < p \<and> (\<forall>m. m dvd p \<longrightarrow> (m=1 \<or> m=p))"}
 \end{warn}
 \<close>
 (*<*)
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Protocol/Event.thy
--- a/src/Doc/Tutorial/Protocol/Event.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Protocol/Event.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -12,7 +12,7 @@
 theory Event imports Message begin
 
 consts  (*Initial states of agents -- parameter of the construction*)
-  initState :: "agent => msg set"
+  initState :: "agent \<Rightarrow> msg set"
 
 datatype
   event = Says  agent agent msg
@@ -26,28 +26,28 @@
 text\<open>The constant "spies" is retained for compatibility's sake\<close>
 
 primrec
-  knows :: "agent => event list => msg set"
+  knows :: "agent \<Rightarrow> event list \<Rightarrow> msg set"
 where
   knows_Nil:   "knows A [] = initState A"
 | knows_Cons:
     "knows A (ev # evs) =
        (if A = Spy then 
         (case ev of
-           Says A' B X => insert X (knows Spy evs)
-         | Gets A' X => knows Spy evs
-         | Notes A' X  => 
+           Says A' B X \<Rightarrow> insert X (knows Spy evs)
+         | Gets A' X \<Rightarrow> knows Spy evs
+         | Notes A' X  \<Rightarrow> 
              if A' \<in> bad then insert X (knows Spy evs) else knows Spy evs)
         else
         (case ev of
-           Says A' B X => 
+           Says A' B X \<Rightarrow> 
              if A'=A then insert X (knows A evs) else knows A evs
-         | Gets A' X    => 
+         | Gets A' X    \<Rightarrow> 
              if A'=A then insert X (knows A evs) else knows A evs
-         | Notes A' X    => 
+         | Notes A' X    \<Rightarrow> 
              if A'=A then insert X (knows A evs) else knows A evs))"
 
 abbreviation (input)
-  spies  :: "event list => msg set" where
+  spies  :: "event list \<Rightarrow> msg set" where
   "spies == knows Spy"
 
 text\<open>Spy has access to his own key for spoof messages, but Server is secure\<close>
@@ -65,24 +65,24 @@
 primrec
   (*Set of items that might be visible to somebody:
     complement of the set of fresh items*)
-  used :: "event list => msg set"
+  used :: "event list \<Rightarrow> msg set"
 where
   used_Nil:   "used []         = (UN B. parts (initState B))"
 | used_Cons:  "used (ev # evs) =
                      (case ev of
-                        Says A B X => parts {X} \<union> used evs
-                      | Gets A X   => used evs
-                      | Notes A X  => parts {X} \<union> used evs)"
+                        Says A B X \<Rightarrow> parts {X} \<union> used evs
+                      | Gets A X   \<Rightarrow> used evs
+                      | Notes A X  \<Rightarrow> parts {X} \<union> used evs)"
     \<comment> \<open>The case for @{term Gets} seems anomalous, but @{term Gets} always
         follows @{term Says} in real protocols.  Seems difficult to change.
         See @{text Gets_correct} in theory @{text "Guard/Extensions.thy"}.\<close>
 
-lemma Notes_imp_used [rule_format]: "Notes A X \<in> set evs --> X \<in> used evs"
+lemma Notes_imp_used [rule_format]: "Notes A X \<in> set evs \<longrightarrow> X \<in> used evs"
 apply (induct_tac evs)
 apply (auto split: event.split) 
 done
 
-lemma Says_imp_used [rule_format]: "Says A B X \<in> set evs --> X \<in> used evs"
+lemma Says_imp_used [rule_format]: "Says A B X \<in> set evs \<longrightarrow> X \<in> used evs"
 apply (induct_tac evs)
 apply (auto split: event.split) 
 done
@@ -103,7 +103,7 @@
       on whether @{term "A=Spy"} and whether @{term "A\<in>bad"}\<close>
 lemma knows_Spy_Notes [simp]:
      "knows Spy (Notes A X # evs) =  
-          (if A:bad then insert X (knows Spy evs) else knows Spy evs)"
+          (if A\<in>bad then insert X (knows Spy evs) else knows Spy evs)"
 by simp
 
 lemma knows_Spy_Gets [simp]: "knows Spy (Gets A X # evs) = knows Spy evs"
@@ -123,13 +123,13 @@
 
 text\<open>Spy sees what is sent on the traffic\<close>
 lemma Says_imp_knows_Spy [rule_format]:
-     "Says A B X \<in> set evs --> X \<in> knows Spy evs"
+     "Says A B X \<in> set evs \<longrightarrow> X \<in> knows Spy evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 done
 
 lemma Notes_imp_knows_Spy [rule_format]:
-     "Notes A X \<in> set evs --> A: bad --> X \<in> knows Spy evs"
+     "Notes A X \<in> set evs \<longrightarrow> A \<in> bad \<longrightarrow> X \<in> knows Spy evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 done
@@ -158,7 +158,7 @@
 by simp
 
 lemma knows_Gets:
-     "A \<noteq> Spy --> knows A (Gets A X # evs) = insert X (knows A evs)"
+     "A \<noteq> Spy \<longrightarrow> knows A (Gets A X # evs) = insert X (knows A evs)"
 by simp
 
 
@@ -172,14 +172,14 @@
 by (simp add: subset_insertI)
 
 text\<open>Agents know what they say\<close>
-lemma Says_imp_knows [rule_format]: "Says A B X \<in> set evs --> X \<in> knows A evs"
+lemma Says_imp_knows [rule_format]: "Says A B X \<in> set evs \<longrightarrow> X \<in> knows A evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 apply blast
 done
 
 text\<open>Agents know what they note\<close>
-lemma Notes_imp_knows [rule_format]: "Notes A X \<in> set evs --> X \<in> knows A evs"
+lemma Notes_imp_knows [rule_format]: "Notes A X \<in> set evs \<longrightarrow> X \<in> knows A evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 apply blast
@@ -187,7 +187,7 @@
 
 text\<open>Agents know what they receive\<close>
 lemma Gets_imp_knows_agents [rule_format]:
-     "A \<noteq> Spy --> Gets A X \<in> set evs --> X \<in> knows A evs"
+     "A \<noteq> Spy \<longrightarrow> Gets A X \<in> set evs \<longrightarrow> X \<in> knows A evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 done
@@ -196,8 +196,8 @@
 text\<open>What agents DIFFERENT FROM Spy know 
   was either said, or noted, or got, or known initially\<close>
 lemma knows_imp_Says_Gets_Notes_initState [rule_format]:
-     "[| X \<in> knows A evs; A \<noteq> Spy |] ==> EX B.  
-  Says A B X \<in> set evs | Gets A X \<in> set evs | Notes A X \<in> set evs | X \<in> initState A"
+     "[| X \<in> knows A evs; A \<noteq> Spy |] ==> \<exists>B.
+  Says A B X \<in> set evs \<or> Gets A X \<in> set evs \<or> Notes A X \<in> set evs \<or> X \<in> initState A"
 apply (erule rev_mp)
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
@@ -207,8 +207,8 @@
 text\<open>What the Spy knows -- for the time being --
   was either said or noted, or known initially\<close>
 lemma knows_Spy_imp_Says_Notes_initState [rule_format]:
-     "[| X \<in> knows Spy evs |] ==> EX A B.  
-  Says A B X \<in> set evs | Notes A X \<in> set evs | X \<in> initState Spy"
+     "[| X \<in> knows Spy evs |] ==> \<exists>A B.
+  Says A B X \<in> set evs \<or> Notes A X \<in> set evs \<or> X \<in> initState Spy"
 apply (erule rev_mp)
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
@@ -222,7 +222,7 @@
 
 lemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]
 
-lemma initState_into_used: "X \<in> parts (initState B) ==> X \<in> used evs"
+lemma initState_into_used: "X \<in> parts (initState B) \<Longrightarrow> X \<in> used evs"
 apply (induct_tac "evs")
 apply (simp_all add: parts_insert_knows_A split: event.split, blast)
 done
@@ -246,7 +246,7 @@
         used_Nil [simp del] used_Cons [simp del]
 
 
-text\<open>For proving theorems of the form @{term "X \<notin> analz (knows Spy evs) --> P"}
+text\<open>For proving theorems of the form @{term "X \<notin> analz (knows Spy evs) \<longrightarrow> P"}
   New events added by induction to "evs" are discarded.  Provided 
   this information isn't needed, the proof will be much shorter, since
   it will omit complicated reasoning about @{term analz}.\<close>
@@ -286,7 +286,7 @@
 
 method_setup analz_mono_contra = \<open>
     Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt)))\<close>
-    "for proving theorems of the form X \<notin> analz (knows Spy evs) --> P"
+    "for proving theorems of the form X \<notin> analz (knows Spy evs) \<longrightarrow> P"
 
 subsubsection\<open>Useful for case analysis on whether a hash is a spoof or not\<close>
 
@@ -343,7 +343,7 @@
 
 method_setup synth_analz_mono_contra = \<open>
     Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (synth_analz_mono_contra_tac ctxt)))\<close>
-    "for proving theorems of the form X \<notin> synth (analz (knows Spy evs)) --> P"
+    "for proving theorems of the form X \<notin> synth (analz (knows Spy evs)) \<longrightarrow> P"
 (*>*)
 
 section\<open>Event Traces \label{sec:events}\<close>
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Protocol/Message.thy
--- a/src/Doc/Tutorial/Protocol/Message.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Protocol/Message.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -39,7 +39,7 @@
 
 specification (invKey)
   invKey [simp]: "invKey (invKey K) = K"
-  invKey_symmetric: "all_symmetric --> invKey = id"
+  invKey_symmetric: "all_symmetric \<longrightarrow> invKey = id"
     by (rule exI [of _ id], auto)
 
 
@@ -81,13 +81,13 @@
 (*<*)
 text\<open>Concrete syntax: messages appear as \<open>\<lbrace>A,B,NA\<rbrace>\<close>, etc...\<close>
 syntax
-  "_MTuple"      :: "['a, args] => 'a * 'b"       ("(2\<lbrace>_,/ _\<rbrace>)")
+  "_MTuple"      :: "['a, args] \<Rightarrow> 'a * 'b"       ("(2\<lbrace>_,/ _\<rbrace>)")
 translations
   "\<lbrace>x, y, z\<rbrace>"   == "\<lbrace>x, \<lbrace>y, z\<rbrace>\<rbrace>"
   "\<lbrace>x, y\<rbrace>"      == "CONST MPair x y"
 
 
-definition keysFor :: "msg set => key set" where
+definition keysFor :: "msg set \<Rightarrow> key set" where
     \<comment> \<open>Keys useful to decrypt elements of a message set\<close>
   "keysFor H == invKey ` {K. \<exists>X. Crypt K X \<in> H}"
 
@@ -95,17 +95,17 @@
 subsubsection\<open>Inductive Definition of All Parts" of a Message\<close>
 
 inductive_set
-  parts :: "msg set => msg set"
+  parts :: "msg set \<Rightarrow> msg set"
   for H :: "msg set"
   where
-    Inj [intro]:               "X \<in> H ==> X \<in> parts H"
-  | Fst:         "\<lbrace>X,Y\<rbrace>   \<in> parts H ==> X \<in> parts H"
-  | Snd:         "\<lbrace>X,Y\<rbrace>   \<in> parts H ==> Y \<in> parts H"
-  | Body:        "Crypt K X \<in> parts H ==> X \<in> parts H"
+    Inj [intro]:               "X \<in> H \<Longrightarrow> X \<in> parts H"
+  | Fst:         "\<lbrace>X,Y\<rbrace>   \<in> parts H \<Longrightarrow> X \<in> parts H"
+  | Snd:         "\<lbrace>X,Y\<rbrace>   \<in> parts H \<Longrightarrow> Y \<in> parts H"
+  | Body:        "Crypt K X \<in> parts H \<Longrightarrow> X \<in> parts H"
 
 
 text\<open>Monotonicity\<close>
-lemma parts_mono: "G \<subseteq> H ==> parts(G) \<subseteq> parts(H)"
+lemma parts_mono: "G \<subseteq> H \<Longrightarrow> parts(G) \<subseteq> parts(H)"
 apply auto
 apply (erule parts.induct) 
 apply (blast dest: parts.Fst parts.Snd parts.Body)+
@@ -113,7 +113,7 @@
 
 
 text\<open>Equations hold because constructors are injective.\<close>
-lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x:A)"
+lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x\<in>A)"
 by auto
 
 lemma Key_image_eq [simp]: "(Key x \<in> Key`A) = (x\<in>A)"
@@ -143,7 +143,7 @@
 by (unfold keysFor_def, blast)
 
 text\<open>Monotonicity\<close>
-lemma keysFor_mono: "G \<subseteq> H ==> keysFor(G) \<subseteq> keysFor(H)"
+lemma keysFor_mono: "G \<subseteq> H \<Longrightarrow> keysFor(G) \<subseteq> keysFor(H)"
 by (unfold keysFor_def, blast)
 
 lemma keysFor_insert_Agent [simp]: "keysFor (insert (Agent A) H) = keysFor H"
@@ -165,7 +165,7 @@
 lemma keysFor_image_Key [simp]: "keysFor (Key`E) = {}"
 by (unfold keysFor_def, auto)
 
-lemma Crypt_imp_invKey_keysFor: "Crypt K X \<in> H ==> invKey K \<in> keysFor H"
+lemma Crypt_imp_invKey_keysFor: "Crypt K X \<in> H \<Longrightarrow> invKey K \<in> keysFor H"
 by (unfold keysFor_def, blast)
 
 
@@ -192,11 +192,11 @@
 apply (erule parts.induct, blast+)
 done
 
-lemma parts_emptyE [elim!]: "X\<in> parts{} ==> P"
+lemma parts_emptyE [elim!]: "X\<in> parts{} \<Longrightarrow> P"
 by simp
 
 text\<open>WARNING: loops if H = {Y}, therefore must not be repeated!\<close>
-lemma parts_singleton: "X\<in> parts H ==> \<exists>Y\<in>H. X\<in> parts {Y}"
+lemma parts_singleton: "X\<in> parts H \<Longrightarrow> \<exists>Y\<in>H. X\<in> parts {Y}"
 by (erule parts.induct, fast+)
 
 
@@ -252,7 +252,7 @@
 
 subsubsection\<open>Idempotence and transitivity\<close>
 
-lemma parts_partsD [dest!]: "X\<in> parts (parts H) ==> X\<in> parts H"
+lemma parts_partsD [dest!]: "X \<in> parts (parts H) \<Longrightarrow> X\<in> parts H"
 by (erule parts.induct, blast+)
 
 lemma parts_idem [simp]: "parts (parts H) = parts H"
@@ -324,7 +324,7 @@
 
 
 text\<open>In any message, there is an upper bound N on its greatest nonce.\<close>
-lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n --> Nonce n \<notin> parts {msg}"
+lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Nonce n \<notin> parts {msg}"
 apply (induct_tac "msg")
 apply (simp_all (no_asm_simp) add: exI parts_insert2)
  txt\<open>MPair case: blast works out the necessary sum itself!\<close>
@@ -363,7 +363,7 @@
               \<Longrightarrow> X \<in> analz H"
 (*<*)
 text\<open>Monotonicity; Lemma 1 of Lowe's paper\<close>
-lemma analz_mono: "G\<subseteq>H ==> analz(G) \<subseteq> analz(H)"
+lemma analz_mono: "G\<subseteq>H \<Longrightarrow> analz(G) \<subseteq> analz(H)"
 apply auto
 apply (erule analz.induct) 
 apply (auto dest: analz.Fst analz.Snd) 
@@ -435,7 +435,7 @@
 
 text\<open>Can only pull out Keys if they are not needed to decrypt the rest\<close>
 lemma analz_insert_Key [simp]: 
-    "K \<notin> keysFor (analz H) ==>   
+    "K \<notin> keysFor (analz H) \<Longrightarrow>   
           analz (insert (Key K) H) = insert (Key K) (analz H)"
 apply (unfold keysFor_def)
 apply (rule analz_insert_eq_I) 
@@ -455,20 +455,20 @@
 text\<open>Can pull out enCrypted message if the Key is not known\<close>
 lemma analz_insert_Crypt:
      "Key (invKey K) \<notin> analz H 
-      ==> analz (insert (Crypt K X) H) = insert (Crypt K X) (analz H)"
+      \<Longrightarrow> analz (insert (Crypt K X) H) = insert (Crypt K X) (analz H)"
 apply (rule analz_insert_eq_I) 
 apply (erule analz.induct, auto) 
 
 done
 
-lemma lemma1: "Key (invKey K) \<in> analz H ==>   
+lemma lemma1: "Key (invKey K) \<in> analz H \<Longrightarrow>   
                analz (insert (Crypt K X) H) \<subseteq>  
                insert (Crypt K X) (analz (insert X H))"
 apply (rule subsetI)
 apply (erule_tac x = x in analz.induct, auto)
 done
 
-lemma lemma2: "Key (invKey K) \<in> analz H ==>   
+lemma lemma2: "Key (invKey K) \<in> analz H \<Longrightarrow>   
                insert (Crypt K X) (analz (insert X H)) \<subseteq>  
                analz (insert (Crypt K X) H)"
 apply auto
@@ -477,7 +477,7 @@
 done
 
 lemma analz_insert_Decrypt:
-     "Key (invKey K) \<in> analz H ==>   
+     "Key (invKey K) \<in> analz H \<Longrightarrow>   
                analz (insert (Crypt K X) H) =  
                insert (Crypt K X) (analz (insert X H))"
 by (intro equalityI lemma1 lemma2)
@@ -511,7 +511,7 @@
 
 subsubsection\<open>Idempotence and transitivity\<close>
 
-lemma analz_analzD [dest!]: "X\<in> analz (analz H) ==> X\<in> analz H"
+lemma analz_analzD [dest!]: "X\<in> analz (analz H) \<Longrightarrow> X\<in> analz H"
 by (erule analz.induct, blast+)
 
 lemma analz_idem [simp]: "analz (analz H) = analz H"
@@ -531,13 +531,13 @@
 by (erule analz_trans, blast)
 
 (*Cut can be proved easily by induction on
-   "Y: analz (insert X H) ==> X: analz H --> Y: analz H"
+   "Y \<in> analz (insert X H) \<Longrightarrow> X \<in> analz H \<longrightarrow> Y \<in> analz H"
 *)
 
 text\<open>This rewrite rule helps in the simplification of messages that involve
   the forwarding of unknown components (X).  Without it, removing occurrences
   of X can be very complicated.\<close>
-lemma analz_insert_eq: "X\<in> analz H ==> analz (insert X H) = analz H"
+lemma analz_insert_eq: "X\<in> analz H \<Longrightarrow> analz (insert X H) = analz H"
 by (blast intro: analz_cut analz_insertI)
 
 
@@ -556,7 +556,7 @@
 by (intro equalityI analz_subset_cong, simp_all) 
 
 lemma analz_insert_cong:
-     "analz H = analz H' ==> analz(insert X H) = analz(insert X H')"
+     "analz H = analz H' \<Longrightarrow> analz(insert X H) = analz(insert X H')"
 by (force simp only: insert_def intro!: analz_cong)
 
 text\<open>If there are no pairs or encryptions then analz does nothing\<close>
@@ -568,7 +568,7 @@
 
 text\<open>These two are obsolete (with a single Spy) but cost little to prove...\<close>
 lemma analz_UN_analz_lemma:
-     "X\<in> analz (\<Union>i\<in>A. analz (H i)) ==> X\<in> analz (\<Union>i\<in>A. H i)"
+     "X\<in> analz (\<Union>i\<in>A. analz (H i)) \<Longrightarrow> X\<in> analz (\<Union>i\<in>A. H i)"
 apply (erule analz.induct)
 apply (blast intro: analz_mono [THEN [2] rev_subsetD])+
 done
@@ -598,7 +598,7 @@
   | Crypt  [intro]:
               "\<lbrakk>X \<in> synth H;  Key K \<in> H\<rbrakk> \<Longrightarrow> Crypt K X \<in> synth H"
 (*<*)
-lemma synth_mono: "G\<subseteq>H ==> synth(G) \<subseteq> synth(H)"
+lemma synth_mono: "G\<subseteq>H \<Longrightarrow> synth(G) \<subseteq> synth(H)"
   by (auto, erule synth.induct, auto)  
 
 inductive_cases Key_synth   [elim!]: "Key K \<in> synth H"
@@ -668,7 +668,7 @@
 
 subsubsection\<open>Idempotence and transitivity\<close>
 
-lemma synth_synthD [dest!]: "X\<in> synth (synth H) ==> X\<in> synth H"
+lemma synth_synthD [dest!]: "X\<in> synth (synth H) \<Longrightarrow> X\<in> synth H"
 by (erule synth.induct, blast+)
 
 lemma synth_idem: "synth (synth H) = synth H"
@@ -697,7 +697,7 @@
 by blast
 
 lemma Crypt_synth_eq [simp]:
-     "Key K \<notin> H ==> (Crypt K X \<in> synth H) = (Crypt K X \<in> H)"
+     "Key K \<notin> H \<Longrightarrow> (Crypt K X \<in> synth H) = (Crypt K X \<in> H)"
 by blast
 
 
@@ -724,13 +724,13 @@
 
 subsubsection\<open>For reasoning about the Fake rule in traces\<close>
 
-lemma parts_insert_subset_Un: "X\<in> G ==> parts(insert X H) \<subseteq> parts G \<union> parts H"
+lemma parts_insert_subset_Un: "X \<in> G \<Longrightarrow> parts(insert X H) \<subseteq> parts G \<union> parts H"
 by (rule subset_trans [OF parts_mono parts_Un_subset2], blast)
 
 text\<open>More specifically for Fake.  Very occasionally we could do with a version
   of the form  @{term"parts{X} \<subseteq> synth (analz H) \<union> parts H"}\<close>
 lemma Fake_parts_insert:
-     "X \<in> synth (analz H) ==>  
+     "X \<in> synth (analz H) \<Longrightarrow>
       parts (insert X H) \<subseteq> synth (analz H) \<union> parts H"
 apply (drule parts_insert_subset_Un)
 apply (simp (no_asm_use))
@@ -738,14 +738,14 @@
 done
 
 lemma Fake_parts_insert_in_Un:
-     "[|Z \<in> parts (insert X H);  X: synth (analz H)|] 
+     "[|Z \<in> parts (insert X H);  X \<in> synth (analz H)|] 
       ==> Z \<in>  synth (analz H) \<union> parts H"
 by (blast dest: Fake_parts_insert  [THEN subsetD, dest])
 
 text\<open>@{term H} is sometimes @{term"Key ` KK \<union> spies evs"}, so can't put 
   @{term "G=H"}.\<close>
 lemma Fake_analz_insert:
-     "X\<in> synth (analz G) ==>  
+     "X \<in> synth (analz G) \<Longrightarrow>  
       analz (insert X H) \<subseteq> synth (analz G) \<union> analz (G \<union> H)"
 apply (rule subsetI)
 apply (subgoal_tac "x \<in> analz (synth (analz G) \<union> H) ")
@@ -869,11 +869,11 @@
 lemma Crypt_notin_image_Key [simp]: "Crypt K X \<notin> Key ` A"
 by auto
 
-lemma synth_analz_mono: "G\<subseteq>H ==> synth (analz(G)) \<subseteq> synth (analz(H))"
+lemma synth_analz_mono: "G\<subseteq>H \<Longrightarrow> synth (analz(G)) \<subseteq> synth (analz(H))"
 by (iprover intro: synth_mono analz_mono) 
 
 lemma Fake_analz_eq [simp]:
-     "X \<in> synth(analz H) ==> synth (analz (insert X H)) = synth (analz H)"
+     "X \<in> synth(analz H) \<Longrightarrow> synth (analz (insert X H)) = synth (analz H)"
 apply (drule Fake_analz_insert[of _ _ "H"])
 apply (simp add: synth_increasing[THEN Un_absorb2])
 apply (drule synth_mono)
@@ -885,18 +885,18 @@
 
 text\<open>Two generalizations of @{text analz_insert_eq}\<close>
 lemma gen_analz_insert_eq [rule_format]:
-     "X \<in> analz H ==> ALL G. H \<subseteq> G --> analz (insert X G) = analz G"
+     "X \<in> analz H \<Longrightarrow> \<forall>G. H \<subseteq> G \<longrightarrow> analz (insert X G) = analz G"
 by (blast intro: analz_cut analz_insertI analz_mono [THEN [2] rev_subsetD])
 
 lemma synth_analz_insert_eq [rule_format]:
      "X \<in> synth (analz H) 
-      ==> ALL G. H \<subseteq> G --> (Key K \<in> analz (insert X G)) = (Key K \<in> analz G)"
+      \<Longrightarrow> \<forall>G. H \<subseteq> G \<longrightarrow> (Key K \<in> analz (insert X G)) = (Key K \<in> analz G)"
 apply (erule synth.induct) 
 apply (simp_all add: gen_analz_insert_eq subset_trans [OF _ subset_insertI]) 
 done
 
 lemma Fake_parts_sing:
-     "X \<in> synth (analz H) ==> parts{X} \<subseteq> synth (analz H) \<union> parts H"
+     "X \<in> synth (analz H) \<Longrightarrow> parts{X} \<subseteq> synth (analz H) \<union> parts H"
 apply (rule subset_trans) 
  apply (erule_tac [2] Fake_parts_insert)
 apply (rule parts_mono, blast)
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Protocol/Public.thy
--- a/src/Doc/Tutorial/Protocol/Public.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Protocol/Public.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -32,7 +32,7 @@
 | initState_Friend:  "initState (Friend i) =    
                          insert (Key (priK (Friend i))) (Key ` range pubK)"
 | initState_Spy:     "initState Spy        =    
-                         (Key`invKey`pubK`bad) Un (Key ` range pubK)"
+                         (Key`invKey`pubK`bad) \<union> (Key ` range pubK)"
 
 end
 (*>*)
@@ -77,14 +77,14 @@
 
 (** "Image" equations that hold for injective functions **)
 
-lemma invKey_image_eq[simp]: "(invKey x : invKey`A) = (x:A)"
+lemma invKey_image_eq[simp]: "(invKey x \<in> invKey`A) = (x\<in>A)"
   by auto
 
 (*holds because invKey is injective*)
-lemma pubK_image_eq[simp]: "(pubK x : pubK`A) = (x:A)"
+lemma pubK_image_eq[simp]: "(pubK x \<in> pubK`A) = (x\<in>A)"
   by auto
 
-lemma priK_pubK_image_eq[simp]: "(priK x ~: pubK`A)"
+lemma priK_pubK_image_eq[simp]: "(priK x \<notin> pubK`A)"
   by auto
 
 
@@ -101,15 +101,15 @@
 (*** Function "spies" ***)
 
 (*Agents see their own private keys!*)
-lemma priK_in_initState[iff]: "Key (priK A) : initState A"
+lemma priK_in_initState[iff]: "Key (priK A) \<in> initState A"
   by (induct A) auto
 
 (*All public keys are visible*)
-lemma spies_pubK[iff]: "Key (pubK A) : spies evs"
+lemma spies_pubK[iff]: "Key (pubK A) \<in> spies evs"
   by (induct evs) (simp_all add: imageI knows_Cons split: event.split)
 
 (*Spy sees private keys of bad agents!*)
-lemma Spy_spies_bad[intro!]: "A: bad ==> Key (priK A) : spies evs"
+lemma Spy_spies_bad[intro!]: "A \<in> bad \<Longrightarrow> Key (priK A) \<in> spies evs"
   by (induct evs) (simp_all add: imageI knows_Cons split: event.split)
 
 lemmas [iff] = spies_pubK [THEN analz.Inj]
@@ -117,17 +117,17 @@
 
 (*** Fresh nonces ***)
 
-lemma Nonce_notin_initState[iff]: "Nonce N ~: parts (initState B)"
+lemma Nonce_notin_initState[iff]: "Nonce N \<notin> parts (initState B)"
   by (induct B) auto
 
-lemma Nonce_notin_used_empty[simp]: "Nonce N ~: used []"
+lemma Nonce_notin_used_empty[simp]: "Nonce N \<notin> used []"
   by (simp add: used_Nil)
 
 
 (*** Supply fresh nonces for possibility theorems. ***)
 
 (*In any trace, there is an upper bound N on the greatest nonce in use.*)
-lemma Nonce_supply_lemma: "EX N. ALL n. N<=n --> Nonce n \<notin> used evs"
+lemma Nonce_supply_lemma: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Nonce n \<notin> used evs"
 apply (induct_tac "evs")
 apply (rule_tac x = 0 in exI)
 apply (simp_all (no_asm_simp) add: used_Cons split: event.split)
@@ -135,10 +135,10 @@
 apply (rule msg_Nonce_supply [THEN exE], blast elim!: add_leE)+
 done
 
-lemma Nonce_supply1: "EX N. Nonce N \<notin> used evs"
+lemma Nonce_supply1: "\<exists>N. Nonce N \<notin> used evs"
 by (rule Nonce_supply_lemma [THEN exE], blast)
 
-lemma Nonce_supply: "Nonce (@ N. Nonce N \<notin> used evs) \<notin> used evs"
+lemma Nonce_supply: "Nonce (SOME N. Nonce N \<notin> used evs) \<notin> used evs"
 apply (rule Nonce_supply_lemma [THEN exE])
 apply (rule someI, fast)
 done
@@ -146,10 +146,10 @@
 
 (*** Specialized rewriting for the analz_image_... theorems ***)
 
-lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} Un H"
+lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} \<union> H"
   by blast
 
-lemma insert_Key_image: "insert (Key K) (Key`KK Un C) = Key ` (insert K KK) Un C"
+lemma insert_Key_image: "insert (Key K) (Key`KK \<union> C) = Key ` (insert K KK) \<union> C"
   by blast
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Rules/TPrimes.thy
--- a/src/Doc/Tutorial/Rules/TPrimes.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Rules/TPrimes.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -96,7 +96,7 @@
 
 definition is_gcd :: "[nat,nat,nat] \<Rightarrow> bool" where        (*gcd as a relation*)
     "is_gcd p m n == p dvd m  \<and>  p dvd n  \<and>
-                     (ALL d. d dvd m \<and> d dvd n \<longrightarrow> d dvd p)"
+                     (\<forall>d. d dvd m \<and> d dvd n \<longrightarrow> d dvd p)"
 
 (*Function gcd yields the Greatest Common Divisor*)
 lemma is_gcd: "is_gcd (gcd m n) m n"
diff -r e4e57da0583a -r 560fbd6bc047 src/Doc/Tutorial/Sets/Examples.thy
--- a/src/Doc/Tutorial/Sets/Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/Doc/Tutorial/Sets/Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -155,7 +155,7 @@
 by blast
 
 definition prime :: "nat set" where
-    "prime == {p. 1<p & (ALL m. m dvd p --> m=1 | m=p)}"
+    "prime == {p. 1<p & (\<forall>m. m dvd p \<longrightarrow> m=1 \<or> m=p)}"
 
 lemma "{p*q | p q. p\<in>prime \<and> q\<in>prime} =
        {z. \<exists>p q. z = p*q \<and> p\<in>prime \<and> q\<in>prime}"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/AbelCoset.thy
--- a/src/HOL/Algebra/AbelCoset.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/AbelCoset.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -554,7 +554,7 @@
   ..
 
 lemma (in abelian_group_hom) hom_add [simp]:
-  "[| x : carrier G; y : carrier G |]
+  "[| x \<in> carrier G; y \<in> carrier G |]
         ==> h (x \<oplus>\<^bsub>G\<^esub> y) = h x \<oplus>\<^bsub>H\<^esub> h y"
 by (rule group_hom.hom_mult[OF a_group_hom,
     simplified ring_record_simps])
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/FiniteProduct.thy
--- a/src/HOL/Algebra/FiniteProduct.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/FiniteProduct.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -22,7 +22,7 @@
   for D :: "'a set" and f :: "'b => 'a => 'a" and e :: 'a
   where
     emptyI [intro]: "e \<in> D ==> ({}, e) \<in> foldSetD D f e"
-  | insertI [intro]: "[| x ~: A; f x y \<in> D; (A, y) \<in> foldSetD D f e |] ==>
+  | insertI [intro]: "[| x \<notin> A; f x y \<in> D; (A, y) \<in> foldSetD D f e |] ==>
                       (insert x A, f x y) \<in> foldSetD D f e"
 
 inductive_cases empty_foldSetDE [elim!]: "({}, x) \<in> foldSetD D f e"
@@ -178,7 +178,7 @@
   done
 
 lemma (in LCD) foldD_insert:
-    "[| finite A; x ~: A; x \<in> B; e \<in> D; A \<subseteq> B |] ==>
+    "[| finite A; x \<notin> A; x \<in> B; e \<in> D; A \<subseteq> B |] ==>
      foldD D f e (insert x A) = f x (foldD D f e A)"
   apply (unfold foldD_def)
   apply (simp add: foldD_insert_aux)
@@ -423,13 +423,13 @@
       proof (intro finprod_insert)
         show "finite B" by fact
       next
-        show "x ~: B" by fact
+        show "x \<notin> B" by fact
       next
-        assume "x ~: B" "!!i. i \<in> insert x B \<Longrightarrow> f i = g i"
+        assume "x \<notin> B" "!!i. i \<in> insert x B \<Longrightarrow> f i = g i"
           "g \<in> insert x B \<rightarrow> carrier G"
         thus "f \<in> B \<rightarrow> carrier G" by fastforce
       next
-        assume "x ~: B" "!!i. i \<in> insert x B \<Longrightarrow> f i = g i"
+        assume "x \<notin> B" "!!i. i \<in> insert x B \<Longrightarrow> f i = g i"
           "g \<in> insert x B \<rightarrow> carrier G"
         thus "f x \<in> carrier G" by fastforce
       qed
@@ -491,8 +491,8 @@
 (* The following two were contributed by Jeremy Avigad. *)
 
 lemma finprod_reindex:
-  "f : (h ` A) \<rightarrow> carrier G \<Longrightarrow> 
-        inj_on h A ==> finprod G f (h ` A) = finprod G (%x. f (h x)) A"
+  "f \<in> (h ` A) \<rightarrow> carrier G \<Longrightarrow> 
+        inj_on h A \<Longrightarrow> finprod G f (h ` A) = finprod G (\<lambda>x. f (h x)) A"
 proof (induct A rule: infinite_finite_induct)
   case (infinite A)
   hence "\<not> finite (h ` A)"
@@ -501,8 +501,8 @@
 qed (auto simp add: Pi_def)
 
 lemma finprod_const:
-  assumes a [simp]: "a : carrier G"
-    shows "finprod G (%x. a) A = a [^] card A"
+  assumes a [simp]: "a \<in> carrier G"
+    shows "finprod G (\<lambda>x. a) A = a [^] card A"
 proof (induct A rule: infinite_finite_induct)
   case (insert b A)
   show ?case 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/Group.thy
--- a/src/HOL/Algebra/Group.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/Group.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -435,7 +435,7 @@
   "x \<in> carrier G \<Longrightarrow> x [^] (i + j::int) = x [^] i \<otimes> x [^] j"
 proof -
   have [simp]: "-i - j = -j - i" by simp
-  assume "x : carrier G" then
+  assume "x \<in> carrier G" then
   show ?thesis
     by (auto simp add: int_pow_def2 inv_solve_left inv_solve_right nat_add_distrib [symmetric] nat_pow_mult )
 qed
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/Order.thy
--- a/src/HOL/Algebra/Order.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/Order.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -379,7 +379,7 @@
 proof -
   have "Upper L A \<subseteq> carrier L" by simp
   moreover from above L have "s \<in> Upper L A" by (simp add: Upper_def)
-  moreover from below have "ALL x : Upper L A. s \<sqsubseteq> x" by fast
+  moreover from below have "\<forall>x \<in> Upper L A. s \<sqsubseteq> x" by fast
   ultimately show ?thesis by (simp add: least_def)
 qed
 
@@ -439,7 +439,7 @@
 proof -
   have "Lower L A \<subseteq> carrier L" by simp
   moreover from below L have "i \<in> Lower L A" by (simp add: Lower_def)
-  moreover from above have "ALL x : Lower L A. x \<sqsubseteq> i" by fast
+  moreover from above have "\<forall>x \<in> Lower L A. x \<sqsubseteq> i" by fast
   ultimately show ?thesis by (simp add: greatest_def)
 qed
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/Ring.thy
--- a/src/HOL/Algebra/Ring.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/Ring.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -74,7 +74,7 @@
     and a_comm:
       "!!x y. [| x \<in> carrier R; y \<in> carrier R |] ==> x \<oplus> y = y \<oplus> x"
     and l_zero: "!!x. x \<in> carrier R ==> \<zero> \<oplus> x = x"
-    and l_inv_ex: "!!x. x \<in> carrier R ==> EX y : carrier R. y \<oplus> x = \<zero>"
+    and l_inv_ex: "\<And>x. x \<in> carrier R \<Longrightarrow> \<exists>y \<in> carrier R. y \<oplus> x = \<zero>"
   shows "abelian_group R"
   by (auto intro!: abelian_group.intro abelian_monoidI
       abelian_group_axioms.intro comm_monoidI comm_groupI
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/RingHom.thy
--- a/src/HOL/Algebra/RingHom.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/RingHom.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -39,8 +39,8 @@
   assumes "ring R" "ring S"
   assumes (* morphism: "h \<in> carrier R \<rightarrow> carrier S" *)
           hom_closed: "!!x. x \<in> carrier R ==> h x \<in> carrier S"
-      and compatible_mult: "!!x y. [| x : carrier R; y : carrier R |] ==> h (x \<otimes> y) = h x \<otimes>\<^bsub>S\<^esub> h y"
-      and compatible_add: "!!x y. [| x : carrier R; y : carrier R |] ==> h (x \<oplus> y) = h x \<oplus>\<^bsub>S\<^esub> h y"
+      and compatible_mult: "\<And>x y. [| x \<in> carrier R; y \<in> carrier R |] ==> h (x \<otimes> y) = h x \<otimes>\<^bsub>S\<^esub> h y"
+      and compatible_add: "\<And>x y. [| x \<in> carrier R; y \<in> carrier R |] ==> h (x \<oplus> y) = h x \<oplus>\<^bsub>S\<^esub> h y"
       and compatible_one: "h \<one> = \<one>\<^bsub>S\<^esub>"
   shows "ring_hom_ring R S h"
 proof -
@@ -72,7 +72,7 @@
 lemma ring_hom_ringI3:
   fixes R (structure) and S (structure)
   assumes "abelian_group_hom R S h" "ring R" "ring S" 
-  assumes compatible_mult: "!!x y. [| x : carrier R; y : carrier R |] ==> h (x \<otimes> y) = h x \<otimes>\<^bsub>S\<^esub> h y"
+  assumes compatible_mult: "\<And>x y. [| x \<in> carrier R; y \<in> carrier R |] ==> h (x \<otimes> y) = h x \<otimes>\<^bsub>S\<^esub> h y"
       and compatible_one: "h \<one> = \<one>\<^bsub>S\<^esub>"
   shows "ring_hom_ring R S h"
 proof -
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/Sylow.thy
--- a/src/HOL/Algebra/Sylow.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/Sylow.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -257,7 +257,7 @@
 lemmas H_elem_map_eq = H_elem_map [THEN someI_ex, THEN conjunct2]
 
 lemma rcosets_H_funcset_M:
-  "(\<lambda>C \<in> rcosets H. M1 #> (@g. g \<in> carrier G \<and> H #> g = C)) \<in> rcosets H \<rightarrow> M"
+  "(\<lambda>C \<in> rcosets H. M1 #> (SOME g. g \<in> carrier G \<and> H #> g = C)) \<in> rcosets H \<rightarrow> M"
   apply (simp add: RCOSETS_def)
   apply (fast intro: someI2
       intro!: M1_in_M in_quotient_imp_closed [OF RelM_equiv M_in_quot _  M1_RelM_rcosetGM1g])
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Algebra/UnivPoly.thy
--- a/src/HOL/Algebra/UnivPoly.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Algebra/UnivPoly.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -284,7 +284,7 @@
 
 lemma UP_l_neg_ex:
   assumes R: "p \<in> carrier P"
-  shows "EX q : carrier P. q \<oplus>\<^bsub>P\<^esub> p = \<zero>\<^bsub>P\<^esub>"
+  shows "\<exists>q \<in> carrier P. q \<oplus>\<^bsub>P\<^esub> p = \<zero>\<^bsub>P\<^esub>"
 proof -
   let ?q = "\<lambda>i. \<ominus> (p i)"
   from R have closed: "?q \<in> carrier P"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Arcwise_Connected.thy
--- a/src/HOL/Analysis/Arcwise_Connected.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Arcwise_Connected.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -21,12 +21,12 @@
     where "inj B" "\<And>n. open(B n)" and open_cov: "\<And>S. open S \<Longrightarrow> \<exists>K. S = \<Union>(B ` K)"
       by (metis Setcompr_eq_image that univ_second_countable_sequence)
   define A where "A \<equiv> rec_nat S (\<lambda>n a. if \<exists>U. U \<subseteq> a \<and> closed U \<and> \<phi> U \<and> U \<inter> (B n) = {}
-                                        then @U. U \<subseteq> a \<and> closed U \<and> \<phi> U \<and> U \<inter> (B n) = {}
+                                        then SOME U. U \<subseteq> a \<and> closed U \<and> \<phi> U \<and> U \<inter> (B n) = {}
                                         else a)"
   have [simp]: "A 0 = S"
     by (simp add: A_def)
   have ASuc: "A(Suc n) = (if \<exists>U. U \<subseteq> A n \<and> closed U \<and> \<phi> U \<and> U \<inter> (B n) = {}
-                          then @U. U \<subseteq> A n \<and> closed U \<and> \<phi> U \<and> U \<inter> (B n) = {}
+                          then SOME U. U \<subseteq> A n \<and> closed U \<and> \<phi> U \<and> U \<inter> (B n) = {}
                           else A n)" for n
     by (auto simp: A_def)
   have sub: "\<And>n. A(Suc n) \<subseteq> A n"
@@ -1801,7 +1801,7 @@
     and peq: "\<And>x y. \<lbrakk>x \<in> T; y \<in> T; open_segment x y \<inter> T = {}\<rbrakk> \<Longrightarrow> p x = p y"
     unfolding \<phi>_def by metis+
   then have "T \<noteq> {}" by auto
-  define h where "h \<equiv> \<lambda>x. p(@y. y \<in> T \<and> open_segment x y \<inter> T = {})"
+  define h where "h \<equiv> \<lambda>x. p(SOME y. y \<in> T \<and> open_segment x y \<inter> T = {})"
   have "p y = p z" if "y \<in> T" "z \<in> T" and xyT: "open_segment x y \<inter> T = {}" and xzT: "open_segment x z \<inter> T = {}"
     for x y z
   proof (cases "x \<in> T")
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Cauchy_Integral_Theorem.thy
--- a/src/HOL/Analysis/Cauchy_Integral_Theorem.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Cauchy_Integral_Theorem.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -714,9 +714,9 @@
   where "f contour_integrable_on g \<equiv> \<exists>i. (f has_contour_integral i) g"
 
 definition contour_integral
-  where "contour_integral g f \<equiv> @i. (f has_contour_integral i) g \<or> ~ f contour_integrable_on g \<and> i=0"
-
-lemma not_integrable_contour_integral: "~ f contour_integrable_on g \<Longrightarrow> contour_integral g f = 0"
+  where "contour_integral g f \<equiv> SOME i. (f has_contour_integral i) g \<or> \<not> f contour_integrable_on g \<and> i=0"
+
+lemma not_integrable_contour_integral: "\<not> f contour_integrable_on g \<Longrightarrow> contour_integral g f = 0"
   unfolding contour_integrable_on_def contour_integral_def by blast
 
 lemma contour_integral_unique: "(f has_contour_integral i) g \<Longrightarrow> contour_integral g f = i"
@@ -3327,7 +3327,7 @@
 
 definition winding_number:: "[real \<Rightarrow> complex, complex] \<Rightarrow> complex" where
   "winding_number \<gamma> z \<equiv>
-    @n. \<forall>e > 0. \<exists>p. valid_path p \<and> z \<notin> path_image p \<and>
+    SOME n. \<forall>e > 0. \<exists>p. valid_path p \<and> z \<notin> path_image p \<and>
                     pathstart p = pathstart \<gamma> \<and>
                     pathfinish p = pathfinish \<gamma> \<and>
                     (\<forall>t \<in> {0..1}. norm(\<gamma> t - p t) < e) \<and>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Continuous_Extension.thy
--- a/src/HOL/Analysis/Continuous_Extension.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Continuous_Extension.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -309,7 +309,7 @@
                   "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
 proof (cases "S = {}")
   case True then show thesis
-    apply (rule_tac g="\<lambda>x. @y. y \<in> C" in that)
+    apply (rule_tac g="\<lambda>x. SOME y. y \<in> C" in that)
       apply (rule continuous_intros)
      apply (meson all_not_in_conv \<open>C \<noteq> {}\<close> image_subsetI someI_ex, simp)
     done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Convex_Euclidean_Space.thy
--- a/src/HOL/Analysis/Convex_Euclidean_Space.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Convex_Euclidean_Space.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1944,7 +1944,7 @@
       using \<open>u + v = 1\<close> by auto
     ultimately have "a + (u *\<^sub>R x + v *\<^sub>R y) \<in> (\<lambda>x. a + x) ` S"
       using h1 by auto
-    then have "u *\<^sub>R x + v *\<^sub>R y : S" by auto
+    then have "u *\<^sub>R x + v *\<^sub>R y \<in> S" by auto
   }
   then show ?thesis unfolding affine_def by auto
 qed
@@ -2031,7 +2031,7 @@
   have [simp]: "(\<lambda>x. x - a) = plus (- a)" by (simp add: fun_eq_iff)
   have "affine ((\<lambda>x. (-a)+x) ` S)"
     using  affine_translation assms by auto
-  moreover have "0 : ((\<lambda>x. (-a)+x) ` S)"
+  moreover have "0 \<in> ((\<lambda>x. (-a)+x) ` S)"
     using assms exI[of "(\<lambda>x. x\<in>S \<and> -a+x = 0)" a] by auto
   ultimately show ?thesis using subspace_affine by auto
 qed
@@ -2130,7 +2130,7 @@
 
 lemma mem_cone:
   assumes "cone S" "x \<in> S" "c \<ge> 0"
-  shows "c *\<^sub>R x : S"
+  shows "c *\<^sub>R x \<in> S"
   using assms cone_def[of S] by auto
 
 lemma cone_contains_0:
@@ -3409,7 +3409,7 @@
   assumes "a \<notin> S"
   shows "affine_dependent (insert a S) \<longleftrightarrow> dependent ((\<lambda>x. -a + x) ` S)"
 proof -
-  have "((+) (- a) ` S) = {x - a| x . x : S}" by auto
+  have "((+) (- a) ` S) = {x - a| x . x \<in> S}" by auto
   then show ?thesis
     using affine_dependent_translation_eq[of "(insert a S)" "-a"]
       affine_dependent_imp_dependent2 assms
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy
--- a/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Equivalence_Lebesgue_Henstock_Integration.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1324,7 +1324,7 @@
         using pairwise_subset [OF pw \<open>\<D>' \<subseteq> \<D>\<close>] unfolding pairwise_def apply force+
         done
       have le_meaT: "measure lebesgue (\<Union>\<D>') \<le> measure lebesgue T"
-      proof (rule measure_mono_fmeasurable [OF _ _ \<open>T : lmeasurable\<close>])
+      proof (rule measure_mono_fmeasurable [OF _ _ \<open>T \<in> lmeasurable\<close>])
         show "(\<Union>\<D>') \<in> sets lebesgue"
           using div lmeasurable_division by auto
         have "\<Union>\<D>' \<subseteq> \<Union>\<D>"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Extended_Real_Limits.thy
--- a/src/HOL/Analysis/Extended_Real_Limits.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Extended_Real_Limits.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -159,7 +159,7 @@
     then obtain b where b: "Inf S - e < b" "b < Inf S"
       using fin ereal_between[of "Inf S" e] dense[of "Inf S - e"]
       by auto
-    then have "b: {Inf S - e <..< Inf S + e}"
+    then have "b \<in> {Inf S - e <..< Inf S + e}"
       using e fin ereal_between[of "Inf S" e]
       by auto
     then have "b \<in> S"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Polytope.thy
--- a/src/HOL/Analysis/Polytope.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Polytope.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -3201,7 +3201,7 @@
         finite \<C> \<and>
         (\<forall>S \<in> \<C>. \<exists>n. n simplex S) \<and>
         (\<forall>F S. S \<in> \<C> \<and> F face_of S \<longrightarrow> F \<in> \<C>) \<and>
-        (!S S'. S \<in> \<C> \<and> S' \<in> \<C>
+        (\<forall>S S'. S \<in> \<C> \<and> S' \<in> \<C>
                 \<longrightarrow> (S \<inter> S') face_of S \<and> (S \<inter> S') face_of S')"
 
 definition triangulation where
@@ -3350,7 +3350,7 @@
       and convex\<N>: "\<And>C. C \<in> \<N> \<Longrightarrow> convex C"
       and closed\<N>: "\<And>C. C \<in> \<N> \<Longrightarrow> closed C"
       by (auto simp: \<N>_def poly\<M> polytope_imp_convex polytope_imp_closed)
-    have in_rel_interior: "(@z. z \<in> rel_interior C) \<in> rel_interior C" if "C \<in> \<N>" for C
+    have in_rel_interior: "(SOME z. z \<in> rel_interior C) \<in> rel_interior C" if "C \<in> \<N>" for C
         using that poly\<M> polytope_imp_convex rel_interior_aff_dim some_in_eq by (fastforce simp: \<N>_def)
     have *: "\<exists>T. ~affine_dependent T \<and> card T \<le> n \<and> aff_dim K < n \<and> K = convex hull T"
       if "K \<in> \<U>" for K
@@ -3396,7 +3396,7 @@
         by fastforce
     qed
     let ?\<T> = "(\<Union>C \<in> \<N>. \<Union>K \<in> \<U> \<inter> Pow (rel_frontier C).
-                     {convex hull (insert (@z. z \<in> rel_interior C) K)})"
+                     {convex hull (insert (SOME z. z \<in> rel_interior C) K)})"
     have "\<exists>\<T>. simplicial_complex \<T> \<and>
               (\<forall>K \<in> \<T>. aff_dim K \<le> of_nat n) \<and>
               (\<forall>C \<in> \<M>. \<exists>F. F \<subseteq> \<T> \<and> C = \<Union>F) \<and>
@@ -3415,9 +3415,9 @@
             using S face\<U> that by blast
           moreover have "F \<in> \<U> \<union> ?\<T>"
             if "F face_of S" "C \<in> \<N>" "K \<in> \<U>" and "K \<subseteq> rel_frontier C"
-              and S: "S = convex hull insert (@z. z \<in> rel_interior C) K" for C K
+              and S: "S = convex hull insert (SOME z. z \<in> rel_interior C) K" for C K
           proof -
-            let ?z = "@z. z \<in> rel_interior C"
+            let ?z = "SOME z. z \<in> rel_interior C"
             have "?z \<in> rel_interior C"
               by (simp add: in_rel_interior \<open>C \<in> \<N>\<close>)
             moreover
@@ -3490,13 +3490,13 @@
             proof -
               obtain C K
                 where "C \<in> \<N>" "K \<in> \<U>" "K \<subseteq> rel_frontier C"
-                and Y: "Y = convex hull insert (@z. z \<in> rel_interior C) K"
+                and Y: "Y = convex hull insert (SOME z. z \<in> rel_interior C) K"
                 using XY by blast
               have "convex C"
                 by (simp add: \<open>C \<in> \<N>\<close> convex\<N>)
               have "K \<subseteq> C"
                 by (metis DiffE \<open>C \<in> \<N>\<close> \<open>K \<subseteq> rel_frontier C\<close> closed\<N> closure_closed rel_frontier_def subset_iff)
-              let ?z = "(@z. z \<in> rel_interior C)"
+              let ?z = "(SOME z. z \<in> rel_interior C)"
               have z: "?z \<in> rel_interior C"
                 using \<open>C \<in> \<N>\<close> in_rel_interior by blast
               obtain D where "D \<in> \<S>" "X \<subseteq> D"
@@ -3533,11 +3533,11 @@
             proof -
               obtain C K D L
                 where "C \<in> \<N>" "K \<in> \<U>" "K \<subseteq> rel_frontier C"
-                and X: "X = convex hull insert (@z. z \<in> rel_interior C) K"
+                and X: "X = convex hull insert (SOME z. z \<in> rel_interior C) K"
                 and "D \<in> \<N>" "L \<in> \<U>" "L \<subseteq> rel_frontier D"
-                and Y: "Y = convex hull insert (@z. z \<in> rel_interior D) L"
+                and Y: "Y = convex hull insert (SOME z. z \<in> rel_interior D) L"
                 using XY by blast
-              let ?z = "(@z. z \<in> rel_interior C)"
+              let ?z = "(SOME z. z \<in> rel_interior C)"
               have z: "?z \<in> rel_interior C"
                 using \<open>C \<in> \<N>\<close> in_rel_interior by blast
               have "convex C"
@@ -3564,7 +3564,7 @@
                   by (metis DiffE \<open>C \<in> \<N>\<close> \<open>K \<subseteq> rel_frontier C\<close> closed\<N> closure_closed rel_frontier_def subset_eq)
                 have "L \<subseteq> D"
                   by (metis DiffE \<open>D \<in> \<N>\<close> \<open>L \<subseteq> rel_frontier D\<close> closed\<N> closure_closed rel_frontier_def subset_eq)
-                let ?w = "(@w. w \<in> rel_interior D)"
+                let ?w = "(SOME w. w \<in> rel_interior D)"
                 have w: "?w \<in> rel_interior D"
                   using \<open>D \<in> \<N>\<close> in_rel_interior by blast
                 have "C \<inter> rel_interior D = (D \<inter> C) \<inter> rel_interior D"
@@ -3663,7 +3663,7 @@
         case False
         then have "C \<in> \<N>"
           by (simp add: \<N>_def \<S>_def aff\<M> less_le that)
-        let ?z = "@z. z \<in> rel_interior C"
+        let ?z = "SOME z. z \<in> rel_interior C"
         have z: "?z \<in> rel_interior C"
           using \<open>C \<in> \<N>\<close> in_rel_interior by blast
         let ?F = "\<Union>K \<in> \<U> \<inter> Pow (rel_frontier C). {convex hull (insert ?z K)}"
@@ -3726,7 +3726,7 @@
       next
         assume "L \<in> ?\<T>"
         then obtain C K where "C \<in> \<N>"
-          and L: "L = convex hull insert (@z. z \<in> rel_interior C) K"
+          and L: "L = convex hull insert (SOME z. z \<in> rel_interior C) K"
           and K: "K \<in> \<U>" "K \<subseteq> rel_frontier C"
           by auto
         then have "convex hull C = C"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Starlike.thy
--- a/src/HOL/Analysis/Starlike.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Starlike.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1272,7 +1272,7 @@
     fix x :: "'a::euclidean_space"
     fix u
     assume as: "\<forall>x\<in>?D. 0 \<le> u x" "sum u ?D \<le> 1" "(\<Sum>x\<in>?D. u x *\<^sub>R x) = x"
-    have *: "\<forall>i\<in>Basis. i:d \<longrightarrow> u i = x\<bullet>i"
+    have *: "\<forall>i\<in>Basis. i \<in> d \<longrightarrow> u i = x\<bullet>i"
       and "(\<forall>i\<in>Basis. i \<notin> d \<longrightarrow> x \<bullet> i = 0)"
       using as(3)
       unfolding substdbasis_expansion_unique[OF assms]
@@ -1590,7 +1590,7 @@
           case True
           have "norm (x - y) < x\<bullet>i"
             using y[unfolded min_less_iff_conj dist_norm, THEN conjunct1]
-            using Min_gr_iff[of "(\<bullet>) x ` d" "norm (x - y)"] \<open>0 < card d\<close> \<open>i:d\<close>
+            using Min_gr_iff[of "(\<bullet>) x ` d" "norm (x - y)"] \<open>0 < card d\<close> \<open>i \<in> d\<close>
             by (simp add: card_gt_0_iff)
           then show "0 \<le> y\<bullet>i"
             using Basis_le_norm[OF i, of "x - y"] and as(1)[rule_format]
@@ -1833,7 +1833,7 @@
            then have e1: "e1 > 0" "e1 \<le> 1" "e1 * norm (x - a) \<le> e"
              using \<open>x \<noteq> a\<close> \<open>e > 0\<close> le_divide_eq[of e1 e "norm (x - a)"]
              by simp_all
-           then have *: "x - e1 *\<^sub>R (x - a) : rel_interior S"
+           then have *: "x - e1 *\<^sub>R (x - a) \<in> rel_interior S"
              using rel_interior_closure_convex_shrink[of S a x e1] assms x a e1_def
              by auto
            have "\<exists>y. y \<in> rel_interior S \<and> y \<noteq> x \<and> dist y x \<le> e"
@@ -2442,11 +2442,11 @@
 
 subsubsection \<open>Relative interior and closure under common operations\<close>
 
-lemma rel_interior_inter_aux: "\<Inter>{rel_interior S |S. S : I} \<subseteq> \<Inter>I"
+lemma rel_interior_inter_aux: "\<Inter>{rel_interior S |S. S \<in> I} \<subseteq> \<Inter>I"
 proof -
   {
     fix y
-    assume "y \<in> \<Inter>{rel_interior S |S. S : I}"
+    assume "y \<in> \<Inter>{rel_interior S |S. S \<in> I}"
     then have y: "\<forall>S \<in> I. y \<in> rel_interior S"
       by auto
     {
@@ -2824,13 +2824,13 @@
       fix x
       assume "x \<in> f ` S"
       then obtain x1 where x1: "x1 \<in> S" "f x1 = x" by auto
-      then obtain e where e: "e > 1" "(1 - e) *\<^sub>R x1 + e *\<^sub>R z1 : S"
+      then obtain e where e: "e > 1" "(1 - e) *\<^sub>R x1 + e *\<^sub>R z1 \<in> S"
         using convex_rel_interior_iff[of S z1] \<open>convex S\<close> x1 z1 by auto
       moreover have "f ((1 - e) *\<^sub>R x1 + e *\<^sub>R z1) = (1 - e) *\<^sub>R x + e *\<^sub>R z"
         using x1 z1 \<open>linear f\<close> by (simp add: linear_add_cmul)
-      ultimately have "(1 - e) *\<^sub>R x + e *\<^sub>R z : f ` S"
+      ultimately have "(1 - e) *\<^sub>R x + e *\<^sub>R z \<in> f ` S"
         using imageI[of "(1 - e) *\<^sub>R x1 + e *\<^sub>R z1" S f] by auto
-      then have "\<exists>e. e > 1 \<and> (1 - e) *\<^sub>R x + e *\<^sub>R z : f ` S"
+      then have "\<exists>e. e > 1 \<and> (1 - e) *\<^sub>R x + e *\<^sub>R z \<in> f ` S"
         using e by auto
     }
     then have "z \<in> rel_interior (f ` S)"
@@ -2861,7 +2861,7 @@
   {
     fix z
     assume "z \<in> f -` (rel_interior S)"
-    then have z: "f z : rel_interior S"
+    then have z: "f z \<in> rel_interior S"
       by auto
     {
       fix x
@@ -3115,7 +3115,7 @@
       by (metis Domain_iff fst_eq_Domain)
     then have "y \<in> rel_interior {t. f t \<noteq> {}}"
       using h1 by auto
-    then have "y \<in> rel_interior {t. f t \<noteq> {}}" and "(z : rel_interior (f y))"
+    then have "y \<in> rel_interior {t. f t \<noteq> {}}" and "(z \<in> rel_interior (f y))"
       using h2 asm by auto
   }
   then show ?thesis using h2 by blast
@@ -3238,7 +3238,7 @@
   have "?lhs \<supseteq> ?rhs"
   proof
     fix x
-    assume "x : ?rhs"
+    assume "x \<in> ?rhs"
     then obtain c s where *: "sum (\<lambda>i. c i *\<^sub>R s i) I = x" "sum c I = 1"
       "(\<forall>i\<in>I. c i \<ge> 0) \<and> (\<forall>i\<in>I. s i \<in> S i)" by auto
     then have "\<forall>i\<in>I. s i \<in> convex hull (\<Union>(S ` I))"
@@ -3676,7 +3676,7 @@
       by auto
     define k where "k i = (c i, c i *\<^sub>R s i)" for i
     {
-      fix i assume "i:I"
+      fix i assume "i \<in> I"
       then have "k i \<in> rel_interior (K i)"
         using k_def K_def assms cs rel_interior_convex_cone[of "S i"]
         by auto
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Analysis/Topology_Euclidean_Space.thy
--- a/src/HOL/Analysis/Topology_Euclidean_Space.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Analysis/Topology_Euclidean_Space.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -2353,7 +2353,7 @@
     by (meson Int_mono closure_mono closure_subset order_refl)
 qed
 
-lemma islimpt_in_closure: "(x islimpt S) = (x:closure(S-{x}))"
+lemma islimpt_in_closure: "(x islimpt S) = (x\<in>closure(S-{x}))"
   unfolding closure_def using islimpt_punctured by blast
 
 lemma connected_imp_connected_closure: "connected S \<Longrightarrow> connected (closure S)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/CertifiedEmail.thy
--- a/src/HOL/Auth/CertifiedEmail.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/CertifiedEmail.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -11,7 +11,7 @@
   "TTP == Server"
 
 abbreviation
-  RPwd :: "agent => key" where
+  RPwd :: "agent \<Rightarrow> key" where
   "RPwd == shrK"
 
  
@@ -24,7 +24,7 @@
   BothAuth :: nat
 
 text\<open>We formalize a fixed way of computing responses.  Could be better.\<close>
-definition "response" :: "agent => agent => nat => msg" where
+definition "response" :: "agent \<Rightarrow> agent \<Rightarrow> nat \<Rightarrow> msg" where
    "response S R q == Hash \<lbrace>Agent S, Key (shrK R), Nonce q\<rbrace>"
 
 
@@ -129,9 +129,9 @@
 
 lemma hr_form_lemma [rule_format]:
  "evs \<in> certified_mail
-  ==> hr \<notin> synth (analz (spies evs)) --> 
+  \<Longrightarrow> hr \<notin> synth (analz (spies evs)) \<longrightarrow>
       (\<forall>S2TTP. Notes TTP \<lbrace>Agent R, Agent TTP, S2TTP, pwd, hr\<rbrace>
-          \<in> set evs --> 
+          \<in> set evs \<longrightarrow>
       (\<exists>clt q S em. hr = Hash \<lbrace>Number clt, Nonce q, response S R q, em\<rbrace>))"
 apply (erule certified_mail.induct)
 apply (synth_analz_mono_contra, simp_all, blast+)
@@ -201,7 +201,7 @@
 done
 
 lemma Spy_dont_know_RPwd [rule_format]:
-    "evs \<in> certified_mail ==> Key (RPwd A) \<in> parts(spies evs) --> A \<in> bad"
+    "evs \<in> certified_mail ==> Key (RPwd A) \<in> parts(spies evs) \<longrightarrow> A \<in> bad"
 apply (erule certified_mail.induct, simp_all) 
 txt\<open>Fake\<close>
 apply (blast dest: Fake_parts_insert_in_Un) 
@@ -247,8 +247,8 @@
 
 lemma analz_image_freshK [rule_format]:
  "evs \<in> certified_mail ==>
-   \<forall>K KK. invKey (pubEK TTP) \<notin> KK -->
-          (Key K \<in> analz (Key`KK Un (spies evs))) =
+   \<forall>K KK. invKey (pubEK TTP) \<notin> KK \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (spies evs))) =
           (K \<in> KK | Key K \<in> analz (spies evs))"
 apply (erule certified_mail.induct)
 apply (drule_tac [6] A=TTP in symKey_neq_priEK) 
@@ -281,11 +281,11 @@
    isn't inductive: message 3 case can't be proved *)
 lemma S2TTP_sender_lemma [rule_format]:
  "evs \<in> certified_mail ==>
-    Key K \<notin> analz (spies evs) -->
+    Key K \<notin> analz (spies evs) \<longrightarrow>
     (\<forall>AO. Crypt (pubEK TTP)
-           \<lbrace>Agent S, Number AO, Key K, Agent R, hs\<rbrace> \<in> used evs -->
+           \<lbrace>Agent S, Number AO, Key K, Agent R, hs\<rbrace> \<in> used evs \<longrightarrow>
     (\<exists>m ctxt q. 
-        hs = Hash\<lbrace>Number ctxt, Nonce q, response S R q, Crypt K (Number m)\<rbrace> &
+        hs = Hash\<lbrace>Number ctxt, Nonce q, response S R q, Crypt K (Number m)\<rbrace> \<and>
         Says S R
            \<lbrace>Agent S, Agent TTP, Crypt K (Number m), Number AO,
              Number ctxt, Nonce q,
@@ -314,7 +314,7 @@
     Key K \<notin> analz (spies evs);
     evs \<in> certified_mail|]
   ==> \<exists>m ctxt q. 
-        hs = Hash\<lbrace>Number ctxt, Nonce q, response S R q, Crypt K (Number m)\<rbrace> &
+        hs = Hash\<lbrace>Number ctxt, Nonce q, response S R q, Crypt K (Number m)\<rbrace> \<and>
         Says S R
            \<lbrace>Agent S, Agent TTP, Crypt K (Number m), Number AO,
              Number ctxt, Nonce q,
@@ -345,19 +345,19 @@
 where @{term K} is secure.\<close>
 lemma Key_unique_lemma [rule_format]:
      "evs \<in> certified_mail ==>
-       Key K \<notin> analz (spies evs) -->
+       Key K \<notin> analz (spies evs) \<longrightarrow>
        (\<forall>m cleartext q hs.
         Says S R
            \<lbrace>Agent S, Agent TTP, Crypt K (Number m), Number AO,
              Number cleartext, Nonce q,
              Crypt (pubEK TTP) \<lbrace>Agent S, Number AO, Key K, Agent R, hs\<rbrace>\<rbrace>
-          \<in> set evs -->
+          \<in> set evs \<longrightarrow>
        (\<forall>m' cleartext' q' hs'.
        Says S' R'
            \<lbrace>Agent S', Agent TTP, Crypt K (Number m'), Number AO',
              Number cleartext', Nonce q',
              Crypt (pubEK TTP) \<lbrace>Agent S', Number AO', Key K, Agent R', hs'\<rbrace>\<rbrace>
-          \<in> set evs --> R' = R & S' = S & AO' = AO & hs' = hs))" 
+          \<in> set evs \<longrightarrow> R' = R \<and> S' = S \<and> AO' = AO \<and> hs' = hs))" 
 apply (erule certified_mail.induct, analz_mono_contra, simp_all)
  prefer 2
  txt\<open>Message 1\<close>
@@ -380,7 +380,7 @@
           \<in> set evs;
          Key K \<notin> analz (spies evs);
          evs \<in> certified_mail|]
-       ==> R' = R & S' = S & AO' = AO & hs' = hs"
+       ==> R' = R \<and> S' = S \<and> AO' = AO \<and> hs' = hs"
 by (rule Key_unique_lemma, assumption+)
 
 
@@ -396,7 +396,7 @@
          Key K \<in> analz (spies evs);
          evs \<in> certified_mail;
          S\<noteq>Spy|]
-      ==> R \<in> bad & Gets S (Crypt (priSK TTP) S2TTP) \<in> set evs"
+      ==> R \<in> bad \<and> Gets S (Crypt (priSK TTP) S2TTP) \<in> set evs"
 apply (erule rev_mp)
 apply (erule ssubst)
 apply (erule rev_mp)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Event.thy
--- a/src/HOL/Auth/Event.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Event.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -13,7 +13,7 @@
 theory Event imports Message begin
 
 consts  (*Initial states of agents -- parameter of the construction*)
-  initState :: "agent => msg set"
+  initState :: "agent \<Rightarrow> msg set"
 
 datatype
   event = Says  agent agent msg
@@ -29,24 +29,24 @@
   Server_not_bad [iff]: "Server \<notin> bad"
     by (rule exI [of _ "{Spy}"], simp)
 
-primrec knows :: "agent => event list => msg set"
+primrec knows :: "agent \<Rightarrow> event list \<Rightarrow> msg set"
 where
   knows_Nil:   "knows A [] = initState A"
 | knows_Cons:
     "knows A (ev # evs) =
        (if A = Spy then 
         (case ev of
-           Says A' B X => insert X (knows Spy evs)
-         | Gets A' X => knows Spy evs
-         | Notes A' X  => 
+           Says A' B X \<Rightarrow> insert X (knows Spy evs)
+         | Gets A' X \<Rightarrow> knows Spy evs
+         | Notes A' X  \<Rightarrow> 
              if A' \<in> bad then insert X (knows Spy evs) else knows Spy evs)
         else
         (case ev of
-           Says A' B X => 
+           Says A' B X \<Rightarrow> 
              if A'=A then insert X (knows A evs) else knows A evs
-         | Gets A' X    => 
+         | Gets A' X    \<Rightarrow> 
              if A'=A then insert X (knows A evs) else knows A evs
-         | Notes A' X    => 
+         | Notes A' X    \<Rightarrow> 
              if A'=A then insert X (knows A evs) else knows A evs))"
 (*
   Case A=Spy on the Gets event
@@ -57,31 +57,31 @@
 text\<open>The constant "spies" is retained for compatibility's sake\<close>
 
 abbreviation (input)
-  spies  :: "event list => msg set" where
+  spies  :: "event list \<Rightarrow> msg set" where
   "spies == knows Spy"
 
 
 (*Set of items that might be visible to somebody:
     complement of the set of fresh items*)
 
-primrec used :: "event list => msg set"
+primrec used :: "event list \<Rightarrow> msg set"
 where
   used_Nil:   "used []         = (UN B. parts (initState B))"
 | used_Cons:  "used (ev # evs) =
                      (case ev of
-                        Says A B X => parts {X} \<union> used evs
-                      | Gets A X   => used evs
-                      | Notes A X  => parts {X} \<union> used evs)"
+                        Says A B X \<Rightarrow> parts {X} \<union> used evs
+                      | Gets A X   \<Rightarrow> used evs
+                      | Notes A X  \<Rightarrow> parts {X} \<union> used evs)"
     \<comment> \<open>The case for @{term Gets} seems anomalous, but @{term Gets} always
         follows @{term Says} in real protocols.  Seems difficult to change.
         See \<open>Gets_correct\<close> in theory \<open>Guard/Extensions.thy\<close>.\<close>
 
-lemma Notes_imp_used [rule_format]: "Notes A X \<in> set evs --> X \<in> used evs"
+lemma Notes_imp_used [rule_format]: "Notes A X \<in> set evs \<longrightarrow> X \<in> used evs"
 apply (induct_tac evs)
 apply (auto split: event.split) 
 done
 
-lemma Says_imp_used [rule_format]: "Says A B X \<in> set evs --> X \<in> used evs"
+lemma Says_imp_used [rule_format]: "Says A B X \<in> set evs \<longrightarrow> X \<in> used evs"
 apply (induct_tac evs)
 apply (auto split: event.split) 
 done
@@ -102,7 +102,7 @@
       on whether @{term "A=Spy"} and whether @{term "A\<in>bad"}\<close>
 lemma knows_Spy_Notes [simp]:
      "knows Spy (Notes A X # evs) =  
-          (if A:bad then insert X (knows Spy evs) else knows Spy evs)"
+          (if A\<in>bad then insert X (knows Spy evs) else knows Spy evs)"
 by simp
 
 lemma knows_Spy_Gets [simp]: "knows Spy (Gets A X # evs) = knows Spy evs"
@@ -122,13 +122,13 @@
 
 text\<open>Spy sees what is sent on the traffic\<close>
 lemma Says_imp_knows_Spy [rule_format]:
-     "Says A B X \<in> set evs --> X \<in> knows Spy evs"
+     "Says A B X \<in> set evs \<longrightarrow> X \<in> knows Spy evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 done
 
 lemma Notes_imp_knows_Spy [rule_format]:
-     "Notes A X \<in> set evs --> A: bad --> X \<in> knows Spy evs"
+     "Notes A X \<in> set evs \<longrightarrow> A \<in> bad \<longrightarrow> X \<in> knows Spy evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 done
@@ -162,14 +162,14 @@
 by (simp add: subset_insertI)
 
 text\<open>Agents know what they say\<close>
-lemma Says_imp_knows [rule_format]: "Says A B X \<in> set evs --> X \<in> knows A evs"
+lemma Says_imp_knows [rule_format]: "Says A B X \<in> set evs \<longrightarrow> X \<in> knows A evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 apply blast
 done
 
 text\<open>Agents know what they note\<close>
-lemma Notes_imp_knows [rule_format]: "Notes A X \<in> set evs --> X \<in> knows A evs"
+lemma Notes_imp_knows [rule_format]: "Notes A X \<in> set evs \<longrightarrow> X \<in> knows A evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 apply blast
@@ -177,7 +177,7 @@
 
 text\<open>Agents know what they receive\<close>
 lemma Gets_imp_knows_agents [rule_format]:
-     "A \<noteq> Spy --> Gets A X \<in> set evs --> X \<in> knows A evs"
+     "A \<noteq> Spy \<longrightarrow> Gets A X \<in> set evs \<longrightarrow> X \<in> knows A evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
 done
@@ -186,8 +186,8 @@
 text\<open>What agents DIFFERENT FROM Spy know 
   was either said, or noted, or got, or known initially\<close>
 lemma knows_imp_Says_Gets_Notes_initState [rule_format]:
-     "[| X \<in> knows A evs; A \<noteq> Spy |] ==> EX B.  
-  Says A B X \<in> set evs | Gets A X \<in> set evs | Notes A X \<in> set evs | X \<in> initState A"
+     "[| X \<in> knows A evs; A \<noteq> Spy |] ==> \<exists> B.
+  Says A B X \<in> set evs \<or> Gets A X \<in> set evs \<or> Notes A X \<in> set evs \<or> X \<in> initState A"
 apply (erule rev_mp)
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
@@ -197,8 +197,8 @@
 text\<open>What the Spy knows -- for the time being --
   was either said or noted, or known initially\<close>
 lemma knows_Spy_imp_Says_Notes_initState [rule_format]:
-     "[| X \<in> knows Spy evs |] ==> EX A B.  
-  Says A B X \<in> set evs | Notes A X \<in> set evs | X \<in> initState Spy"
+     "X \<in> knows Spy evs \<Longrightarrow> \<exists>A B.
+  Says A B X \<in> set evs \<or> Notes A X \<in> set evs \<or> X \<in> initState Spy"
 apply (erule rev_mp)
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) split: event.split)
@@ -212,7 +212,7 @@
 
 lemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]
 
-lemma initState_into_used: "X \<in> parts (initState B) ==> X \<in> used evs"
+lemma initState_into_used: "X \<in> parts (initState B) \<Longrightarrow> X \<in> used evs"
 apply (induct_tac "evs")
 apply (simp_all add: parts_insert_knows_A split: event.split, blast)
 done
@@ -236,7 +236,7 @@
         used_Nil [simp del] used_Cons [simp del]
 
 
-text\<open>For proving theorems of the form @{term "X \<notin> analz (knows Spy evs) --> P"}
+text\<open>For proving theorems of the form @{term "X \<notin> analz (knows Spy evs) \<longrightarrow> P"}
   New events added by induction to "evs" are discarded.  Provided 
   this information isn't needed, the proof will be much shorter, since
   it will omit complicated reasoning about @{term analz}.\<close>
@@ -278,7 +278,7 @@
 
 method_setup analz_mono_contra = \<open>
     Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt)))\<close>
-    "for proving theorems of the form X \<notin> analz (knows Spy evs) --> P"
+    "for proving theorems of the form X \<notin> analz (knows Spy evs) \<longrightarrow> P"
 
 subsubsection\<open>Useful for case analysis on whether a hash is a spoof or not\<close>
 
@@ -299,6 +299,6 @@
 
 method_setup synth_analz_mono_contra = \<open>
     Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (synth_analz_mono_contra_tac ctxt)))\<close>
-    "for proving theorems of the form X \<notin> synth (analz (knows Spy evs)) --> P"
+    "for proving theorems of the form X \<notin> synth (analz (knows Spy evs)) \<longrightarrow> P"
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Analz.thy
--- a/src/HOL/Auth/Guard/Analz.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Analz.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -16,37 +16,37 @@
   pparts :: "msg set => msg set"
   for H :: "msg set"
 where
-  Inj [intro]: "[| X:H; is_MPair X |] ==> X:pparts H"
-| Fst [dest]: "[| \<lbrace>X,Y\<rbrace>:pparts H; is_MPair X |] ==> X:pparts H"
-| Snd [dest]: "[| \<lbrace>X,Y\<rbrace>:pparts H; is_MPair Y |] ==> Y:pparts H"
+  Inj [intro]: "[| X \<in> H; is_MPair X |] ==> X \<in> pparts H"
+| Fst [dest]: "[| \<lbrace>X,Y\<rbrace> \<in> pparts H; is_MPair X |] ==> X \<in> pparts H"
+| Snd [dest]: "[| \<lbrace>X,Y\<rbrace> \<in> pparts H; is_MPair Y |] ==> Y \<in> pparts H"
 
 subsection\<open>basic facts about @{term pparts}\<close>
 
-lemma pparts_is_MPair [dest]: "X:pparts H ==> is_MPair X"
+lemma pparts_is_MPair [dest]: "X \<in> pparts H \<Longrightarrow> is_MPair X"
 by (erule pparts.induct, auto)
 
-lemma Crypt_notin_pparts [iff]: "Crypt K X ~:pparts H"
+lemma Crypt_notin_pparts [iff]: "Crypt K X \<notin> pparts H"
 by auto
 
-lemma Key_notin_pparts [iff]: "Key K ~:pparts H"
+lemma Key_notin_pparts [iff]: "Key K \<notin> pparts H"
 by auto
 
-lemma Nonce_notin_pparts [iff]: "Nonce n ~:pparts H"
+lemma Nonce_notin_pparts [iff]: "Nonce n \<notin> pparts H"
 by auto
 
-lemma Number_notin_pparts [iff]: "Number n ~:pparts H"
+lemma Number_notin_pparts [iff]: "Number n \<notin> pparts H"
 by auto
 
-lemma Agent_notin_pparts [iff]: "Agent A ~:pparts H"
+lemma Agent_notin_pparts [iff]: "Agent A \<notin> pparts H"
 by auto
 
 lemma pparts_empty [iff]: "pparts {} = {}"
 by (auto, erule pparts.induct, auto)
 
-lemma pparts_insertI [intro]: "X:pparts H ==> X:pparts (insert Y H)"
+lemma pparts_insertI [intro]: "X \<in> pparts H \<Longrightarrow> X \<in> pparts (insert Y H)"
 by (erule pparts.induct, auto)
 
-lemma pparts_sub: "[| X:pparts G; G<=H |] ==> X:pparts H"
+lemma pparts_sub: "[| X \<in> pparts G; G \<subseteq> H |] ==> X \<in> pparts H"
 by (erule pparts.induct, auto)
 
 lemma pparts_insert2 [iff]: "pparts (insert X (insert Y H))
@@ -78,13 +78,13 @@
 lemma pparts_insert_Hash [iff]: "pparts (insert (Hash X) H) = pparts H"
 by (rule eq, erule pparts.induct, auto)
 
-lemma pparts_insert: "X:pparts (insert Y H) ==> X:pparts {Y} Un pparts H"
+lemma pparts_insert: "X \<in> pparts (insert Y H) \<Longrightarrow> X \<in> pparts {Y} \<union> pparts H"
 by (erule pparts.induct, blast+)
 
-lemma insert_pparts: "X:pparts {Y} Un pparts H ==> X:pparts (insert Y H)"
+lemma insert_pparts: "X \<in> pparts {Y} \<union> pparts H \<Longrightarrow> X \<in> pparts (insert Y H)"
 by (safe, erule pparts.induct, auto)
 
-lemma pparts_Un [iff]: "pparts (G Un H) = pparts G Un pparts H"
+lemma pparts_Un [iff]: "pparts (G \<union> H) = pparts G \<union> pparts H"
 by (rule eq, erule pparts.induct, auto dest: pparts_sub)
 
 lemma pparts_pparts [iff]: "pparts (pparts H) = pparts H"
@@ -95,21 +95,21 @@
 
 lemmas pparts_insert_substI = pparts_insert_eq [THEN ssubst]
 
-lemma in_pparts: "Y:pparts H ==> EX X. X:H & Y:pparts {X}"
+lemma in_pparts: "Y \<in> pparts H \<Longrightarrow> \<exists>X. X \<in> H \<and> Y \<in> pparts {X}"
 by (erule pparts.induct, auto)
 
 subsection\<open>facts about @{term pparts} and @{term parts}\<close>
 
-lemma pparts_no_Nonce [dest]: "[| X:pparts {Y}; Nonce n ~:parts {Y} |]
-==> Nonce n ~:parts {X}"
+lemma pparts_no_Nonce [dest]: "[| X \<in> pparts {Y}; Nonce n \<notin> parts {Y} |]
+==> Nonce n \<notin> parts {X}"
 by (erule pparts.induct, simp_all)
 
 subsection\<open>facts about @{term pparts} and @{term analz}\<close>
 
-lemma pparts_analz: "X:pparts H ==> X:analz H"
+lemma pparts_analz: "X \<in> pparts H \<Longrightarrow> X \<in> analz H"
 by (erule pparts.induct, auto)
 
-lemma pparts_analz_sub: "[| X:pparts G; G<=H |] ==> X:analz H"
+lemma pparts_analz_sub: "[| X \<in> pparts G; G \<subseteq> H |] ==> X \<in> analz H"
 by (auto dest: pparts_sub pparts_analz)
 
 subsection\<open>messages that contribute to analz\<close>
@@ -118,23 +118,23 @@
   kparts :: "msg set => msg set"
   for H :: "msg set"
 where
-  Inj [intro]: "[| X:H; not_MPair X |] ==> X:kparts H"
-| Fst [intro]: "[| \<lbrace>X,Y\<rbrace> \<in> pparts H; not_MPair X |] ==> X:kparts H"
-| Snd [intro]: "[| \<lbrace>X,Y\<rbrace> \<in> pparts H; not_MPair Y |] ==> Y:kparts H"
+  Inj [intro]: "[| X \<in> H; not_MPair X |] ==> X \<in> kparts H"
+| Fst [intro]: "[| \<lbrace>X,Y\<rbrace> \<in> pparts H; not_MPair X |] ==> X \<in> kparts H"
+| Snd [intro]: "[| \<lbrace>X,Y\<rbrace> \<in> pparts H; not_MPair Y |] ==> Y \<in> kparts H"
 
 subsection\<open>basic facts about @{term kparts}\<close>
 
-lemma kparts_not_MPair [dest]: "X:kparts H ==> not_MPair X"
+lemma kparts_not_MPair [dest]: "X \<in> kparts H \<Longrightarrow> not_MPair X"
 by (erule kparts.induct, auto)
 
 lemma kparts_empty [iff]: "kparts {} = {}"
 by (rule eq, erule kparts.induct, auto)
 
-lemma kparts_insertI [intro]: "X:kparts H ==> X:kparts (insert Y H)"
+lemma kparts_insertI [intro]: "X \<in> kparts H \<Longrightarrow> X \<in> kparts (insert Y H)"
 by (erule kparts.induct, auto dest: pparts_insertI)
 
 lemma kparts_insert2 [iff]: "kparts (insert X (insert Y H))
-= kparts {X} Un kparts {Y} Un kparts H"
+= kparts {X} \<union> kparts {Y} \<union> kparts H"
 by (rule eq, (erule kparts.induct, auto)+)
 
 lemma kparts_insert_MPair [iff]: "kparts (insert \<lbrace>X,Y\<rbrace> H)
@@ -165,17 +165,17 @@
 = insert (Hash X) (kparts H)"
 by (rule eq, erule kparts.induct, auto)
 
-lemma kparts_insert: "X:kparts (insert X H) ==> X:kparts {X} Un kparts H"
+lemma kparts_insert: "X \<in> kparts (insert X H) \<Longrightarrow> X \<in> kparts {X} \<union> kparts H"
 by (erule kparts.induct, (blast dest: pparts_insert)+)
 
-lemma kparts_insert_fst [rule_format,dest]: "X:kparts (insert Z H) ==>
-X ~:kparts H --> X:kparts {Z}"
+lemma kparts_insert_fst [rule_format,dest]: "X \<in> kparts (insert Z H) \<Longrightarrow>
+X \<notin> kparts H \<longrightarrow> X \<in> kparts {Z}"
 by (erule kparts.induct, (blast dest: pparts_insert)+)
 
-lemma kparts_sub: "[| X:kparts G; G<=H |] ==> X:kparts H"
+lemma kparts_sub: "[| X \<in> kparts G; G \<subseteq> H |] ==> X \<in> kparts H"
 by (erule kparts.induct, auto dest: pparts_sub)
 
-lemma kparts_Un [iff]: "kparts (G Un H) = kparts G Un kparts H"
+lemma kparts_Un [iff]: "kparts (G \<union> H) = kparts G \<union> kparts H"
 by (rule eq, erule kparts.induct, auto dest: kparts_sub)
 
 lemma pparts_kparts [iff]: "pparts (kparts H) = {}"
@@ -184,12 +184,12 @@
 lemma kparts_kparts [iff]: "kparts (kparts H) = kparts H"
 by (rule eq, erule kparts.induct, auto)
 
-lemma kparts_insert_eq: "kparts (insert X H) = kparts {X} Un kparts H"
+lemma kparts_insert_eq: "kparts (insert X H) = kparts {X} \<union> kparts H"
 by (rule_tac A=H in insert_Un, rule kparts_Un)
 
 lemmas kparts_insert_substI = kparts_insert_eq [THEN ssubst]
 
-lemma in_kparts: "Y:kparts H ==> EX X. X:H & Y:kparts {X}"
+lemma in_kparts: "Y \<in> kparts H \<Longrightarrow> \<exists>X. X \<in> H \<and> Y \<in> kparts {X}"
 by (erule kparts.induct, auto dest: in_pparts)
 
 lemma kparts_has_no_pair [iff]: "has_no_pair (kparts H)"
@@ -197,59 +197,59 @@
 
 subsection\<open>facts about @{term kparts} and @{term parts}\<close>
 
-lemma kparts_no_Nonce [dest]: "[| X:kparts {Y}; Nonce n ~:parts {Y} |]
-==> Nonce n ~:parts {X}"
+lemma kparts_no_Nonce [dest]: "[| X \<in> kparts {Y}; Nonce n \<notin> parts {Y} |]
+==> Nonce n \<notin> parts {X}"
 by (erule kparts.induct, auto)
 
-lemma kparts_parts: "X:kparts H ==> X:parts H"
+lemma kparts_parts: "X \<in> kparts H \<Longrightarrow> X \<in> parts H"
 by (erule kparts.induct, auto dest: pparts_analz)
 
-lemma parts_kparts: "X:parts (kparts H) ==> X:parts H"
+lemma parts_kparts: "X \<in> parts (kparts H) \<Longrightarrow> X \<in> parts H"
 by (erule parts.induct, auto dest: kparts_parts
 intro: parts.Fst parts.Snd parts.Body)
 
-lemma Crypt_kparts_Nonce_parts [dest]: "[| Crypt K Y:kparts {Z};
-Nonce n:parts {Y} |] ==> Nonce n:parts {Z}"
+lemma Crypt_kparts_Nonce_parts [dest]: "[| Crypt K Y \<in> kparts {Z};
+Nonce n \<in> parts {Y} |] ==> Nonce n \<in> parts {Z}"
 by auto
 
 subsection\<open>facts about @{term kparts} and @{term analz}\<close>
 
-lemma kparts_analz: "X:kparts H ==> X:analz H"
+lemma kparts_analz: "X \<in> kparts H \<Longrightarrow> X \<in> analz H"
 by (erule kparts.induct, auto dest: pparts_analz)
 
-lemma kparts_analz_sub: "[| X:kparts G; G<=H |] ==> X:analz H"
+lemma kparts_analz_sub: "[| X \<in> kparts G; G \<subseteq> H |] ==> X \<in> analz H"
 by (erule kparts.induct, auto dest: pparts_analz_sub)
 
-lemma analz_kparts [rule_format,dest]: "X:analz H ==>
-Y:kparts {X} --> Y:analz H"
+lemma analz_kparts [rule_format,dest]: "X \<in> analz H \<Longrightarrow>
+Y \<in> kparts {X} \<longrightarrow> Y \<in> analz H"
 by (erule analz.induct, auto dest: kparts_analz_sub)
 
-lemma analz_kparts_analz: "X:analz (kparts H) ==> X:analz H"
+lemma analz_kparts_analz: "X \<in> analz (kparts H) \<Longrightarrow> X \<in> analz H"
 by (erule analz.induct, auto dest: kparts_analz)
 
-lemma analz_kparts_insert: "X:analz (kparts (insert Z H)) ==> X:analz (kparts {Z} Un kparts H)"
+lemma analz_kparts_insert: "X \<in> analz (kparts (insert Z H)) \<Longrightarrow> X \<in> analz (kparts {Z} \<union> kparts H)"
 by (rule analz_sub, auto)
 
-lemma Nonce_kparts_synth [rule_format]: "Y:synth (analz G)
-==> Nonce n:kparts {Y} --> Nonce n:analz G"
+lemma Nonce_kparts_synth [rule_format]: "Y \<in> synth (analz G)
+\<Longrightarrow> Nonce n \<in> kparts {Y} \<longrightarrow> Nonce n \<in> analz G"
 by (erule synth.induct, auto)
 
-lemma kparts_insert_synth: "[| Y:parts (insert X G); X:synth (analz G);
-Nonce n:kparts {Y}; Nonce n ~:analz G |] ==> Y:parts G"
+lemma kparts_insert_synth: "[| Y \<in> parts (insert X G); X \<in> synth (analz G);
+Nonce n \<in> kparts {Y}; Nonce n \<notin> analz G |] ==> Y \<in> parts G"
 apply (drule parts_insert_substD, clarify)
 apply (drule in_sub, drule_tac X=Y in parts_sub, simp)
 apply (auto dest: Nonce_kparts_synth)
 done
 
 lemma Crypt_insert_synth:
-  "[| Crypt K Y:parts (insert X G); X:synth (analz G); Nonce n:kparts {Y}; Nonce n ~:analz G |] 
-   ==> Crypt K Y:parts G"
+  "[| Crypt K Y \<in> parts (insert X G); X \<in> synth (analz G); Nonce n \<in> kparts {Y}; Nonce n \<notin> analz G |] 
+   ==> Crypt K Y \<in> parts G"
 by (metis Fake_parts_insert_in_Un Nonce_kparts_synth UnE analz_conj_parts synth_simps(5))
 
 
 subsection\<open>analz is pparts + analz of kparts\<close>
 
-lemma analz_pparts_kparts: "X:analz H ==> X:pparts H | X:analz (kparts H)"
+lemma analz_pparts_kparts: "X \<in> analz H \<Longrightarrow> X \<in> pparts H \<or> X \<in> analz (kparts H)"
 by (erule analz.induct, auto) 
 
 lemma analz_pparts_kparts_eq: "analz H = pparts H Un analz (kparts H)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Extensions.thy
--- a/src/HOL/Auth/Guard/Extensions.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Extensions.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -11,13 +11,13 @@
 
 subsection\<open>Extensions to Theory \<open>Set\<close>\<close>
 
-lemma eq: "[| !!x. x:A ==> x:B; !!x. x:B ==> x:A |] ==> A=B"
+lemma eq: "[| \<And>x. x\<in>A \<Longrightarrow> x\<in>B; \<And>x. x\<in>B \<Longrightarrow> x\<in>A |] ==> A=B"
 by auto
 
-lemma insert_Un: "P ({x} Un A) ==> P (insert x A)"
+lemma insert_Un: "P ({x} \<union> A) \<Longrightarrow> P (insert x A)"
 by simp
 
-lemma in_sub: "x:A ==> {x}<=A"
+lemma in_sub: "x\<in>A \<Longrightarrow> {x}\<subseteq>A"
 by auto
 
 
@@ -51,7 +51,7 @@
 subsubsection\<open>messages that are pairs\<close>
 
 definition is_MPair :: "msg => bool" where
-"is_MPair X == EX Y Z. X = \<lbrace>Y,Z\<rbrace>"
+"is_MPair X == \<exists>Y Z. X = \<lbrace>Y,Z\<rbrace>"
 
 declare is_MPair_def [simp]
 
@@ -86,7 +86,7 @@
 declare is_MPair_def [simp del]
 
 definition has_no_pair :: "msg set => bool" where
-"has_no_pair H == ALL X Y. \<lbrace>X,Y\<rbrace> \<notin> H"
+"has_no_pair H == \<forall>X Y. \<lbrace>X,Y\<rbrace> \<notin> H"
 
 declare has_no_pair_def [simp]
 
@@ -98,38 +98,38 @@
 lemma wf_Crypt2 [iff]: "X ~= Crypt K X"
 by (induct X, auto)
 
-lemma parts_size: "X:parts {Y} ==> X=Y | size X < size Y"
+lemma parts_size: "X \<in> parts {Y} \<Longrightarrow> X=Y \<or> size X < size Y"
 by (erule parts.induct, auto)
 
-lemma wf_Crypt_parts [iff]: "Crypt K X ~:parts {X}"
+lemma wf_Crypt_parts [iff]: "Crypt K X \<notin> parts {X}"
 by (auto dest: parts_size)
 
 subsubsection\<open>lemmas on keysFor\<close>
 
 definition usekeys :: "msg set => key set" where
-"usekeys G == {K. EX Y. Crypt K Y:G}"
+"usekeys G \<equiv> {K. \<exists>Y. Crypt K Y \<in> G}"
 
 lemma finite_keysFor [intro]: "finite G ==> finite (keysFor G)"
 apply (simp add: keysFor_def)
 apply (rule finite_imageI)
 apply (induct G rule: finite_induct)
 apply auto
-apply (case_tac "EX K X. x = Crypt K X", clarsimp)
-apply (subgoal_tac "{Ka. EX Xa. (Ka=K & Xa=X) | Crypt Ka Xa:F}
+apply (case_tac "\<exists>K X. x = Crypt K X", clarsimp)
+apply (subgoal_tac "{Ka. \<exists>Xa. (Ka=K \<and> Xa=X) \<or> Crypt Ka Xa \<in> F} 
 = insert K (usekeys F)", auto simp: usekeys_def)
-by (subgoal_tac "{K. EX X. Crypt K X = x | Crypt K X:F} = usekeys F",
+by (subgoal_tac "{K. \<exists>X. Crypt K X = x \<or> Crypt K X \<in> F} = usekeys F",
 auto simp: usekeys_def)
 
 subsubsection\<open>lemmas on parts\<close>
 
-lemma parts_sub: "[| X:parts G; G<=H |] ==> X:parts H"
+lemma parts_sub: "[| X \<in> parts G; G \<subseteq> H |] ==> X \<in> parts H"
 by (auto dest: parts_mono)
 
-lemma parts_Diff [dest]: "X:parts (G - H) ==> X:parts G"
+lemma parts_Diff [dest]: "X \<in> parts (G - H) \<Longrightarrow> X \<in> parts G"
 by (erule parts_sub, auto)
 
-lemma parts_Diff_notin: "[| Y ~:H; Nonce n ~:parts (H - {Y}) |]
-==> Nonce n ~:parts H"
+lemma parts_Diff_notin: "[| Y \<notin> H; Nonce n \<notin> parts (H - {Y}) |]
+==> Nonce n \<notin> parts H"
 by simp
 
 lemmas parts_insert_substI = parts_insert [THEN ssubst]
@@ -138,39 +138,39 @@
 lemma finite_parts_msg [iff]: "finite (parts {X})"
 by (induct X, auto)
 
-lemma finite_parts [intro]: "finite H ==> finite (parts H)"
+lemma finite_parts [intro]: "finite H \<Longrightarrow> finite (parts H)"
 apply (erule finite_induct, simp)
 by (rule parts_insert_substI, simp)
 
-lemma parts_parts: "[| X:parts {Y}; Y:parts G |] ==> X:parts G"
+lemma parts_parts: "[| X \<in> parts {Y}; Y \<in> parts G |] ==> X \<in> parts G"
 by (frule parts_cut, auto) 
 
 
-lemma parts_parts_parts: "[| X:parts {Y}; Y:parts {Z}; Z:parts G |] ==> X:parts G"
+lemma parts_parts_parts: "[| X \<in> parts {Y}; Y \<in> parts {Z}; Z \<in> parts G |] ==> X \<in> parts G"
 by (auto dest: parts_parts)
 
-lemma parts_parts_Crypt: "[| Crypt K X:parts G; Nonce n:parts {X} |]
-==> Nonce n:parts G"
+lemma parts_parts_Crypt: "[| Crypt K X \<in> parts G; Nonce n \<in> parts {X} |]
+==> Nonce n \<in> parts G"
 by (blast intro: parts.Body dest: parts_parts)
 
 subsubsection\<open>lemmas on synth\<close>
 
-lemma synth_sub: "[| X:synth G; G<=H |] ==> X:synth H"
+lemma synth_sub: "[| X \<in> synth G; G \<subseteq> H |] ==> X \<in> synth H"
 by (auto dest: synth_mono)
 
-lemma Crypt_synth [rule_format]: "[| X:synth G; Key K ~:G |] ==>
-Crypt K Y:parts {X} --> Crypt K Y:parts G"
+lemma Crypt_synth [rule_format]: "[| X \<in> synth G; Key K \<notin> G |] ==>
+Crypt K Y \<in> parts {X} \<longrightarrow> Crypt K Y \<in> parts G"
 by (erule synth.induct, auto dest: parts_sub)
 
 subsubsection\<open>lemmas on analz\<close>
 
-lemma analz_UnI1 [intro]: "X:analz G ==> X:analz (G Un H)"
+lemma analz_UnI1 [intro]: "X \<in> analz G ==> X \<in> analz (G \<union> H)"
   by (subgoal_tac "G <= G Un H") (blast dest: analz_mono)+
 
-lemma analz_sub: "[| X:analz G; G <= H |] ==> X:analz H"
+lemma analz_sub: "[| X \<in> analz G; G \<subseteq> H |] ==> X \<in> analz H"
 by (auto dest: analz_mono)
 
-lemma analz_Diff [dest]: "X:analz (G - H) ==> X:analz G"
+lemma analz_Diff [dest]: "X \<in> analz (G - H) \<Longrightarrow> X \<in> analz G"
 by (erule analz.induct, auto)
 
 lemmas in_analz_subset_cong = analz_subset_cong [THEN subsetD]
@@ -181,32 +181,32 @@
 lemmas insert_commute_substI = insert_commute [THEN ssubst]
 
 lemma analz_insertD:
-     "[| Crypt K Y:H; Key (invKey K):H |] ==> analz (insert Y H) = analz H"
+     "[| Crypt K Y \<in> H; Key (invKey K) \<in> H |] ==> analz (insert Y H) = analz H"
 by (blast intro: analz.Decrypt analz_insert_eq)  
 
-lemma must_decrypt [rule_format,dest]: "[| X:analz H; has_no_pair H |] ==>
-X ~:H --> (EX K Y. Crypt K Y:H & Key (invKey K):H)"
+lemma must_decrypt [rule_format,dest]: "[| X \<in> analz H; has_no_pair H |] ==>
+X \<notin> H \<longrightarrow> (\<exists>K Y. Crypt K Y \<in> H \<and> Key (invKey K) \<in> H)"
 by (erule analz.induct, auto)
 
-lemma analz_needs_only_finite: "X:analz H ==> EX G. G <= H & finite G"
+lemma analz_needs_only_finite: "X \<in> analz H \<Longrightarrow> \<exists>G. G \<subseteq> H \<and> finite G"
 by (erule analz.induct, auto)
 
-lemma notin_analz_insert: "X ~:analz (insert Y G) ==> X ~:analz G"
+lemma notin_analz_insert: "X \<notin> analz (insert Y G) \<Longrightarrow> X \<notin> analz G"
 by auto
 
 subsubsection\<open>lemmas on parts, synth and analz\<close>
 
-lemma parts_invKey [rule_format,dest]:"X:parts {Y} ==>
-X:analz (insert (Crypt K Y) H) --> X ~:analz H --> Key (invKey K):analz H"
+lemma parts_invKey [rule_format,dest]:"X \<in> parts {Y} \<Longrightarrow>
+X \<in> analz (insert (Crypt K Y) H) \<longrightarrow> X \<notin> analz H \<longrightarrow> Key (invKey K) \<in> analz H"
 by (erule parts.induct, auto dest: parts.Fst parts.Snd parts.Body)
 
-lemma in_analz: "Y:analz H ==> EX X. X:H & Y:parts {X}"
+lemma in_analz: "Y \<in> analz H \<Longrightarrow> \<exists>X. X \<in> H \<and> Y \<in> parts {X}"
 by (erule analz.induct, auto intro: parts.Fst parts.Snd parts.Body)
 
 lemmas in_analz_subset_parts = analz_subset_parts [THEN subsetD]
 
-lemma Crypt_synth_insert: "[| Crypt K X:parts (insert Y H);
-Y:synth (analz H); Key K ~:analz H |] ==> Crypt K X:parts H"
+lemma Crypt_synth_insert: "[| Crypt K X \<in> parts (insert Y H);
+Y \<in> synth (analz H); Key K \<notin> analz H |] ==> Crypt K X \<in> parts H"
 apply (drule parts_insert_substD, clarify)
 apply (frule in_sub)
 apply (frule parts_mono)
@@ -222,24 +222,24 @@
 | "greatest_msg (Crypt K X) = greatest_msg X"
 | "greatest_msg other = 0"
 
-lemma greatest_msg_is_greatest: "Nonce n:parts {X} ==> n <= greatest_msg X"
+lemma greatest_msg_is_greatest: "Nonce n \<in> parts {X} \<Longrightarrow> n \<le> greatest_msg X"
 by (induct X, auto)
 
 subsubsection\<open>sets of keys\<close>
 
 definition keyset :: "msg set => bool" where
-"keyset G == ALL X. X:G --> (EX K. X = Key K)"
+"keyset G \<equiv> \<forall>X. X \<in> G \<longrightarrow> (\<exists>K. X = Key K)"
 
-lemma keyset_in [dest]: "[| keyset G; X:G |] ==> EX K. X = Key K"
+lemma keyset_in [dest]: "[| keyset G; X \<in> G |] ==> \<exists>K. X = Key K"
 by (auto simp: keyset_def)
 
 lemma MPair_notin_keyset [simp]: "keyset G ==> \<lbrace>X,Y\<rbrace> \<notin> G"
 by auto
 
-lemma Crypt_notin_keyset [simp]: "keyset G ==> Crypt K X ~:G"
+lemma Crypt_notin_keyset [simp]: "keyset G \<Longrightarrow> Crypt K X \<notin> G"
 by auto
 
-lemma Nonce_notin_keyset [simp]: "keyset G ==> Nonce n ~:G"
+lemma Nonce_notin_keyset [simp]: "keyset G \<Longrightarrow> Nonce n \<notin> G"
 by auto
 
 lemma parts_keyset [simp]: "keyset G ==> parts G = G"
@@ -256,10 +256,10 @@
 lemma keyset_Diff_keysfor [simp]: "keyset H ==> keyset (H - keysfor G)"
 by (auto simp: keyset_def)
 
-lemma keysfor_Crypt: "Crypt K X:parts G ==> Key (invKey K):keysfor G"
+lemma keysfor_Crypt: "Crypt K X \<in> parts G \<Longrightarrow> Key (invKey K) \<in> keysfor G"
 by (auto simp: keysfor_def Crypt_imp_invKey_keysFor)
 
-lemma no_key_no_Crypt: "Key K ~:keysfor G ==> Crypt (invKey K) X ~:parts G"
+lemma no_key_no_Crypt: "Key K \<notin> keysfor G \<Longrightarrow> Crypt (invKey K) X \<notin> parts G"
 by (auto dest: keysfor_Crypt)
 
 lemma finite_keysfor [intro]: "finite G ==> finite (keysfor G)"
@@ -273,7 +273,7 @@
 apply (erule analz.induct, blast)
 apply (simp, blast)
 apply (simp, blast)
-apply (case_tac "Key (invKey K):H - keysfor G", clarsimp)
+apply (case_tac "Key (invKey K) \<in> H - keysfor G", clarsimp)
 apply (drule_tac X=X in no_key_no_Crypt)
 by (auto intro: analz_sub)
 
@@ -286,7 +286,7 @@
 subsubsection\<open>general protocol properties\<close>
 
 definition is_Says :: "event => bool" where
-"is_Says ev == (EX A B X. ev = Says A B X)"
+"is_Says ev == (\<exists>A B X. ev = Says A B X)"
 
 lemma is_Says_Says [iff]: "is_Says (Says A B X)"
 by (simp add: is_Says_def)
@@ -294,36 +294,36 @@
 (* one could also require that Gets occurs after Says
 but this is sufficient for our purpose *)
 definition Gets_correct :: "event list set => bool" where
-"Gets_correct p == ALL evs B X. evs:p --> Gets B X:set evs
---> (EX A. Says A B X:set evs)"
+"Gets_correct p == \<forall>evs B X. evs \<in> p \<longrightarrow> Gets B X \<in> set evs
+\<longrightarrow> (\<exists>A. Says A B X \<in> set evs)"
 
-lemma Gets_correct_Says: "[| Gets_correct p; Gets B X # evs:p |]
-==> EX A. Says A B X:set evs"
+lemma Gets_correct_Says: "[| Gets_correct p; Gets B X # evs \<in> p |]
+==> \<exists>A. Says A B X \<in> set evs"
 apply (simp add: Gets_correct_def)
 by (drule_tac x="Gets B X # evs" in spec, auto)
 
 definition one_step :: "event list set => bool" where
-"one_step p == ALL evs ev. ev#evs:p --> evs:p"
+"one_step p == \<forall>evs ev. ev#evs \<in> p \<longrightarrow> evs \<in> p"
 
-lemma one_step_Cons [dest]: "[| one_step p; ev#evs:p |] ==> evs:p"
+lemma one_step_Cons [dest]: "[| one_step p; ev#evs \<in> p |] ==> evs \<in> p"
 by (unfold one_step_def, blast)
 
-lemma one_step_app: "[| evs@evs':p; one_step p; []:p |] ==> evs':p"
+lemma one_step_app: "[| evs@evs' \<in> p; one_step p; [] \<in> p |] ==> evs' \<in> p"
 by (induct evs, auto)
 
-lemma trunc: "[| evs @ evs':p; one_step p |] ==> evs':p"
+lemma trunc: "[| evs @ evs' \<in> p; one_step p |] ==> evs' \<in> p"
 by (induct evs, auto)
 
 definition has_only_Says :: "event list set => bool" where
-"has_only_Says p == ALL evs ev. evs:p --> ev:set evs
---> (EX A B X. ev = Says A B X)"
+"has_only_Says p \<equiv> \<forall>evs ev. evs \<in> p \<longrightarrow> ev \<in> set evs
+\<longrightarrow> (\<exists>A B X. ev = Says A B X)"
 
-lemma has_only_SaysD: "[| ev:set evs; evs:p; has_only_Says p |]
-==> EX A B X. ev = Says A B X"
+lemma has_only_SaysD: "[| ev \<in> set evs; evs \<in> p; has_only_Says p |]
+==> \<exists>A B X. ev = Says A B X"
 by (unfold has_only_Says_def, blast)
 
-lemma in_has_only_Says [dest]: "[| has_only_Says p; evs:p; ev:set evs |]
-==> EX A B X. ev = Says A B X"
+lemma in_has_only_Says [dest]: "[| has_only_Says p; evs \<in> p; ev \<in> set evs |]
+==> \<exists>A B X. ev = Says A B X"
 by (auto simp: has_only_Says_def)
 
 lemma has_only_Says_imp_Gets_correct [simp]: "has_only_Says p
@@ -332,11 +332,11 @@
 
 subsubsection\<open>lemma on knows\<close>
 
-lemma Says_imp_spies2: "Says A B \<lbrace>X,Y\<rbrace> \<in> set evs ==> Y \<in> parts (spies evs)"
+lemma Says_imp_spies2: "Says A B \<lbrace>X,Y\<rbrace> \<in> set evs \<Longrightarrow> Y \<in> parts (spies evs)"
 by (drule Says_imp_spies, drule parts.Inj, drule parts.Snd, simp)
 
-lemma Says_not_parts: "[| Says A B X:set evs; Y ~:parts (spies evs) |]
-==> Y ~:parts {X}"
+lemma Says_not_parts: "[| Says A B X \<in> set evs; Y \<notin> parts (spies evs) |]
+==> Y \<notin> parts {X}"
 by (auto dest: Says_imp_spies parts_parts)
 
 subsubsection\<open>knows without initState\<close>
@@ -349,7 +349,7 @@
      case ev of
        Says A' B X => insert X (knows' A evs)
      | Gets A' X => knows' A evs
-     | Notes A' X => if A':bad then insert X (knows' A evs) else knows' A evs
+     | Notes A' X => if A' \<in> bad then insert X (knows' A evs) else knows' A evs
    ) else (
      case ev of
        Says A' B X => if A=A' then insert X (knows' A evs) else knows' A evs
@@ -390,8 +390,8 @@
 lemmas knows_Cons_substI = knows_Cons [THEN ssubst]
 lemmas knows_Cons_substD = knows_Cons [THEN sym, THEN ssubst]
 
-lemma knows'_sub_spies': "[| evs:p; has_only_Says p; one_step p |]
-==> knows' A evs <= spies' evs"
+lemma knows'_sub_spies': "[| evs \<in> p; has_only_Says p; one_step p |]
+==> knows' A evs \<subseteq> spies' evs"
 by (induct evs, auto split: event.splits)
 
 subsubsection\<open>knows' is finite\<close>
@@ -404,7 +404,7 @@
 lemma knows_sub_Cons: "knows A evs <= knows A (ev#evs)"
 by(cases A, induct evs, auto simp: knows.simps split:event.split)
 
-lemma knows_ConsI: "X:knows A evs ==> X:knows A (ev#evs)"
+lemma knows_ConsI: "X \<in> knows A evs \<Longrightarrow> X \<in> knows A (ev#evs)"
 by (auto dest: knows_sub_Cons [THEN subsetD])
 
 lemma knows_sub_app: "knows A evs <= knows A (evs @ evs')"
@@ -424,7 +424,7 @@
       Says A' B X => insert X (knows_max' A evs)
     | Gets A' X => knows_max' A evs
     | Notes A' X =>
-      if A':bad then insert X (knows_max' A evs) else knows_max' A evs
+      if A' \<in> bad then insert X (knows_max' A evs) else knows_max' A evs
   ) else (
     case ev of
       Says A' B X =>
@@ -466,22 +466,22 @@
 lemma finite_knows_max' [iff]: "finite (knows_max' A evs)"
 by (induct evs, auto split: event.split)
 
-lemma knows_max'_sub_spies': "[| evs:p; has_only_Says p; one_step p |]
-==> knows_max' A evs <= spies' evs"
+lemma knows_max'_sub_spies': "[| evs \<in> p; has_only_Says p; one_step p |]
+==> knows_max' A evs \<subseteq> spies' evs"
 by (induct evs, auto split: event.splits)
 
-lemma knows_max'_in_spies' [dest]: "[| evs:p; X:knows_max' A evs;
-has_only_Says p; one_step p |] ==> X:spies' evs"
+lemma knows_max'_in_spies' [dest]: "[| evs \<in> p; X \<in> knows_max' A evs;
+has_only_Says p; one_step p |] ==> X \<in> spies' evs"
 by (rule knows_max'_sub_spies' [THEN subsetD], auto)
 
 lemma knows_max'_app: "knows_max' A (evs @ evs')
 = knows_max' A evs Un knows_max' A evs'"
 by (induct evs, auto split: event.splits)
 
-lemma Says_to_knows_max': "Says A B X:set evs ==> X:knows_max' B evs"
+lemma Says_to_knows_max': "Says A B X \<in> set evs \<Longrightarrow> X \<in> knows_max' B evs"
 by (simp add: in_set_conv_decomp, clarify, simp add: knows_max'_app)
 
-lemma Says_from_knows_max': "Says A B X:set evs ==> X:knows_max' A evs"
+lemma Says_from_knows_max': "Says A B X \<in> set evs \<Longrightarrow> X \<in> knows_max' A evs"
 by (simp add: in_set_conv_decomp, clarify, simp add: knows_max'_app)
 
 subsubsection\<open>used without initState\<close>
@@ -501,10 +501,10 @@
 lemma used_decomp: "used evs = init Un used' evs"
 by (induct evs, auto simp: init_def split: event.split)
 
-lemma used'_sub_app: "used' evs <= used' (evs@evs')"
+lemma used'_sub_app: "used' evs \<subseteq> used' (evs@evs')"
 by (induct evs, auto split: event.split)
 
-lemma used'_parts [rule_format]: "X:used' evs ==> Y:parts {X} --> Y:used' evs"
+lemma used'_parts [rule_format]: "X \<in> used' evs \<Longrightarrow> Y \<in> parts {X} \<longrightarrow> Y \<in> used' evs"
 apply (induct evs, simp)
 apply (rename_tac a b)
 apply (case_tac a, simp_all) 
@@ -516,35 +516,35 @@
 lemma used_sub_Cons: "used evs <= used (ev#evs)"
 by (induct evs, (induct ev, auto)+)
 
-lemma used_ConsI: "X:used evs ==> X:used (ev#evs)"
+lemma used_ConsI: "X \<in> used evs \<Longrightarrow> X \<in> used (ev#evs)"
 by (auto dest: used_sub_Cons [THEN subsetD])
 
-lemma notin_used_ConsD: "X ~:used (ev#evs) ==> X ~:used evs"
+lemma notin_used_ConsD: "X \<notin> used (ev#evs) \<Longrightarrow> X \<notin> used evs"
 by (auto dest: used_sub_Cons [THEN subsetD])
 
-lemma used_appD [dest]: "X:used (evs @ evs') ==> X:used evs | X:used evs'"
+lemma used_appD [dest]: "X \<in> used (evs @ evs') \<Longrightarrow> X \<in> used evs \<or> X \<in> used evs'"
 by (induct evs, auto, rename_tac a b, case_tac a, auto)
 
-lemma used_ConsD: "X:used (ev#evs) ==> X:used [ev] | X:used evs"
+lemma used_ConsD: "X \<in> used (ev#evs) \<Longrightarrow> X \<in> used [ev] \<or> X \<in> used evs"
 by (case_tac ev, auto)
 
 lemma used_sub_app: "used evs <= used (evs@evs')"
 by (auto simp: used_decomp dest: used'_sub_app [THEN subsetD])
 
-lemma used_appIL: "X:used evs ==> X:used (evs' @ evs)"
+lemma used_appIL: "X \<in> used evs \<Longrightarrow> X \<in> used (evs' @ evs)"
 by (induct evs', auto intro: used_ConsI)
 
-lemma used_appIR: "X:used evs ==> X:used (evs @ evs')"
+lemma used_appIR: "X \<in> used evs \<Longrightarrow> X \<in> used (evs @ evs')"
 by (erule used_sub_app [THEN subsetD])
 
-lemma used_parts: "[| X:parts {Y}; Y:used evs |] ==> X:used evs"
+lemma used_parts: "[| X \<in> parts {Y}; Y \<in> used evs |] ==> X \<in> used evs"
 apply (auto simp: used_decomp dest: used'_parts)
 by (auto simp: init_def used_Nil dest: parts_trans)
 
-lemma parts_Says_used: "[| Says A B X:set evs; Y:parts {X} |] ==> Y:used evs"
+lemma parts_Says_used: "[| Says A B X \<in> set evs; Y \<in> parts {X} |] ==> Y \<in> used evs"
 by (induct evs, simp_all, safe, auto intro: used_ConsI)
 
-lemma parts_used_app: "X:parts {Y} ==> X:used (evs @ Says A B Y # evs')"
+lemma parts_used_app: "X \<in> parts {Y} \<Longrightarrow> X \<in> used (evs @ Says A B Y # evs')"
 apply (drule_tac evs="[Says A B Y]" in used_parts, simp, blast)
 apply (drule_tac evs'=evs' in used_appIR)
 apply (drule_tac evs'=evs in used_appIL)
@@ -552,67 +552,67 @@
 
 subsubsection\<open>lemmas on used and knows\<close>
 
-lemma initState_used: "X:parts (initState A) ==> X:used evs"
+lemma initState_used: "X \<in> parts (initState A) \<Longrightarrow> X \<in> used evs"
 by (induct evs, auto simp: used.simps split: event.split)
 
-lemma Says_imp_used: "Says A B X:set evs ==> parts {X} <= used evs"
+lemma Says_imp_used: "Says A B X \<in> set evs \<Longrightarrow> parts {X} \<subseteq> used evs"
 by (induct evs, auto intro: used_ConsI)
 
-lemma not_used_not_spied: "X ~:used evs ==> X ~:parts (spies evs)"
+lemma not_used_not_spied: "X \<notin> used evs \<Longrightarrow> X \<notin> parts (spies evs)"
 by (induct evs, auto simp: used_Nil)
 
-lemma not_used_not_parts: "[| Y ~:used evs; Says A B X:set evs |]
-==> Y ~:parts {X}"
+lemma not_used_not_parts: "[| Y \<notin> used evs; Says A B X \<in> set evs |]
+==> Y \<notin> parts {X}"
 by (induct evs, auto intro: used_ConsI)
 
-lemma not_used_parts_false: "[| X ~:used evs; Y:parts (spies evs) |]
-==> X ~:parts {Y}"
+lemma not_used_parts_false: "[| X \<notin> used evs; Y \<in> parts (spies evs) |]
+==> X \<notin> parts {Y}"
 by (auto dest: parts_parts)
 
-lemma known_used [rule_format]: "[| evs:p; Gets_correct p; one_step p |]
-==> X:parts (knows A evs) --> X:used evs"
+lemma known_used [rule_format]: "[| evs \<in> p; Gets_correct p; one_step p |]
+==> X \<in> parts (knows A evs) \<longrightarrow> X \<in> used evs"
 apply (case_tac "A=Spy", blast)
 apply (induct evs)
 apply (simp add: used.simps, blast)
 apply (rename_tac a evs)
 apply (frule_tac ev=a and evs=evs in one_step_Cons, simp, clarify)
-apply (drule_tac P="%G. X:parts G" in knows_Cons_substD, safe)
+apply (drule_tac P="\<lambda>G. X \<in> parts G" in knows_Cons_substD, safe)
 apply (erule initState_used)
 apply (case_tac a, auto)
 apply (rename_tac msg)
 apply (drule_tac B=A and X=msg and evs=evs in Gets_correct_Says)
 by (auto dest: Says_imp_used intro: used_ConsI)
 
-lemma known_max_used [rule_format]: "[| evs:p; Gets_correct p; one_step p |]
-==> X:parts (knows_max A evs) --> X:used evs"
+lemma known_max_used [rule_format]: "[| evs \<in> p; Gets_correct p; one_step p |]
+==> X \<in> parts (knows_max A evs) \<longrightarrow> X \<in> used evs"
 apply (case_tac "A=Spy")
 apply force
 apply (induct evs)
 apply (simp add: knows_max_def used.simps, blast)
 apply (rename_tac a evs)
 apply (frule_tac ev=a and evs=evs in one_step_Cons, simp, clarify)
-apply (drule_tac P="%G. X:parts G" in knows_max_Cons_substD, safe)
+apply (drule_tac P="\<lambda>G. X \<in> parts G" in knows_max_Cons_substD, safe)
 apply (case_tac a, auto)
 apply (rename_tac msg)
 apply (drule_tac B=A and X=msg and evs=evs in Gets_correct_Says)
 by (auto simp: knows_max'_Cons dest: Says_imp_used intro: used_ConsI)
 
-lemma not_used_not_known: "[| evs:p; X ~:used evs;
-Gets_correct p; one_step p |] ==> X ~:parts (knows A evs)"
+lemma not_used_not_known: "[| evs \<in> p; X \<notin> used evs;
+Gets_correct p; one_step p |] ==> X \<notin> parts (knows A evs)"
 by (case_tac "A=Spy", auto dest: not_used_not_spied known_used)
 
-lemma not_used_not_known_max: "[| evs:p; X ~:used evs;
-Gets_correct p; one_step p |] ==> X ~:parts (knows_max A evs)"
+lemma not_used_not_known_max: "[| evs \<in> p; X \<notin> used evs;
+Gets_correct p; one_step p |] ==> X \<notin> parts (knows_max A evs)"
 by (case_tac "A=Spy", auto dest: not_used_not_spied known_max_used)
 
 subsubsection\<open>a nonce or key in a message cannot equal a fresh nonce or key\<close>
 
-lemma Nonce_neq [dest]: "[| Nonce n' ~:used evs;
-Says A B X:set evs; Nonce n:parts {X} |] ==> n ~= n'"
+lemma Nonce_neq [dest]: "[| Nonce n' \<notin> used evs;
+Says A B X \<in> set evs; Nonce n \<in> parts {X} |] ==> n \<noteq> n'"
 by (drule not_used_not_spied, auto dest: Says_imp_knows_Spy parts_sub)
 
-lemma Key_neq [dest]: "[| Key n' ~:used evs;
-Says A B X:set evs; Key n:parts {X} |] ==> n ~= n'"
+lemma Key_neq [dest]: "[| Key n' \<notin> used evs;
+Says A B X \<in> set evs; Key n \<in> parts {X} |] ==> n ~= n'"
 by (drule not_used_not_spied, auto dest: Says_imp_knows_Spy parts_sub)
 
 subsubsection\<open>message of an event\<close>
@@ -623,7 +623,7 @@
 | "msg (Gets A X) = X"
 | "msg (Notes A X) = X"
 
-lemma used_sub_parts_used: "X:used (ev # evs) ==> X:parts {msg ev} Un used evs"
+lemma used_sub_parts_used: "X \<in> used (ev # evs) ==> X \<in> parts {msg ev} \<union> used evs"
 by (induct ev, auto)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Guard.thy
--- a/src/HOL/Auth/Guard/Guard.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Guard.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -13,82 +13,82 @@
 ******************************************************************************)
 
 inductive_set
-  guard :: "nat => key set => msg set"
+  guard :: "nat \<Rightarrow> key set \<Rightarrow> msg set"
   for n :: nat and Ks :: "key set"
 where
-  No_Nonce [intro]: "Nonce n ~:parts {X} ==> X:guard n Ks"
-| Guard_Nonce [intro]: "invKey K:Ks ==> Crypt K X:guard n Ks"
-| Crypt [intro]: "X:guard n Ks ==> Crypt K X:guard n Ks"
-| Pair [intro]: "[| X:guard n Ks; Y:guard n Ks |] ==> \<lbrace>X,Y\<rbrace> \<in> guard n Ks"
+  No_Nonce [intro]: "Nonce n \<notin> parts {X} \<Longrightarrow> X \<in> guard n Ks"
+| Guard_Nonce [intro]: "invKey K \<in> Ks \<Longrightarrow> Crypt K X \<in> guard n Ks"
+| Crypt [intro]: "X \<in> guard n Ks \<Longrightarrow> Crypt K X \<in> guard n Ks"
+| Pair [intro]: "[| X \<in> guard n Ks; Y \<in> guard n Ks |] ==> \<lbrace>X,Y\<rbrace> \<in> guard n Ks"
 
 subsection\<open>basic facts about @{term guard}\<close>
 
-lemma Key_is_guard [iff]: "Key K:guard n Ks"
+lemma Key_is_guard [iff]: "Key K \<in> guard n Ks"
 by auto
 
-lemma Agent_is_guard [iff]: "Agent A:guard n Ks"
+lemma Agent_is_guard [iff]: "Agent A \<in> guard n Ks"
 by auto
 
-lemma Number_is_guard [iff]: "Number r:guard n Ks"
+lemma Number_is_guard [iff]: "Number r \<in> guard n Ks"
 by auto
 
-lemma Nonce_notin_guard: "X:guard n Ks ==> X ~= Nonce n"
+lemma Nonce_notin_guard: "X \<in> guard n Ks \<Longrightarrow> X \<noteq> Nonce n"
 by (erule guard.induct, auto)
 
-lemma Nonce_notin_guard_iff [iff]: "Nonce n ~:guard n Ks"
+lemma Nonce_notin_guard_iff [iff]: "Nonce n \<notin> guard n Ks"
 by (auto dest: Nonce_notin_guard)
 
-lemma guard_has_Crypt [rule_format]: "X:guard n Ks ==> Nonce n:parts {X}
---> (EX K Y. Crypt K Y:kparts {X} & Nonce n:parts {Y})"
+lemma guard_has_Crypt [rule_format]: "X \<in> guard n Ks ==> Nonce n \<in> parts {X}
+\<longrightarrow> (\<exists>K Y. Crypt K Y \<in> kparts {X} \<and> Nonce n \<in> parts {Y})"
 by (erule guard.induct, auto)
 
-lemma Nonce_notin_kparts_msg: "X:guard n Ks ==> Nonce n ~:kparts {X}"
+lemma Nonce_notin_kparts_msg: "X \<in> guard n Ks \<Longrightarrow> Nonce n \<notin> kparts {X}"
 by (erule guard.induct, auto)
 
-lemma Nonce_in_kparts_imp_no_guard: "Nonce n:kparts H
-==> EX X. X:H & X ~:guard n Ks"
+lemma Nonce_in_kparts_imp_no_guard: "Nonce n \<in> kparts H
+\<Longrightarrow> \<exists>X. X \<in> H \<and> X \<notin> guard n Ks"
 apply (drule in_kparts, clarify)
 apply (rule_tac x=X in exI, clarify)
 by (auto dest: Nonce_notin_kparts_msg)
 
-lemma guard_kparts [rule_format]: "X:guard n Ks ==>
-Y:kparts {X} --> Y:guard n Ks"
+lemma guard_kparts [rule_format]: "X \<in> guard n Ks \<Longrightarrow>
+Y \<in> kparts {X} \<longrightarrow> Y \<in> guard n Ks"
 by (erule guard.induct, auto)
 
-lemma guard_Crypt: "[| Crypt K Y:guard n Ks; K ~:invKey`Ks |] ==> Y:guard n Ks"
-  by (ind_cases "Crypt K Y:guard n Ks") (auto intro!: image_eqI)
+lemma guard_Crypt: "[| Crypt K Y \<in> guard n Ks; K \<notin> invKey`Ks |] ==> Y \<in> guard n Ks"
+  by (ind_cases "Crypt K Y \<in> guard n Ks") (auto intro!: image_eqI)
 
 lemma guard_MPair [iff]: "(\<lbrace>X,Y\<rbrace> \<in> guard n Ks) = (X \<in> guard n Ks \<and> Y \<in> guard n Ks)"
 by (auto, (ind_cases "\<lbrace>X,Y\<rbrace> \<in> guard n Ks", auto)+)
 
-lemma guard_not_guard [rule_format]: "X:guard n Ks ==>
-Crypt K Y:kparts {X} --> Nonce n:kparts {Y} --> Y ~:guard n Ks"
+lemma guard_not_guard [rule_format]: "X \<in> guard n Ks \<Longrightarrow>
+Crypt K Y \<in> kparts {X} \<longrightarrow> Nonce n \<in> kparts {Y} \<longrightarrow> Y \<notin> guard n Ks"
 by (erule guard.induct, auto dest: guard_kparts)
 
-lemma guard_extand: "[| X:guard n Ks; Ks <= Ks' |] ==> X:guard n Ks'"
+lemma guard_extand: "[| X \<in> guard n Ks; Ks \<subseteq> Ks' |] ==> X \<in> guard n Ks'"
 by (erule guard.induct, auto)
 
 subsection\<open>guarded sets\<close>
 
-definition Guard :: "nat => key set => msg set => bool" where
-"Guard n Ks H == ALL X. X:H --> X:guard n Ks"
+definition Guard :: "nat \<Rightarrow> key set \<Rightarrow> msg set \<Rightarrow> bool" where
+"Guard n Ks H \<equiv> \<forall>X. X \<in> H \<longrightarrow> X \<in> guard n Ks"
 
 subsection\<open>basic facts about @{term Guard}\<close>
 
 lemma Guard_empty [iff]: "Guard n Ks {}"
 by (simp add: Guard_def)
 
-lemma notin_parts_Guard [intro]: "Nonce n ~:parts G ==> Guard n Ks G"
+lemma notin_parts_Guard [intro]: "Nonce n \<notin> parts G \<Longrightarrow> Guard n Ks G"
 apply (unfold Guard_def, clarify)
-apply (subgoal_tac "Nonce n ~:parts {X}")
+apply (subgoal_tac "Nonce n \<notin> parts {X}")
 by (auto dest: parts_sub)
 
-lemma Nonce_notin_kparts [simplified]: "Guard n Ks H ==> Nonce n ~:kparts H"
+lemma Nonce_notin_kparts [simplified]: "Guard n Ks H \<Longrightarrow> Nonce n \<notin> kparts H"
 by (auto simp: Guard_def dest: in_kparts Nonce_notin_kparts_msg)
 
-lemma Guard_must_decrypt: "[| Guard n Ks H; Nonce n:analz H |] ==>
-EX K Y. Crypt K Y:kparts H & Key (invKey K):kparts H"
-apply (drule_tac P="%G. Nonce n:G" in analz_pparts_kparts_substD, simp)
+lemma Guard_must_decrypt: "[| Guard n Ks H; Nonce n \<in> analz H |] ==>
+\<exists>K Y. Crypt K Y \<in> kparts H \<and> Key (invKey K) \<in> kparts H"
+apply (drule_tac P="\<lambda>G. Nonce n \<in> G" in analz_pparts_kparts_substD, simp)
 by (drule must_decrypt, auto dest: Nonce_notin_kparts)
 
 lemma Guard_kparts [intro]: "Guard n Ks H ==> Guard n Ks (kparts H)"
@@ -98,7 +98,7 @@
 by (auto simp: Guard_def)
 
 lemma Guard_insert [iff]: "Guard n Ks (insert X H)
-= (Guard n Ks H & X:guard n Ks)"
+= (Guard n Ks H \<and> X \<in> guard n Ks)"
 by (auto simp: Guard_def)
 
 lemma Guard_Un [iff]: "Guard n Ks (G Un H) = (Guard n Ks G & Guard n Ks H)"
@@ -107,51 +107,51 @@
 lemma Guard_synth [intro]: "Guard n Ks G ==> Guard n Ks (synth G)"
 by (auto simp: Guard_def, erule synth.induct, auto)
 
-lemma Guard_analz [intro]: "[| Guard n Ks G; ALL K. K:Ks --> Key K ~:analz G |]
+lemma Guard_analz [intro]: "[| Guard n Ks G; \<forall>K. K \<in> Ks \<longrightarrow> Key K \<notin> analz G |]
 ==> Guard n Ks (analz G)"
 apply (auto simp: Guard_def)
 apply (erule analz.induct, auto)
-by (ind_cases "Crypt K Xa:guard n Ks" for K Xa, auto)
+by (ind_cases "Crypt K Xa \<in> guard n Ks" for K Xa, auto)
 
-lemma in_Guard [dest]: "[| X:G; Guard n Ks G |] ==> X:guard n Ks"
+lemma in_Guard [dest]: "[| X \<in> G; Guard n Ks G |] ==> X \<in> guard n Ks"
 by (auto simp: Guard_def)
 
-lemma in_synth_Guard: "[| X:synth G; Guard n Ks G |] ==> X:guard n Ks"
+lemma in_synth_Guard: "[| X \<in> synth G; Guard n Ks G |] ==> X \<in> guard n Ks"
 by (drule Guard_synth, auto)
 
-lemma in_analz_Guard: "[| X:analz G; Guard n Ks G;
-ALL K. K:Ks --> Key K ~:analz G |] ==> X:guard n Ks"
+lemma in_analz_Guard: "[| X \<in> analz G; Guard n Ks G;
+\<forall>K. K \<in> Ks \<longrightarrow> Key K \<notin> analz G |] ==> X \<in> guard n Ks"
 by (drule Guard_analz, auto)
 
 lemma Guard_keyset [simp]: "keyset G ==> Guard n Ks G"
 by (auto simp: Guard_def)
 
-lemma Guard_Un_keyset: "[| Guard n Ks G; keyset H |] ==> Guard n Ks (G Un H)"
+lemma Guard_Un_keyset: "[| Guard n Ks G; keyset H |] ==> Guard n Ks (G \<union> H)"
 by auto
 
-lemma in_Guard_kparts: "[| X:G; Guard n Ks G; Y:kparts {X} |] ==> Y:guard n Ks"
+lemma in_Guard_kparts: "[| X \<in> G; Guard n Ks G; Y \<in> kparts {X} |] ==> Y \<in> guard n Ks"
 by blast
 
-lemma in_Guard_kparts_neq: "[| X:G; Guard n Ks G; Nonce n':kparts {X} |]
-==> n ~= n'"
+lemma in_Guard_kparts_neq: "[| X \<in> G; Guard n Ks G; Nonce n' \<in> kparts {X} |]
+==> n \<noteq> n'"
 by (blast dest: in_Guard_kparts)
 
-lemma in_Guard_kparts_Crypt: "[| X:G; Guard n Ks G; is_MPair X;
-Crypt K Y:kparts {X}; Nonce n:kparts {Y} |] ==> invKey K:Ks"
+lemma in_Guard_kparts_Crypt: "[| X \<in> G; Guard n Ks G; is_MPair X;
+Crypt K Y \<in> kparts {X}; Nonce n \<in> kparts {Y} |] ==> invKey K \<in> Ks"
 apply (drule in_Guard, simp)
 apply (frule guard_not_guard, simp+)
 apply (drule guard_kparts, simp)
-by (ind_cases "Crypt K Y:guard n Ks", auto)
+by (ind_cases "Crypt K Y \<in> guard n Ks", auto)
 
-lemma Guard_extand: "[| Guard n Ks G; Ks <= Ks' |] ==> Guard n Ks' G"
+lemma Guard_extand: "[| Guard n Ks G; Ks \<subseteq> Ks' |] ==> Guard n Ks' G"
 by (auto simp: Guard_def dest: guard_extand)
 
-lemma guard_invKey [rule_format]: "[| X:guard n Ks; Nonce n:kparts {Y} |] ==>
-Crypt K Y:kparts {X} --> invKey K:Ks"
+lemma guard_invKey [rule_format]: "[| X \<in> guard n Ks; Nonce n \<in> kparts {Y} |] ==>
+Crypt K Y \<in> kparts {X} \<longrightarrow> invKey K \<in> Ks"
 by (erule guard.induct, auto)
 
-lemma Crypt_guard_invKey [rule_format]: "[| Crypt K Y:guard n Ks;
-Nonce n:kparts {Y} |] ==> invKey K:Ks"
+lemma Crypt_guard_invKey [rule_format]: "[| Crypt K Y \<in> guard n Ks;
+Nonce n \<in> kparts {Y} |] ==> invKey K \<in> Ks"
 by (auto dest: guard_invKey)
 
 subsection\<open>set obtained by decrypting a message\<close>
@@ -160,14 +160,14 @@
   decrypt :: "msg set => key => msg => msg set" where
   "decrypt H K Y == insert Y (H - {Crypt K Y})"
 
-lemma analz_decrypt: "[| Crypt K Y:H; Key (invKey K):H; Nonce n:analz H |]
-==> Nonce n:analz (decrypt H K Y)"
-apply (drule_tac P="%H. Nonce n:analz H" in ssubst [OF insert_Diff])
+lemma analz_decrypt: "[| Crypt K Y \<in> H; Key (invKey K) \<in> H; Nonce n \<in> analz H |]
+==> Nonce n \<in> analz (decrypt H K Y)"
+apply (drule_tac P="\<lambda>H. Nonce n \<in> analz H" in ssubst [OF insert_Diff])
 apply assumption
 apply (simp only: analz_Crypt_if, simp)
 done
 
-lemma parts_decrypt: "[| Crypt K Y:H; X:parts (decrypt H K Y) |] ==> X:parts H"
+lemma parts_decrypt: "[| Crypt K Y \<in> H; X \<in> parts (decrypt H K Y) |] ==> X \<in> parts H"
 by (erule parts.induct, auto intro: parts.Fst parts.Snd parts.Body)
 
 subsection\<open>number of Crypt's in a message\<close>
@@ -180,7 +180,7 @@
 
 subsection\<open>basic facts about @{term crypt_nb}\<close>
 
-lemma non_empty_crypt_msg: "Crypt K Y:parts {X} ==> crypt_nb X \<noteq> 0"
+lemma non_empty_crypt_msg: "Crypt K Y \<in> parts {X} \<Longrightarrow> crypt_nb X \<noteq> 0"
 by (induct X, simp_all, safe, simp_all)
 
 subsection\<open>number of Crypt's in a message list\<close>
@@ -206,16 +206,16 @@
 apply simp
 done
 
-lemma parts_cnb: "Z:parts (set l) ==>
+lemma parts_cnb: "Z \<in> parts (set l) \<Longrightarrow>
 cnb l = (cnb l - crypt_nb Z) + crypt_nb Z"
 by (erule parts.induct, auto simp: in_set_conv_decomp)
 
-lemma non_empty_crypt: "Crypt K Y:parts (set l) ==> cnb l \<noteq> 0"
+lemma non_empty_crypt: "Crypt K Y \<in> parts (set l) \<Longrightarrow> cnb l \<noteq> 0"
 by (induct l, auto dest: non_empty_crypt_msg parts_insert_substD)
 
 subsection\<open>list of kparts\<close>
 
-lemma kparts_msg_set: "EX l. kparts {X} = set l & cnb l = crypt_nb X"
+lemma kparts_msg_set: "\<exists>l. kparts {X} = set l \<and> cnb l = crypt_nb X"
 apply (induct X, simp_all)
 apply (rename_tac agent, rule_tac x="[Agent agent]" in exI, simp)
 apply (rename_tac nat, rule_tac x="[Number nat]" in exI, simp)
@@ -225,11 +225,11 @@
 apply (clarify, rule_tac x="l@la" in exI, simp)
 by (clarify, rename_tac nat X y, rule_tac x="[Crypt nat X]" in exI, simp)
 
-lemma kparts_set: "EX l'. kparts (set l) = set l' & cnb l' = cnb l"
+lemma kparts_set: "\<exists>l'. kparts (set l) = set l' \<and> cnb l' = cnb l"
 apply (induct l)
 apply (rule_tac x="[]" in exI, simp, clarsimp)
 apply (rename_tac a b l')
-apply (subgoal_tac "EX l''.  kparts {a} = set l'' & cnb l'' = crypt_nb a", clarify)
+apply (subgoal_tac "\<exists>l''.  kparts {a} = set l'' \<and> cnb l'' = crypt_nb a", clarify)
 apply (rule_tac x="l''@l'" in exI, simp)
 apply (rule kparts_insert_substI, simp)
 by (rule kparts_msg_set)
@@ -249,28 +249,28 @@
 subsection\<open>if the analyse of a finite guarded set gives n then it must also gives
 one of the keys of Ks\<close>
 
-lemma Guard_invKey_by_list [rule_format]: "ALL l. cnb l = p
---> Guard n Ks (set l) --> Nonce n:analz (set l)
---> (EX K. K:Ks & Key K:analz (set l))"
+lemma Guard_invKey_by_list [rule_format]: "\<forall>l. cnb l = p
+\<longrightarrow> Guard n Ks (set l) \<longrightarrow> Nonce n \<in> analz (set l)
+\<longrightarrow> (\<exists>K. K \<in> Ks \<and> Key K \<in> analz (set l))"
 apply (induct p)
 (* case p=0 *)
 apply (clarify, drule Guard_must_decrypt, simp, clarify)
 apply (drule kparts_parts, drule non_empty_crypt, simp)
 (* case p>0 *)
 apply (clarify, frule Guard_must_decrypt, simp, clarify)
-apply (drule_tac P="%G. Nonce n:G" in analz_pparts_kparts_substD, simp)
+apply (drule_tac P="\<lambda>G. Nonce n \<in> G" in analz_pparts_kparts_substD, simp)
 apply (frule analz_decrypt, simp_all)
-apply (subgoal_tac "EX l'. kparts (set l) = set l' & cnb l' = cnb l", clarsimp)
+apply (subgoal_tac "\<exists>l'. kparts (set l) = set l' \<and> cnb l' = cnb l", clarsimp)
 apply (drule_tac G="insert Y (set l' - {Crypt K Y})"
 and H="set (decrypt' l' K Y)" in analz_sub, rule decrypt_minus)
 apply (rule_tac analz_pparts_kparts_substI, simp)
-apply (case_tac "K:invKey`Ks")
+apply (case_tac "K \<in> invKey`Ks")
 (* K:invKey`Ks *)
 apply (clarsimp, blast)
 (* K ~:invKey`Ks *)
 apply (subgoal_tac "Guard n Ks (set (decrypt' l' K Y))")
 apply (drule_tac x="decrypt' l' K Y" in spec, simp)
-apply (subgoal_tac "Crypt K Y:parts (set l)")
+apply (subgoal_tac "Crypt K Y \<in> parts (set l)")
 apply (drule parts_cnb, rotate_tac -1, simp)
 apply (clarify, drule_tac X="Key Ka" and H="insert Y (set l')" in analz_sub)
 apply (rule insert_mono, rule set_remove)
@@ -286,21 +286,21 @@
 apply (rule_tac B="set l'" in subset_trans, rule set_remove, blast)
 by (rule kparts_set)
 
-lemma Guard_invKey_finite: "[| Nonce n:analz G; Guard n Ks G; finite G |]
-==> EX K. K:Ks & Key K:analz G"
+lemma Guard_invKey_finite: "[| Nonce n \<in> analz G; Guard n Ks G; finite G |]
+==> \<exists>K. K \<in> Ks \<and> Key K \<in> analz G"
 apply (drule finite_list, clarify)
 by (rule Guard_invKey_by_list, auto)
 
-lemma Guard_invKey: "[| Nonce n:analz G; Guard n Ks G |]
-==> EX K. K:Ks & Key K:analz G"
+lemma Guard_invKey: "[| Nonce n \<in> analz G; Guard n Ks G |]
+==> \<exists>K. K \<in> Ks \<and> Key K \<in> analz G"
 by (auto dest: analz_needs_only_finite Guard_invKey_finite)
 
 subsection\<open>if the analyse of a finite guarded set and a (possibly infinite) set of keys
 gives n then it must also gives Ks\<close>
 
-lemma Guard_invKey_keyset: "[| Nonce n:analz (G Un H); Guard n Ks G; finite G;
-keyset H |] ==> EX K. K:Ks & Key K:analz (G Un H)"
-apply (frule_tac P="%G. Nonce n:G" and G=G in analz_keyset_substD, simp_all)
+lemma Guard_invKey_keyset: "[| Nonce n \<in> analz (G \<union> H); Guard n Ks G; finite G;
+keyset H |] ==> \<exists>K. K \<in> Ks \<and> Key K \<in> analz (G \<union> H)"
+apply (frule_tac P="\<lambda>G. Nonce n \<in> G" and G=G in analz_keyset_substD, simp_all)
 apply (drule_tac G="G Un (H Int keysfor G)" in Guard_invKey_finite)
 by (auto simp: Guard_def intro: analz_sub)
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/GuardK.thy
--- a/src/HOL/Auth/Guard/GuardK.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/GuardK.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -23,149 +23,149 @@
   guardK :: "nat => key set => msg set"
   for n :: nat and Ks :: "key set"
 where
-  No_Key [intro]: "Key n ~:parts {X} ==> X:guardK n Ks"
-| Guard_Key [intro]: "invKey K:Ks ==> Crypt K X:guardK n Ks"
-| Crypt [intro]: "X:guardK n Ks ==> Crypt K X:guardK n Ks"
-| Pair [intro]: "[| X:guardK n Ks; Y:guardK n Ks |] ==> \<lbrace>X,Y\<rbrace>:guardK n Ks"
+  No_Key [intro]: "Key n \<notin> parts {X} \<Longrightarrow> X \<in> guardK n Ks"
+| Guard_Key [intro]: "invKey K \<in> Ks ==> Crypt K X \<in> guardK n Ks"
+| Crypt [intro]: "X \<in> guardK n Ks \<Longrightarrow> Crypt K X \<in> guardK n Ks"
+| Pair [intro]: "[| X \<in> guardK n Ks; Y \<in> guardK n Ks |] ==> \<lbrace>X,Y\<rbrace> \<in> guardK n Ks"
 
 subsection\<open>basic facts about @{term guardK}\<close>
 
-lemma Nonce_is_guardK [iff]: "Nonce p:guardK n Ks"
+lemma Nonce_is_guardK [iff]: "Nonce p \<in> guardK n Ks"
 by auto
 
-lemma Agent_is_guardK [iff]: "Agent A:guardK n Ks"
+lemma Agent_is_guardK [iff]: "Agent A \<in> guardK n Ks"
 by auto
 
-lemma Number_is_guardK [iff]: "Number r:guardK n Ks"
+lemma Number_is_guardK [iff]: "Number r \<in> guardK n Ks"
 by auto
 
-lemma Key_notin_guardK: "X:guardK n Ks ==> X ~= Key n"
+lemma Key_notin_guardK: "X \<in> guardK n Ks \<Longrightarrow> X \<noteq> Key n"
 by (erule guardK.induct, auto)
 
-lemma Key_notin_guardK_iff [iff]: "Key n ~:guardK n Ks"
+lemma Key_notin_guardK_iff [iff]: "Key n \<notin> guardK n Ks"
 by (auto dest: Key_notin_guardK)
 
-lemma guardK_has_Crypt [rule_format]: "X:guardK n Ks ==> Key n:parts {X}
---> (EX K Y. Crypt K Y:kparts {X} & Key n:parts {Y})"
+lemma guardK_has_Crypt [rule_format]: "X \<in> guardK n Ks \<Longrightarrow> Key n \<in> parts {X}
+\<longrightarrow> (\<exists>K Y. Crypt K Y \<in> kparts {X} \<and> Key n \<in> parts {Y})"
 by (erule guardK.induct, auto)
 
-lemma Key_notin_kparts_msg: "X:guardK n Ks ==> Key n ~:kparts {X}"
+lemma Key_notin_kparts_msg: "X \<in> guardK n Ks \<Longrightarrow> Key n \<notin> kparts {X}"
 by (erule guardK.induct, auto dest: kparts_parts)
 
-lemma Key_in_kparts_imp_no_guardK: "Key n:kparts H
-==> EX X. X:H & X ~:guardK n Ks"
+lemma Key_in_kparts_imp_no_guardK: "Key n \<in> kparts H
+\<Longrightarrow> \<exists>X. X \<in> H \<and> X \<notin> guardK n Ks"
 apply (drule in_kparts, clarify)
 apply (rule_tac x=X in exI, clarify)
 by (auto dest: Key_notin_kparts_msg)
 
-lemma guardK_kparts [rule_format]: "X:guardK n Ks ==>
-Y:kparts {X} --> Y:guardK n Ks"
+lemma guardK_kparts [rule_format]: "X \<in> guardK n Ks \<Longrightarrow>
+Y \<in> kparts {X} \<longrightarrow> Y \<in> guardK n Ks"
 by (erule guardK.induct, auto dest: kparts_parts parts_sub)
 
-lemma guardK_Crypt: "[| Crypt K Y:guardK n Ks; K ~:invKey`Ks |] ==> Y:guardK n Ks"
-  by (ind_cases "Crypt K Y:guardK n Ks") (auto intro!: image_eqI)
+lemma guardK_Crypt: "[| Crypt K Y \<in> guardK n Ks; K \<notin> invKey`Ks |] ==> Y \<in> guardK n Ks"
+  by (ind_cases "Crypt K Y \<in> guardK n Ks") (auto intro!: image_eqI)
 
-lemma guardK_MPair [iff]: "(\<lbrace>X,Y\<rbrace>:guardK n Ks)
-= (X:guardK n Ks & Y:guardK n Ks)"
-by (auto, (ind_cases "\<lbrace>X,Y\<rbrace>:guardK n Ks", auto)+)
+lemma guardK_MPair [iff]: "(\<lbrace>X,Y\<rbrace> \<in> guardK n Ks)
+= (X \<in> guardK n Ks \<and> Y \<in> guardK n Ks)"
+by (auto, (ind_cases "\<lbrace>X,Y\<rbrace> \<in> guardK n Ks", auto)+)
 
-lemma guardK_not_guardK [rule_format]: "X:guardK n Ks ==>
-Crypt K Y:kparts {X} --> Key n:kparts {Y} --> Y ~:guardK n Ks"
+lemma guardK_not_guardK [rule_format]: "X \<in>guardK n Ks \<Longrightarrow>
+Crypt K Y \<in> kparts {X} \<longrightarrow> Key n \<in> kparts {Y} \<longrightarrow> Y \<notin> guardK n Ks"
 by (erule guardK.induct, auto dest: guardK_kparts)
 
-lemma guardK_extand: "[| X:guardK n Ks; Ks <= Ks';
-[| K:Ks'; K ~:Ks |] ==> Key K ~:parts {X} |] ==> X:guardK n Ks'"
+lemma guardK_extand: "[| X \<in> guardK n Ks; Ks \<subseteq> Ks';
+[| K \<in> Ks'; K \<notin> Ks |] ==> Key K \<notin> parts {X} |] ==> X \<in> guardK n Ks'"
 by (erule guardK.induct, auto)
 
 subsection\<open>guarded sets\<close>
 
-definition GuardK :: "nat => key set => msg set => bool" where
-"GuardK n Ks H == ALL X. X:H --> X:guardK n Ks"
+definition GuardK :: "nat \<Rightarrow> key set \<Rightarrow> msg set \<Rightarrow> bool" where
+"GuardK n Ks H \<equiv> \<forall>X. X \<in> H \<longrightarrow> X \<in> guardK n Ks"
 
 subsection\<open>basic facts about @{term GuardK}\<close>
 
 lemma GuardK_empty [iff]: "GuardK n Ks {}"
 by (simp add: GuardK_def)
 
-lemma Key_notin_kparts [simplified]: "GuardK n Ks H ==> Key n ~:kparts H"
+lemma Key_notin_kparts [simplified]: "GuardK n Ks H \<Longrightarrow> Key n \<notin> kparts H"
 by (auto simp: GuardK_def dest: in_kparts Key_notin_kparts_msg)
 
-lemma GuardK_must_decrypt: "[| GuardK n Ks H; Key n:analz H |] ==>
-EX K Y. Crypt K Y:kparts H & Key (invKey K):kparts H"
-apply (drule_tac P="%G. Key n:G" in analz_pparts_kparts_substD, simp)
+lemma GuardK_must_decrypt: "[| GuardK n Ks H; Key n \<in> analz H |] ==>
+\<exists>K Y. Crypt K Y \<in> kparts H \<and> Key (invKey K) \<in> kparts H"
+apply (drule_tac P="\<lambda>G. Key n \<in> G" in analz_pparts_kparts_substD, simp)
 by (drule must_decrypt, auto dest: Key_notin_kparts)
 
-lemma GuardK_kparts [intro]: "GuardK n Ks H ==> GuardK n Ks (kparts H)"
+lemma GuardK_kparts [intro]: "GuardK n Ks H \<Longrightarrow> GuardK n Ks (kparts H)"
 by (auto simp: GuardK_def dest: in_kparts guardK_kparts)
 
-lemma GuardK_mono: "[| GuardK n Ks H; G <= H |] ==> GuardK n Ks G"
+lemma GuardK_mono: "[| GuardK n Ks H; G \<subseteq> H |] ==> GuardK n Ks G"
 by (auto simp: GuardK_def)
 
 lemma GuardK_insert [iff]: "GuardK n Ks (insert X H)
-= (GuardK n Ks H & X:guardK n Ks)"
+= (GuardK n Ks H \<and> X \<in> guardK n Ks)"
 by (auto simp: GuardK_def)
 
 lemma GuardK_Un [iff]: "GuardK n Ks (G Un H) = (GuardK n Ks G & GuardK n Ks H)"
 by (auto simp: GuardK_def)
 
-lemma GuardK_synth [intro]: "GuardK n Ks G ==> GuardK n Ks (synth G)"
+lemma GuardK_synth [intro]: "GuardK n Ks G \<Longrightarrow> GuardK n Ks (synth G)"
 by (auto simp: GuardK_def, erule synth.induct, auto)
 
-lemma GuardK_analz [intro]: "[| GuardK n Ks G; ALL K. K:Ks --> Key K ~:analz G |]
+lemma GuardK_analz [intro]: "[| GuardK n Ks G; \<forall>K. K \<in> Ks \<longrightarrow> Key K \<notin> analz G |]
 ==> GuardK n Ks (analz G)"
 apply (auto simp: GuardK_def)
 apply (erule analz.induct, auto)
-by (ind_cases "Crypt K Xa:guardK n Ks" for K Xa, auto)
+by (ind_cases "Crypt K Xa \<in> guardK n Ks" for K Xa, auto)
 
-lemma in_GuardK [dest]: "[| X:G; GuardK n Ks G |] ==> X:guardK n Ks"
+lemma in_GuardK [dest]: "[| X \<in> G; GuardK n Ks G |] ==> X \<in> guardK n Ks"
 by (auto simp: GuardK_def)
 
-lemma in_synth_GuardK: "[| X:synth G; GuardK n Ks G |] ==> X:guardK n Ks"
+lemma in_synth_GuardK: "[| X \<in> synth G; GuardK n Ks G |] ==> X \<in> guardK n Ks"
 by (drule GuardK_synth, auto)
 
-lemma in_analz_GuardK: "[| X:analz G; GuardK n Ks G;
-ALL K. K:Ks --> Key K ~:analz G |] ==> X:guardK n Ks"
+lemma in_analz_GuardK: "[| X \<in> analz G; GuardK n Ks G;
+\<forall>K. K \<in> Ks \<longrightarrow> Key K \<notin> analz G |] ==> X \<in> guardK n Ks"
 by (drule GuardK_analz, auto)
 
-lemma GuardK_keyset [simp]: "[| keyset G; Key n ~:G |] ==> GuardK n Ks G"
+lemma GuardK_keyset [simp]: "[| keyset G; Key n \<notin> G |] ==> GuardK n Ks G"
 by (simp only: GuardK_def, clarify, drule keyset_in, auto)
 
-lemma GuardK_Un_keyset: "[| GuardK n Ks G; keyset H; Key n ~:H |]
+lemma GuardK_Un_keyset: "[| GuardK n Ks G; keyset H; Key n \<notin> H |]
 ==> GuardK n Ks (G Un H)"
 by auto
 
-lemma in_GuardK_kparts: "[| X:G; GuardK n Ks G; Y:kparts {X} |] ==> Y:guardK n Ks"
+lemma in_GuardK_kparts: "[| X \<in> G; GuardK n Ks G; Y \<in> kparts {X} |] ==> Y \<in> guardK n Ks"
 by blast
 
-lemma in_GuardK_kparts_neq: "[| X:G; GuardK n Ks G; Key n':kparts {X} |]
-==> n ~= n'"
+lemma in_GuardK_kparts_neq: "[| X \<in> G; GuardK n Ks G; Key n' \<in> kparts {X} |]
+==> n \<noteq> n'"
 by (blast dest: in_GuardK_kparts)
 
-lemma in_GuardK_kparts_Crypt: "[| X:G; GuardK n Ks G; is_MPair X;
-Crypt K Y:kparts {X}; Key n:kparts {Y} |] ==> invKey K:Ks"
+lemma in_GuardK_kparts_Crypt: "[| X \<in> G; GuardK n Ks G; is_MPair X;
+Crypt K Y \<in> kparts {X}; Key n \<in> kparts {Y} |] ==> invKey K \<in> Ks"
 apply (drule in_GuardK, simp)
 apply (frule guardK_not_guardK, simp+)
 apply (drule guardK_kparts, simp)
-by (ind_cases "Crypt K Y:guardK n Ks", auto)
+by (ind_cases "Crypt K Y \<in> guardK n Ks", auto)
 
-lemma GuardK_extand: "[| GuardK n Ks G; Ks <= Ks';
-[| K:Ks'; K ~:Ks |] ==> Key K ~:parts G |] ==> GuardK n Ks' G"
+lemma GuardK_extand: "[| GuardK n Ks G; Ks \<subseteq> Ks';
+[| K \<in> Ks'; K \<notin> Ks |] ==> Key K \<notin> parts G |] ==> GuardK n Ks' G"
 by (auto simp: GuardK_def dest: guardK_extand parts_sub)
 
 subsection\<open>set obtained by decrypting a message\<close>
 
 abbreviation (input)
-  decrypt :: "msg set => key => msg => msg set" where
-  "decrypt H K Y == insert Y (H - {Crypt K Y})"
+  decrypt :: "msg set \<Rightarrow> key \<Rightarrow> msg \<Rightarrow> msg set" where
+  "decrypt H K Y \<equiv> insert Y (H - {Crypt K Y})"
 
-lemma analz_decrypt: "[| Crypt K Y:H; Key (invKey K):H; Key n:analz H |]
-==> Key n:analz (decrypt H K Y)"
-apply (drule_tac P="%H. Key n:analz H" in ssubst [OF insert_Diff])
+lemma analz_decrypt: "[| Crypt K Y \<in> H; Key (invKey K) \<in> H; Key n \<in> analz H |]
+==> Key n \<in> analz (decrypt H K Y)"
+apply (drule_tac P="\<lambda>H. Key n \<in> analz H" in ssubst [OF insert_Diff])
 apply assumption 
 apply (simp only: analz_Crypt_if, simp)
 done
 
-lemma parts_decrypt: "[| Crypt K Y:H; X:parts (decrypt H K Y) |] ==> X:parts H"
+lemma parts_decrypt: "[| Crypt K Y \<in> H; X \<in> parts (decrypt H K Y) |] ==> X \<in> parts H"
 by (erule parts.induct, auto intro: parts.Fst parts.Snd parts.Body)
 
 subsection\<open>number of Crypt's in a message\<close>
@@ -177,7 +177,7 @@
 
 subsection\<open>basic facts about @{term crypt_nb}\<close>
 
-lemma non_empty_crypt_msg: "Crypt K Y:parts {X} ==> crypt_nb X \<noteq> 0"
+lemma non_empty_crypt_msg: "Crypt K Y \<in> parts {X} \<Longrightarrow> crypt_nb X \<noteq> 0"
 by (induct X, simp_all, safe, simp_all)
 
 subsection\<open>number of Crypt's in a message list\<close>
@@ -200,16 +200,16 @@
 apply (induct l, auto)
 by (erule_tac l=l and x=x in mem_cnb_minus_substI, simp)
 
-lemma parts_cnb: "Z:parts (set l) ==>
+lemma parts_cnb: "Z \<in> parts (set l) \<Longrightarrow>
 cnb l = (cnb l - crypt_nb Z) + crypt_nb Z"
 by (erule parts.induct, auto simp: in_set_conv_decomp)
 
-lemma non_empty_crypt: "Crypt K Y:parts (set l) ==> cnb l \<noteq> 0"
+lemma non_empty_crypt: "Crypt K Y \<in> parts (set l) \<Longrightarrow> cnb l \<noteq> 0"
 by (induct l, auto dest: non_empty_crypt_msg parts_insert_substD)
 
 subsection\<open>list of kparts\<close>
 
-lemma kparts_msg_set: "EX l. kparts {X} = set l & cnb l = crypt_nb X"
+lemma kparts_msg_set: "\<exists>l. kparts {X} = set l \<and> cnb l = crypt_nb X"
 apply (induct X, simp_all)
 apply (rename_tac agent, rule_tac x="[Agent agent]" in exI, simp)
 apply (rename_tac nat, rule_tac x="[Number nat]" in exI, simp)
@@ -219,11 +219,11 @@
 apply (clarify, rule_tac x="l@la" in exI, simp)
 by (clarify, rename_tac nat X y, rule_tac x="[Crypt nat X]" in exI, simp)
 
-lemma kparts_set: "EX l'. kparts (set l) = set l' & cnb l' = cnb l"
+lemma kparts_set: "\<exists>l'. kparts (set l) = set l' & cnb l' = cnb l"
 apply (induct l)
 apply (rule_tac x="[]" in exI, simp, clarsimp)
 apply (rename_tac a b l')
-apply (subgoal_tac "EX l''.  kparts {a} = set l'' & cnb l'' = crypt_nb a", clarify)
+apply (subgoal_tac "\<exists>l''.  kparts {a} = set l'' & cnb l'' = crypt_nb a", clarify)
 apply (rule_tac x="l''@l'" in exI, simp)
 apply (rule kparts_insert_substI, simp)
 by (rule kparts_msg_set)
@@ -243,28 +243,28 @@
 text\<open>if the analysis of a finite guarded set gives n then it must also give
 one of the keys of Ks\<close>
 
-lemma GuardK_invKey_by_list [rule_format]: "ALL l. cnb l = p
---> GuardK n Ks (set l) --> Key n:analz (set l)
---> (EX K. K:Ks & Key K:analz (set l))"
+lemma GuardK_invKey_by_list [rule_format]: "\<forall>l. cnb l = p
+\<longrightarrow> GuardK n Ks (set l) \<longrightarrow> Key n \<in> analz (set l)
+\<longrightarrow> (\<exists>K. K \<in> Ks \<and> Key K \<in> analz (set l))"
 apply (induct p)
 (* case p=0 *)
 apply (clarify, drule GuardK_must_decrypt, simp, clarify)
 apply (drule kparts_parts, drule non_empty_crypt, simp)
 (* case p>0 *)
 apply (clarify, frule GuardK_must_decrypt, simp, clarify)
-apply (drule_tac P="%G. Key n:G" in analz_pparts_kparts_substD, simp)
+apply (drule_tac P="\<lambda>G. Key n \<in> G" in analz_pparts_kparts_substD, simp)
 apply (frule analz_decrypt, simp_all)
-apply (subgoal_tac "EX l'. kparts (set l) = set l' & cnb l' = cnb l", clarsimp)
+apply (subgoal_tac "\<exists>l'. kparts (set l) = set l' \<and> cnb l' = cnb l", clarsimp)
 apply (drule_tac G="insert Y (set l' - {Crypt K Y})"
 and H="set (decrypt' l' K Y)" in analz_sub, rule decrypt_minus)
 apply (rule_tac analz_pparts_kparts_substI, simp)
-apply (case_tac "K:invKey`Ks")
+apply (case_tac "K \<in> invKey`Ks")
 (* K:invKey`Ks *)
 apply (clarsimp, blast)
 (* K ~:invKey`Ks *)
 apply (subgoal_tac "GuardK n Ks (set (decrypt' l' K Y))")
 apply (drule_tac x="decrypt' l' K Y" in spec, simp)
-apply (subgoal_tac "Crypt K Y:parts (set l)")
+apply (subgoal_tac "Crypt K Y \<in> parts (set l)")
 apply (drule parts_cnb, rotate_tac -1, simp)
 apply (clarify, drule_tac X="Key Ka" and H="insert Y (set l')" in analz_sub)
 apply (rule insert_mono, rule set_remove)
@@ -280,21 +280,21 @@
 apply (rule_tac B="set l'" in subset_trans, rule set_remove, blast)
 by (rule kparts_set)
 
-lemma GuardK_invKey_finite: "[| Key n:analz G; GuardK n Ks G; finite G |]
-==> EX K. K:Ks & Key K:analz G"
+lemma GuardK_invKey_finite: "[| Key n \<in> analz G; GuardK n Ks G; finite G |]
+==> \<exists>K. K \<in> Ks \<and> Key K \<in> analz G"
 apply (drule finite_list, clarify)
 by (rule GuardK_invKey_by_list, auto)
 
-lemma GuardK_invKey: "[| Key n:analz G; GuardK n Ks G |]
-==> EX K. K:Ks & Key K:analz G"
+lemma GuardK_invKey: "[| Key n \<in> analz G; GuardK n Ks G |]
+==> \<exists>K. K \<in> Ks \<and> Key K \<in> analz G"
 by (auto dest: analz_needs_only_finite GuardK_invKey_finite)
 
 text\<open>if the analyse of a finite guarded set and a (possibly infinite) set of
 keys gives n then it must also gives Ks\<close>
 
-lemma GuardK_invKey_keyset: "[| Key n:analz (G Un H); GuardK n Ks G; finite G;
-keyset H; Key n ~:H |] ==> EX K. K:Ks & Key K:analz (G Un H)"
-apply (frule_tac P="%G. Key n:G" and G=G in analz_keyset_substD, simp_all)
+lemma GuardK_invKey_keyset: "[| Key n \<in> analz (G \<union> H); GuardK n Ks G; finite G;
+keyset H; Key n \<notin> H |] ==> \<exists>K. K \<in> Ks \<and> Key K \<in> analz (G \<union> H)"
+apply (frule_tac P="\<lambda>G. Key n \<in> G" and G=G in analz_keyset_substD, simp_all)
 apply (drule_tac G="G Un (H Int keysfor G)" in GuardK_invKey_finite)
 apply (auto simp: GuardK_def intro: analz_sub)
 by (drule keyset_in, auto)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Guard_NS_Public.thy
--- a/src/HOL/Auth/Guard/Guard_NS_Public.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Guard_NS_Public.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -37,17 +37,17 @@
 inductive_set nsp :: "event list set"
 where
 
-  Nil: "[]:nsp"
+  Nil: "[] \<in> nsp"
 
-| Fake: "[| evs:nsp; X:synth (analz (spies evs)) |] ==> Says Spy B X # evs : nsp"
+| Fake: "[| evs \<in> nsp; X \<in> synth (analz (spies evs)) |] ==> Says Spy B X # evs \<in> nsp"
 
-| NS1: "[| evs1:nsp; Nonce NA ~:used evs1 |] ==> ns1 A B NA # evs1 : nsp"
+| NS1: "[| evs1 \<in> nsp; Nonce NA \<notin> used evs1 |] ==> ns1 A B NA # evs1 \<in> nsp"
 
-| NS2: "[| evs2:nsp; Nonce NB ~:used evs2; ns1' A' A B NA:set evs2 |] ==>
-  ns2 B A NA NB # evs2:nsp"
+| NS2: "[| evs2 \<in> nsp; Nonce NB \<notin> used evs2; ns1' A' A B NA \<in> set evs2 |] ==>
+  ns2 B A NA NB # evs2 \<in> nsp"
 
-| NS3: "!!A B B' NA NB evs3. [| evs3:nsp; ns1 A B NA:set evs3; ns2' B' B A NA NB:set evs3 |] ==>
-  ns3 A B NB # evs3:nsp"
+| NS3: "\<And>A B B' NA NB evs3. [| evs3 \<in> nsp; ns1 A B NA \<in> set evs3; ns2' B' B A NA NB \<in> set evs3 |] ==>
+  ns3 A B NB # evs3 \<in> nsp"
 
 subsection\<open>declarations for tactics\<close>
 
@@ -57,17 +57,17 @@
 
 subsection\<open>general properties of nsp\<close>
 
-lemma nsp_has_no_Gets: "evs:nsp ==> ALL A X. Gets A X ~:set evs"
+lemma nsp_has_no_Gets: "evs \<in> nsp \<Longrightarrow> \<forall>A X. Gets A X \<notin> set evs"
 by (erule nsp.induct, auto)
 
 lemma nsp_is_Gets_correct [iff]: "Gets_correct nsp"
 by (auto simp: Gets_correct_def dest: nsp_has_no_Gets)
 
 lemma nsp_is_one_step [iff]: "one_step nsp"
-by (unfold one_step_def, clarify, ind_cases "ev#evs:nsp" for ev evs, auto)
+by (unfold one_step_def, clarify, ind_cases "ev#evs \<in> nsp" for ev evs, auto)
 
-lemma nsp_has_only_Says' [rule_format]: "evs:nsp ==>
-ev:set evs --> (EX A B X. ev=Says A B X)"
+lemma nsp_has_only_Says' [rule_format]: "evs \<in> nsp \<Longrightarrow>
+ev \<in> set evs \<longrightarrow> (\<exists>A B X. ev=Says A B X)"
 by (erule nsp.induct, auto)
 
 lemma nsp_has_only_Says [iff]: "has_only_Says nsp"
@@ -79,37 +79,37 @@
 
 subsection\<open>nonce are used only once\<close>
 
-lemma NA_is_uniq [rule_format]: "evs:nsp ==>
-Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>:parts (spies evs)
---> Crypt (pubK B') \<lbrace>Nonce NA, Agent A'\<rbrace>:parts (spies evs)
---> Nonce NA ~:analz (spies evs) --> A=A' & B=B'"
+lemma NA_is_uniq [rule_format]: "evs \<in> nsp \<Longrightarrow>
+Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Crypt (pubK B') \<lbrace>Nonce NA, Agent A'\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Nonce NA \<notin> analz (spies evs) \<longrightarrow> A=A' \<and> B=B'"
 apply (erule nsp.induct, simp_all)
 by (blast intro: analz_insertI)+
 
-lemma no_Nonce_NS1_NS2 [rule_format]: "evs:nsp ==>
-Crypt (pubK B') \<lbrace>Nonce NA', Nonce NA, Agent A'\<rbrace>:parts (spies evs)
---> Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>:parts (spies evs)
---> Nonce NA:analz (spies evs)"
+lemma no_Nonce_NS1_NS2 [rule_format]: "evs \<in> nsp \<Longrightarrow>
+Crypt (pubK B') \<lbrace>Nonce NA', Nonce NA, Agent A'\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Nonce NA \<in> analz (spies evs)"
 apply (erule nsp.induct, simp_all)
 by (blast intro: analz_insertI)+
 
 lemma no_Nonce_NS1_NS2' [rule_format]:
-"[| Crypt (pubK B') \<lbrace>Nonce NA', Nonce NA, Agent A'\<rbrace>:parts (spies evs);
-Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>:parts (spies evs); evs:nsp |]
-==> Nonce NA:analz (spies evs)"
+"[| Crypt (pubK B') \<lbrace>Nonce NA', Nonce NA, Agent A'\<rbrace> \<in> parts (spies evs);
+Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace> \<in> parts (spies evs); evs \<in> nsp |]
+==> Nonce NA \<in> analz (spies evs)"
 by (rule no_Nonce_NS1_NS2, auto)
  
-lemma NB_is_uniq [rule_format]: "evs:nsp ==>
-Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>:parts (spies evs)
---> Crypt (pubK A') \<lbrace>Nonce NA', Nonce NB, Agent B'\<rbrace>:parts (spies evs)
---> Nonce NB ~:analz (spies evs) --> A=A' & B=B' & NA=NA'"
+lemma NB_is_uniq [rule_format]: "evs \<in> nsp \<Longrightarrow>
+Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Crypt (pubK A') \<lbrace>Nonce NA', Nonce NB, Agent B'\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Nonce NB \<notin> analz (spies evs) \<longrightarrow> A=A' \<and> B=B' \<and> NA=NA'"
 apply (erule nsp.induct, simp_all)
 by (blast intro: analz_insertI)+
 
 subsection\<open>guardedness of NA\<close>
 
-lemma ns1_imp_Guard [rule_format]: "[| evs:nsp; A ~:bad; B ~:bad |] ==>
-ns1 A B NA:set evs --> Guard NA {priK A,priK B} (spies evs)"
+lemma ns1_imp_Guard [rule_format]: "[| evs \<in> nsp; A \<notin> bad; B \<notin> bad |] ==>
+ns1 A B NA \<in> set evs \<longrightarrow> Guard NA {priK A,priK B} (spies evs)"
 apply (erule nsp.induct)
 (* Nil *)
 apply simp_all
@@ -135,8 +135,8 @@
 
 subsection\<open>guardedness of NB\<close>
 
-lemma ns2_imp_Guard [rule_format]: "[| evs:nsp; A ~:bad; B ~:bad |] ==>
-ns2 B A NA NB:set evs --> Guard NB {priK A,priK B} (spies evs)" 
+lemma ns2_imp_Guard [rule_format]: "[| evs \<in> nsp; A \<notin> bad; B \<notin> bad |] ==>
+ns2 B A NA NB \<in> set evs \<longrightarrow> Guard NB {priK A,priK B} (spies evs)" 
 apply (erule nsp.induct)
 (* Nil *)
 apply simp_all
@@ -165,15 +165,15 @@
 
 subsection\<open>Agents' Authentication\<close>
 
-lemma B_trusts_NS1: "[| evs:nsp; A ~:bad; B ~:bad |] ==>
-Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>:parts (spies evs)
---> Nonce NA ~:analz (spies evs) --> ns1 A B NA:set evs"
+lemma B_trusts_NS1: "[| evs \<in> nsp; A \<notin> bad; B \<notin> bad |] ==>
+Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Nonce NA \<notin> analz (spies evs) \<longrightarrow> ns1 A B NA \<in> set evs"
 apply (erule nsp.induct, simp_all)
 by (blast intro: analz_insertI)+
 
-lemma A_trusts_NS2: "[| evs:nsp; A ~:bad; B ~:bad |] ==> ns1 A B NA:set evs
---> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>:parts (spies evs)
---> ns2 B A NA NB:set evs"
+lemma A_trusts_NS2: "[| evs \<in> nsp; A \<notin> bad; B \<notin> bad |] ==> ns1 A B NA \<in> set evs
+\<longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> ns2 B A NA NB \<in> set evs"
 apply (erule nsp.induct, simp_all, safe)
 apply (frule_tac B=B in ns1_imp_Guard, simp+)
 apply (drule Guard_Nonce_analz, simp+, blast)
@@ -182,8 +182,8 @@
 apply (frule_tac B=B in ns1_imp_Guard, simp+)
 by (drule Guard_Nonce_analz, simp+, blast+)
 
-lemma B_trusts_NS3: "[| evs:nsp; A ~:bad; B ~:bad |] ==> ns2 B A NA NB:set evs
---> Crypt (pubK B) (Nonce NB):parts (spies evs) --> ns3 A B NB:set evs"
+lemma B_trusts_NS3: "[| evs \<in> nsp; A \<notin> bad; B \<notin> bad |] ==> ns2 B A NA NB \<in> set evs
+\<longrightarrow> Crypt (pubK B) (Nonce NB) \<in> parts (spies evs) \<longrightarrow> ns3 A B NB \<in> set evs"
 apply (erule nsp.induct, simp_all, safe)
 apply (frule_tac B=B in ns2_imp_Guard, simp+)
 apply (drule Guard_Nonce_analz, simp+, blast)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Guard_OtwayRees.thy
--- a/src/HOL/Auth/Guard/Guard_OtwayRees.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Guard_OtwayRees.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -59,20 +59,20 @@
 inductive_set or :: "event list set"
 where
 
-  Nil: "[]:or"
+  Nil: "[] \<in> or"
 
-| Fake: "[| evs:or; X:synth (analz (spies evs)) |] ==> Says Spy B X # evs:or"
+| Fake: "[| evs \<in> or; X \<in> synth (analz (spies evs)) |] ==> Says Spy B X # evs \<in> or"
 
-| OR1: "[| evs1:or; Nonce NA ~:used evs1 |] ==> or1 A B NA # evs1:or"
+| OR1: "[| evs1 \<in> or; Nonce NA \<notin> used evs1 |] ==> or1 A B NA # evs1 \<in> or"
 
-| OR2: "[| evs2:or; or1' A' A B NA X:set evs2; Nonce NB ~:used evs2 |]
-  ==> or2 A B NA NB X # evs2:or"
+| OR2: "[| evs2 \<in> or; or1' A' A B NA X \<in> set evs2; Nonce NB \<notin> used evs2 |]
+  ==> or2 A B NA NB X # evs2 \<in> or"
 
-| OR3: "[| evs3:or; or2' B' A B NA NB:set evs3; Key K ~:used evs3 |]
-  ==> or3 A B NA NB K # evs3:or"
+| OR3: "[| evs3 \<in> or; or2' B' A B NA NB \<in> set evs3; Key K \<notin> used evs3 |]
+  ==> or3 A B NA NB K # evs3 \<in> or"
 
-| OR4: "[| evs4:or; or2 A B NA NB X:set evs4; or3' S Y A B NA NB K:set evs4 |]
-  ==> or4 A B NA X # evs4:or"
+| OR4: "[| evs4 \<in> or; or2 A B NA NB X \<in> set evs4; or3' S Y A B NA NB K \<in> set evs4 |]
+  ==> or4 A B NA X # evs4 \<in> or"
 
 subsection\<open>declarations for tactics\<close>
 
@@ -82,17 +82,17 @@
 
 subsection\<open>general properties of or\<close>
 
-lemma or_has_no_Gets: "evs:or ==> ALL A X. Gets A X ~:set evs"
+lemma or_has_no_Gets: "evs \<in> or \<Longrightarrow> \<forall>A X. Gets A X \<notin> set evs"
 by (erule or.induct, auto)
 
 lemma or_is_Gets_correct [iff]: "Gets_correct or"
 by (auto simp: Gets_correct_def dest: or_has_no_Gets)
 
 lemma or_is_one_step [iff]: "one_step or"
-by (unfold one_step_def, clarify, ind_cases "ev#evs:or" for ev evs, auto)
+by (unfold one_step_def, clarify, ind_cases "ev#evs \<in> or" for ev evs, auto)
 
-lemma or_has_only_Says' [rule_format]: "evs:or ==>
-ev:set evs --> (EX A B X. ev=Says A B X)"
+lemma or_has_only_Says' [rule_format]: "evs \<in> or \<Longrightarrow>
+ev \<in> set evs \<longrightarrow> (\<exists>A B X. ev=Says A B X)"
 by (erule or.induct, auto)
 
 lemma or_has_only_Says [iff]: "has_only_Says or"
@@ -100,16 +100,16 @@
 
 subsection\<open>or is regular\<close>
 
-lemma or1'_parts_spies [dest]: "or1' A' A B NA X:set evs
-==> X:parts (spies evs)"
+lemma or1'_parts_spies [dest]: "or1' A' A B NA X \<in> set evs
+\<Longrightarrow> X \<in> parts (spies evs)"
 by blast
 
-lemma or2_parts_spies [dest]: "or2 A B NA NB X:set evs
-==> X:parts (spies evs)"
+lemma or2_parts_spies [dest]: "or2 A B NA NB X \<in> set evs
+\<Longrightarrow> X \<in> parts (spies evs)"
 by blast
 
-lemma or3_parts_spies [dest]: "Says S B \<lbrace>NA, Y, Ciph B \<lbrace>NB, K\<rbrace>\<rbrace>:set evs
-==> K:parts (spies evs)"
+lemma or3_parts_spies [dest]: "Says S B \<lbrace>NA, Y, Ciph B \<lbrace>NB, K\<rbrace>\<rbrace> \<in> set evs
+\<Longrightarrow> K \<in> parts (spies evs)"
 by blast
 
 lemma or_is_regular [iff]: "regular or"
@@ -119,8 +119,8 @@
 
 subsection\<open>guardedness of KAB\<close>
 
-lemma Guard_KAB [rule_format]: "[| evs:or; A ~:bad; B ~:bad |] ==>
-or3 A B NA NB K:set evs --> GuardK K {shrK A,shrK B} (spies evs)" 
+lemma Guard_KAB [rule_format]: "[| evs \<in> or; A \<notin> bad; B \<notin> bad |] ==>
+or3 A B NA NB K \<in> set evs \<longrightarrow> GuardK K {shrK A,shrK B} (spies evs)" 
 apply (erule or.induct)
 (* Nil *)
 apply simp_all
@@ -140,8 +140,8 @@
 
 subsection\<open>guardedness of NB\<close>
 
-lemma Guard_NB [rule_format]: "[| evs:or; B ~:bad |] ==>
-or2 A B NA NB X:set evs --> Guard NB {shrK B} (spies evs)" 
+lemma Guard_NB [rule_format]: "[| evs \<in> or; B \<notin> bad |] ==>
+or2 A B NA NB X \<in> set evs \<longrightarrow> Guard NB {shrK B} (spies evs)" 
 apply (erule or.induct)
 (* Nil *)
 apply simp_all
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Guard_Public.thy
--- a/src/HOL/Auth/Guard/Guard_Public.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Guard_Public.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -22,7 +22,7 @@
 subsubsection\<open>agent associated to a key\<close>
 
 definition agt :: "key => agent" where
-"agt K == @A. K = priK A | K = pubK A"
+"agt K == SOME A. K = priK A | K = pubK A"
 
 lemma agt_priK [simp]: "agt (priK A) = A"
 by (simp add: agt_def)
@@ -32,18 +32,18 @@
 
 subsubsection\<open>basic facts about @{term initState}\<close>
 
-lemma no_Crypt_in_parts_init [simp]: "Crypt K X ~:parts (initState A)"
+lemma no_Crypt_in_parts_init [simp]: "Crypt K X \<notin> parts (initState A)"
 by (cases A, auto simp: initState.simps)
 
-lemma no_Crypt_in_analz_init [simp]: "Crypt K X ~:analz (initState A)"
+lemma no_Crypt_in_analz_init [simp]: "Crypt K X \<notin> analz (initState A)"
 by auto
 
-lemma no_priK_in_analz_init [simp]: "A ~:bad
-==> Key (priK A) ~:analz (initState Spy)"
+lemma no_priK_in_analz_init [simp]: "A \<notin> bad
+\<Longrightarrow> Key (priK A) \<notin> analz (initState Spy)"
 by (auto simp: initState.simps)
 
-lemma priK_notin_initState_Friend [simp]: "A ~= Friend C
-==> Key (priK A) ~: parts (initState (Friend C))"
+lemma priK_notin_initState_Friend [simp]: "A \<noteq> Friend C
+\<Longrightarrow> Key (priK A) \<notin> parts (initState (Friend C))"
 by (auto simp: initState.simps)
 
 lemma keyset_init [iff]: "keyset (initState A)"
@@ -52,9 +52,9 @@
 subsubsection\<open>sets of private keys\<close>
 
 definition priK_set :: "key set => bool" where
-"priK_set Ks == ALL K. K:Ks --> (EX A. K = priK A)"
+"priK_set Ks \<equiv> \<forall>K. K \<in> Ks \<longrightarrow> (\<exists>A. K = priK A)"
 
-lemma in_priK_set: "[| priK_set Ks; K:Ks |] ==> EX A. K = priK A"
+lemma in_priK_set: "[| priK_set Ks; K \<in> Ks |] ==> \<exists>A. K = priK A"
 by (simp add: priK_set_def)
 
 lemma priK_set1 [iff]: "priK_set {priK A}"
@@ -66,15 +66,15 @@
 subsubsection\<open>sets of good keys\<close>
 
 definition good :: "key set => bool" where
-"good Ks == ALL K. K:Ks --> agt K ~:bad"
+"good Ks == \<forall>K. K \<in> Ks \<longrightarrow> agt K \<notin> bad"
 
-lemma in_good: "[| good Ks; K:Ks |] ==> agt K ~:bad"
+lemma in_good: "[| good Ks; K \<in> Ks |] ==> agt K \<notin> bad"
 by (simp add: good_def)
 
-lemma good1 [simp]: "A ~:bad ==> good {priK A}"
+lemma good1 [simp]: "A \<notin> bad \<Longrightarrow> good {priK A}"
 by (simp add: good_def)
 
-lemma good2 [simp]: "[| A ~:bad; B ~:bad |] ==> good {priK A, priK B}"
+lemma good2 [simp]: "[| A \<notin> bad; B \<notin> bad |] ==> good {priK A, priK B}"
 by (simp add: good_def)
 
 subsubsection\<open>greatest nonce used in a trace, 0 if there is no nonce\<close>
@@ -84,7 +84,7 @@
   "greatest [] = 0"
 | "greatest (ev # evs) = max (greatest_msg (msg ev)) (greatest evs)"
 
-lemma greatest_is_greatest: "Nonce n:used evs ==> n <= greatest evs"
+lemma greatest_is_greatest: "Nonce n \<in> used evs \<Longrightarrow> n \<le> greatest evs"
 apply (induct evs, auto simp: initState.simps)
 apply (drule used_sub_parts_used, safe)
 apply (drule greatest_msg_is_greatest, arith)
@@ -92,10 +92,10 @@
 
 subsubsection\<open>function giving a new nonce\<close>
 
-definition new :: "event list => nat" where
-"new evs == Suc (greatest evs)"
+definition new :: "event list \<Rightarrow> nat" where
+"new evs \<equiv> Suc (greatest evs)"
 
-lemma new_isnt_used [iff]: "Nonce (new evs) ~:used evs"
+lemma new_isnt_used [iff]: "Nonce (new evs) \<notin> used evs"
 by (clarify, drule greatest_is_greatest, auto simp: new_def)
 
 subsection\<open>Proofs About Guarded Messages\<close>
@@ -109,13 +109,13 @@
 
 lemmas invKey_invKey_substI = invKey [THEN ssubst]
 
-lemma "Nonce n:parts {X} ==> Crypt (pubK A) X:guard n {priK A}"
+lemma "Nonce n \<in> parts {X} \<Longrightarrow> Crypt (pubK A) X \<in> guard n {priK A}"
 apply (rule pubK_is_invKey_priK_substI, rule invKey_invKey_substI)
 by (rule Guard_Nonce, simp+)
 
 subsubsection\<open>guardedness results\<close>
 
-lemma sign_guard [intro]: "X:guard n Ks ==> sign A X:guard n Ks"
+lemma sign_guard [intro]: "X \<in> guard n Ks \<Longrightarrow> sign A X \<in> guard n Ks"
 by (auto simp: sign_def)
 
 lemma Guard_init [iff]: "Guard n Ks (initState B)"
@@ -125,38 +125,38 @@
 ==> Guard n Ks (knows_max C evs)"
 by (simp add: knows_max_def)
 
-lemma Nonce_not_used_Guard_spies [dest]: "Nonce n ~:used evs
-==> Guard n Ks (spies evs)"
+lemma Nonce_not_used_Guard_spies [dest]: "Nonce n \<notin> used evs
+\<Longrightarrow> Guard n Ks (spies evs)"
 by (auto simp: Guard_def dest: not_used_not_known parts_sub)
 
-lemma Nonce_not_used_Guard [dest]: "[| evs:p; Nonce n ~:used evs;
+lemma Nonce_not_used_Guard [dest]: "[| evs \<in> p; Nonce n \<notin> used evs;
 Gets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)"
 by (auto simp: Guard_def dest: known_used parts_trans)
 
-lemma Nonce_not_used_Guard_max [dest]: "[| evs:p; Nonce n ~:used evs;
+lemma Nonce_not_used_Guard_max [dest]: "[| evs \<in> p; Nonce n \<notin> used evs;
 Gets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)"
 by (auto simp: Guard_def dest: known_max_used parts_trans)
 
-lemma Nonce_not_used_Guard_max' [dest]: "[| evs:p; Nonce n ~:used evs;
+lemma Nonce_not_used_Guard_max' [dest]: "[| evs \<in> p; Nonce n \<notin> used evs;
 Gets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)"
 apply (rule_tac H="knows_max (Friend C) evs" in Guard_mono)
 by (auto simp: knows_max_def)
 
 subsubsection\<open>regular protocols\<close>
 
-definition regular :: "event list set => bool" where
-"regular p == ALL evs A. evs:p --> (Key (priK A):parts (spies evs)) = (A:bad)"
+definition regular :: "event list set \<Rightarrow> bool" where
+"regular p \<equiv> \<forall>evs A. evs \<in> p \<longrightarrow> (Key (priK A) \<in> parts (spies evs)) = (A \<in> bad)"
 
-lemma priK_parts_iff_bad [simp]: "[| evs:p; regular p |] ==>
-(Key (priK A):parts (spies evs)) = (A:bad)"
+lemma priK_parts_iff_bad [simp]: "[| evs \<in> p; regular p |] ==>
+(Key (priK A) \<in> parts (spies evs)) = (A \<in> bad)"
 by (auto simp: regular_def)
 
-lemma priK_analz_iff_bad [simp]: "[| evs:p; regular p |] ==>
-(Key (priK A):analz (spies evs)) = (A:bad)"
+lemma priK_analz_iff_bad [simp]: "[| evs \<in> p; regular p |] ==>
+(Key (priK A) \<in> analz (spies evs)) = (A \<in> bad)"
 by auto
 
-lemma Guard_Nonce_analz: "[| Guard n Ks (spies evs); evs:p;
-priK_set Ks; good Ks; regular p |] ==> Nonce n ~:analz (spies evs)"
+lemma Guard_Nonce_analz: "[| Guard n Ks (spies evs); evs \<in> p;
+priK_set Ks; good Ks; regular p |] ==> Nonce n \<notin> analz (spies evs)"
 apply (clarify, simp only: knows_decomp)
 apply (drule Guard_invKey_keyset, simp+, safe)
 apply (drule in_good, simp)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Guard_Shared.thy
--- a/src/HOL/Auth/Guard/Guard_Shared.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Guard_Shared.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -20,25 +20,25 @@
 subsubsection\<open>agent associated to a key\<close>
 
 definition agt :: "key => agent" where
-"agt K == @A. K = shrK A"
+"agt K == SOME A. K = shrK A"
 
 lemma agt_shrK [simp]: "agt (shrK A) = A"
 by (simp add: agt_def)
 
 subsubsection\<open>basic facts about @{term initState}\<close>
 
-lemma no_Crypt_in_parts_init [simp]: "Crypt K X ~:parts (initState A)"
+lemma no_Crypt_in_parts_init [simp]: "Crypt K X \<notin> parts (initState A)"
 by (cases A, auto simp: initState.simps)
 
-lemma no_Crypt_in_analz_init [simp]: "Crypt K X ~:analz (initState A)"
+lemma no_Crypt_in_analz_init [simp]: "Crypt K X \<notin> analz (initState A)"
 by auto
 
-lemma no_shrK_in_analz_init [simp]: "A ~:bad
-==> Key (shrK A) ~:analz (initState Spy)"
+lemma no_shrK_in_analz_init [simp]: "A \<notin> bad
+\<Longrightarrow> Key (shrK A) \<notin> analz (initState Spy)"
 by (auto simp: initState.simps)
 
-lemma shrK_notin_initState_Friend [simp]: "A ~= Friend C
-==> Key (shrK A) ~: parts (initState (Friend C))"
+lemma shrK_notin_initState_Friend [simp]: "A \<noteq> Friend C
+\<Longrightarrow> Key (shrK A) \<notin> parts (initState (Friend C))"
 by (auto simp: initState.simps)
 
 lemma keyset_init [iff]: "keyset (initState A)"
@@ -47,9 +47,9 @@
 subsubsection\<open>sets of symmetric keys\<close>
 
 definition shrK_set :: "key set => bool" where
-"shrK_set Ks == ALL K. K:Ks --> (EX A. K = shrK A)"
+"shrK_set Ks \<equiv> \<forall>K. K \<in> Ks \<longrightarrow> (\<exists>A. K = shrK A)"
 
-lemma in_shrK_set: "[| shrK_set Ks; K:Ks |] ==> EX A. K = shrK A"
+lemma in_shrK_set: "[| shrK_set Ks; K \<in> Ks |] ==> \<exists>A. K = shrK A"
 by (simp add: shrK_set_def)
 
 lemma shrK_set1 [iff]: "shrK_set {shrK A}"
@@ -60,16 +60,16 @@
 
 subsubsection\<open>sets of good keys\<close>
 
-definition good :: "key set => bool" where
-"good Ks == ALL K. K:Ks --> agt K ~:bad"
+definition good :: "key set \<Rightarrow> bool" where
+"good Ks \<equiv> \<forall>K. K \<in> Ks \<longrightarrow> agt K \<notin> bad"
 
-lemma in_good: "[| good Ks; K:Ks |] ==> agt K ~:bad"
+lemma in_good: "[| good Ks; K \<in> Ks |] ==> agt K \<notin> bad"
 by (simp add: good_def)
 
-lemma good1 [simp]: "A ~:bad ==> good {shrK A}"
+lemma good1 [simp]: "A \<notin> bad \<Longrightarrow> good {shrK A}"
 by (simp add: good_def)
 
-lemma good2 [simp]: "[| A ~:bad; B ~:bad |] ==> good {shrK A, shrK B}"
+lemma good2 [simp]: "[| A \<notin> bad; B \<notin> bad |] ==> good {shrK A, shrK B}"
 by (simp add: good_def)
 
 
@@ -84,16 +84,16 @@
 
 lemmas invKey_invKey_substI = invKey [THEN ssubst]
 
-lemma "Nonce n:parts {X} ==> Crypt (shrK A) X:guard n {shrK A}"
+lemma "Nonce n \<in> parts {X} \<Longrightarrow> Crypt (shrK A) X \<in> guard n {shrK A}"
 apply (rule shrK_is_invKey_shrK_substI, rule invKey_invKey_substI)
 by (rule Guard_Nonce, simp+)
 
 subsubsection\<open>guardedness results on nonces\<close>
 
-lemma guard_ciph [simp]: "shrK A:Ks ==> Ciph A X:guard n Ks"
+lemma guard_ciph [simp]: "shrK A \<in> Ks \<Longrightarrow> Ciph A X \<in> guard n Ks"
 by (rule Guard_Nonce, simp)
 
-lemma guardK_ciph [simp]: "shrK A:Ks ==> Ciph A X:guardK n Ks"
+lemma guardK_ciph [simp]: "shrK A \<in> Ks \<Longrightarrow> Ciph A X \<in> guardK n Ks"
 by (rule Guard_Key, simp)
 
 lemma Guard_init [iff]: "Guard n Ks (initState B)"
@@ -103,45 +103,45 @@
 ==> Guard n Ks (knows_max C evs)"
 by (simp add: knows_max_def)
 
-lemma Nonce_not_used_Guard_spies [dest]: "Nonce n ~:used evs
-==> Guard n Ks (spies evs)"
+lemma Nonce_not_used_Guard_spies [dest]: "Nonce n \<notin> used evs
+\<Longrightarrow> Guard n Ks (spies evs)"
 by (auto simp: Guard_def dest: not_used_not_known parts_sub)
 
-lemma Nonce_not_used_Guard [dest]: "[| evs:p; Nonce n ~:used evs;
+lemma Nonce_not_used_Guard [dest]: "[| evs \<in> p; Nonce n \<notin> used evs;
 Gets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)"
 by (auto simp: Guard_def dest: known_used parts_trans)
 
-lemma Nonce_not_used_Guard_max [dest]: "[| evs:p; Nonce n ~:used evs;
+lemma Nonce_not_used_Guard_max [dest]: "[| evs \<in> p; Nonce n \<notin> used evs;
 Gets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)"
 by (auto simp: Guard_def dest: known_max_used parts_trans)
 
-lemma Nonce_not_used_Guard_max' [dest]: "[| evs:p; Nonce n ~:used evs;
+lemma Nonce_not_used_Guard_max' [dest]: "[| evs \<in> p; Nonce n \<notin> used evs;
 Gets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)"
 apply (rule_tac H="knows_max (Friend C) evs" in Guard_mono)
 by (auto simp: knows_max_def)
 
 subsubsection\<open>guardedness results on keys\<close>
 
-lemma GuardK_init [simp]: "n ~:range shrK ==> GuardK n Ks (initState B)"
+lemma GuardK_init [simp]: "n \<notin> range shrK \<Longrightarrow> GuardK n Ks (initState B)"
 by (induct B, auto simp: GuardK_def initState.simps)
 
-lemma GuardK_knows_max': "[| GuardK n A (knows_max' C evs); n ~:range shrK |]
+lemma GuardK_knows_max': "[| GuardK n A (knows_max' C evs); n \<notin> range shrK |]
 ==> GuardK n A (knows_max C evs)"
 by (simp add: knows_max_def)
 
-lemma Key_not_used_GuardK_spies [dest]: "Key n ~:used evs
-==> GuardK n A (spies evs)"
+lemma Key_not_used_GuardK_spies [dest]: "Key n \<notin> used evs
+\<Longrightarrow> GuardK n A (spies evs)"
 by (auto simp: GuardK_def dest: not_used_not_known parts_sub)
 
-lemma Key_not_used_GuardK [dest]: "[| evs:p; Key n ~:used evs;
+lemma Key_not_used_GuardK [dest]: "[| evs \<in> p; Key n \<notin> used evs;
 Gets_correct p; one_step p |] ==> GuardK n A (knows (Friend C) evs)"
 by (auto simp: GuardK_def dest: known_used parts_trans)
 
-lemma Key_not_used_GuardK_max [dest]: "[| evs:p; Key n ~:used evs;
+lemma Key_not_used_GuardK_max [dest]: "[| evs \<in> p; Key n \<notin> used evs;
 Gets_correct p; one_step p |] ==> GuardK n A (knows_max (Friend C) evs)"
 by (auto simp: GuardK_def dest: known_max_used parts_trans)
 
-lemma Key_not_used_GuardK_max' [dest]: "[| evs:p; Key n ~:used evs;
+lemma Key_not_used_GuardK_max' [dest]: "[| evs \<in> p; Key n \<notin> used evs;
 Gets_correct p; one_step p |] ==> GuardK n A (knows_max' (Friend C) evs)"
 apply (rule_tac H="knows_max (Friend C) evs" in GuardK_mono)
 by (auto simp: knows_max_def)
@@ -149,18 +149,18 @@
 subsubsection\<open>regular protocols\<close>
 
 definition regular :: "event list set => bool" where
-"regular p == ALL evs A. evs:p --> (Key (shrK A):parts (spies evs)) = (A:bad)"
+"regular p \<equiv> \<forall>evs A. evs \<in> p \<longrightarrow> (Key (shrK A) \<in> parts (spies evs)) = (A \<in> bad)"
 
-lemma shrK_parts_iff_bad [simp]: "[| evs:p; regular p |] ==>
-(Key (shrK A):parts (spies evs)) = (A:bad)"
+lemma shrK_parts_iff_bad [simp]: "[| evs \<in> p; regular p |] ==>
+(Key (shrK A) \<in> parts (spies evs)) = (A \<in> bad)"
 by (auto simp: regular_def)
 
-lemma shrK_analz_iff_bad [simp]: "[| evs:p; regular p |] ==>
-(Key (shrK A):analz (spies evs)) = (A:bad)"
+lemma shrK_analz_iff_bad [simp]: "[| evs \<in> p; regular p |] ==>
+(Key (shrK A) \<in> analz (spies evs)) = (A \<in> bad)"
 by auto
 
-lemma Guard_Nonce_analz: "[| Guard n Ks (spies evs); evs:p;
-shrK_set Ks; good Ks; regular p |] ==> Nonce n ~:analz (spies evs)"
+lemma Guard_Nonce_analz: "[| Guard n Ks (spies evs); evs \<in> p;
+shrK_set Ks; good Ks; regular p |] ==> Nonce n \<notin> analz (spies evs)"
 apply (clarify, simp only: knows_decomp)
 apply (drule Guard_invKey_keyset, simp+, safe)
 apply (drule in_good, simp)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Guard_Yahalom.thy
--- a/src/HOL/Auth/Guard/Guard_Yahalom.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Guard_Yahalom.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -50,20 +50,20 @@
 inductive_set ya :: "event list set"
 where
 
-  Nil: "[]:ya"
+  Nil: "[] \<in> ya"
 
-| Fake: "[| evs:ya; X:synth (analz (spies evs)) |] ==> Says Spy B X # evs:ya"
+| Fake: "[| evs \<in> ya; X \<in> synth (analz (spies evs)) |] ==> Says Spy B X # evs \<in> ya"
 
-| YA1: "[| evs1:ya; Nonce NA ~:used evs1 |] ==> ya1 A B NA # evs1:ya"
+| YA1: "[| evs1 \<in> ya; Nonce NA \<notin> used evs1 |] ==> ya1 A B NA # evs1 \<in> ya"
 
-| YA2: "[| evs2:ya; ya1' A' A B NA:set evs2; Nonce NB ~:used evs2 |]
-  ==> ya2 A B NA NB # evs2:ya"
+| YA2: "[| evs2 \<in> ya; ya1' A' A B NA \<in> set evs2; Nonce NB \<notin> used evs2 |]
+  ==> ya2 A B NA NB # evs2 \<in> ya"
 
-| YA3: "[| evs3:ya; ya2' B' A B NA NB:set evs3; Key K ~:used evs3 |]
-  ==> ya3 A B NA NB K # evs3:ya"
+| YA3: "[| evs3 \<in> ya; ya2' B' A B NA NB \<in> set evs3; Key K \<notin> used evs3 |]
+  ==> ya3 A B NA NB K # evs3 \<in> ya"
 
-| YA4: "[| evs4:ya; ya1 A B NA:set evs4; ya3' S Y A B NA NB K:set evs4 |]
-  ==> ya4 A B K NB Y # evs4:ya"
+| YA4: "[| evs4 \<in> ya; ya1 A B NA \<in> set evs4; ya3' S Y A B NA NB K \<in> set evs4 |]
+  ==> ya4 A B K NB Y # evs4 \<in> ya"
 
 subsection\<open>declarations for tactics\<close>
 
@@ -73,17 +73,17 @@
 
 subsection\<open>general properties of ya\<close>
 
-lemma ya_has_no_Gets: "evs:ya ==> ALL A X. Gets A X ~:set evs"
+lemma ya_has_no_Gets: "evs \<in> ya \<Longrightarrow> \<forall>A X. Gets A X \<notin> set evs"
 by (erule ya.induct, auto)
 
 lemma ya_is_Gets_correct [iff]: "Gets_correct ya"
 by (auto simp: Gets_correct_def dest: ya_has_no_Gets)
 
 lemma ya_is_one_step [iff]: "one_step ya"
-by (unfold one_step_def, clarify, ind_cases "ev#evs:ya" for ev evs, auto)
+by (unfold one_step_def, clarify, ind_cases "ev#evs \<in> ya" for ev evs, auto)
 
-lemma ya_has_only_Says' [rule_format]: "evs:ya ==>
-ev:set evs --> (EX A B X. ev=Says A B X)"
+lemma ya_has_only_Says' [rule_format]: "evs \<in> ya \<Longrightarrow>
+ev \<in> set evs \<longrightarrow> (\<exists>A B X. ev=Says A B X)"
 by (erule ya.induct, auto)
 
 lemma ya_has_only_Says [iff]: "has_only_Says ya"
@@ -96,8 +96,8 @@
 
 subsection\<open>guardedness of KAB\<close>
 
-lemma Guard_KAB [rule_format]: "[| evs:ya; A ~:bad; B ~:bad |] ==>
-ya3 A B NA NB K:set evs --> GuardK K {shrK A,shrK B} (spies evs)" 
+lemma Guard_KAB [rule_format]: "[| evs \<in> ya; A \<notin> bad; B \<notin> bad |] ==>
+ya3 A B NA NB K \<in> set evs \<longrightarrow> GuardK K {shrK A,shrK B} (spies evs)" 
 apply (erule ya.induct)
 (* Nil *)
 apply simp_all
@@ -117,55 +117,55 @@
 
 subsection\<open>session keys are not symmetric keys\<close>
 
-lemma KAB_isnt_shrK [rule_format]: "evs:ya ==>
-ya3 A B NA NB K:set evs --> K ~:range shrK"
+lemma KAB_isnt_shrK [rule_format]: "evs \<in> ya \<Longrightarrow>
+ya3 A B NA NB K \<in> set evs \<longrightarrow> K \<notin> range shrK"
 by (erule ya.induct, auto)
 
-lemma ya3_shrK: "evs:ya ==> ya3 A B NA NB (shrK C) ~:set evs"
+lemma ya3_shrK: "evs \<in> ya \<Longrightarrow> ya3 A B NA NB (shrK C) \<notin> set evs"
 by (blast dest: KAB_isnt_shrK)
 
 subsection\<open>ya2' implies ya1'\<close>
 
 lemma ya2'_parts_imp_ya1'_parts [rule_format]:
-     "[| evs:ya; B ~:bad |] ==>
-      Ciph B \<lbrace>Agent A, Nonce NA, Nonce NB\<rbrace>:parts (spies evs) -->
-      \<lbrace>Agent A, Nonce NA\<rbrace>:spies evs"
+     "[| evs \<in> ya; B \<notin> bad |] ==>
+      Ciph B \<lbrace>Agent A, Nonce NA, Nonce NB\<rbrace> \<in> parts (spies evs) \<longrightarrow>
+      \<lbrace>Agent A, Nonce NA\<rbrace> \<in> spies evs"
 by (erule ya.induct, auto dest: Says_imp_spies intro: parts_parts)
 
-lemma ya2'_imp_ya1'_parts: "[| ya2' B' A B NA NB:set evs; evs:ya; B ~:bad |]
-==> \<lbrace>Agent A, Nonce NA\<rbrace>:spies evs"
+lemma ya2'_imp_ya1'_parts: "[| ya2' B' A B NA NB \<in> set evs; evs \<in> ya; B \<notin> bad |]
+==> \<lbrace>Agent A, Nonce NA\<rbrace> \<in> spies evs"
 by (blast dest: Says_imp_spies ya2'_parts_imp_ya1'_parts)
 
 subsection\<open>uniqueness of NB\<close>
 
-lemma NB_is_uniq_in_ya2'_parts [rule_format]: "[| evs:ya; B ~:bad; B' ~:bad |] ==>
-Ciph B \<lbrace>Agent A, Nonce NA, Nonce NB\<rbrace>:parts (spies evs) -->
-Ciph B' \<lbrace>Agent A', Nonce NA', Nonce NB\<rbrace>:parts (spies evs) -->
-A=A' & B=B' & NA=NA'"
+lemma NB_is_uniq_in_ya2'_parts [rule_format]: "[| evs \<in> ya; B \<notin> bad; B' \<notin> bad |] ==>
+Ciph B \<lbrace>Agent A, Nonce NA, Nonce NB\<rbrace> \<in> parts (spies evs) \<longrightarrow>
+Ciph B' \<lbrace>Agent A', Nonce NA', Nonce NB\<rbrace> \<in> parts (spies evs) \<longrightarrow>
+A=A' \<and> B=B' \<and> NA=NA'"
 apply (erule ya.induct, simp_all, clarify)
 apply (drule Crypt_synth_insert, simp+)
 apply (drule Crypt_synth_insert, simp+, safe)
 apply (drule not_used_parts_false, simp+)+
 by (drule Says_not_parts, simp+)+
 
-lemma NB_is_uniq_in_ya2': "[| ya2' C A B NA NB:set evs;
-ya2' C' A' B' NA' NB:set evs; evs:ya; B ~:bad; B' ~:bad |]
-==> A=A' & B=B' & NA=NA'"
+lemma NB_is_uniq_in_ya2': "[| ya2' C A B NA NB \<in> set evs;
+ya2' C' A' B' NA' NB \<in> set evs; evs \<in> ya; B \<notin> bad; B' \<notin> bad |]
+==> A=A' \<and> B=B' \<and> NA=NA'"
 by (drule NB_is_uniq_in_ya2'_parts, auto dest: Says_imp_spies)
 
 subsection\<open>ya3' implies ya2'\<close>
 
-lemma ya3'_parts_imp_ya2'_parts [rule_format]: "[| evs:ya; A ~:bad |] ==>
-Ciph A \<lbrace>Agent B, Key K, Nonce NA, Nonce NB\<rbrace>:parts (spies evs)
---> Ciph B \<lbrace>Agent A, Nonce NA, Nonce NB\<rbrace>:parts (spies evs)"
+lemma ya3'_parts_imp_ya2'_parts [rule_format]: "[| evs \<in> ya; A \<notin> bad |] ==>
+Ciph A \<lbrace>Agent B, Key K, Nonce NA, Nonce NB\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> Ciph B \<lbrace>Agent A, Nonce NA, Nonce NB\<rbrace> \<in> parts (spies evs)"
 apply (erule ya.induct, simp_all)
 apply (clarify, drule Crypt_synth_insert, simp+)
 apply (blast intro: parts_sub, blast)
 by (auto dest: Says_imp_spies parts_parts)
 
-lemma ya3'_parts_imp_ya2' [rule_format]: "[| evs:ya; A ~:bad |] ==>
-Ciph A \<lbrace>Agent B, Key K, Nonce NA, Nonce NB\<rbrace>:parts (spies evs)
---> (EX B'. ya2' B' A B NA NB:set evs)"
+lemma ya3'_parts_imp_ya2' [rule_format]: "[| evs \<in> ya; A \<notin> bad |] ==>
+Ciph A \<lbrace>Agent B, Key K, Nonce NA, Nonce NB\<rbrace> \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B'. ya2' B' A B NA NB \<in> set evs)"
 apply (erule ya.induct, simp_all, safe)
 apply (drule Crypt_synth_insert, simp+)
 apply (drule Crypt_synth_insert, simp+, blast)
@@ -173,30 +173,30 @@
 apply blast
 by (auto dest: Says_imp_spies2 parts_parts)
 
-lemma ya3'_imp_ya2': "[| ya3' S Y A B NA NB K:set evs; evs:ya; A ~:bad |]
-==> (EX B'. ya2' B' A B NA NB:set evs)"
+lemma ya3'_imp_ya2': "[| ya3' S Y A B NA NB K \<in> set evs; evs \<in> ya; A \<notin> bad |]
+==> (\<exists>B'. ya2' B' A B NA NB \<in> set evs)"
 by (drule ya3'_parts_imp_ya2', auto dest: Says_imp_spies)
 
 subsection\<open>ya3' implies ya3\<close>
 
-lemma ya3'_parts_imp_ya3 [rule_format]: "[| evs:ya; A ~:bad |] ==>
-Ciph A \<lbrace>Agent B, Key K, Nonce NA, Nonce NB\<rbrace>:parts(spies evs)
---> ya3 A B NA NB K:set evs"
+lemma ya3'_parts_imp_ya3 [rule_format]: "[| evs \<in> ya; A \<notin> bad |] ==>
+Ciph A \<lbrace>Agent B, Key K, Nonce NA, Nonce NB\<rbrace> \<in> parts(spies evs)
+\<longrightarrow> ya3 A B NA NB K \<in> set evs"
 apply (erule ya.induct, simp_all, safe)
 apply (drule Crypt_synth_insert, simp+)
 by (blast dest: Says_imp_spies2 parts_parts)
 
-lemma ya3'_imp_ya3: "[| ya3' S Y A B NA NB K:set evs; evs:ya; A ~:bad |]
-==> ya3 A B NA NB K:set evs"
+lemma ya3'_imp_ya3: "[| ya3' S Y A B NA NB K \<in> set evs; evs \<in> ya; A \<notin> bad |]
+==> ya3 A B NA NB K \<in> set evs"
 by (blast dest: Says_imp_spies ya3'_parts_imp_ya3)
 
 subsection\<open>guardedness of NB\<close>
 
-definition ya_keys :: "agent => agent => nat => nat => event list => key set" where
-"ya_keys A B NA NB evs == {shrK A,shrK B} Un {K. ya3 A B NA NB K:set evs}"
+definition ya_keys :: "agent \<Rightarrow> agent \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> event list \<Rightarrow> key set" where
+"ya_keys A B NA NB evs \<equiv> {shrK A,shrK B} \<union> {K. ya3 A B NA NB K \<in> set evs}"
 
-lemma Guard_NB [rule_format]: "[| evs:ya; A ~:bad; B ~:bad |] ==>
-ya2 A B NA NB:set evs --> Guard NB (ya_keys A B NA NB evs) (spies evs)"
+lemma Guard_NB [rule_format]: "[| evs \<in> ya; A \<notin> bad; B \<notin> bad |] ==>
+ya2 A B NA NB \<in> set evs \<longrightarrow> Guard NB (ya_keys A B NA NB evs) (spies evs)"
 apply (erule ya.induct)
 (* Nil *)
 apply (simp_all add: ya_keys_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/List_Msg.thy
--- a/src/HOL/Auth/Guard/List_Msg.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/List_Msg.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -37,7 +37,7 @@
 "len (cons x l) = Suc (len l)" |
 "len other = 0"
 
-lemma len_not_empty: "n < len l ==> EX x l'. l = cons x l'"
+lemma len_not_empty: "n < len l \<Longrightarrow> \<exists>x l'. l = cons x l'"
 by (cases l) auto
 
 subsubsection\<open>membership\<close>
@@ -113,36 +113,36 @@
 
 inductive_set agl :: "msg set"
 where
-  Nil[intro]: "nil:agl"
-| Cons[intro]: "[| A:agent; I:agl |] ==> cons (Agent A) I :agl"
+  Nil[intro]: "nil \<in> agl"
+| Cons[intro]: "[| A \<in> agent; I \<in> agl |] ==> cons (Agent A) I \<in> agl"
 
 subsubsection\<open>basic facts about agent lists\<close>
 
-lemma del_in_agl [intro]: "I:agl ==> del (a,I):agl"
+lemma del_in_agl [intro]: "I \<in> agl \<Longrightarrow> del (a,I) \<in> agl"
 by (erule agl.induct, auto)
 
-lemma app_in_agl [intro]: "[| I:agl; J:agl |] ==> app (I,J):agl"
+lemma app_in_agl [intro]: "[| I \<in> agl; J \<in> agl |] ==> app (I,J) \<in> agl"
 by (erule agl.induct, auto)
 
-lemma no_Key_in_agl: "I:agl ==> Key K ~:parts {I}"
+lemma no_Key_in_agl: "I \<in> agl \<Longrightarrow> Key K \<notin> parts {I}"
 by (erule agl.induct, auto)
 
-lemma no_Nonce_in_agl: "I:agl ==> Nonce n ~:parts {I}"
+lemma no_Nonce_in_agl: "I \<in> agl \<Longrightarrow> Nonce n \<notin> parts {I}"
 by (erule agl.induct, auto)
 
-lemma no_Key_in_appdel: "[| I:agl; J:agl |] ==>
-Key K ~:parts {app (J, del (Agent B, I))}"
+lemma no_Key_in_appdel: "[| I \<in> agl; J \<in> agl |] ==>
+Key K \<notin> parts {app (J, del (Agent B, I))}"
 by (rule no_Key_in_agl, auto)
 
-lemma no_Nonce_in_appdel: "[| I:agl; J:agl |] ==>
-Nonce n ~:parts {app (J, del (Agent B, I))}"
+lemma no_Nonce_in_appdel: "[| I \<in> agl; J \<in> agl |] ==>
+Nonce n \<notin> parts {app (J, del (Agent B, I))}"
 by (rule no_Nonce_in_agl, auto)
 
-lemma no_Crypt_in_agl: "I:agl ==> Crypt K X ~:parts {I}"
+lemma no_Crypt_in_agl: "I \<in> agl \<Longrightarrow> Crypt K X \<notin> parts {I}"
 by (erule agl.induct, auto)
 
-lemma no_Crypt_in_appdel: "[| I:agl; J:agl |] ==>
-Crypt K X ~:parts {app (J, del (Agent B,I))}"
+lemma no_Crypt_in_appdel: "[| I \<in> agl; J \<in> agl |] ==>
+Crypt K X \<notin> parts {app (J, del (Agent B,I))}"
 by (rule no_Crypt_in_agl, auto)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/P1.thy
--- a/src/HOL/Auth/Guard/P1.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/P1.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -45,7 +45,7 @@
 = (B=B' & ofr=ofr' & A=A' & head L = head L' & C=C')"
 by (auto simp: chain_def Let_def)
 
-lemma Nonce_in_chain [iff]: "Nonce ofr:parts {chain B ofr A L C}"
+lemma Nonce_in_chain [iff]: "Nonce ofr \<in> parts {chain B ofr A L C}"
 by (auto simp: chain_def sign_def)
 
 subsubsection\<open>agent whose key is used to sign an offer\<close>
@@ -81,7 +81,7 @@
 = (A=A' & n=n' & B=B')"
 by (auto simp: anchor_def)
 
-lemma Nonce_in_anchor [iff]: "Nonce n:parts {anchor A n B}"
+lemma Nonce_in_anchor [iff]: "Nonce n \<in> parts {anchor A n B}"
 by (auto simp: anchor_def)
 
 lemma shop_anchor [simp]: "shop (anchor A n B) = Agent A"
@@ -103,7 +103,7 @@
 = (A=A' & r=r' & n=n' & I=I' & B=B')"
 by (auto simp: reqm_def)
 
-lemma Nonce_in_reqm [iff]: "Nonce n:parts {reqm A r n I B}"
+lemma Nonce_in_reqm [iff]: "Nonce n \<in> parts {reqm A r n I B}"
 by (auto simp: reqm_def)
 
 definition req :: "agent => nat => nat => msg => agent => event" where
@@ -125,7 +125,7 @@
 ==> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'"
 by (auto simp: prom_def)
 
-lemma Nonce_in_prom [iff]: "Nonce ofr:parts {prom B ofr A r I L J C}"
+lemma Nonce_in_prom [iff]: "Nonce ofr \<in> parts {prom B ofr A r I L J C}"
 by (auto simp: prom_def)
 
 definition pro :: "agent => nat => agent => nat => msg => msg =>
@@ -141,21 +141,21 @@
 inductive_set p1 :: "event list set"
 where
 
-  Nil: "[]:p1"
+  Nil: "[] \<in> p1"
 
-| Fake: "[| evsf:p1; X:synth (analz (spies evsf)) |] ==> Says Spy B X # evsf : p1"
+| Fake: "[| evsf \<in> p1; X \<in> synth (analz (spies evsf)) |] ==> Says Spy B X # evsf \<in> p1"
 
-| Request: "[| evsr:p1; Nonce n ~:used evsr; I:agl |] ==> req A r n I B # evsr : p1"
+| Request: "[| evsr \<in> p1; Nonce n \<notin> used evsr; I \<in> agl |] ==> req A r n I B # evsr \<in> p1"
 
-| Propose: "[| evsp:p1; Says A' B \<lbrace>Agent A,Number r,I,cons M L\<rbrace>:set evsp;
-  I:agl; J:agl; isin (Agent C, app (J, del (Agent B, I)));
-  Nonce ofr ~:used evsp |] ==> pro B ofr A r I (cons M L) J C # evsp : p1"
+| Propose: "[| evsp \<in> p1; Says A' B \<lbrace>Agent A,Number r,I,cons M L\<rbrace> \<in> set evsp;
+  I \<in> agl; J \<in> agl; isin (Agent C, app (J, del (Agent B, I)));
+  Nonce ofr \<notin> used evsp |] ==> pro B ofr A r I (cons M L) J C # evsp \<in> p1"
 
 subsubsection\<open>Composition of Traces\<close>
 
-lemma "evs':p1 ==> 
-       evs:p1 & (ALL n. Nonce n:used evs' --> Nonce n ~:used evs) --> 
-       evs'@evs : p1"
+lemma "evs' \<in> p1 \<Longrightarrow>
+       evs \<in> p1 \<and> (\<forall>n. Nonce n \<in> used evs' \<longrightarrow> Nonce n \<notin> used evs) \<longrightarrow>
+       evs' @ evs \<in> p1"
 apply (erule p1.induct, safe) 
 apply (simp_all add: used_ConsI) 
 apply (erule p1.Fake, erule synth_sub, rule analz_mono, rule knows_sub_app)
@@ -168,30 +168,30 @@
 subsubsection\<open>Valid Offer Lists\<close>
 
 inductive_set
-  valid :: "agent => nat => agent => msg set"
+  valid :: "agent \<Rightarrow> nat \<Rightarrow> agent \<Rightarrow> msg set"
   for A :: agent and n :: nat and B :: agent
 where
-  Request [intro]: "cons (anchor A n B) nil:valid A n B"
+  Request [intro]: "cons (anchor A n B) nil \<in> valid A n B"
 
-| Propose [intro]: "L:valid A n B
-==> cons (chain (next_shop (head L)) ofr A L C) L:valid A n B"
+| Propose [intro]: "L \<in> valid A n B
+\<Longrightarrow> cons (chain (next_shop (head L)) ofr A L C) L \<in> valid A n B"
 
 subsubsection\<open>basic properties of valid\<close>
 
-lemma valid_not_empty: "L:valid A n B ==> EX M L'. L = cons M L'"
+lemma valid_not_empty: "L \<in> valid A n B \<Longrightarrow> \<exists>M L'. L = cons M L'"
 by (erule valid.cases, auto)
 
-lemma valid_pos_len: "L:valid A n B ==> 0 < len L"
+lemma valid_pos_len: "L \<in> valid A n B \<Longrightarrow> 0 < len L"
 by (erule valid.induct, auto)
 
 subsubsection\<open>offers of an offer list\<close>
 
-definition offer_nonces :: "msg => msg set" where
-"offer_nonces L == {X. X:parts {L} & (EX n. X = Nonce n)}"
+definition offer_nonces :: "msg \<Rightarrow> msg set" where
+"offer_nonces L \<equiv> {X. X \<in> parts {L} \<and> (\<exists>n. X = Nonce n)}"
 
 subsubsection\<open>the originator can get the offers\<close>
 
-lemma "L:valid A n B ==> offer_nonces L <= analz (insert L (initState A))"
+lemma "L \<in> valid A n B \<Longrightarrow> offer_nonces L \<subseteq> analz (insert L (initState A))"
 by (erule valid.induct, auto simp: anchor_def chain_def sign_def
 offer_nonces_def initState.simps)
 
@@ -207,22 +207,22 @@
 "shops (cons M L) = cons (shop M) (shops L)" |
 "shops other = other"
 
-lemma shops_in_agl: "L:valid A n B ==> shops L:agl"
+lemma shops_in_agl: "L \<in> valid A n B \<Longrightarrow> shops L \<in> agl"
 by (erule valid.induct, auto simp: anchor_def chain_def sign_def)
 
 subsubsection\<open>builds a trace from an itinerary\<close>
 
-fun offer_list :: "agent * nat * agent * msg * nat => msg" where
+fun offer_list :: "agent \<times> nat \<times> agent \<times> msg \<times> nat \<Rightarrow> msg" where
 "offer_list (A,n,B,nil,ofr) = cons (anchor A n B) nil" |
 "offer_list (A,n,B,cons (Agent C) I,ofr) = (
 let L = offer_list (A,n,B,I,Suc ofr) in
 cons (chain (next_shop (head L)) ofr A L C) L)"
 
-lemma "I:agl ==> ALL ofr. offer_list (A,n,B,I,ofr):valid A n B"
+lemma "I \<in> agl \<Longrightarrow> \<forall>ofr. offer_list (A,n,B,I,ofr) \<in> valid A n B"
 by (erule agl.induct, auto)
 
-fun trace :: "agent * nat * agent * nat * msg * msg * msg
-=> event list" where
+fun trace :: "agent \<times> nat \<times> agent \<times> nat \<times> msg \<times> msg \<times> msg
+\<Rightarrow> event list" where
 "trace (B,ofr,A,r,I,L,nil) = []" |
 "trace (B,ofr,A,r,I,L,cons (Agent D) K) = (
 let C = (if K=nil then B else agt_nb (head K)) in
@@ -232,8 +232,8 @@
 pro C (Suc ofr) A r I' L nil D
 # trace (B,Suc ofr,A,r,I'',tail L,K))"
 
-definition trace' :: "agent => nat => nat => msg => agent => nat => event list" where
-"trace' A r n I B ofr == (
+definition trace' :: "agent \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> msg \<Rightarrow> agent \<Rightarrow> nat \<Rightarrow> event list" where
+"trace' A r n I B ofr \<equiv> (
 let AI = cons (Agent A) I in
 let L = offer_list (A,n,B,AI,ofr) in
 trace (B,ofr,A,r,nil,L,AI))"
@@ -242,8 +242,8 @@
 
 subsubsection\<open>there is a trace in which the originator receives a valid answer\<close>
 
-lemma p1_not_empty: "evs:p1 ==> req A r n I B:set evs -->
-(EX evs'. evs'@evs:p1 & pro B' ofr A r I' L J A:set evs' & L:valid A n B)"
+lemma p1_not_empty: "evs \<in> p1 \<Longrightarrow> req A r n I B \<in> set evs \<longrightarrow>
+(\<exists>evs'. evs' @ evs \<in> p1 \<and> pro B' ofr A r I' L J A \<in> set evs' \<and> L \<in> valid A n B)"
 oops
 
 
@@ -255,66 +255,66 @@
 subsubsection\<open>strong forward integrity:
 except the last one, no offer can be modified\<close>
 
-lemma strong_forward_integrity: "ALL L. Suc i < len L
---> L:valid A n B & repl (L,Suc i,M):valid A n B --> M = ith (L,Suc i)"
+lemma strong_forward_integrity: "\<forall>L. Suc i < len L
+\<longrightarrow> L \<in> valid A n B \<and> repl (L,Suc i,M) \<in> valid A n B \<longrightarrow> M = ith (L,Suc i)"
 apply (induct i)
 (* i = 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,xa,l'a\<rbrace>:valid A n B" for x xa l'a)
-apply (ind_cases "\<lbrace>x,M,l'a\<rbrace>:valid A n B" for x l'a)
+apply (ind_cases "\<lbrace>x,xa,l'a\<rbrace> \<in> valid A n B" for x xa l'a)
+apply (ind_cases "\<lbrace>x,M,l'a\<rbrace> \<in> valid A n B" for x l'a)
 apply (simp add: chain_def)
 (* i > 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,repl(l',Suc na,M)\<rbrace>:valid A n B" for x l' na)
+apply (ind_cases "\<lbrace>x,repl(l',Suc na,M)\<rbrace> \<in> valid A n B" for x l' na)
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 by (drule_tac x=l' in spec, simp, blast)
 
 subsubsection\<open>insertion resilience:
 except at the beginning, no offer can be inserted\<close>
 
-lemma chain_isnt_head [simp]: "L:valid A n B ==>
-head L ~= chain (next_shop (head L)) ofr A L C"
+lemma chain_isnt_head [simp]: "L \<in> valid A n B \<Longrightarrow>
+head L \<noteq> chain (next_shop (head L)) ofr A L C"
 by (erule valid.induct, auto simp: chain_def sign_def anchor_def)
 
-lemma insertion_resilience: "ALL L. L:valid A n B --> Suc i < len L
---> ins (L,Suc i,M) ~:valid A n B"
+lemma insertion_resilience: "\<forall>L. L \<in> valid A n B \<longrightarrow> Suc i < len L
+\<longrightarrow> ins (L,Suc i,M) \<notin> valid A n B"
 apply (induct i)
 (* i = 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l', simp)
-apply (ind_cases "\<lbrace>x,M,l'\<rbrace>:valid A n B" for x l', clarsimp)
-apply (ind_cases "\<lbrace>head l',l'\<rbrace>:valid A n B" for l', simp, simp)
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l', simp)
+apply (ind_cases "\<lbrace>x,M,l'\<rbrace> \<in> valid A n B" for x l', clarsimp)
+apply (ind_cases "\<lbrace>head l',l'\<rbrace> \<in> valid A n B" for l', simp, simp)
 (* i > 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,ins(l',Suc na,M)\<rbrace>:valid A n B" for x l' na)
+apply (ind_cases "\<lbrace>x,ins(l',Suc na,M)\<rbrace> \<in> valid A n B" for x l' na)
 apply (frule len_not_empty, clarsimp)
 by (drule_tac x=l' in spec, clarsimp)
 
 subsubsection\<open>truncation resilience:
 only shop i can truncate at offer i\<close>
 
-lemma truncation_resilience: "ALL L. L:valid A n B --> Suc i < len L
---> cons M (trunc (L,Suc i)):valid A n B --> shop M = shop (ith (L,i))"
+lemma truncation_resilience: "\<forall>L. L \<in> valid A n B \<longrightarrow> Suc i < len L
+\<longrightarrow> cons M (trunc (L,Suc i)) \<in> valid A n B \<longrightarrow> shop M = shop (ith (L,i))"
 apply (induct i)
 (* i = 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>M,l'\<rbrace>:valid A n B" for l')
+apply (ind_cases "\<lbrace>M,l'\<rbrace> \<in> valid A n B" for l')
 apply (frule len_not_empty, clarsimp, simp)
 (* i > 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 apply (frule len_not_empty, clarsimp)
 by (drule_tac x=l' in spec, clarsimp)
 
@@ -326,37 +326,37 @@
 
 subsubsection\<open>get components of a message\<close>
 
-lemma get_ML [dest]: "Says A' B \<lbrace>A,r,I,M,L\<rbrace>:set evs ==>
-M:parts (spies evs) & L:parts (spies evs)"
+lemma get_ML [dest]: "Says A' B \<lbrace>A,r,I,M,L\<rbrace> \<in> set evs \<Longrightarrow>
+M \<in> parts (spies evs) \<and> L \<in> parts (spies evs)"
 by blast
 
 subsubsection\<open>general properties of p1\<close>
 
 lemma reqm_neq_prom [iff]:
-"reqm A r n I B ~= prom B' ofr A' r' I' (cons M L) J C"
+"reqm A r n I B \<noteq> prom B' ofr A' r' I' (cons M L) J C"
 by (auto simp: reqm_def prom_def)
 
 lemma prom_neq_reqm [iff]:
-"prom B' ofr A' r' I' (cons M L) J C ~= reqm A r n I B"
+"prom B' ofr A' r' I' (cons M L) J C \<noteq> reqm A r n I B"
 by (auto simp: reqm_def prom_def)
 
-lemma req_neq_pro [iff]: "req A r n I B ~= pro B' ofr A' r' I' (cons M L) J C"
+lemma req_neq_pro [iff]: "req A r n I B \<noteq> pro B' ofr A' r' I' (cons M L) J C"
 by (auto simp: req_def pro_def)
 
-lemma pro_neq_req [iff]: "pro B' ofr A' r' I' (cons M L) J C ~= req A r n I B"
+lemma pro_neq_req [iff]: "pro B' ofr A' r' I' (cons M L) J C \<noteq> req A r n I B"
 by (auto simp: req_def pro_def)
 
-lemma p1_has_no_Gets: "evs:p1 ==> ALL A X. Gets A X ~:set evs"
+lemma p1_has_no_Gets: "evs \<in> p1 \<Longrightarrow> \<forall>A X. Gets A X \<notin> set evs"
 by (erule p1.induct, auto simp: req_def pro_def)
 
 lemma p1_is_Gets_correct [iff]: "Gets_correct p1"
 by (auto simp: Gets_correct_def dest: p1_has_no_Gets)
 
 lemma p1_is_one_step [iff]: "one_step p1"
-by (unfold one_step_def, clarify, ind_cases "ev#evs:p1" for ev evs, auto)
+by (unfold one_step_def, clarify, ind_cases "ev#evs \<in> p1" for ev evs, auto)
 
-lemma p1_has_only_Says' [rule_format]: "evs:p1 ==>
-ev:set evs --> (EX A B X. ev=Says A B X)"
+lemma p1_has_only_Says' [rule_format]: "evs \<in> p1 \<Longrightarrow>
+ev \<in> set evs \<longrightarrow> (\<exists>A B X. ev=Says A B X)"
 by (erule p1.induct, auto simp: req_def pro_def)
 
 lemma p1_has_only_Says [iff]: "has_only_Says p1"
@@ -372,8 +372,8 @@
 subsubsection\<open>private keys are safe\<close>
 
 lemma priK_parts_Friend_imp_bad [rule_format,dest]:
-     "[| evs:p1; Friend B ~= A |]
-      ==> (Key (priK A):parts (knows (Friend B) evs)) --> (A:bad)"
+     "[| evs \<in> p1; Friend B \<noteq> A |]
+      ==> (Key (priK A) \<in> parts (knows (Friend B) evs)) \<longrightarrow> (A \<in> bad)"
 apply (erule p1.induct)
 apply (simp_all add: initState.simps knows.simps pro_def prom_def
                 req_def reqm_def anchor_def chain_def sign_def)
@@ -383,12 +383,12 @@
 done
 
 lemma priK_analz_Friend_imp_bad [rule_format,dest]:
-     "[| evs:p1; Friend B ~= A |]
-==> (Key (priK A):analz (knows (Friend B) evs)) --> (A:bad)"
+     "[| evs \<in> p1; Friend B \<noteq> A |]
+==> (Key (priK A) \<in> analz (knows (Friend B) evs)) \<longrightarrow> (A \<in> bad)"
 by auto
 
-lemma priK_notin_knows_max_Friend: "[| evs:p1; A ~:bad; A ~= Friend C |]
-==> Key (priK A) ~:analz (knows_max (Friend C) evs)"
+lemma priK_notin_knows_max_Friend: "[| evs \<in> p1; A \<notin> bad; A \<noteq> Friend C |]
+==> Key (priK A) \<notin> analz (knows_max (Friend C) evs)"
 apply (rule not_parts_not_analz, simp add: knows_max_def, safe)
 apply (drule_tac H="spies' evs" in parts_sub)
 apply (rule_tac p=p1 in knows_max'_sub_spies', simp+)
@@ -397,78 +397,78 @@
 
 subsubsection\<open>general guardedness properties\<close>
 
-lemma agl_guard [intro]: "I:agl ==> I:guard n Ks"
+lemma agl_guard [intro]: "I \<in> agl \<Longrightarrow> I \<in> guard n Ks"
 by (erule agl.induct, auto)
 
-lemma Says_to_knows_max'_guard: "[| Says A' C \<lbrace>A'',r,I,L\<rbrace>:set evs;
-Guard n Ks (knows_max' C evs) |] ==> L:guard n Ks"
+lemma Says_to_knows_max'_guard: "[| Says A' C \<lbrace>A'',r,I,L\<rbrace> \<in> set evs;
+Guard n Ks (knows_max' C evs) |] ==> L \<in> guard n Ks"
 by (auto dest: Says_to_knows_max')
 
-lemma Says_from_knows_max'_guard: "[| Says C A' \<lbrace>A'',r,I,L\<rbrace>:set evs;
-Guard n Ks (knows_max' C evs) |] ==> L:guard n Ks"
+lemma Says_from_knows_max'_guard: "[| Says C A' \<lbrace>A'',r,I,L\<rbrace> \<in> set evs;
+Guard n Ks (knows_max' C evs) |] ==> L \<in> guard n Ks"
 by (auto dest: Says_from_knows_max')
 
-lemma Says_Nonce_not_used_guard: "[| Says A' B \<lbrace>A'',r,I,L\<rbrace>:set evs;
-Nonce n ~:used evs |] ==> L:guard n Ks"
+lemma Says_Nonce_not_used_guard: "[| Says A' B \<lbrace>A'',r,I,L\<rbrace> \<in> set evs;
+Nonce n \<notin> used evs |] ==> L \<in> guard n Ks"
 by (drule not_used_not_parts, auto)
 
 subsubsection\<open>guardedness of messages\<close>
 
-lemma chain_guard [iff]: "chain B ofr A L C:guard n {priK A}"
+lemma chain_guard [iff]: "chain B ofr A L C \<in> guard n {priK A}"
 by (case_tac "ofr=n", auto simp: chain_def sign_def)
 
-lemma chain_guard_Nonce_neq [intro]: "n ~= ofr
-==> chain B ofr A' L C:guard n {priK A}"
+lemma chain_guard_Nonce_neq [intro]: "n \<noteq> ofr
+\<Longrightarrow> chain B ofr A' L C \<in> guard n {priK A}"
 by (auto simp: chain_def sign_def)
 
-lemma anchor_guard [iff]: "anchor A n' B:guard n {priK A}"
+lemma anchor_guard [iff]: "anchor A n' B \<in> guard n {priK A}"
 by (case_tac "n'=n", auto simp: anchor_def)
 
-lemma anchor_guard_Nonce_neq [intro]: "n ~= n'
-==> anchor A' n' B:guard n {priK A}"
+lemma anchor_guard_Nonce_neq [intro]: "n \<noteq> n'
+\<Longrightarrow> anchor A' n' B \<in> guard n {priK A}"
 by (auto simp: anchor_def)
 
-lemma reqm_guard [intro]: "I:agl ==> reqm A r n' I B:guard n {priK A}"
+lemma reqm_guard [intro]: "I \<in> agl \<Longrightarrow> reqm A r n' I B \<in> guard n {priK A}"
 by (case_tac "n'=n", auto simp: reqm_def)
 
-lemma reqm_guard_Nonce_neq [intro]: "[| n ~= n'; I:agl |]
-==> reqm A' r n' I B:guard n {priK A}"
+lemma reqm_guard_Nonce_neq [intro]: "[| n \<noteq> n'; I \<in> agl |]
+==> reqm A' r n' I B \<in> guard n {priK A}"
 by (auto simp: reqm_def)
 
-lemma prom_guard [intro]: "[| I:agl; J:agl; L:guard n {priK A} |]
-==> prom B ofr A r I L J C:guard n {priK A}"
+lemma prom_guard [intro]: "[| I \<in> agl; J \<in> agl; L \<in> guard n {priK A} |]
+==> prom B ofr A r I L J C \<in> guard n {priK A}"
 by (auto simp: prom_def)
 
-lemma prom_guard_Nonce_neq [intro]: "[| n ~= ofr; I:agl; J:agl;
-L:guard n {priK A} |] ==> prom B ofr A' r I L J C:guard n {priK A}"
+lemma prom_guard_Nonce_neq [intro]: "[| n \<noteq> ofr; I \<in> agl; J \<in> agl;
+L \<in> guard n {priK A} |] ==> prom B ofr A' r I L J C \<in> guard n {priK A}"
 by (auto simp: prom_def)
 
 subsubsection\<open>Nonce uniqueness\<close>
 
-lemma uniq_Nonce_in_chain [dest]: "Nonce k:parts {chain B ofr A L C} ==> k=ofr"
+lemma uniq_Nonce_in_chain [dest]: "Nonce k \<in> parts {chain B ofr A L C} \<Longrightarrow> k=ofr"
 by (auto simp: chain_def sign_def)
 
-lemma uniq_Nonce_in_anchor [dest]: "Nonce k:parts {anchor A n B} ==> k=n"
+lemma uniq_Nonce_in_anchor [dest]: "Nonce k \<in> parts {anchor A n B} \<Longrightarrow> k=n"
 by (auto simp: anchor_def chain_def sign_def)
 
-lemma uniq_Nonce_in_reqm [dest]: "[| Nonce k:parts {reqm A r n I B};
-I:agl |] ==> k=n"
+lemma uniq_Nonce_in_reqm [dest]: "[| Nonce k \<in> parts {reqm A r n I B};
+I \<in> agl |] ==> k=n"
 by (auto simp: reqm_def dest: no_Nonce_in_agl)
 
-lemma uniq_Nonce_in_prom [dest]: "[| Nonce k:parts {prom B ofr A r I L J C};
-I:agl; J:agl; Nonce k ~:parts {L} |] ==> k=ofr"
+lemma uniq_Nonce_in_prom [dest]: "[| Nonce k \<in> parts {prom B ofr A r I L J C};
+I \<in> agl; J \<in> agl; Nonce k \<notin> parts {L} |] ==> k=ofr"
 by (auto simp: prom_def dest: no_Nonce_in_agl no_Nonce_in_appdel)
 
 subsubsection\<open>requests are guarded\<close>
 
-lemma req_imp_Guard [rule_format]: "[| evs:p1; A ~:bad |] ==>
-req A r n I B:set evs --> Guard n {priK A} (spies evs)"
+lemma req_imp_Guard [rule_format]: "[| evs \<in> p1; A \<notin> bad |] ==>
+req A r n I B \<in> set evs \<longrightarrow> Guard n {priK A} (spies evs)"
 apply (erule p1.induct, simp)
 apply (simp add: req_def knows.simps, safe)
 apply (erule in_synth_Guard, erule Guard_analz, simp)
 by (auto simp: req_def pro_def dest: Says_imp_knows_Spy)
 
-lemma req_imp_Guard_Friend: "[| evs:p1; A ~:bad; req A r n I B:set evs |]
+lemma req_imp_Guard_Friend: "[| evs \<in> p1; A \<notin> bad; req A r n I B \<in> set evs |]
 ==> Guard n {priK A} (knows_max (Friend C) evs)"
 apply (rule Guard_knows_max')
 apply (rule_tac H="spies evs" in Guard_mono)
@@ -479,8 +479,8 @@
 
 subsubsection\<open>propositions are guarded\<close>
 
-lemma pro_imp_Guard [rule_format]: "[| evs:p1; B ~:bad; A ~:bad |] ==>
-pro B ofr A r I (cons M L) J C:set evs --> Guard ofr {priK A} (spies evs)"
+lemma pro_imp_Guard [rule_format]: "[| evs \<in> p1; B \<notin> bad; A \<notin> bad |] ==>
+pro B ofr A r I (cons M L) J C \<in> set evs \<longrightarrow> Guard ofr {priK A} (spies evs)"
 apply (erule p1.induct) (* +3 subgoals *)
 (* Nil *)
 apply simp
@@ -516,8 +516,8 @@
 apply (simp add: pro_def)
 by (blast dest: Says_imp_knows_Spy)
 
-lemma pro_imp_Guard_Friend: "[| evs:p1; B ~:bad; A ~:bad;
-pro B ofr A r I (cons M L) J C:set evs |]
+lemma pro_imp_Guard_Friend: "[| evs \<in> p1; B \<notin> bad; A \<notin> bad;
+pro B ofr A r I (cons M L) J C \<in> set evs |]
 ==> Guard ofr {priK A} (knows_max (Friend D) evs)"
 apply (rule Guard_knows_max')
 apply (rule_tac H="spies evs" in Guard_mono)
@@ -529,23 +529,23 @@
 subsubsection\<open>data confidentiality:
 no one other than the originator can decrypt the offers\<close>
 
-lemma Nonce_req_notin_spies: "[| evs:p1; req A r n I B:set evs; A ~:bad |]
-==> Nonce n ~:analz (spies evs)"
+lemma Nonce_req_notin_spies: "[| evs \<in> p1; req A r n I B \<in> set evs; A \<notin> bad |]
+==> Nonce n \<notin> analz (spies evs)"
 by (frule req_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)
 
-lemma Nonce_req_notin_knows_max_Friend: "[| evs:p1; req A r n I B:set evs;
-A ~:bad; A ~= Friend C |] ==> Nonce n ~:analz (knows_max (Friend C) evs)"
+lemma Nonce_req_notin_knows_max_Friend: "[| evs \<in> p1; req A r n I B \<in> set evs;
+A \<notin> bad; A \<noteq> Friend C |] ==> Nonce n \<notin> analz (knows_max (Friend C) evs)"
 apply (clarify, frule_tac C=C in req_imp_Guard_Friend, simp+)
 apply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)
 by (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)
 
-lemma Nonce_pro_notin_spies: "[| evs:p1; B ~:bad; A ~:bad;
-pro B ofr A r I (cons M L) J C:set evs |] ==> Nonce ofr ~:analz (spies evs)"
+lemma Nonce_pro_notin_spies: "[| evs \<in> p1; B \<notin> bad; A \<notin> bad;
+pro B ofr A r I (cons M L) J C \<in> set evs |] ==> Nonce ofr \<notin> analz (spies evs)"
 by (frule pro_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)
 
-lemma Nonce_pro_notin_knows_max_Friend: "[| evs:p1; B ~:bad; A ~:bad;
-A ~= Friend D; pro B ofr A r I (cons M L) J C:set evs |]
-==> Nonce ofr ~:analz (knows_max (Friend D) evs)"
+lemma Nonce_pro_notin_knows_max_Friend: "[| evs \<in> p1; B \<notin> bad; A \<notin> bad;
+A \<noteq> Friend D; pro B ofr A r I (cons M L) J C \<in> set evs |]
+==> Nonce ofr \<notin> analz (knows_max (Friend D) evs)"
 apply (clarify, frule_tac A=A in pro_imp_Guard_Friend, simp+)
 apply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)
 by (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)
@@ -553,59 +553,59 @@
 subsubsection\<open>non repudiability:
 an offer signed by B has been sent by B\<close>
 
-lemma Crypt_reqm: "[| Crypt (priK A) X:parts {reqm A' r n I B}; I:agl |] ==> A=A'"
+lemma Crypt_reqm: "[| Crypt (priK A) X \<in> parts {reqm A' r n I B}; I \<in> agl |] ==> A=A'"
 by (auto simp: reqm_def anchor_def chain_def sign_def dest: no_Crypt_in_agl)
 
-lemma Crypt_prom: "[| Crypt (priK A) X:parts {prom B ofr A' r I L J C};
-I:agl; J:agl |] ==> A=B | Crypt (priK A) X:parts {L}"
+lemma Crypt_prom: "[| Crypt (priK A) X \<in> parts {prom B ofr A' r I L J C};
+I \<in> agl; J \<in> agl |] ==> A=B \<or> Crypt (priK A) X \<in> parts {L}"
 apply (simp add: prom_def anchor_def chain_def sign_def)
 by (blast dest: no_Crypt_in_agl no_Crypt_in_appdel)
 
-lemma Crypt_safeness: "[| evs:p1; A ~:bad |] ==> Crypt (priK A) X:parts (spies evs)
---> (EX B Y. Says A B Y:set evs & Crypt (priK A) X:parts {Y})"
+lemma Crypt_safeness: "[| evs \<in> p1; A \<notin> bad |] ==> Crypt (priK A) X \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B Y. Says A B Y \<in> set evs \<and> Crypt (priK A) X \<in> parts {Y})"
 apply (erule p1.induct)
 (* Nil *)
 apply simp
 (* Fake *)
 apply clarsimp
-apply (drule_tac P="%G. Crypt (priK A) X:G" in parts_insert_substD, simp)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) X \<in> G" in parts_insert_substD, simp)
 apply (erule disjE)
 apply (drule_tac K="priK A" in Crypt_synth, simp+, blast, blast)
 (* Request *)
 apply (simp add: req_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) X:G" in parts_insert_substD, simp)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) X \<in> G" in parts_insert_substD, simp)
 apply (erule disjE)
 apply (frule Crypt_reqm, simp, clarify)
 apply (rule_tac x=B in exI, rule_tac x="reqm A r n I B" in exI, simp, blast)
 (* Propose *)
 apply (simp add: pro_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) X:G" in parts_insert_substD, simp)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) X \<in> G" in parts_insert_substD, simp)
 apply (rotate_tac -1, erule disjE)
 apply (frule Crypt_prom, simp, simp)
 apply (rotate_tac -1, erule disjE)
 apply (rule_tac x=C in exI)
 apply (rule_tac x="prom B ofr Aa r I (cons M L) J C" in exI, blast)
-apply (subgoal_tac "cons M L:parts (spies evsp)")
+apply (subgoal_tac "cons M L \<in> parts (spies evsp)")
 apply (drule_tac G="{cons M L}" and H="spies evsp" in parts_trans, blast, blast)
 apply (drule Says_imp_spies, rotate_tac -1, drule parts.Inj)
 apply (drule parts.Snd, drule parts.Snd, drule parts.Snd)
 by auto
 
-lemma Crypt_Hash_imp_sign: "[| evs:p1; A ~:bad |] ==>
-Crypt (priK A) (Hash X):parts (spies evs)
---> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})"
+lemma Crypt_Hash_imp_sign: "[| evs \<in> p1; A \<notin> bad |] ==>
+Crypt (priK A) (Hash X) \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B Y. Says A B Y \<in> set evs \<and> sign A X \<in> parts {Y})"
 apply (erule p1.induct)
 (* Nil *)
 apply simp
 (* Fake *)
 apply clarsimp
-apply (drule_tac P="%G. Crypt (priK A) (Hash X):G" in parts_insert_substD)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) (Hash X) \<in> G" in parts_insert_substD)
 apply simp
 apply (erule disjE)
 apply (drule_tac K="priK A" in Crypt_synth, simp+, blast, blast)
 (* Request *)
 apply (simp add: req_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) (Hash X):G" in parts_insert_substD)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) (Hash X) \<in> G" in parts_insert_substD)
 apply simp
 apply (erule disjE)
 apply (frule Crypt_reqm, simp+)
@@ -614,7 +614,7 @@
 apply (simp add: chain_def sign_def, blast)
 (* Propose *)
 apply (simp add: pro_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) (Hash X):G" in parts_insert_substD)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) (Hash X) \<in> G" in parts_insert_substD)
 apply simp
 apply (rotate_tac -1, erule disjE)
 apply (simp add: prom_def sign_def no_Crypt_in_agl no_Crypt_in_appdel)
@@ -628,8 +628,8 @@
 apply (blast del: MPair_parts)+
 done
 
-lemma sign_safeness: "[| evs:p1; A ~:bad |] ==> sign A X:parts (spies evs)
---> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})"
+lemma sign_safeness: "[| evs \<in> p1; A \<notin> bad |] ==> sign A X \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B Y. Says A B Y \<in> set evs \<and> sign A X \<in> parts {Y})"
 apply (clarify, simp add: sign_def, frule parts.Snd)
 apply (blast dest: Crypt_Hash_imp_sign [unfolded sign_def])
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/P2.thy
--- a/src/HOL/Auth/Guard/P2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/P2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -32,7 +32,7 @@
 = (B=B' & ofr=ofr' & A=A' & head L = head L' & C=C')"
 by (auto simp: chain_def Let_def)
 
-lemma Nonce_in_chain [iff]: "Nonce ofr:parts {chain B ofr A L C}"
+lemma Nonce_in_chain [iff]: "Nonce ofr \<in> parts {chain B ofr A L C}"
 by (auto simp: chain_def sign_def)
 
 subsubsection\<open>agent whose key is used to sign an offer\<close>
@@ -65,10 +65,10 @@
 "anchor A n B == chain A n A (cons nil nil) B"
 
 lemma anchor_inj [iff]:
-     "(anchor A n B = anchor A' n' B') = (A=A' & n=n' & B=B')"
+     "(anchor A n B = anchor A' n' B') = (A=A' \<and> n=n' \<and> B=B')"
 by (auto simp: anchor_def)
 
-lemma Nonce_in_anchor [iff]: "Nonce n:parts {anchor A n B}"
+lemma Nonce_in_anchor [iff]: "Nonce n \<in> parts {anchor A n B}"
 by (auto simp: anchor_def)
 
 lemma shop_anchor [simp]: "shop (anchor A n B) = Agent A"
@@ -84,7 +84,7 @@
 = (A=A' & r=r' & n=n' & I=I' & B=B')"
 by (auto simp: reqm_def)
 
-lemma Nonce_in_reqm [iff]: "Nonce n:parts {reqm A r n I B}"
+lemma Nonce_in_reqm [iff]: "Nonce n \<in> parts {reqm A r n I B}"
 by (auto simp: reqm_def)
 
 definition req :: "agent => nat => nat => msg => agent => event" where
@@ -105,7 +105,7 @@
 ==> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'"
 by (auto simp: prom_def)
 
-lemma Nonce_in_prom [iff]: "Nonce ofr:parts {prom B ofr A r I L J C}"
+lemma Nonce_in_prom [iff]: "Nonce ofr \<in> parts {prom B ofr A r I L J C}"
 by (auto simp: prom_def)
 
 definition pro :: "agent => nat => agent => nat => msg => msg =>
@@ -121,38 +121,38 @@
 inductive_set p2 :: "event list set"
 where
 
-  Nil: "[]:p2"
+  Nil: "[] \<in> p2"
 
-| Fake: "[| evsf:p2; X:synth (analz (spies evsf)) |] ==> Says Spy B X # evsf : p2"
+| Fake: "[| evsf \<in> p2; X \<in> synth (analz (spies evsf)) |] ==> Says Spy B X # evsf \<in> p2"
 
-| Request: "[| evsr:p2; Nonce n ~:used evsr; I:agl |] ==> req A r n I B # evsr : p2"
+| Request: "[| evsr \<in> p2; Nonce n \<notin> used evsr; I \<in> agl |] ==> req A r n I B # evsr \<in> p2"
 
-| Propose: "[| evsp:p2; Says A' B \<lbrace>Agent A,Number r,I,cons M L\<rbrace>:set evsp;
-  I:agl; J:agl; isin (Agent C, app (J, del (Agent B, I)));
-  Nonce ofr ~:used evsp |] ==> pro B ofr A r I (cons M L) J C # evsp : p2"
+| Propose: "[| evsp \<in> p2; Says A' B \<lbrace>Agent A,Number r,I,cons M L\<rbrace> \<in> set evsp;
+  I \<in> agl; J \<in> agl; isin (Agent C, app (J, del (Agent B, I)));
+  Nonce ofr \<notin> used evsp |] ==> pro B ofr A r I (cons M L) J C # evsp \<in> p2"
 
 subsubsection\<open>valid offer lists\<close>
 
 inductive_set
-  valid :: "agent => nat => agent => msg set"
+  valid :: "agent \<Rightarrow> nat \<Rightarrow> agent \<Rightarrow> msg set"
   for A :: agent and  n :: nat and B :: agent
 where
-  Request [intro]: "cons (anchor A n B) nil:valid A n B"
+  Request [intro]: "cons (anchor A n B) nil \<in> valid A n B"
 
-| Propose [intro]: "L:valid A n B
-  ==> cons (chain (next_shop (head L)) ofr A L C) L:valid A n B"
+| Propose [intro]: "L \<in> valid A n B
+  \<Longrightarrow> cons (chain (next_shop (head L)) ofr A L C) L \<in> valid A n B"
 
 subsubsection\<open>basic properties of valid\<close>
 
-lemma valid_not_empty: "L:valid A n B ==> EX M L'. L = cons M L'"
+lemma valid_not_empty: "L \<in> valid A n B \<Longrightarrow> \<exists>M L'. L = cons M L'"
 by (erule valid.cases, auto)
 
-lemma valid_pos_len: "L:valid A n B ==> 0 < len L"
+lemma valid_pos_len: "L \<in> valid A n B \<Longrightarrow> 0 < len L"
 by (erule valid.induct, auto)
 
 subsubsection\<open>list of offers\<close>
 
-fun offers :: "msg => msg"
+fun offers :: "msg \<Rightarrow> msg"
 where
   "offers (cons M L) = cons \<lbrace>shop M, nonce M\<rbrace> (offers L)"
 | "offers other = nil"
@@ -166,66 +166,66 @@
 subsection\<open>strong forward integrity:
 except the last one, no offer can be modified\<close>
 
-lemma strong_forward_integrity: "ALL L. Suc i < len L
---> L:valid A n B --> repl (L,Suc i,M):valid A n B --> M = ith (L,Suc i)"
+lemma strong_forward_integrity: "\<forall>L. Suc i < len L
+\<longrightarrow> L \<in> valid A n B \<longrightarrow> repl (L,Suc i,M) \<in> valid A n B \<longrightarrow> M = ith (L,Suc i)"
 apply (induct i)
 (* i = 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,xa,l'a\<rbrace>:valid A n B" for x xa l'a)
-apply (ind_cases "\<lbrace>x,M,l'a\<rbrace>:valid A n B" for x l'a)
+apply (ind_cases "\<lbrace>x,xa,l'a\<rbrace> \<in> valid A n B" for x xa l'a)
+apply (ind_cases "\<lbrace>x,M,l'a\<rbrace> \<in> valid A n B" for x l'a)
 apply (simp add: chain_def)
 (* i > 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,repl(l',Suc na,M)\<rbrace>:valid A n B" for x l' na)
+apply (ind_cases "\<lbrace>x,repl(l',Suc na,M)\<rbrace> \<in> valid A n B" for x l' na)
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 by (drule_tac x=l' in spec, simp, blast)
 
 subsection\<open>insertion resilience:
 except at the beginning, no offer can be inserted\<close>
 
-lemma chain_isnt_head [simp]: "L:valid A n B ==>
-head L ~= chain (next_shop (head L)) ofr A L C"
+lemma chain_isnt_head [simp]: "L \<in> valid A n B \<Longrightarrow>
+head L \<noteq> chain (next_shop (head L)) ofr A L C"
 by (erule valid.induct, auto simp: chain_def sign_def anchor_def)
 
-lemma insertion_resilience: "ALL L. L:valid A n B --> Suc i < len L
---> ins (L,Suc i,M) ~:valid A n B"
+lemma insertion_resilience: "\<forall>L. L \<in> valid A n B \<longrightarrow> Suc i < len L
+\<longrightarrow> ins (L,Suc i,M) \<notin> valid A n B"
 apply (induct i)
 (* i = 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l', simp)
-apply (ind_cases "\<lbrace>x,M,l'\<rbrace>:valid A n B" for x l', clarsimp)
-apply (ind_cases "\<lbrace>head l',l'\<rbrace>:valid A n B" for l', simp, simp)
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l', simp)
+apply (ind_cases "\<lbrace>x,M,l'\<rbrace> \<in> valid A n B" for x l', clarsimp)
+apply (ind_cases "\<lbrace>head l',l'\<rbrace> \<in> valid A n B" for l', simp, simp)
 (* i > 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,ins(l',Suc na,M)\<rbrace>:valid A n B" for x l' na)
+apply (ind_cases "\<lbrace>x,ins(l',Suc na,M)\<rbrace> \<in> valid A n B" for x l' na)
 apply (frule len_not_empty, clarsimp)
 by (drule_tac x=l' in spec, clarsimp)
 
 subsection\<open>truncation resilience:
 only shop i can truncate at offer i\<close>
 
-lemma truncation_resilience: "ALL L. L:valid A n B --> Suc i < len L
---> cons M (trunc (L,Suc i)):valid A n B --> shop M = shop (ith (L,i))"
+lemma truncation_resilience: "\<forall>L. L \<in> valid A n B \<longrightarrow> Suc i < len L
+\<longrightarrow> cons M (trunc (L,Suc i)) \<in> valid A n B \<longrightarrow> shop M = shop (ith (L,i))"
 apply (induct i)
 (* i = 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>M,l'\<rbrace>:valid A n B" for l')
+apply (ind_cases "\<lbrace>M,l'\<rbrace> \<in> valid A n B" for l')
 apply (frule len_not_empty, clarsimp, simp)
 (* i > 0 *)
 apply clarify
 apply (frule len_not_empty, clarsimp)
-apply (ind_cases "\<lbrace>x,l'\<rbrace>:valid A n B" for x l')
+apply (ind_cases "\<lbrace>x,l'\<rbrace> \<in> valid A n B" for x l')
 apply (frule len_not_empty, clarsimp)
 by (drule_tac x=l' in spec, clarsimp)
 
@@ -237,37 +237,37 @@
 
 subsection\<open>get components of a message\<close>
 
-lemma get_ML [dest]: "Says A' B \<lbrace>A,R,I,M,L\<rbrace>:set evs ==>
-M:parts (spies evs) & L:parts (spies evs)"
+lemma get_ML [dest]: "Says A' B \<lbrace>A,R,I,M,L\<rbrace> \<in> set evs \<Longrightarrow>
+M \<in> parts (spies evs) \<and> L \<in> parts (spies evs)"
 by blast
 
 subsection\<open>general properties of p2\<close>
 
 lemma reqm_neq_prom [iff]:
-"reqm A r n I B ~= prom B' ofr A' r' I' (cons M L) J C"
+"reqm A r n I B \<noteq> prom B' ofr A' r' I' (cons M L) J C"
 by (auto simp: reqm_def prom_def)
 
 lemma prom_neq_reqm [iff]:
-"prom B' ofr A' r' I' (cons M L) J C ~= reqm A r n I B"
+"prom B' ofr A' r' I' (cons M L) J C \<noteq> reqm A r n I B"
 by (auto simp: reqm_def prom_def)
 
-lemma req_neq_pro [iff]: "req A r n I B ~= pro B' ofr A' r' I' (cons M L) J C"
+lemma req_neq_pro [iff]: "req A r n I B \<noteq> pro B' ofr A' r' I' (cons M L) J C"
 by (auto simp: req_def pro_def)
 
-lemma pro_neq_req [iff]: "pro B' ofr A' r' I' (cons M L) J C ~= req A r n I B"
+lemma pro_neq_req [iff]: "pro B' ofr A' r' I' (cons M L) J C \<noteq> req A r n I B"
 by (auto simp: req_def pro_def)
 
-lemma p2_has_no_Gets: "evs:p2 ==> ALL A X. Gets A X ~:set evs"
+lemma p2_has_no_Gets: "evs \<in> p2 \<Longrightarrow> \<forall>A X. Gets A X \<notin> set evs"
 by (erule p2.induct, auto simp: req_def pro_def)
 
 lemma p2_is_Gets_correct [iff]: "Gets_correct p2"
 by (auto simp: Gets_correct_def dest: p2_has_no_Gets)
 
 lemma p2_is_one_step [iff]: "one_step p2"
-by (unfold one_step_def, clarify, ind_cases "ev#evs:p2" for ev evs, auto)
+by (unfold one_step_def, clarify, ind_cases "ev#evs \<in> p2" for ev evs, auto)
 
-lemma p2_has_only_Says' [rule_format]: "evs:p2 ==>
-ev:set evs --> (EX A B X. ev=Says A B X)"
+lemma p2_has_only_Says' [rule_format]: "evs \<in> p2 \<Longrightarrow>
+ev \<in> set evs \<longrightarrow> (\<exists>A B X. ev=Says A B X)"
 by (erule p2.induct, auto simp: req_def pro_def)
 
 lemma p2_has_only_Says [iff]: "has_only_Says p2"
@@ -283,8 +283,8 @@
 subsection\<open>private keys are safe\<close>
 
 lemma priK_parts_Friend_imp_bad [rule_format,dest]:
-     "[| evs:p2; Friend B ~= A |]
-      ==> (Key (priK A):parts (knows (Friend B) evs)) --> (A:bad)"
+     "[| evs \<in> p2; Friend B \<noteq> A |]
+      ==> (Key (priK A) \<in> parts (knows (Friend B) evs)) \<longrightarrow> (A \<in> bad)"
 apply (erule p2.induct)
 apply (simp_all add: initState.simps knows.simps pro_def prom_def
                 req_def reqm_def anchor_def chain_def sign_def) 
@@ -294,13 +294,13 @@
 done
 
 lemma priK_analz_Friend_imp_bad [rule_format,dest]:
-     "[| evs:p2; Friend B ~= A |]
-==> (Key (priK A):analz (knows (Friend B) evs)) --> (A:bad)"
+     "[| evs \<in> p2; Friend B \<noteq> A |]
+==> (Key (priK A) \<in> analz (knows (Friend B) evs)) \<longrightarrow> (A \<in> bad)"
 by auto
 
 lemma priK_notin_knows_max_Friend:
-     "[| evs:p2; A ~:bad; A ~= Friend C |]
-      ==> Key (priK A) ~:analz (knows_max (Friend C) evs)"
+     "[| evs \<in> p2; A \<notin> bad; A \<noteq> Friend C |]
+      ==> Key (priK A) \<notin> analz (knows_max (Friend C) evs)"
 apply (rule not_parts_not_analz, simp add: knows_max_def, safe)
 apply (drule_tac H="spies' evs" in parts_sub)
 apply (rule_tac p=p2 in knows_max'_sub_spies', simp+)
@@ -309,78 +309,78 @@
 
 subsection\<open>general guardedness properties\<close>
 
-lemma agl_guard [intro]: "I:agl ==> I:guard n Ks"
+lemma agl_guard [intro]: "I \<in> agl \<Longrightarrow> I \<in> guard n Ks"
 by (erule agl.induct, auto)
 
-lemma Says_to_knows_max'_guard: "[| Says A' C \<lbrace>A'',r,I,L\<rbrace>:set evs;
-Guard n Ks (knows_max' C evs) |] ==> L:guard n Ks"
+lemma Says_to_knows_max'_guard: "[| Says A' C \<lbrace>A'',r,I,L\<rbrace> \<in> set evs;
+Guard n Ks (knows_max' C evs) |] ==> L \<in> guard n Ks"
 by (auto dest: Says_to_knows_max')
 
-lemma Says_from_knows_max'_guard: "[| Says C A' \<lbrace>A'',r,I,L\<rbrace>:set evs;
-Guard n Ks (knows_max' C evs) |] ==> L:guard n Ks"
+lemma Says_from_knows_max'_guard: "[| Says C A' \<lbrace>A'',r,I,L\<rbrace> \<in> set evs;
+Guard n Ks (knows_max' C evs) |] ==> L \<in> guard n Ks"
 by (auto dest: Says_from_knows_max')
 
-lemma Says_Nonce_not_used_guard: "[| Says A' B \<lbrace>A'',r,I,L\<rbrace>:set evs;
-Nonce n ~:used evs |] ==> L:guard n Ks"
+lemma Says_Nonce_not_used_guard: "[| Says A' B \<lbrace>A'',r,I,L\<rbrace> \<in> set evs;
+Nonce n \<notin> used evs |] ==> L \<in> guard n Ks"
 by (drule not_used_not_parts, auto)
 
 subsection\<open>guardedness of messages\<close>
 
-lemma chain_guard [iff]: "chain B ofr A L C:guard n {priK A}"
+lemma chain_guard [iff]: "chain B ofr A L C \<in> guard n {priK A}"
 by (case_tac "ofr=n", auto simp: chain_def sign_def)
 
-lemma chain_guard_Nonce_neq [intro]: "n ~= ofr
-==> chain B ofr A' L C:guard n {priK A}"
+lemma chain_guard_Nonce_neq [intro]: "n \<noteq> ofr
+\<Longrightarrow> chain B ofr A' L C \<in> guard n {priK A}"
 by (auto simp: chain_def sign_def)
 
-lemma anchor_guard [iff]: "anchor A n' B:guard n {priK A}"
+lemma anchor_guard [iff]: "anchor A n' B \<in> guard n {priK A}"
 by (case_tac "n'=n", auto simp: anchor_def)
 
-lemma anchor_guard_Nonce_neq [intro]: "n ~= n'
-==> anchor A' n' B:guard n {priK A}"
+lemma anchor_guard_Nonce_neq [intro]: "n \<noteq> n'
+\<Longrightarrow> anchor A' n' B \<in> guard n {priK A}"
 by (auto simp: anchor_def)
 
-lemma reqm_guard [intro]: "I:agl ==> reqm A r n' I B:guard n {priK A}"
+lemma reqm_guard [intro]: "I \<in> agl \<Longrightarrow> reqm A r n' I B \<in> guard n {priK A}"
 by (case_tac "n'=n", auto simp: reqm_def)
 
-lemma reqm_guard_Nonce_neq [intro]: "[| n ~= n'; I:agl |]
-==> reqm A' r n' I B:guard n {priK A}"
+lemma reqm_guard_Nonce_neq [intro]: "[| n \<noteq> n'; I \<in> agl |]
+==> reqm A' r n' I B \<in> guard n {priK A}"
 by (auto simp: reqm_def)
 
-lemma prom_guard [intro]: "[| I:agl; J:agl; L:guard n {priK A} |]
-==> prom B ofr A r I L J C:guard n {priK A}"
+lemma prom_guard [intro]: "[| I \<in> agl; J \<in> agl; L \<in> guard n {priK A} |]
+==> prom B ofr A r I L J C \<in> guard n {priK A}"
 by (auto simp: prom_def)
 
-lemma prom_guard_Nonce_neq [intro]: "[| n ~= ofr; I:agl; J:agl;
-L:guard n {priK A} |] ==> prom B ofr A' r I L J C:guard n {priK A}"
+lemma prom_guard_Nonce_neq [intro]: "[| n \<noteq> ofr; I \<in> agl; J \<in> agl;
+L \<in> guard n {priK A} |] ==> prom B ofr A' r I L J C \<in> guard n {priK A}"
 by (auto simp: prom_def)
 
 subsection\<open>Nonce uniqueness\<close>
 
-lemma uniq_Nonce_in_chain [dest]: "Nonce k:parts {chain B ofr A L C} ==> k=ofr"
+lemma uniq_Nonce_in_chain [dest]: "Nonce k \<in> parts {chain B ofr A L C} \<Longrightarrow> k=ofr"
 by (auto simp: chain_def sign_def)
 
-lemma uniq_Nonce_in_anchor [dest]: "Nonce k:parts {anchor A n B} ==> k=n"
+lemma uniq_Nonce_in_anchor [dest]: "Nonce k \<in> parts {anchor A n B} \<Longrightarrow> k=n"
 by (auto simp: anchor_def chain_def sign_def)
 
-lemma uniq_Nonce_in_reqm [dest]: "[| Nonce k:parts {reqm A r n I B};
-I:agl |] ==> k=n"
+lemma uniq_Nonce_in_reqm [dest]: "[| Nonce k \<in> parts {reqm A r n I B};
+I \<in> agl |] ==> k=n"
 by (auto simp: reqm_def dest: no_Nonce_in_agl)
 
-lemma uniq_Nonce_in_prom [dest]: "[| Nonce k:parts {prom B ofr A r I L J C};
-I:agl; J:agl; Nonce k ~:parts {L} |] ==> k=ofr"
+lemma uniq_Nonce_in_prom [dest]: "[| Nonce k \<in> parts {prom B ofr A r I L J C};
+I \<in> agl; J \<in> agl; Nonce k \<notin> parts {L} |] ==> k=ofr"
 by (auto simp: prom_def dest: no_Nonce_in_agl no_Nonce_in_appdel)
 
 subsection\<open>requests are guarded\<close>
 
-lemma req_imp_Guard [rule_format]: "[| evs:p2; A ~:bad |] ==>
-req A r n I B:set evs --> Guard n {priK A} (spies evs)"
+lemma req_imp_Guard [rule_format]: "[| evs \<in> p2; A \<notin> bad |] ==>
+req A r n I B \<in> set evs \<longrightarrow> Guard n {priK A} (spies evs)"
 apply (erule p2.induct, simp)
 apply (simp add: req_def knows.simps, safe)
 apply (erule in_synth_Guard, erule Guard_analz, simp)
 by (auto simp: req_def pro_def dest: Says_imp_knows_Spy)
 
-lemma req_imp_Guard_Friend: "[| evs:p2; A ~:bad; req A r n I B:set evs |]
+lemma req_imp_Guard_Friend: "[| evs \<in> p2; A \<notin> bad; req A r n I B \<in> set evs |]
 ==> Guard n {priK A} (knows_max (Friend C) evs)"
 apply (rule Guard_knows_max')
 apply (rule_tac H="spies evs" in Guard_mono)
@@ -391,8 +391,8 @@
 
 subsection\<open>propositions are guarded\<close>
 
-lemma pro_imp_Guard [rule_format]: "[| evs:p2; B ~:bad; A ~:bad |] ==>
-pro B ofr A r I (cons M L) J C:set evs --> Guard ofr {priK A} (spies evs)"
+lemma pro_imp_Guard [rule_format]: "[| evs \<in> p2; B \<notin> bad; A \<notin> bad |] ==>
+pro B ofr A r I (cons M L) J C \<in> set evs \<longrightarrow> Guard ofr {priK A} (spies evs)"
 apply (erule p2.induct) (* +3 subgoals *)
 (* Nil *)
 apply simp
@@ -428,8 +428,8 @@
 apply (simp add: pro_def)
 by (blast dest: Says_imp_knows_Spy)
 
-lemma pro_imp_Guard_Friend: "[| evs:p2; B ~:bad; A ~:bad;
-pro B ofr A r I (cons M L) J C:set evs |]
+lemma pro_imp_Guard_Friend: "[| evs \<in> p2; B \<notin> bad; A \<notin> bad;
+pro B ofr A r I (cons M L) J C \<in> set evs |]
 ==> Guard ofr {priK A} (knows_max (Friend D) evs)"
 apply (rule Guard_knows_max')
 apply (rule_tac H="spies evs" in Guard_mono)
@@ -441,23 +441,23 @@
 subsection\<open>data confidentiality:
 no one other than the originator can decrypt the offers\<close>
 
-lemma Nonce_req_notin_spies: "[| evs:p2; req A r n I B:set evs; A ~:bad |]
-==> Nonce n ~:analz (spies evs)"
+lemma Nonce_req_notin_spies: "[| evs \<in> p2; req A r n I B \<in> set evs; A \<notin> bad |]
+==> Nonce n \<notin> analz (spies evs)"
 by (frule req_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)
 
-lemma Nonce_req_notin_knows_max_Friend: "[| evs:p2; req A r n I B:set evs;
-A ~:bad; A ~= Friend C |] ==> Nonce n ~:analz (knows_max (Friend C) evs)"
+lemma Nonce_req_notin_knows_max_Friend: "[| evs \<in> p2; req A r n I B \<in> set evs;
+A \<notin> bad; A \<noteq> Friend C |] ==> Nonce n \<notin> analz (knows_max (Friend C) evs)"
 apply (clarify, frule_tac C=C in req_imp_Guard_Friend, simp+)
 apply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)
 by (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)
 
-lemma Nonce_pro_notin_spies: "[| evs:p2; B ~:bad; A ~:bad;
-pro B ofr A r I (cons M L) J C:set evs |] ==> Nonce ofr ~:analz (spies evs)"
+lemma Nonce_pro_notin_spies: "[| evs \<in> p2; B \<notin> bad; A \<notin> bad;
+pro B ofr A r I (cons M L) J C \<in> set evs |] ==> Nonce ofr \<notin> analz (spies evs)"
 by (frule pro_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)
 
-lemma Nonce_pro_notin_knows_max_Friend: "[| evs:p2; B ~:bad; A ~:bad;
-A ~= Friend D; pro B ofr A r I (cons M L) J C:set evs |]
-==> Nonce ofr ~:analz (knows_max (Friend D) evs)"
+lemma Nonce_pro_notin_knows_max_Friend: "[| evs \<in> p2; B \<notin> bad; A \<notin> bad;
+A \<noteq> Friend D; pro B ofr A r I (cons M L) J C \<in> set evs |]
+==> Nonce ofr \<notin> analz (knows_max (Friend D) evs)"
 apply (clarify, frule_tac A=A in pro_imp_Guard_Friend, simp+)
 apply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)
 by (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)
@@ -465,71 +465,71 @@
 subsection\<open>forward privacy:
 only the originator can know the identity of the shops\<close>
 
-lemma forward_privacy_Spy: "[| evs:p2; B ~:bad; A ~:bad;
-pro B ofr A r I (cons M L) J C:set evs |]
-==> sign B (Nonce ofr) ~:analz (spies evs)"
+lemma forward_privacy_Spy: "[| evs \<in> p2; B \<notin> bad; A \<notin> bad;
+pro B ofr A r I (cons M L) J C \<in> set evs |]
+==> sign B (Nonce ofr) \<notin> analz (spies evs)"
 by (auto simp:sign_def dest: Nonce_pro_notin_spies)
 
-lemma forward_privacy_Friend: "[| evs:p2; B ~:bad; A ~:bad; A ~= Friend D;
-pro B ofr A r I (cons M L) J C:set evs |]
-==> sign B (Nonce ofr) ~:analz (knows_max (Friend D) evs)"
+lemma forward_privacy_Friend: "[| evs \<in> p2; B \<notin> bad; A \<notin> bad; A \<noteq> Friend D;
+pro B ofr A r I (cons M L) J C \<in> set evs |]
+==> sign B (Nonce ofr) \<notin> analz (knows_max (Friend D) evs)"
 by (auto simp:sign_def dest:Nonce_pro_notin_knows_max_Friend )
 
 subsection\<open>non repudiability: an offer signed by B has been sent by B\<close>
 
-lemma Crypt_reqm: "[| Crypt (priK A) X:parts {reqm A' r n I B}; I:agl |] ==> A=A'"
+lemma Crypt_reqm: "[| Crypt (priK A) X \<in> parts {reqm A' r n I B}; I \<in> agl |] ==> A=A'"
 by (auto simp: reqm_def anchor_def chain_def sign_def dest: no_Crypt_in_agl)
 
-lemma Crypt_prom: "[| Crypt (priK A) X:parts {prom B ofr A' r I L J C};
-I:agl; J:agl |] ==> A=B | Crypt (priK A) X:parts {L}"
+lemma Crypt_prom: "[| Crypt (priK A) X \<in> parts {prom B ofr A' r I L J C};
+I \<in> agl; J \<in> agl |] ==> A=B | Crypt (priK A) X \<in> parts {L}"
 apply (simp add: prom_def anchor_def chain_def sign_def)
 by (blast dest: no_Crypt_in_agl no_Crypt_in_appdel)
 
-lemma Crypt_safeness: "[| evs:p2; A ~:bad |] ==> Crypt (priK A) X:parts (spies evs)
---> (EX B Y. Says A B Y:set evs & Crypt (priK A) X:parts {Y})"
+lemma Crypt_safeness: "[| evs \<in> p2; A \<notin> bad |] ==> Crypt (priK A) X \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B Y. Says A B Y \<in> set evs & Crypt (priK A) X \<in> parts {Y})"
 apply (erule p2.induct)
 (* Nil *)
 apply simp
 (* Fake *)
 apply clarsimp
-apply (drule_tac P="%G. Crypt (priK A) X:G" in parts_insert_substD, simp)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) X \<in> G" in parts_insert_substD, simp)
 apply (erule disjE)
 apply (drule_tac K="priK A" in Crypt_synth, simp+, blast, blast)
 (* Request *)
 apply (simp add: req_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) X:G" in parts_insert_substD, simp)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) X \<in> G" in parts_insert_substD, simp)
 apply (erule disjE)
 apply (frule Crypt_reqm, simp, clarify)
 apply (rule_tac x=B in exI, rule_tac x="reqm A r n I B" in exI, simp, blast)
 (* Propose *)
 apply (simp add: pro_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) X:G" in parts_insert_substD, simp)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) X \<in> G" in parts_insert_substD, simp)
 apply (rotate_tac -1, erule disjE)
 apply (frule Crypt_prom, simp, simp)
 apply (rotate_tac -1, erule disjE)
 apply (rule_tac x=C in exI)
 apply (rule_tac x="prom B ofr Aa r I (cons M L) J C" in exI, blast)
-apply (subgoal_tac "cons M L:parts (spies evsp)")
+apply (subgoal_tac "cons M L \<in> parts (spies evsp)")
 apply (drule_tac G="{cons M L}" and H="spies evsp" in parts_trans, blast, blast)
 apply (drule Says_imp_spies, rotate_tac -1, drule parts.Inj)
 apply (drule parts.Snd, drule parts.Snd, drule parts.Snd)
 by auto
 
-lemma Crypt_Hash_imp_sign: "[| evs:p2; A ~:bad |] ==>
-Crypt (priK A) (Hash X):parts (spies evs)
---> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})"
+lemma Crypt_Hash_imp_sign: "[| evs \<in> p2; A \<notin> bad |] ==>
+Crypt (priK A) (Hash X) \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B Y. Says A B Y \<in> set evs \<and> sign A X \<in> parts {Y})"
 apply (erule p2.induct)
 (* Nil *)
 apply simp
 (* Fake *)
 apply clarsimp
-apply (drule_tac P="%G. Crypt (priK A) (Hash X):G" in parts_insert_substD)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) (Hash X) \<in> G" in parts_insert_substD)
 apply simp
 apply (erule disjE)
 apply (drule_tac K="priK A" in Crypt_synth, simp+, blast, blast)
 (* Request *)
 apply (simp add: req_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) (Hash X):G" in parts_insert_substD)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) (Hash X) \<in> G" in parts_insert_substD)
 apply simp
 apply (erule disjE)
 apply (frule Crypt_reqm, simp+)
@@ -538,7 +538,7 @@
 apply (simp add: chain_def sign_def, blast)
 (* Propose *)
 apply (simp add: pro_def, clarify)
-apply (drule_tac P="%G. Crypt (priK A) (Hash X):G" in parts_insert_substD)
+apply (drule_tac P="\<lambda>G. Crypt (priK A) (Hash X) \<in> G" in parts_insert_substD)
 apply simp
 apply (rotate_tac -1, erule disjE)
 apply (simp add: prom_def sign_def no_Crypt_in_agl no_Crypt_in_appdel)
@@ -552,8 +552,8 @@
 apply (blast del: MPair_parts)+
 done
 
-lemma sign_safeness: "[| evs:p2; A ~:bad |] ==> sign A X:parts (spies evs)
---> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})"
+lemma sign_safeness: "[| evs \<in> p2; A \<notin> bad |] ==> sign A X \<in> parts (spies evs)
+\<longrightarrow> (\<exists>B Y. Says A B Y \<in> set evs \<and> sign A X \<in> parts {Y})"
 apply (clarify, simp add: sign_def, frule parts.Snd)
 apply (blast dest: Crypt_Hash_imp_sign [unfolded sign_def])
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Guard/Proto.thy
--- a/src/HOL/Auth/Guard/Proto.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Guard/Proto.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -18,8 +18,8 @@
 type_synonym proto = "rule set"
 
 definition wdef :: "proto => bool" where
-"wdef p == ALL R k. R:p --> Number k:parts {msg' R}
---> Number k:parts (msg`(fst R))"
+"wdef p \<equiv> \<forall>R k. R \<in> p \<longrightarrow> Number k \<in> parts {msg' R}
+\<longrightarrow> Number k \<in> parts (msg`(fst R))"
 
 subsection\<open>substitutions\<close>
 
@@ -36,89 +36,89 @@
 | "apm s (Key K) = Key (key s K)"
 | "apm s (Hash X) = Hash (apm s X)"
 | "apm s (Crypt K X) = (
-if (EX A. K = pubK A) then Crypt (pubK (agent s (agt K))) (apm s X)
-else if (EX A. K = priK A) then Crypt (priK (agent s (agt K))) (apm s X)
+if (\<exists>A. K = pubK A) then Crypt (pubK (agent s (agt K))) (apm s X)
+else if (\<exists>A. K = priK A) then Crypt (priK (agent s (agt K))) (apm s X)
 else Crypt (key s K) (apm s X))"
 | "apm s \<lbrace>X,Y\<rbrace> = \<lbrace>apm s X, apm s Y\<rbrace>"
 
-lemma apm_parts: "X:parts {Y} ==> apm s X:parts {apm s Y}"
+lemma apm_parts: "X \<in> parts {Y} \<Longrightarrow> apm s X \<in> parts {apm s Y}"
 apply (erule parts.induct, simp_all, blast)
 apply (erule parts.Fst)
 apply (erule parts.Snd)
 by (erule parts.Body)+
 
-lemma Nonce_apm [rule_format]: "Nonce n:parts {apm s X} ==>
-(ALL k. Number k:parts {X} --> Nonce n ~:parts {nb s k}) -->
-(EX k. Nonce k:parts {X} & nonce s k = n)"
+lemma Nonce_apm [rule_format]: "Nonce n \<in> parts {apm s X} \<Longrightarrow>
+(\<forall>k. Number k \<in> parts {X} \<longrightarrow> Nonce n \<notin> parts {nb s k}) \<longrightarrow>
+(\<exists>k. Nonce k \<in> parts {X} \<and> nonce s k = n)"
 by (induct X, simp_all, blast)
 
-lemma wdef_Nonce: "[| Nonce n:parts {apm s X}; R:p; msg' R = X; wdef p;
-Nonce n ~:parts (apm s `(msg `(fst R))) |] ==>
-(EX k. Nonce k:parts {X} & nonce s k = n)"
+lemma wdef_Nonce: "[| Nonce n \<in> parts {apm s X}; R \<in> p; msg' R = X; wdef p;
+Nonce n \<notin> parts (apm s `(msg `(fst R))) |] ==>
+(\<exists>k. Nonce k \<in> parts {X} \<and> nonce s k = n)"
 apply (erule Nonce_apm, unfold wdef_def)
 apply (drule_tac x=R in spec, drule_tac x=k in spec, clarsimp)
 apply (drule_tac x=x in bspec, simp)
 apply (drule_tac Y="msg x" and s=s in apm_parts, simp)
 by (blast dest: parts_parts)
 
-primrec ap :: "subs => event => event" where
+primrec ap :: "subs \<Rightarrow> event \<Rightarrow> event" where
   "ap s (Says A B X) = Says (agent s A) (agent s B) (apm s X)"
 | "ap s (Gets A X) = Gets (agent s A) (apm s X)"
 | "ap s (Notes A X) = Notes (agent s A) (apm s X)"
 
 abbreviation
-  ap' :: "subs => rule => event" where
-  "ap' s R == ap s (snd R)"
+  ap' :: "subs \<Rightarrow> rule \<Rightarrow> event" where
+  "ap' s R \<equiv> ap s (snd R)"
 
 abbreviation
-  apm' :: "subs => rule => msg" where
-  "apm' s R == apm s (msg' R)"
+  apm' :: "subs \<Rightarrow> rule \<Rightarrow> msg" where
+  "apm' s R \<equiv> apm s (msg' R)"
 
 abbreviation
-  priK' :: "subs => agent => key" where
-  "priK' s A == priK (agent s A)"
+  priK' :: "subs \<Rightarrow> agent \<Rightarrow> key" where
+  "priK' s A \<equiv> priK (agent s A)"
 
 abbreviation
-  pubK' :: "subs => agent => key" where
-  "pubK' s A == pubK (agent s A)"
+  pubK' :: "subs \<Rightarrow> agent \<Rightarrow> key" where
+  "pubK' s A \<equiv> pubK (agent s A)"
 
 subsection\<open>nonces generated by a rule\<close>
 
-definition newn :: "rule => nat set" where
-"newn R == {n. Nonce n:parts {msg (snd R)} & Nonce n ~:parts (msg`(fst R))}"
+definition newn :: "rule \<Rightarrow> nat set" where
+"newn R \<equiv> {n. Nonce n \<in> parts {msg (snd R)} \<and> Nonce n \<notin> parts (msg`(fst R))}"
 
-lemma newn_parts: "n:newn R ==> Nonce (nonce s n):parts {apm' s R}"
+lemma newn_parts: "n \<in> newn R \<Longrightarrow> Nonce (nonce s n) \<in> parts {apm' s R}"
 by (auto simp: newn_def dest: apm_parts)
 
 subsection\<open>traces generated by a protocol\<close>
 
-definition ok :: "event list => rule => subs => bool" where
-"ok evs R s == ((ALL x. x:fst R --> ap s x:set evs)
-& (ALL n. n:newn R --> Nonce (nonce s n) ~:used evs))"
+definition ok :: "event list \<Rightarrow> rule \<Rightarrow> subs \<Rightarrow> bool" where
+"ok evs R s \<equiv> ((\<forall>x. x \<in> fst R \<longrightarrow> ap s x \<in> set evs)
+\<and> (\<forall>n. n \<in> newn R \<longrightarrow> Nonce (nonce s n) \<notin> used evs))"
 
 inductive_set
   tr :: "proto => event list set"
   for p :: proto
 where
 
-  Nil [intro]: "[]:tr p"
+  Nil [intro]: "[] \<in> tr p"
 
-| Fake [intro]: "[| evsf:tr p; X:synth (analz (spies evsf)) |]
-  ==> Says Spy B X # evsf:tr p"
+| Fake [intro]: "[| evsf \<in> tr p; X \<in> synth (analz (spies evsf)) |]
+  ==> Says Spy B X # evsf \<in> tr p"
 
-| Proto [intro]: "[| evs:tr p; R:p; ok evs R s |] ==> ap' s R # evs:tr p"
+| Proto [intro]: "[| evs \<in> tr p; R \<in> p; ok evs R s |] ==> ap' s R # evs \<in> tr p"
 
 subsection\<open>general properties\<close>
 
 lemma one_step_tr [iff]: "one_step (tr p)"
 apply (unfold one_step_def, clarify)
-by (ind_cases "ev # evs:tr p" for ev evs, auto)
+by (ind_cases "ev # evs \<in> tr p" for ev evs, auto)
 
 definition has_only_Says' :: "proto => bool" where
-"has_only_Says' p == ALL R. R:p --> is_Says (snd R)"
+"has_only_Says' p \<equiv> \<forall>R. R \<in> p \<longrightarrow> is_Says (snd R)"
 
-lemma has_only_Says'D: "[| R:p; has_only_Says' p |]
-==> (EX A B X. snd R = Says A B X)"
+lemma has_only_Says'D: "[| R \<in> p; has_only_Says' p |]
+==> (\<exists>A B X. snd R = Says A B X)"
 by (unfold has_only_Says'_def is_Says_def, blast)
 
 lemma has_only_Says_tr [simp]: "has_only_Says' p ==> has_only_Says (tr p)"
@@ -129,17 +129,17 @@
 by (drule_tac x=a in spec, auto simp: is_Says_def)
 
 lemma has_only_Says'_in_trD: "[| has_only_Says' p; list @ ev # evs1 \<in> tr p |]
-==> (EX A B X. ev = Says A B X)"
+==> (\<exists>A B X. ev = Says A B X)"
 by (drule has_only_Says_tr, auto)
 
-lemma ok_not_used: "[| Nonce n ~:used evs; ok evs R s;
-ALL x. x:fst R --> is_Says x |] ==> Nonce n ~:parts (apm s `(msg `(fst R)))"
+lemma ok_not_used: "[| Nonce n \<notin> used evs; ok evs R s;
+\<forall>x. x \<in> fst R \<longrightarrow> is_Says x |] ==> Nonce n \<notin> parts (apm s `(msg `(fst R)))"
 apply (unfold ok_def, clarsimp)
 apply (drule_tac x=x in spec, drule_tac x=x in spec)
 by (auto simp: is_Says_def dest: Says_imp_spies not_used_not_spied parts_parts)
 
-lemma ok_is_Says: "[| evs' @ ev # evs:tr p; ok evs R s; has_only_Says' p;
-R:p; x:fst R |] ==> is_Says x"
+lemma ok_is_Says: "[| evs' @ ev # evs \<in> tr p; ok evs R s; has_only_Says' p;
+R \<in> p; x \<in> fst R |] ==> is_Says x"
 apply (unfold ok_def is_Says_def, clarify)
 apply (drule_tac x=x in spec, simp)
 apply (subgoal_tac "one_step (tr p)")
@@ -149,42 +149,42 @@
 
 subsection\<open>types\<close>
 
-type_synonym keyfun = "rule => subs => nat => event list => key set"
+type_synonym keyfun = "rule \<Rightarrow> subs \<Rightarrow> nat \<Rightarrow> event list \<Rightarrow> key set"
 
-type_synonym secfun = "rule => nat => subs => key set => msg"
+type_synonym secfun = "rule \<Rightarrow> nat \<Rightarrow> subs \<Rightarrow> key set \<Rightarrow> msg"
 
 subsection\<open>introduction of a fresh guarded nonce\<close>
 
-definition fresh :: "proto => rule => subs => nat => key set => event list
-=> bool" where
-"fresh p R s n Ks evs == (EX evs1 evs2. evs = evs2 @ ap' s R # evs1
-& Nonce n ~:used evs1 & R:p & ok evs1 R s & Nonce n:parts {apm' s R}
-& apm' s R:guard n Ks)"
+definition fresh :: "proto \<Rightarrow> rule \<Rightarrow> subs \<Rightarrow> nat \<Rightarrow> key set \<Rightarrow> event list
+\<Rightarrow> bool" where
+"fresh p R s n Ks evs \<equiv> (\<exists>evs1 evs2. evs = evs2 @ ap' s R # evs1
+\<and> Nonce n \<notin> used evs1 \<and> R \<in> p \<and> ok evs1 R s \<and> Nonce n \<in> parts {apm' s R}
+\<and> apm' s R \<in> guard n Ks)"
 
-lemma freshD: "fresh p R s n Ks evs ==> (EX evs1 evs2.
-evs = evs2 @ ap' s R # evs1 & Nonce n ~:used evs1 & R:p & ok evs1 R s
-& Nonce n:parts {apm' s R} & apm' s R:guard n Ks)"
+lemma freshD: "fresh p R s n Ks evs \<Longrightarrow> (\<exists>evs1 evs2.
+evs = evs2 @ ap' s R # evs1 \<and> Nonce n \<notin> used evs1 \<and> R \<in> p \<and> ok evs1 R s
+\<and> Nonce n \<in> parts {apm' s R} \<and> apm' s R \<in> guard n Ks)"
 by (unfold fresh_def, blast)
 
-lemma freshI [intro]: "[| Nonce n ~:used evs1; R:p; Nonce n:parts {apm' s R};
-ok evs1 R s; apm' s R:guard n Ks |]
+lemma freshI [intro]: "[| Nonce n \<notin> used evs1; R \<in> p; Nonce n \<in> parts {apm' s R};
+ok evs1 R s; apm' s R \<in> guard n Ks |]
 ==> fresh p R s n Ks (list @ ap' s R # evs1)"
 by (unfold fresh_def, blast)
 
-lemma freshI': "[| Nonce n ~:used evs1; (l,r):p;
-Nonce n:parts {apm s (msg r)}; ok evs1 (l,r) s; apm s (msg r):guard n Ks |]
+lemma freshI': "[| Nonce n \<notin> used evs1; (l,r) \<in> p;
+Nonce n \<in> parts {apm s (msg r)}; ok evs1 (l,r) s; apm s (msg r) \<in> guard n Ks |]
 ==> fresh p (l,r) s n Ks (evs2 @ ap s r # evs1)"
 by (drule freshI, simp+)
 
 lemma fresh_used: "[| fresh p R' s' n Ks evs; has_only_Says' p |]
-==> Nonce n:used evs"
+==> Nonce n \<in> used evs"
 apply (unfold fresh_def, clarify)
 apply (drule has_only_Says'D)
 by (auto intro: parts_used_app)
 
-lemma fresh_newn: "[| evs' @ ap' s R # evs:tr p; wdef p; has_only_Says' p;
-Nonce n ~:used evs; R:p; ok evs R s; Nonce n:parts {apm' s R} |]
-==> EX k. k:newn R & nonce s k = n"
+lemma fresh_newn: "[| evs' @ ap' s R # evs \<in> tr p; wdef p; has_only_Says' p;
+Nonce n \<notin> used evs; R \<in> p; ok evs R s; Nonce n \<in> parts {apm' s R} |]
+==> \<exists>k. k \<in> newn R \<and> nonce s k = n"
 apply (drule wdef_Nonce, simp+)
 apply (frule ok_not_used, simp+)
 apply (clarify, erule ok_is_Says, simp+)
@@ -193,22 +193,22 @@
 apply (drule ok_not_used, simp+)
 by (clarify, erule ok_is_Says, simp_all)
 
-lemma fresh_rule: "[| evs' @ ev # evs:tr p; wdef p; Nonce n ~:used evs;
-Nonce n:parts {msg ev} |] ==> EX R s. R:p & ap' s R = ev"
-apply (drule trunc, simp, ind_cases "ev # evs:tr p", simp)
+lemma fresh_rule: "[| evs' @ ev # evs \<in> tr p; wdef p; Nonce n \<notin> used evs;
+Nonce n \<in> parts {msg ev} |] ==> \<exists>R s. R \<in> p \<and> ap' s R = ev"
+apply (drule trunc, simp, ind_cases "ev # evs \<in> tr p", simp)
 by (drule_tac x=X in in_sub, drule parts_sub, simp, simp, blast+)
 
-lemma fresh_ruleD: "[| fresh p R' s' n Ks evs; keys R' s' n evs <= Ks; wdef p;
-has_only_Says' p; evs:tr p; ALL R k s. nonce s k = n --> Nonce n:used evs -->
-R:p --> k:newn R --> Nonce n:parts {apm' s R} --> apm' s R:guard n Ks -->
-apm' s R:parts (spies evs) --> keys R s n evs <= Ks --> P |] ==> P"
+lemma fresh_ruleD: "[| fresh p R' s' n Ks evs; keys R' s' n evs \<subseteq> Ks; wdef p;
+has_only_Says' p; evs \<in> tr p; \<forall>R k s. nonce s k = n \<longrightarrow> Nonce n \<in> used evs \<longrightarrow>
+R \<in> p \<longrightarrow> k \<in> newn R \<longrightarrow> Nonce n \<in> parts {apm' s R} \<longrightarrow> apm' s R \<in> guard n Ks \<longrightarrow>
+apm' s R \<in> parts (spies evs) \<longrightarrow> keys R s n evs \<subseteq> Ks \<longrightarrow> P |] ==> P"
 apply (frule fresh_used, simp)
 apply (unfold fresh_def, clarify)
 apply (drule_tac x=R' in spec)
 apply (drule fresh_newn, simp+, clarify)
 apply (drule_tac x=k in spec)
 apply (drule_tac x=s' in spec)
-apply (subgoal_tac "apm' s' R':parts (spies (evs2 @ ap' s' R' # evs1))")
+apply (subgoal_tac "apm' s' R' \<in> parts (spies (evs2 @ ap' s' R' # evs1))")
 apply (case_tac R', drule has_only_Says'D, simp, clarsimp)
 apply (case_tac R', drule has_only_Says'D, simp, clarsimp)
 apply (rule_tac Y="apm s' X" in parts_parts, blast)
@@ -216,50 +216,50 @@
 
 subsection\<open>safe keys\<close>
 
-definition safe :: "key set => msg set => bool" where
-"safe Ks G == ALL K. K:Ks --> Key K ~:analz G"
+definition safe :: "key set \<Rightarrow> msg set \<Rightarrow> bool" where
+"safe Ks G \<equiv> \<forall>K. K \<in> Ks \<longrightarrow> Key K \<notin> analz G"
 
-lemma safeD [dest]: "[| safe Ks G; K:Ks |] ==> Key K ~:analz G"
+lemma safeD [dest]: "[| safe Ks G; K \<in> Ks |] ==> Key K \<notin> analz G"
 by (unfold safe_def, blast)
 
 lemma safe_insert: "safe Ks (insert X G) ==> safe Ks G"
 by (unfold safe_def, blast)
 
-lemma Guard_safe: "[| Guard n Ks G; safe Ks G |] ==> Nonce n ~:analz G"
+lemma Guard_safe: "[| Guard n Ks G; safe Ks G |] ==> Nonce n \<notin> analz G"
 by (blast dest: Guard_invKey)
 
 subsection\<open>guardedness preservation\<close>
 
-definition preserv :: "proto => keyfun => nat => key set => bool" where
-"preserv p keys n Ks == (ALL evs R' s' R s. evs:tr p -->
-Guard n Ks (spies evs) --> safe Ks (spies evs) --> fresh p R' s' n Ks evs -->
-keys R' s' n evs <= Ks --> R:p --> ok evs R s --> apm' s R:guard n Ks)"
+definition preserv :: "proto \<Rightarrow> keyfun \<Rightarrow> nat \<Rightarrow> key set \<Rightarrow> bool" where
+"preserv p keys n Ks \<equiv> (\<forall>evs R' s' R s. evs \<in> tr p \<longrightarrow>
+Guard n Ks (spies evs) \<longrightarrow> safe Ks (spies evs) \<longrightarrow> fresh p R' s' n Ks evs \<longrightarrow>
+keys R' s' n evs \<subseteq> Ks \<longrightarrow> R \<in> p \<longrightarrow> ok evs R s \<longrightarrow> apm' s R \<in> guard n Ks)"
 
-lemma preservD: "[| preserv p keys n Ks; evs:tr p; Guard n Ks (spies evs);
-safe Ks (spies evs); fresh p R' s' n Ks evs; R:p; ok evs R s;
-keys R' s' n evs <= Ks |] ==> apm' s R:guard n Ks"
+lemma preservD: "[| preserv p keys n Ks; evs \<in> tr p; Guard n Ks (spies evs);
+safe Ks (spies evs); fresh p R' s' n Ks evs; R \<in> p; ok evs R s;
+keys R' s' n evs \<subseteq> Ks |] ==> apm' s R \<in> guard n Ks"
 by (unfold preserv_def, blast)
 
-lemma preservD': "[| preserv p keys n Ks; evs:tr p; Guard n Ks (spies evs);
-safe Ks (spies evs); fresh p R' s' n Ks evs; (l,Says A B X):p;
-ok evs (l,Says A B X) s; keys R' s' n evs <= Ks |] ==> apm s X:guard n Ks"
+lemma preservD': "[| preserv p keys n Ks; evs \<in> tr p; Guard n Ks (spies evs);
+safe Ks (spies evs); fresh p R' s' n Ks evs; (l,Says A B X) \<in> p;
+ok evs (l,Says A B X) s; keys R' s' n evs \<subseteq> Ks |] ==> apm s X \<in> guard n Ks"
 by (drule preservD, simp+)
 
 subsection\<open>monotonic keyfun\<close>
 
 definition monoton :: "proto => keyfun => bool" where
-"monoton p keys == ALL R' s' n ev evs. ev # evs:tr p -->
-keys R' s' n evs <= keys R' s' n (ev # evs)"
+"monoton p keys \<equiv> \<forall>R' s' n ev evs. ev # evs \<in> tr p \<longrightarrow>
+keys R' s' n evs \<subseteq> keys R' s' n (ev # evs)"
 
-lemma monotonD [dest]: "[| keys R' s' n (ev # evs) <= Ks; monoton p keys;
-ev # evs:tr p |] ==> keys R' s' n evs <= Ks"
+lemma monotonD [dest]: "[| keys R' s' n (ev # evs) \<subseteq> Ks; monoton p keys;
+ev # evs \<in> tr p |] ==> keys R' s' n evs \<subseteq> Ks"
 by (unfold monoton_def, blast)
 
 subsection\<open>guardedness theorem\<close>
 
-lemma Guard_tr [rule_format]: "[| evs:tr p; has_only_Says' p;
+lemma Guard_tr [rule_format]: "[| evs \<in> tr p; has_only_Says' p;
 preserv p keys n Ks; monoton p keys; Guard n Ks (initState Spy) |] ==>
-safe Ks (spies evs) --> fresh p R' s' n Ks evs --> keys R' s' n evs <= Ks -->
+safe Ks (spies evs) \<longrightarrow> fresh p R' s' n Ks evs \<longrightarrow> keys R' s' n evs \<subseteq> Ks \<longrightarrow>
 Guard n Ks (spies evs)"
 apply (erule tr.induct)
 (* Nil *)
@@ -297,59 +297,59 @@
 
 subsection\<open>useful properties for guardedness\<close>
 
-lemma newn_neq_used: "[| Nonce n:used evs; ok evs R s; k:newn R |]
-==> n ~= nonce s k"
+lemma newn_neq_used: "[| Nonce n \<in> used evs; ok evs R s; k \<in> newn R |]
+==> n \<noteq> nonce s k"
 by (auto simp: ok_def)
 
-lemma ok_Guard: "[| ok evs R s; Guard n Ks (spies evs); x:fst R; is_Says x |]
-==> apm s (msg x):parts (spies evs) & apm s (msg x):guard n Ks"
+lemma ok_Guard: "[| ok evs R s; Guard n Ks (spies evs); x \<in> fst R; is_Says x |]
+==> apm s (msg x) \<in> parts (spies evs) \<and> apm s (msg x) \<in> guard n Ks"
 apply (unfold ok_def is_Says_def, clarify)
 apply (drule_tac x="Says A B X" in spec, simp)
 by (drule Says_imp_spies, auto intro: parts_parts)
 
-lemma ok_parts_not_new: "[| Y:parts (spies evs); Nonce (nonce s n):parts {Y};
-ok evs R s |] ==> n ~:newn R"
+lemma ok_parts_not_new: "[| Y \<in> parts (spies evs); Nonce (nonce s n) \<in> parts {Y};
+ok evs R s |] ==> n \<notin> newn R"
 by (auto simp: ok_def dest: not_used_not_spied parts_parts)
 
 subsection\<open>unicity\<close>
 
-definition uniq :: "proto => secfun => bool" where
-"uniq p secret == ALL evs R R' n n' Ks s s'. R:p --> R':p -->
-n:newn R --> n':newn R' --> nonce s n = nonce s' n' -->
-Nonce (nonce s n):parts {apm' s R} --> Nonce (nonce s n):parts {apm' s' R'} -->
-apm' s R:guard (nonce s n) Ks --> apm' s' R':guard (nonce s n) Ks -->
-evs:tr p --> Nonce (nonce s n) ~:analz (spies evs) -->
-secret R n s Ks:parts (spies evs) --> secret R' n' s' Ks:parts (spies evs) -->
+definition uniq :: "proto \<Rightarrow> secfun \<Rightarrow> bool" where
+"uniq p secret \<equiv> \<forall>evs R R' n n' Ks s s'. R \<in> p \<longrightarrow> R' \<in> p \<longrightarrow>
+n \<in> newn R \<longrightarrow> n' \<in> newn R' \<longrightarrow> nonce s n = nonce s' n' \<longrightarrow>
+Nonce (nonce s n) \<in> parts {apm' s R} \<longrightarrow> Nonce (nonce s n) \<in> parts {apm' s' R'} \<longrightarrow>
+apm' s R \<in> guard (nonce s n) Ks \<longrightarrow> apm' s' R' \<in> guard (nonce s n) Ks \<longrightarrow>
+evs \<in> tr p \<longrightarrow> Nonce (nonce s n) \<notin> analz (spies evs) \<longrightarrow>
+secret R n s Ks \<in> parts (spies evs) \<longrightarrow> secret R' n' s' Ks \<in> parts (spies evs) \<longrightarrow>
 secret R n s Ks = secret R' n' s' Ks"
 
-lemma uniqD: "[| uniq p secret; evs: tr p; R:p; R':p; n:newn R; n':newn R';
-nonce s n = nonce s' n'; Nonce (nonce s n) ~:analz (spies evs);
-Nonce (nonce s n):parts {apm' s R}; Nonce (nonce s n):parts {apm' s' R'};
-secret R n s Ks:parts (spies evs); secret R' n' s' Ks:parts (spies evs);
-apm' s R:guard (nonce s n) Ks; apm' s' R':guard (nonce s n) Ks |] ==>
+lemma uniqD: "[| uniq p secret; evs \<in> tr p; R \<in> p; R' \<in> p; n \<in> newn R; n' \<in> newn R';
+nonce s n = nonce s' n'; Nonce (nonce s n) \<notin> analz (spies evs);
+Nonce (nonce s n) \<in> parts {apm' s R}; Nonce (nonce s n) \<in> parts {apm' s' R'};
+secret R n s Ks \<in> parts (spies evs); secret R' n' s' Ks \<in> parts (spies evs);
+apm' s R \<in> guard (nonce s n) Ks; apm' s' R' \<in> guard (nonce s n) Ks |] ==>
 secret R n s Ks = secret R' n' s' Ks"
 by (unfold uniq_def, blast)
 
-definition ord :: "proto => (rule => rule => bool) => bool" where
-"ord p inff == ALL R R'. R:p --> R':p --> ~ inff R R' --> inff R' R"
+definition ord :: "proto \<Rightarrow> (rule \<Rightarrow> rule \<Rightarrow> bool) \<Rightarrow> bool" where
+"ord p inff \<equiv> \<forall>R R'. R \<in> p \<longrightarrow> R' \<in> p \<longrightarrow> \<not> inff R R' \<longrightarrow> inff R' R"
 
-lemma ordD: "[| ord p inff; ~ inff R R'; R:p; R':p |] ==> inff R' R"
+lemma ordD: "[| ord p inff; \<not> inff R R'; R \<in> p; R' \<in> p |] ==> inff R' R"
 by (unfold ord_def, blast)
 
-definition uniq' :: "proto => (rule => rule => bool) => secfun => bool" where
-"uniq' p inff secret == ALL evs R R' n n' Ks s s'. R:p --> R':p -->
-inff R R' --> n:newn R --> n':newn R' --> nonce s n = nonce s' n' -->
-Nonce (nonce s n):parts {apm' s R} --> Nonce (nonce s n):parts {apm' s' R'} -->
-apm' s R:guard (nonce s n) Ks --> apm' s' R':guard (nonce s n) Ks -->
-evs:tr p --> Nonce (nonce s n) ~:analz (spies evs) -->
-secret R n s Ks:parts (spies evs) --> secret R' n' s' Ks:parts (spies evs) -->
+definition uniq' :: "proto \<Rightarrow> (rule \<Rightarrow> rule \<Rightarrow> bool) \<Rightarrow> secfun \<Rightarrow> bool" where
+"uniq' p inff secret \<equiv> \<forall>evs R R' n n' Ks s s'. R \<in> p \<longrightarrow> R' \<in> p \<longrightarrow>
+inff R R' \<longrightarrow> n \<in> newn R \<longrightarrow> n' \<in> newn R' \<longrightarrow> nonce s n = nonce s' n' \<longrightarrow>
+Nonce (nonce s n) \<in> parts {apm' s R} \<longrightarrow> Nonce (nonce s n) \<in> parts {apm' s' R'} \<longrightarrow>
+apm' s R \<in> guard (nonce s n) Ks \<longrightarrow> apm' s' R' \<in> guard (nonce s n) Ks \<longrightarrow>
+evs \<in> tr p \<longrightarrow> Nonce (nonce s n) \<notin> analz (spies evs) \<longrightarrow>
+secret R n s Ks \<in> parts (spies evs) \<longrightarrow> secret R' n' s' Ks \<in> parts (spies evs) \<longrightarrow>
 secret R n s Ks = secret R' n' s' Ks"
 
-lemma uniq'D: "[| uniq' p inff secret; evs: tr p; inff R R'; R:p; R':p; n:newn R;
-n':newn R'; nonce s n = nonce s' n'; Nonce (nonce s n) ~:analz (spies evs);
-Nonce (nonce s n):parts {apm' s R}; Nonce (nonce s n):parts {apm' s' R'};
-secret R n s Ks:parts (spies evs); secret R' n' s' Ks:parts (spies evs);
-apm' s R:guard (nonce s n) Ks; apm' s' R':guard (nonce s n) Ks |] ==>
+lemma uniq'D: "[| uniq' p inff secret; evs \<in> tr p; inff R R'; R \<in> p; R' \<in> p; n \<in> newn R;
+n' \<in> newn R'; nonce s n = nonce s' n'; Nonce (nonce s n) \<notin> analz (spies evs);
+Nonce (nonce s n) \<in> parts {apm' s R}; Nonce (nonce s n) \<in> parts {apm' s' R'};
+secret R n s Ks \<in> parts (spies evs); secret R' n' s' Ks \<in> parts (spies evs);
+apm' s R \<in> guard (nonce s n) Ks; apm' s' R' \<in> guard (nonce s n) Ks |] ==>
 secret R n s Ks = secret R' n' s' Ks"
 by (unfold uniq'_def, blast)
 
@@ -385,9 +385,9 @@
     Says a b (Crypt (pubK b) (Nonce Nb)))"
 
 inductive_set ns :: proto where
-  [iff]: "ns1:ns"
-| [iff]: "ns2:ns"
-| [iff]: "ns3:ns"
+  [iff]: "ns1 \<in> ns"
+| [iff]: "ns2 \<in> ns"
+| [iff]: "ns3 \<in> ns"
 
 abbreviation (input)
   ns3a :: event where
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/KerberosIV.thy
--- a/src/HOL/Auth/KerberosIV.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/KerberosIV.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -22,7 +22,7 @@
 
 definition
  (* authKeys are those contained in an authTicket *)
-    authKeys :: "event list => key set" where
+    authKeys :: "event list \<Rightarrow> key set" where
     "authKeys evs = {authK. \<exists>A Peer Ta. Says Kas A
                         (Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Number Ta,
                (Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Number Ta\<rbrace>)
@@ -31,21 +31,21 @@
 definition
  (* A is the true creator of X if she has sent X and X never appeared on
     the trace before this event. Recall that traces grow from head. *)
-  Issues :: "[agent, agent, msg, event list] => bool"
+  Issues :: "[agent, agent, msg, event list] \<Rightarrow> bool"
              ("_ Issues _ with _ on _" [50, 0, 0, 50] 50) where
    "(A Issues B with X on evs) =
-      (\<exists>Y. Says A B Y \<in> set evs & X \<in> parts {Y} &
-        X \<notin> parts (spies (takeWhile (% z. z  \<noteq> Says A B Y) (rev evs))))"
+      (\<exists>Y. Says A B Y \<in> set evs \<and> X \<in> parts {Y} \<and>
+        X \<notin> parts (spies (takeWhile (\<lambda>z. z \<noteq> Says A B Y) (rev evs))))"
 
 definition
  (* Yields the subtrace of a given trace from its beginning to a given event *)
-  before :: "[event, event list] => event list" ("before _ on _" [0, 50] 50)
-  where "(before ev on evs) = takeWhile (% z. z ~= ev) (rev evs)"
+  before :: "[event, event list] \<Rightarrow> event list" ("before _ on _" [0, 50] 50)
+  where "(before ev on evs) = takeWhile (\<lambda>z. z \<noteq> ev) (rev evs)"
 
 definition
  (* States than an event really appears only once on a trace *)
-  Unique :: "[event, event list] => bool" ("Unique _ on _" [0, 50] 50)
-  where "(Unique ev on evs) = (ev \<notin> set (tl (dropWhile (% z. z \<noteq> ev) evs)))"
+  Unique :: "[event, event list] \<Rightarrow> bool" ("Unique _ on _" [0, 50] 50)
+  where "(Unique ev on evs) = (ev \<notin> set (tl (dropWhile (\<lambda>z. z \<noteq> ev) evs)))"
 
 
 consts
@@ -79,30 +79,30 @@
 
 abbreviation
   (*The current time is the length of the trace*)
-  CT :: "event list=>nat" where
+  CT :: "event list \<Rightarrow> nat" where
   "CT == length"
 
 abbreviation
-  expiredAK :: "[nat, event list] => bool" where
+  expiredAK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredAK Ta evs == authKlife + Ta < CT evs"
 
 abbreviation
-  expiredSK :: "[nat, event list] => bool" where
+  expiredSK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredSK Ts evs == servKlife + Ts < CT evs"
 
 abbreviation
-  expiredA :: "[nat, event list] => bool" where
+  expiredA :: "[nat, event list] \<Rightarrow> bool" where
   "expiredA T evs == authlife + T < CT evs"
 
 abbreviation
-  valid :: "[nat, nat] => bool" ("valid _ wrt _" [0, 50] 50) where
-  "valid T1 wrt T2 == T1 <= replylife + T2"
+  valid :: "[nat, nat] \<Rightarrow> bool" ("valid _ wrt _" [0, 50] 50) where
+  "valid T1 wrt T2 == T1 \<le> replylife + T2"
 
 (*---------------------------------------------------------------------*)
 
 
 (* Predicate formalising the association between authKeys and servKeys *)
-definition AKcryptSK :: "[key, key, event list] => bool" where
+definition AKcryptSK :: "[key, key, event list] \<Rightarrow> bool" where
   "AKcryptSK authK servK evs ==
      \<exists>A B Ts.
        Says Tgs A (Crypt authK
@@ -175,7 +175,7 @@
                 \<in> set evs4;
             \<not> expiredAK Ta evs4;
             \<not> expiredA T2 evs4;
-            servKlife + (CT evs4) <= authKlife + Ta
+            servKlife + (CT evs4) \<le> authKlife + Ta
          \<rbrakk>
           \<Longrightarrow> Says Tgs A
                 (Crypt authK \<lbrace>Key servK, Agent B, Number (CT evs4),
@@ -267,7 +267,7 @@
 done
 
 lemma spies_Notes_rev: "spies (evs @ [Notes A X]) =
-          (if A:bad then insert X (spies evs) else spies evs)"
+          (if A\<in>bad then insert X (spies evs) else spies evs)"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] a, auto)
@@ -282,7 +282,7 @@
 
 lemmas parts_spies_evs_revD2 = spies_evs_rev [THEN equalityD2, THEN parts_mono]
 
-lemma spies_takeWhile: "spies (takeWhile P evs) <=  spies evs"
+lemma spies_takeWhile: "spies (takeWhile P evs) \<subseteq> spies evs"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
@@ -341,7 +341,7 @@
 lemma Oops_range_spies1:
      "\<lbrakk> Says Kas A (Crypt KeyA \<lbrace>Key authK, Peer, Ta, authTicket\<rbrace>)
            \<in> set evs ;
-         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys"
+         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys"
 apply (erule rev_mp)
 apply (erule kerbIV.induct, auto)
 done
@@ -355,7 +355,7 @@
 lemma Oops_range_spies2:
      "\<lbrakk> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace>)
            \<in> set evs ;
-         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> servK \<notin> range shrK & servK \<in> symKeys"
+         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys"
 apply (erule rev_mp)
 apply (erule kerbIV.induct, auto)
 done
@@ -379,7 +379,7 @@
 by auto
 
 lemma Spy_see_shrK_D [dest!]:
-     "\<lbrakk> Key (shrK A) \<in> parts (spies evs);  evs \<in> kerbIV \<rbrakk> \<Longrightarrow> A:bad"
+     "\<lbrakk> Key (shrK A) \<in> parts (spies evs);  evs \<in> kerbIV \<rbrakk> \<Longrightarrow> A\<in>bad"
 by (blast dest: Spy_see_shrK)
 
 lemmas Spy_analz_shrK_D = analz_subset_parts [THEN subsetD, THEN Spy_see_shrK_D, dest!]
@@ -444,7 +444,7 @@
 done
 
 lemma used_takeWhile_used [rule_format]: 
-      "x : used (takeWhile P X) --> x : used X"
+      "x \<in> used (takeWhile P X) \<longrightarrow> x \<in> used X"
 apply (induct_tac "X")
 apply simp
 apply (rename_tac a b)
@@ -469,12 +469,12 @@
      "\<lbrakk> Says Kas A (Crypt K \<lbrace>Key authK, Agent Peer, Number Ta, authTicket\<rbrace>)
            \<in> set evs;
          evs \<in> kerbIV \<rbrakk> \<Longrightarrow>  
-  K = shrK A  & Peer = Tgs &
-  authK \<notin> range shrK & authK \<in> authKeys evs & authK \<in> symKeys & 
-  authTicket = (Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>) &
+  K = shrK A \<and> Peer = Tgs \<and>
+  authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and> 
+  authTicket = (Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>) \<and>
   Key authK \<notin> used(before 
            Says Kas A (Crypt K \<lbrace>Key authK, Agent Peer, Number Ta, authTicket\<rbrace>)
-                   on evs) &
+                   on evs) \<and>
   Ta = CT (before 
            Says Kas A (Crypt K \<lbrace>Key authK, Agent Peer, Number Ta, authTicket\<rbrace>)
            on evs)"
@@ -540,13 +540,13 @@
      "\<lbrakk> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
            \<in> set evs;
          evs \<in> kerbIV \<rbrakk>
-  \<Longrightarrow> B \<noteq> Tgs & 
-      authK \<notin> range shrK & authK \<in> authKeys evs & authK \<in> symKeys &
-      servK \<notin> range shrK & servK \<notin> authKeys evs & servK \<in> symKeys &
-      servTicket = (Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>) &
+  \<Longrightarrow> B \<noteq> Tgs \<and> 
+      authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and>
+      servK \<notin> range shrK \<and> servK \<notin> authKeys evs \<and> servK \<in> symKeys \<and>
+      servTicket = (Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>) \<and>
       Key servK \<notin> used (before
         Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
-                        on evs) &
+                        on evs) \<and>
       Ts = CT(before 
         Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
               on evs) "
@@ -572,7 +572,7 @@
            \<in> parts (spies evs);
          A \<notin> bad;
          evs \<in> kerbIV \<rbrakk>
-    \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys & 
+    \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys \<and> 
         authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace>"
 apply (erule rev_mp)
 apply (erule kerbIV.induct)
@@ -587,7 +587,7 @@
               \<in> parts (spies evs);
             Key authK \<notin> analz (spies evs);
             evs \<in> kerbIV \<rbrakk>
-         \<Longrightarrow> servK \<notin> range shrK & servK \<in> symKeys & 
+         \<Longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> 
     (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)"
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -601,7 +601,7 @@
      "\<lbrakk> Says Kas' A (Crypt (shrK A)
               \<lbrace>Key authK, Agent Tgs, Ta, authTicket\<rbrace>) \<in> set evs;
          evs \<in> kerbIV \<rbrakk>
-      \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys & 
+      \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys \<and> 
           authTicket =
                   Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace>
           | authTicket \<in> analz (spies evs)"
@@ -612,7 +612,7 @@
  "\<lbrakk> Says Tgs' A (Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace>)
        \<in> set evs;  authK \<in> symKeys;
      evs \<in> kerbIV \<rbrakk>
-  \<Longrightarrow> servK \<notin> range shrK &
+  \<Longrightarrow> servK \<notin> range shrK \<and>
       (\<exists>A. servTicket =
               Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
        | servTicket \<in> analz (spies evs)"
@@ -718,7 +718,7 @@
    \<Longrightarrow> \<exists>Ta. (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
            Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
              \<in> set evs
-          & servKlife + Ts <= authKlife + Ta)"
+          \<and> servKlife + Ts \<le> authKlife + Ta)"
 apply (erule rev_mp)
 apply (erule kerbIV.induct)
 apply (frule_tac [7] K5_msg_in_parts_spies)
@@ -744,7 +744,7 @@
   \<Longrightarrow> \<exists>authK Ta. Says Kas A (Crypt(shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
            Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
              \<in> set evs
-           & servKlife + Ts <= authKlife + Ta"
+           \<and> servKlife + Ts \<le> authKlife + Ta"
 by (blast dest!: servTicket_authentic_Tgs u_K4_imp_K2)
 
 lemma servTicket_authentic:
@@ -755,7 +755,7 @@
      Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
                    Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
        \<in> set evs
-     & Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
+     \<and> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
                    Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>\<rbrace>)
        \<in> set evs"
 by (blast dest: servTicket_authentic_Tgs K4_imp_K2)
@@ -768,14 +768,14 @@
      (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
                    Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
        \<in> set evs
-     & Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
+     \<and> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
                    Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>\<rbrace>)
        \<in> set evs
-     & servKlife + Ts <= authKlife + Ta)"
+     \<and> servKlife + Ts \<le> authKlife + Ta)"
 by (blast dest: servTicket_authentic_Tgs u_K4_imp_K2)
 
 lemma u_NotexpiredSK_NotexpiredAK:
-     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts <= authKlife + Ta \<rbrakk>
+     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts \<le> authKlife + Ta \<rbrakk>
       \<Longrightarrow> \<not> expiredAK Ta evs"
   by (metis le_less_trans)
 
@@ -804,7 +804,7 @@
          Crypt K' \<lbrace>Key SesKey,  Agent B', T', Ticket'\<rbrace>
            \<in> parts (spies evs);  Key SesKey \<notin> analz (spies evs);
          evs \<in> kerbIV \<rbrakk>
-      \<Longrightarrow> K=K' & B=B' & T=T' & Ticket=Ticket'"
+      \<Longrightarrow> K=K' \<and> B=B' \<and> T=T' \<and> Ticket=Ticket'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -870,7 +870,7 @@
          Crypt (shrK B') \<lbrace>Agent A', Agent B', Key SesKey, T'\<rbrace>
            \<in> parts (spies evs);  Key SesKey \<notin> analz (spies evs);
          evs \<in> kerbIV \<rbrakk>
-      \<Longrightarrow> A=A' & B=B' & T=T'"
+      \<Longrightarrow> A=A' \<and> B=B' \<and> T=T'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -947,7 +947,7 @@
      \<Longrightarrow> Key Kc \<notin> analz (spies evs) \<longrightarrow>
            (\<exists>K' B' T' Ticket'. \<forall>K B T Ticket.
             Crypt Kc \<lbrace>Key K, Agent B, T, Ticket\<rbrace>
-             \<in> parts (spies evs) \<longrightarrow> K=K' & B=B' & T=T' & Ticket=Ticket')"
+             \<in> parts (spies evs) \<longrightarrow> K=K' \<and> B=B' \<and> T=T' \<and> Ticket=Ticket')"
 
   would fail on the K2 and K4 cases.
 *)
@@ -957,7 +957,7 @@
               (Crypt Ka \<lbrace>Key authK, Agent Tgs, Ta, X\<rbrace>) \<in> set evs;
          Says Kas A'
               (Crypt Ka' \<lbrace>Key authK, Agent Tgs, Ta', X'\<rbrace>) \<in> set evs;
-         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> A=A' & Ka=Ka' & Ta=Ta' & X=X'"
+         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> A=A' \<and> Ka=Ka' \<and> Ta=Ta' \<and> X=X'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule kerbIV.induct)
@@ -973,7 +973,7 @@
               (Crypt K \<lbrace>Key servK, Agent B, Ts, X\<rbrace>) \<in> set evs;
          Says Tgs A'
               (Crypt K' \<lbrace>Key servK, Agent B', Ts', X'\<rbrace>) \<in> set evs;
-         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> A=A' & B=B' & K=K' & Ts=Ts' & X=X'"
+         evs \<in> kerbIV \<rbrakk> \<Longrightarrow> A=A' \<and> B=B' \<and> K=K' \<and> Ts=Ts' \<and> X=X'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule kerbIV.induct)
@@ -1020,7 +1020,7 @@
 
 lemma AKcryptSK_Says [simp]:
    "AKcryptSK authK servK (Says S A X # evs) =
-     (Tgs = S &
+     (Tgs = S \<and>
       (\<exists>B Ts. X = Crypt authK
                 \<lbrace>Key servK, Agent B, Number Ts,
                   Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace> \<rbrace>)
@@ -1123,9 +1123,9 @@
 text\<open>We take some pains to express the property
   as a logical equivalence so that the simplifier can apply it.\<close>
 lemma Key_analz_image_Key_lemma:
-     "P \<longrightarrow> (Key K \<in> analz (Key`KK Un H)) \<longrightarrow> (K:KK | Key K \<in> analz H)
+     "P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) \<longrightarrow> (K\<in>KK | Key K \<in> analz H)
       \<Longrightarrow>
-      P \<longrightarrow> (Key K \<in> analz (Key`KK Un H)) = (K:KK | Key K \<in> analz H)"
+      P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) = (K\<in>KK | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN subsetD])
 
 
@@ -1137,7 +1137,7 @@
 done
 
 lemma authKeys_are_not_AKcryptSK:
-     "\<lbrakk> K \<in> authKeys evs Un range shrK;  evs \<in> kerbIV \<rbrakk>
+     "\<lbrakk> K \<in> authKeys evs \<union> range shrK;  evs \<in> kerbIV \<rbrakk>
       \<Longrightarrow> \<forall>SK. \<not> AKcryptSK SK K evs \<and> K \<in> symKeys"
 apply (simp add: authKeys_def AKcryptSK_def)
 apply (blast dest: Says_Kas_message_form Says_Tgs_message_form)
@@ -1170,9 +1170,9 @@
  [simplified by LCP]\<close>
 lemma Key_analz_image_Key [rule_format (no_asm)]:
      "evs \<in> kerbIV \<Longrightarrow>
-      (\<forall>SK KK. SK \<in> symKeys & KK <= -(range shrK) \<longrightarrow>
+      (\<forall>SK KK. SK \<in> symKeys \<and> KK \<subseteq> -(range shrK) \<longrightarrow>
        (\<forall>K \<in> KK. \<not> AKcryptSK K SK evs)   \<longrightarrow>
-       (Key SK \<in> analz (Key`KK Un (spies evs))) =
+       (Key SK \<in> analz (Key`KK \<union> (spies evs))) =
        (SK \<in> KK | Key SK \<in> analz (spies evs)))"
 apply (erule kerbIV.induct)
 apply (frule_tac [10] Oops_range_spies2)
@@ -1213,7 +1213,7 @@
 text\<open>First simplification law for analz: no session keys encrypt
 authentication keys or shared keys.\<close>
 lemma analz_insert_freshK1:
-     "\<lbrakk> evs \<in> kerbIV;  K \<in> authKeys evs Un range shrK;
+     "\<lbrakk> evs \<in> kerbIV;  K \<in> authKeys evs \<union> range shrK;
         SesKey \<notin> range shrK \<rbrakk>
       \<Longrightarrow> (Key K \<in> analz (insert (Key SesKey) (spies evs))) =
           (K = SesKey | Key K \<in> analz (spies evs))"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/KerberosIV_Gets.thy
--- a/src/HOL/Auth/KerberosIV_Gets.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/KerberosIV_Gets.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -22,7 +22,7 @@
 
 definition
  (* authKeys are those contained in an authTicket *)
-    authKeys :: "event list => key set" where
+    authKeys :: "event list \<Rightarrow> key set" where
     "authKeys evs = {authK. \<exists>A Peer Ta. Says Kas A
                         (Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Number Ta,
                (Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Number Ta\<rbrace>)
@@ -30,8 +30,8 @@
 
 definition
  (* States than an event really appears only once on a trace *)
-  Unique :: "[event, event list] => bool" ("Unique _ on _" [0, 50] 50)
-  where "(Unique ev on evs) = (ev \<notin> set (tl (dropWhile (% z. z \<noteq> ev) evs)))"
+  Unique :: "[event, event list] \<Rightarrow> bool" ("Unique _ on _" [0, 50] 50)
+  where "(Unique ev on evs) = (ev \<notin> set (tl (dropWhile (\<lambda>z. z \<noteq> ev) evs)))"
 
 
 consts
@@ -65,30 +65,30 @@
 
 abbreviation
   (*The current time is just the length of the trace!*)
-  CT :: "event list=>nat" where
+  CT :: "event list \<Rightarrow> nat" where
   "CT == length"
 
 abbreviation
-  expiredAK :: "[nat, event list] => bool" where
+  expiredAK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredAK Ta evs == authKlife + Ta < CT evs"
 
 abbreviation
-  expiredSK :: "[nat, event list] => bool" where
+  expiredSK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredSK Ts evs == servKlife + Ts < CT evs"
 
 abbreviation
-  expiredA :: "[nat, event list] => bool" where
+  expiredA :: "[nat, event list] \<Rightarrow> bool" where
   "expiredA T evs == authlife + T < CT evs"
 
 abbreviation
-  valid :: "[nat, nat] => bool" ("valid _ wrt _" [0, 50] 50) where
-  "valid T1 wrt T2 == T1 <= replylife + T2"
+  valid :: "[nat, nat] \<Rightarrow> bool" ("valid _ wrt _" [0, 50] 50) where
+  "valid T1 wrt T2 == T1 \<le> replylife + T2"
 
 (*---------------------------------------------------------------------*)
 
 
 (* Predicate formalising the association between authKeys and servKeys *)
-definition AKcryptSK :: "[key, key, event list] => bool" where
+definition AKcryptSK :: "[key, key, event list] \<Rightarrow> bool" where
   "AKcryptSK authK servK evs ==
      \<exists>A B Ts.
        Says Tgs A (Crypt authK
@@ -164,7 +164,7 @@
                 \<in> set evs4;
             \<not> expiredAK Ta evs4;
             \<not> expiredA T2 evs4;
-            servKlife + (CT evs4) <= authKlife + Ta
+            servKlife + (CT evs4) \<le> authKlife + Ta
          \<rbrakk>
           \<Longrightarrow> Says Tgs A
                 (Crypt authK \<lbrace>Key servK, Agent B, Number (CT evs4),
@@ -311,7 +311,7 @@
 lemma Oops_range_spies1:
      "\<lbrakk> Says Kas A (Crypt KeyA \<lbrace>Key authK, Peer, Ta, authTicket\<rbrace>)
            \<in> set evs ;
-         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys"
+         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys"
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct, auto)
 done
@@ -319,7 +319,7 @@
 lemma Oops_range_spies2:
      "\<lbrakk> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace>)
            \<in> set evs ;
-         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> servK \<notin> range shrK & servK \<in> symKeys"
+         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys"
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct, auto)
 done
@@ -339,7 +339,7 @@
 by auto
 
 lemma Spy_see_shrK_D [dest!]:
-     "\<lbrakk> Key (shrK A) \<in> parts (spies evs);  evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> A:bad"
+     "\<lbrakk> Key (shrK A) \<in> parts (spies evs);  evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> A\<in>bad"
 by (blast dest: Spy_see_shrK)
 lemmas Spy_analz_shrK_D = analz_subset_parts [THEN subsetD, THEN Spy_see_shrK_D, dest!]
 
@@ -374,8 +374,8 @@
      "\<lbrakk> Says Kas A (Crypt K \<lbrace>Key authK, Agent Peer, Number Ta, authTicket\<rbrace>)
            \<in> set evs;
          evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow>  
-  K = shrK A  & Peer = Tgs &
-  authK \<notin> range shrK & authK \<in> authKeys evs & authK \<in> symKeys & 
+  K = shrK A  \<and> Peer = Tgs \<and>
+  authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and> 
   authTicket = (Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>)"
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct)
@@ -424,9 +424,9 @@
      "\<lbrakk> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
            \<in> set evs;
          evs \<in> kerbIV_gets \<rbrakk>
-  \<Longrightarrow> B \<noteq> Tgs & 
-      authK \<notin> range shrK & authK \<in> authKeys evs & authK \<in> symKeys &
-      servK \<notin> range shrK & servK \<notin> authKeys evs & servK \<in> symKeys &
+  \<Longrightarrow> B \<noteq> Tgs \<and> 
+      authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and>
+      servK \<notin> range shrK \<and> servK \<notin> authKeys evs \<and> servK \<in> symKeys \<and>
       servTicket = (Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>)"
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct)
@@ -443,7 +443,7 @@
            \<in> parts (spies evs);
          A \<notin> bad;
          evs \<in> kerbIV_gets \<rbrakk>
-    \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys & 
+    \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys \<and>
         authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace>"
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct)
@@ -458,7 +458,7 @@
               \<in> parts (spies evs);
             Key authK \<notin> analz (spies evs);
             evs \<in> kerbIV_gets \<rbrakk>
-         \<Longrightarrow> servK \<notin> range shrK & servK \<in> symKeys & 
+         \<Longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> 
     (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)"
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -472,7 +472,7 @@
      "\<lbrakk> Gets A (Crypt (shrK A)
               \<lbrace>Key authK, Agent Tgs, Ta, authTicket\<rbrace>) \<in> set evs;
          evs \<in> kerbIV_gets \<rbrakk>
-      \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys & 
+      \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys \<and> 
           authTicket =
                   Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace>
           | authTicket \<in> analz (spies evs)"
@@ -483,7 +483,7 @@
  "\<lbrakk> Gets A (Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace>)
        \<in> set evs;  authK \<in> symKeys;
      evs \<in> kerbIV_gets \<rbrakk>
-  \<Longrightarrow> servK \<notin> range shrK &
+  \<Longrightarrow> servK \<notin> range shrK \<and>
       (\<exists>A. servTicket =
               Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
        | servTicket \<in> analz (spies evs)"
@@ -593,7 +593,7 @@
    \<Longrightarrow> \<exists>Ta. (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
            Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
              \<in> set evs
-          & servKlife + Ts <= authKlife + Ta)"
+          \<and> servKlife + Ts \<le> authKlife + Ta)"
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct)
 apply (frule_tac [8] Gets_ticket_parts)
@@ -619,7 +619,7 @@
   \<Longrightarrow> \<exists>authK Ta. Says Kas A (Crypt(shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
            Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
              \<in> set evs
-           & servKlife + Ts <= authKlife + Ta"
+           \<and> servKlife + Ts \<le> authKlife + Ta"
 by (blast dest!: servTicket_authentic_Tgs u_K4_imp_K2)
 
 lemma servTicket_authentic:
@@ -630,7 +630,7 @@
      Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
                    Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
        \<in> set evs
-     & Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
+     \<and> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
                    Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>\<rbrace>)
        \<in> set evs"
 by (blast dest: servTicket_authentic_Tgs K4_imp_K2)
@@ -643,14 +643,14 @@
      (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta,
                    Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>\<rbrace>)
        \<in> set evs
-     & Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
+     \<and> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts,
                    Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>\<rbrace>)
        \<in> set evs
-     & servKlife + Ts <= authKlife + Ta)"
+     \<and> servKlife + Ts \<le> authKlife + Ta)"
 by (blast dest: servTicket_authentic_Tgs u_K4_imp_K2)
 
 lemma u_NotexpiredSK_NotexpiredAK:
-     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts <= authKlife + Ta \<rbrakk>
+     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts \<le> authKlife + Ta \<rbrakk>
       \<Longrightarrow> \<not> expiredAK Ta evs"
 by (blast dest: leI le_trans dest: leD)
 
@@ -679,7 +679,7 @@
          Crypt K' \<lbrace>Key SesKey,  Agent B', T', Ticket'\<rbrace>
            \<in> parts (spies evs);  Key SesKey \<notin> analz (spies evs);
          evs \<in> kerbIV_gets \<rbrakk>
-      \<Longrightarrow> K=K' & B=B' & T=T' & Ticket=Ticket'"
+      \<Longrightarrow> K=K' \<and> B=B' \<and> T=T' \<and> Ticket=Ticket'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -753,7 +753,7 @@
          Crypt (shrK B') \<lbrace>Agent A', Agent B', Key SesKey, T'\<rbrace>
            \<in> parts (spies evs);  Key SesKey \<notin> analz (spies evs);
          evs \<in> kerbIV_gets \<rbrakk>
-      \<Longrightarrow> A=A' & B=B' & T=T'"
+      \<Longrightarrow> A=A' \<and> B=B' \<and> T=T'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -819,7 +819,7 @@
               (Crypt Ka \<lbrace>Key authK, Agent Tgs, Ta, X\<rbrace>) \<in> set evs;
          Says Kas A'
               (Crypt Ka' \<lbrace>Key authK, Agent Tgs, Ta', X'\<rbrace>) \<in> set evs;
-         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> A=A' & Ka=Ka' & Ta=Ta' & X=X'"
+         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> A=A' \<and> Ka=Ka' \<and> Ta=Ta' \<and> X=X'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct)
@@ -835,7 +835,7 @@
               (Crypt K \<lbrace>Key servK, Agent B, Ts, X\<rbrace>) \<in> set evs;
          Says Tgs A'
               (Crypt K' \<lbrace>Key servK, Agent B', Ts', X'\<rbrace>) \<in> set evs;
-         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> A=A' & B=B' & K=K' & Ts=Ts' & X=X'"
+         evs \<in> kerbIV_gets \<rbrakk> \<Longrightarrow> A=A' \<and> B=B' \<and> K=K' \<and> Ts=Ts' \<and> X=X'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule kerbIV_gets.induct)
@@ -882,7 +882,7 @@
 
 lemma AKcryptSK_Says [simp]:
    "AKcryptSK authK servK (Says S A X # evs) =
-     (Tgs = S &
+     (Tgs = S \<and>
       (\<exists>B Ts. X = Crypt authK
                 \<lbrace>Key servK, Agent B, Number Ts,
                   Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace> \<rbrace>)
@@ -996,9 +996,9 @@
 text\<open>We take some pains to express the property
   as a logical equivalence so that the simplifier can apply it.\<close>
 lemma Key_analz_image_Key_lemma:
-     "P \<longrightarrow> (Key K \<in> analz (Key`KK Un H)) \<longrightarrow> (K:KK | Key K \<in> analz H)
+     "P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) \<longrightarrow> (K \<in> KK | Key K \<in> analz H)
       \<Longrightarrow>
-      P \<longrightarrow> (Key K \<in> analz (Key`KK Un H)) = (K:KK | Key K \<in> analz H)"
+      P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) = (K \<in> KK | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN subsetD])
 
 
@@ -1009,7 +1009,7 @@
 by (drule Says_imp_spies [THEN analz.Inj, THEN analz_insertI], auto)
 
 lemma authKeys_are_not_AKcryptSK:
-     "\<lbrakk> K \<in> authKeys evs Un range shrK;  evs \<in> kerbIV_gets \<rbrakk>
+     "\<lbrakk> K \<in> authKeys evs \<union> range shrK;  evs \<in> kerbIV_gets \<rbrakk>
       \<Longrightarrow> \<forall>SK. \<not> AKcryptSK SK K evs \<and> K \<in> symKeys"
 apply (simp add: authKeys_def AKcryptSK_def)
 by (blast dest: Says_Kas_message_form Says_Tgs_message_form)
@@ -1039,9 +1039,9 @@
  in case of loss of a key to the spy. See ESORICS98.\<close>
 lemma Key_analz_image_Key [rule_format (no_asm)]:
      "evs \<in> kerbIV_gets \<Longrightarrow>
-      (\<forall>SK KK. SK \<in> symKeys & KK <= -(range shrK) \<longrightarrow>
+      (\<forall>SK KK. SK \<in> symKeys \<and> KK \<subseteq> -(range shrK) \<longrightarrow>
        (\<forall>K \<in> KK. \<not> AKcryptSK K SK evs)   \<longrightarrow>
-       (Key SK \<in> analz (Key`KK Un (spies evs))) =
+       (Key SK \<in> analz (Key`KK \<union> (spies evs))) =
        (SK \<in> KK | Key SK \<in> analz (spies evs)))"
 apply (erule kerbIV_gets.induct)
 apply (frule_tac [11] Oops_range_spies2)
@@ -1084,7 +1084,7 @@
 text\<open>First simplification law for analz: no session keys encrypt
 authentication keys or shared keys.\<close>
 lemma analz_insert_freshK1:
-     "\<lbrakk> evs \<in> kerbIV_gets;  K \<in> authKeys evs Un range shrK;
+     "\<lbrakk> evs \<in> kerbIV_gets;  K \<in> authKeys evs \<union> range shrK;
         SesKey \<notin> range shrK \<rbrakk>
       \<Longrightarrow> (Key K \<in> analz (insert (Key SesKey) (spies evs))) =
           (K = SesKey | Key K \<in> analz (spies evs))"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/KerberosV.thy
--- a/src/HOL/Auth/KerberosV.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/KerberosV.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -23,7 +23,7 @@
 
 definition
  (* authKeys are those contained in an authTicket *)
-    authKeys :: "event list => key set" where
+    authKeys :: "event list \<Rightarrow> key set" where
     "authKeys evs = {authK. \<exists>A Peer Ta. 
         Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>,
                      Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>
@@ -32,11 +32,11 @@
 definition
  (* A is the true creator of X if she has sent X and X never appeared on
     the trace before this event. Recall that traces grow from head. *)
-  Issues :: "[agent, agent, msg, event list] => bool"
+  Issues :: "[agent, agent, msg, event list] \<Rightarrow> bool"
              ("_ Issues _ with _ on _") where
    "A Issues B with X on evs =
       (\<exists>Y. Says A B Y \<in> set evs \<and> X \<in> parts {Y} \<and>
-        X \<notin> parts (spies (takeWhile (% z. z  \<noteq> Says A B Y) (rev evs))))"
+        X \<notin> parts (spies (takeWhile (\<lambda>z. z  \<noteq> Says A B Y) (rev evs))))"
 
 
 consts
@@ -70,30 +70,30 @@
 
 abbreviation
   (*The current time is just the length of the trace!*)
-  CT :: "event list=>nat" where
+  CT :: "event list \<Rightarrow> nat" where
   "CT == length"
 
 abbreviation
-  expiredAK :: "[nat, event list] => bool" where
+  expiredAK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredAK T evs == authKlife + T < CT evs"
 
 abbreviation
-  expiredSK :: "[nat, event list] => bool" where
+  expiredSK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredSK T evs == servKlife + T < CT evs"
 
 abbreviation
-  expiredA :: "[nat, event list] => bool" where
+  expiredA :: "[nat, event list] \<Rightarrow> bool" where
   "expiredA T evs == authlife + T < CT evs"
 
 abbreviation
-  valid :: "[nat, nat] => bool"  ("valid _ wrt _") where
-  "valid T1 wrt T2 == T1 <= replylife + T2"
+  valid :: "[nat, nat] \<Rightarrow> bool"  ("valid _ wrt _") where
+  "valid T1 wrt T2 == T1 \<le> replylife + T2"
 
 (*---------------------------------------------------------------------*)
 
 
 (* Predicate formalising the association between authKeys and servKeys *)
-definition AKcryptSK :: "[key, key, event list] => bool" where
+definition AKcryptSK :: "[key, key, event list] \<Rightarrow> bool" where
   "AKcryptSK authK servK evs ==
      \<exists>A B tt.
        Says Tgs A \<lbrace>Crypt authK \<lbrace>Key servK, Agent B, tt\<rbrace>,
@@ -142,7 +142,7 @@
                 \<in> set evs4;
             \<not> expiredAK Ta evs4;
             \<not> expiredA T2 evs4;
-            servKlife + (CT evs4) <= authKlife + Ta
+            servKlife + (CT evs4) \<le> authKlife + Ta
          \<rbrakk>
           \<Longrightarrow> Says Tgs A \<lbrace>
              Crypt authK \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>,
@@ -218,7 +218,7 @@
 done
 
 lemma spies_Notes_rev: "spies (evs @ [Notes A X]) =
-          (if A:bad then insert X (spies evs) else spies evs)"
+          (if A\<in>bad then insert X (spies evs) else spies evs)"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
@@ -233,7 +233,7 @@
 
 lemmas parts_spies_evs_revD2 = spies_evs_rev [THEN equalityD2, THEN parts_mono]
 
-lemma spies_takeWhile: "spies (takeWhile P evs) <=  spies evs"
+lemma spies_takeWhile: "spies (takeWhile P evs) \<subseteq> spies evs"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
@@ -294,7 +294,7 @@
 lemma Oops_range_spies1:
      "\<lbrakk> Says Kas A \<lbrace>Crypt KeyA \<lbrace>Key authK, Peer, Ta\<rbrace>, authTicket\<rbrace>
            \<in> set evs ;
-         evs \<in> kerbV \<rbrakk> \<Longrightarrow> authK \<notin> range shrK & authK \<in> symKeys"
+         evs \<in> kerbV \<rbrakk> \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> symKeys"
 apply (erule rev_mp)
 apply (erule kerbV.induct, auto)
 done
@@ -322,7 +322,7 @@
 by auto
 
 lemma Spy_see_shrK_D [dest!]:
-     "\<lbrakk> Key (shrK A) \<in> parts (spies evs);  evs \<in> kerbV \<rbrakk> \<Longrightarrow> A:bad"
+     "\<lbrakk> Key (shrK A) \<in> parts (spies evs);  evs \<in> kerbV \<rbrakk> \<Longrightarrow> A\<in>bad"
 by (blast dest: Spy_see_shrK)
 
 lemmas Spy_analz_shrK_D = analz_subset_parts [THEN subsetD, THEN Spy_see_shrK_D, dest!]
@@ -527,7 +527,7 @@
    \<Longrightarrow> \<exists>Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta\<rbrace>,
              Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace> \<rbrace>
              \<in> set evs
-          \<and> servKlife + Ts <= authKlife + Ta"
+          \<and> servKlife + Ts \<le> authKlife + Ta"
 apply (erule rev_mp)
 apply (erule kerbV.induct)
 apply (frule_tac [7] Says_ticket_parts)
@@ -555,7 +555,7 @@
          \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta\<rbrace>,
            Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace> \<rbrace>
         \<in> set evs \<and> 
-      servKlife + Ts <= authKlife + Ta"
+      servKlife + Ts \<le> authKlife + Ta"
 by (metis servTicket_authentic_Tgs u_K4_imp_K2)
 
 lemma servTicket_authentic:
@@ -580,11 +580,11 @@
      \<and> Says Tgs A \<lbrace>Crypt authK \<lbrace>Key servK, Agent B, Number Ts\<rbrace>,
                  Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>\<rbrace>
        \<in> set evs
-     \<and> servKlife + Ts <= authKlife + Ta"
+     \<and> servKlife + Ts \<le> authKlife + Ta"
 by (metis servTicket_authentic_Tgs u_K4_imp_K2)
 
 lemma u_NotexpiredSK_NotexpiredAK:
-     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts <= authKlife + Ta \<rbrakk>
+     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts \<le> authKlife + Ta \<rbrakk>
       \<Longrightarrow> \<not> expiredAK Ta evs"
 by (metis order_le_less_trans)
 
@@ -653,7 +653,7 @@
          Crypt (shrK B') \<lbrace>Agent A', Agent B', Key SesKey, T'\<rbrace>
            \<in> parts (spies evs);  Key SesKey \<notin> analz (spies evs);
          evs \<in> kerbV \<rbrakk>
-      \<Longrightarrow> A=A' & B=B' & T=T'"
+      \<Longrightarrow> A=A' \<and> B=B' \<and> T=T'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule rev_mp)
@@ -868,9 +868,9 @@
 text\<open>We take some pains to express the property
   as a logical equivalence so that the simplifier can apply it.\<close>
 lemma Key_analz_image_Key_lemma:
-     "P \<longrightarrow> (Key K \<in> analz (Key`KK Un H)) \<longrightarrow> (K:KK | Key K \<in> analz H)
+     "P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) \<longrightarrow> (K\<in>KK \<or> Key K \<in> analz H)
       \<Longrightarrow>
-      P \<longrightarrow> (Key K \<in> analz (Key`KK Un H)) = (K:KK | Key K \<in> analz H)"
+      P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) = (K\<in>KK \<or> Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN subsetD])
 
 
@@ -882,7 +882,7 @@
 done
 
 lemma authKeys_are_not_AKcryptSK:
-     "\<lbrakk> K \<in> authKeys evs Un range shrK;  evs \<in> kerbV \<rbrakk>
+     "\<lbrakk> K \<in> authKeys evs \<union> range shrK;  evs \<in> kerbV \<rbrakk>
       \<Longrightarrow> \<forall>SK. \<not> AKcryptSK SK K evs \<and> K \<in> symKeys"
 apply (simp add: authKeys_def AKcryptSK_def)
 apply (blast dest: Says_Kas_message_form Says_Tgs_message_form)
@@ -914,9 +914,9 @@
  in case of loss of a key to the spy. See ESORICS98.\<close>
 lemma Key_analz_image_Key [rule_format (no_asm)]:
      "evs \<in> kerbV \<Longrightarrow>
-      (\<forall>SK KK. SK \<in> symKeys & KK <= -(range shrK) \<longrightarrow>
+      (\<forall>SK KK. SK \<in> symKeys \<and> KK \<subseteq> -(range shrK) \<longrightarrow>
        (\<forall>K \<in> KK. \<not> AKcryptSK K SK evs)   \<longrightarrow>
-       (Key SK \<in> analz (Key`KK Un (spies evs))) =
+       (Key SK \<in> analz (Key`KK \<union> (spies evs))) =
        (SK \<in> KK | Key SK \<in> analz (spies evs)))"
 apply (erule kerbV.induct)
 apply (frule_tac [10] Oops_range_spies2)
@@ -951,7 +951,7 @@
 text\<open>First simplification law for analz: no session keys encrypt
 authentication keys or shared keys.\<close>
 lemma analz_insert_freshK1:
-     "\<lbrakk> evs \<in> kerbV;  K \<in> authKeys evs Un range shrK;
+     "\<lbrakk> evs \<in> kerbV;  K \<in> authKeys evs \<union> range shrK;
         SesKey \<notin> range shrK \<rbrakk>
       \<Longrightarrow> (Key K \<in> analz (insert (Key SesKey) (spies evs))) =
           (K = SesKey | Key K \<in> analz (spies evs))"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Kerberos_BAN.thy
--- a/src/HOL/Auth/Kerberos_BAN.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Kerberos_BAN.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -38,36 +38,36 @@
     by blast
 
 abbreviation
-  CT :: "event list=>nat" where
+  CT :: "event list \<Rightarrow> nat" where
   "CT == length "
 
 abbreviation
-  expiredK :: "[nat, event list] => bool" where
+  expiredK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredK T evs == sesKlife + T < CT evs"
 
 abbreviation
-  expiredA :: "[nat, event list] => bool" where
+  expiredA :: "[nat, event list] \<Rightarrow> bool" where
   "expiredA T evs == authlife + T < CT evs"
 
 
 definition
  (* A is the true creator of X if she has sent X and X never appeared on
     the trace before this event. Recall that traces grow from head. *)
-  Issues :: "[agent, agent, msg, event list] => bool"
+  Issues :: "[agent, agent, msg, event list] \<Rightarrow> bool"
              ("_ Issues _ with _ on _") where
    "A Issues B with X on evs =
-      (\<exists>Y. Says A B Y \<in> set evs & X \<in> parts {Y} &
-        X \<notin> parts (spies (takeWhile (% z. z  \<noteq> Says A B Y) (rev evs))))"
+      (\<exists>Y. Says A B Y \<in> set evs \<and> X \<in> parts {Y} \<and>
+        X \<notin> parts (spies (takeWhile (\<lambda>z. z  \<noteq> Says A B Y) (rev evs))))"
 
 definition
  (* Yields the subtrace of a given trace from its beginning to a given event *)
-  before :: "[event, event list] => event list" ("before _ on _")
-  where "before ev on evs = takeWhile (% z. z ~= ev) (rev evs)"
+  before :: "[event, event list] \<Rightarrow> event list" ("before _ on _")
+  where "before ev on evs = takeWhile (\<lambda>z. z \<noteq> ev) (rev evs)"
 
 definition
  (* States than an event really appears only once on a trace *)
-  Unique :: "[event, event list] => bool" ("Unique _ on _")
-  where "Unique ev on evs = (ev \<notin> set (tl (dropWhile (% z. z \<noteq> ev) evs)))"
+  Unique :: "[event, event list] \<Rightarrow> bool" ("Unique _ on _")
+  where "Unique ev on evs = (ev \<notin> set (tl (dropWhile (\<lambda>z. z \<noteq> ev) evs)))"
 
 
 inductive_set bankerberos :: "event list set"
@@ -104,7 +104,7 @@
 
  | BK4:  "\<lbrakk> evs4 \<in> bankerberos;
              Says A' B \<lbrace>(Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>),
-                         (Crypt K \<lbrace>Agent A, Number Ta\<rbrace>) \<rbrace>: set evs4;
+                         (Crypt K \<lbrace>Agent A, Number Ta\<rbrace>) \<rbrace> \<in> set evs4;
              \<not> expiredK Tk evs4;  \<not> expiredA Ta evs4 \<rbrakk>
           \<Longrightarrow> Says B A (Crypt K (Number Ta)) # evs4
                 \<in> bankerberos"
@@ -150,7 +150,7 @@
 done
 
 lemma spies_Notes_rev: "spies (evs @ [Notes A X]) =
-          (if A:bad then insert X (spies evs) else spies evs)"
+          (if A\<in>bad then insert X (spies evs) else spies evs)"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
@@ -165,7 +165,7 @@
 
 lemmas parts_spies_evs_revD2 = spies_evs_rev [THEN equalityD2, THEN parts_mono]
 
-lemma spies_takeWhile: "spies (takeWhile P evs) <=  spies evs"
+lemma spies_takeWhile: "spies (takeWhile P evs) \<subseteq> spies evs"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
@@ -211,7 +211,7 @@
 done
 
 lemma used_takeWhile_used [rule_format]: 
-      "x : used (takeWhile P X) --> x : used X"
+      "x \<in> used (takeWhile P X) \<longrightarrow> x \<in> used X"
 apply (induct_tac "X")
 apply simp
 apply (rename_tac a b)
@@ -260,7 +260,7 @@
 
 lemma Spy_see_shrK_D [dest!]:
      "\<lbrakk> Key (shrK A) \<in> parts (spies evs);
-                evs \<in> bankerberos \<rbrakk> \<Longrightarrow> A:bad"
+                evs \<in> bankerberos \<rbrakk> \<Longrightarrow> A\<in>bad"
 apply (blast dest: Spy_see_shrK)
 done
 
@@ -287,11 +287,11 @@
 lemma Says_Server_message_form:
      "\<lbrakk> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
          \<in> set evs; evs \<in> bankerberos \<rbrakk>
-      \<Longrightarrow> K' = shrK A & K \<notin> range shrK &
-          Ticket = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>) &
+      \<Longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and>
+          Ticket = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>) \<and>
           Key K \<notin> used(before
                   Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
-                  on evs) &
+                  on evs) \<and>
           Tk = CT(before 
                   Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
                   on evs)"
@@ -343,7 +343,7 @@
      "\<lbrakk> Says S A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>)
             \<in> set evs;
          evs \<in> bankerberos \<rbrakk>
- \<Longrightarrow> (K \<notin> range shrK & X = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>))
+ \<Longrightarrow> (K \<notin> range shrK \<and> X = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>))
           | X \<in> analz (spies evs)"
 apply (case_tac "A \<in> bad")
 apply (force dest!: Says_imp_spies [THEN analz.Inj])
@@ -367,7 +367,7 @@
 lemma analz_image_freshK [rule_format (no_asm)]:
      "evs \<in> bankerberos \<Longrightarrow>
    \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
-          (Key K \<in> analz (Key`KK Un (spies evs))) =
+          (Key K \<in> analz (Key`KK \<union> (spies evs))) =
           (K \<in> KK | Key K \<in> analz (spies evs))"
 apply (erule bankerberos.induct)
 apply (drule_tac [7] Says_Server_message_form)
@@ -388,7 +388,7 @@
            (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs;
          Says Server A'
           (Crypt (shrK A') \<lbrace>Number Tk', Agent B', Key K, X'\<rbrace>) \<in> set evs;
-         evs \<in> bankerberos \<rbrakk> \<Longrightarrow> A=A' & Tk=Tk' & B=B' & X = X'"
+         evs \<in> bankerberos \<rbrakk> \<Longrightarrow> A=A' \<and> Tk=Tk' \<and> B=B' \<and> X = X'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule bankerberos.induct)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Kerberos_BAN_Gets.thy
--- a/src/HOL/Auth/Kerberos_BAN_Gets.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Kerberos_BAN_Gets.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -40,27 +40,27 @@
 
 
 abbreviation
-  CT :: "event list=>nat" where
+  CT :: "event list \<Rightarrow> nat" where
   "CT == length"
 
 abbreviation
-  expiredK :: "[nat, event list] => bool" where
+  expiredK :: "[nat, event list] \<Rightarrow> bool" where
   "expiredK T evs == sesKlife + T < CT evs"
 
 abbreviation
-  expiredA :: "[nat, event list] => bool" where
+  expiredA :: "[nat, event list] \<Rightarrow> bool" where
   "expiredA T evs == authlife + T < CT evs"
 
 
 definition
  (* Yields the subtrace of a given trace from its beginning to a given event *)
-  before :: "[event, event list] => event list" ("before _ on _")
-  where "before ev on evs = takeWhile (% z. z ~= ev) (rev evs)"
+  before :: "[event, event list] \<Rightarrow> event list" ("before _ on _")
+  where "before ev on evs = takeWhile (\<lambda>z. z \<noteq> ev) (rev evs)"
 
 definition
  (* States than an event really appears only once on a trace *)
-  Unique :: "[event, event list] => bool" ("Unique _ on _")
-  where "Unique ev on evs = (ev \<notin> set (tl (dropWhile (% z. z \<noteq> ev) evs)))"
+  Unique :: "[event, event list] \<Rightarrow> bool" ("Unique _ on _")
+  where "Unique ev on evs = (ev \<notin> set (tl (dropWhile (\<lambda>z. z \<noteq> ev) evs)))"
 
 
 inductive_set bankerb_gets :: "event list set"
@@ -99,7 +99,7 @@
 
  | BK4:  "\<lbrakk> evs4 \<in> bankerb_gets;
              Gets B \<lbrace>(Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>),
-                         (Crypt K \<lbrace>Agent A, Number Ta\<rbrace>) \<rbrace>: set evs4;
+                         (Crypt K \<lbrace>Agent A, Number Ta\<rbrace>) \<rbrace> \<in> set evs4;
              \<not> expiredK Tk evs4;  \<not> expiredA Ta evs4 \<rbrakk>
           \<Longrightarrow> Says B A (Crypt K (Number Ta)) # evs4
                 \<in> bankerb_gets"
@@ -200,7 +200,7 @@
 done
 
 lemma used_takeWhile_used [rule_format]: 
-      "x : used (takeWhile P X) --> x : used X"
+      "x \<in> used (takeWhile P X) \<longrightarrow> x \<in> used X"
 apply (induct_tac "X")
 apply simp
 apply (rename_tac a b)
@@ -249,7 +249,7 @@
 
 lemma Spy_see_shrK_D [dest!]:
      "\<lbrakk> Key (shrK A) \<in> parts (knows Spy evs);
-                evs \<in> bankerb_gets \<rbrakk> \<Longrightarrow> A:bad"
+                evs \<in> bankerb_gets \<rbrakk> \<Longrightarrow> A\<in>bad"
 by (blast dest: Spy_see_shrK)
 
 lemmas Spy_analz_shrK_D = analz_subset_parts [THEN subsetD, THEN Spy_see_shrK_D,  dest!]
@@ -275,11 +275,11 @@
 lemma Says_Server_message_form:
      "\<lbrakk> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
          \<in> set evs; evs \<in> bankerb_gets \<rbrakk>
-      \<Longrightarrow> K' = shrK A & K \<notin> range shrK &
-          Ticket = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>) &
+      \<Longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and>
+          Ticket = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>) \<and>
           Key K \<notin> used(before
                   Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
-                  on evs) &
+                  on evs) \<and>
           Tk = CT(before 
                   Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
                   on evs)"
@@ -337,7 +337,7 @@
      "\<lbrakk> Gets A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>)
             \<in> set evs;
          evs \<in> bankerb_gets \<rbrakk>
- \<Longrightarrow> (K \<notin> range shrK & X = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>))
+ \<Longrightarrow> (K \<notin> range shrK \<and> X = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>))
           | X \<in> analz (knows Spy evs)"
 apply (case_tac "A \<in> bad")
 apply (force dest!: Gets_imp_knows_Spy [THEN analz.Inj])
@@ -398,7 +398,7 @@
 lemma analz_image_freshK [rule_format (no_asm)]:
      "evs \<in> bankerb_gets \<Longrightarrow>
    \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 apply (erule bankerb_gets.induct)
 apply (drule_tac [8] Says_Server_message_form)
@@ -419,7 +419,7 @@
            (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs;
          Says Server A'
           (Crypt (shrK A') \<lbrace>Number Tk', Agent B', Key K, X'\<rbrace>) \<in> set evs;
-         evs \<in> bankerb_gets \<rbrakk> \<Longrightarrow> A=A' & Tk=Tk' & B=B' & X = X'"
+         evs \<in> bankerb_gets \<rbrakk> \<Longrightarrow> A=A' \<and> Tk=Tk' \<and> B=B' \<and> X = X'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule bankerb_gets.induct)
@@ -434,7 +434,7 @@
            (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs;
         Gets A
           (Crypt (shrK A) \<lbrace>Number Tk', Agent B', Key K, X'\<rbrace>) \<in> set evs;
-        A \<notin> bad; evs \<in> bankerb_gets \<rbrakk> \<Longrightarrow> Tk=Tk' & B=B' & X = X'"
+        A \<notin> bad; evs \<in> bankerb_gets \<rbrakk> \<Longrightarrow> Tk=Tk' \<and> B=B' \<and> X = X'"
 apply (blast dest!: Kab_authentic unique_session_keys)
 done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Message.thy
--- a/src/HOL/Auth/Message.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Message.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -21,11 +21,11 @@
 
 consts
   all_symmetric :: bool        \<comment> \<open>true if all keys are symmetric\<close>
-  invKey        :: "key=>key"  \<comment> \<open>inverse of a symmetric key\<close>
+  invKey        :: "key\<Rightarrow>key"  \<comment> \<open>inverse of a symmetric key\<close>
 
 specification (invKey)
   invKey [simp]: "invKey (invKey K) = K"
-  invKey_symmetric: "all_symmetric --> invKey = id"
+  invKey_symmetric: "all_symmetric \<longrightarrow> invKey = id"
     by (rule exI [of _ id], auto)
 
 
@@ -56,11 +56,11 @@
   "\<lbrace>x, y\<rbrace>" \<rightleftharpoons> "CONST MPair x y"
 
 
-definition HPair :: "[msg,msg] => msg" ("(4Hash[_] /_)" [0, 1000]) where
+definition HPair :: "[msg,msg] \<Rightarrow> msg" ("(4Hash[_] /_)" [0, 1000]) where
     \<comment> \<open>Message Y paired with a MAC computed with the help of X\<close>
     "Hash[X] Y == \<lbrace>Hash\<lbrace>X,Y\<rbrace>, Y\<rbrace>"
 
-definition keysFor :: "msg set => key set" where
+definition keysFor :: "msg set \<Rightarrow> key set" where
     \<comment> \<open>Keys useful to decrypt elements of a message set\<close>
   "keysFor H == invKey ` {K. \<exists>X. Crypt K X \<in> H}"
 
@@ -68,7 +68,7 @@
 subsubsection\<open>Inductive Definition of All Parts" of a Message\<close>
 
 inductive_set
-  parts :: "msg set => msg set"
+  parts :: "msg set \<Rightarrow> msg set"
   for H :: "msg set"
   where
     Inj [intro]: "X \<in> H ==> X \<in> parts H"
@@ -86,7 +86,7 @@
 
 
 text\<open>Equations hold because constructors are injective.\<close>
-lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x:A)"
+lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x\<in>A)"
 by auto
 
 lemma Key_image_eq [simp]: "(Key x \<in> Key`A) = (x\<in>A)"
@@ -310,7 +310,7 @@
 by auto
 
 text\<open>In any message, there is an upper bound N on its greatest nonce.\<close>
-lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n --> Nonce n \<notin> parts {msg}"
+lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Nonce n \<notin> parts {msg}"
 proof (induct msg)
   case (Nonce n)
     show ?case
@@ -328,14 +328,14 @@
     be taken apart; messages decrypted with known keys.\<close>
 
 inductive_set
-  analz :: "msg set => msg set"
+  analz :: "msg set \<Rightarrow> msg set"
   for H :: "msg set"
   where
     Inj [intro,simp]: "X \<in> H ==> X \<in> analz H"
   | Fst:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> X \<in> analz H"
   | Snd:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> Y \<in> analz H"
   | Decrypt [dest]: 
-             "[|Crypt K X \<in> analz H; Key(invKey K): analz H|] ==> X \<in> analz H"
+             "\<lbrakk>Crypt K X \<in> analz H; Key(invKey K) \<in> analz H\<rbrakk> \<Longrightarrow> X \<in> analz H"
 
 
 text\<open>Monotonicity; Lemma 1 of Lowe's paper\<close>
@@ -513,7 +513,7 @@
 by (erule analz_trans, blast)
 
 (*Cut can be proved easily by induction on
-   "Y: analz (insert X H) ==> X: analz H --> Y: analz H"
+   "Y: analz (insert X H) ==> X: analz H \<longrightarrow> Y: analz H"
 *)
 
 text\<open>This rewrite rule helps in the simplification of messages that involve
@@ -670,8 +670,8 @@
           parts_synth synth_mono synth_subset_iff)
 
 lemma Fake_parts_insert_in_Un:
-     "[|Z \<in> parts (insert X H);  X: synth (analz H)|] 
-      ==> Z \<in>  synth (analz H) \<union> parts H"
+     "\<lbrakk>Z \<in> parts (insert X H);  X \<in> synth (analz H)\<rbrakk> 
+      \<Longrightarrow> Z \<in> synth (analz H) \<union> parts H"
 by (metis Fake_parts_insert set_mp)
 
 text\<open>@{term H} is sometimes @{term"Key ` KK \<union> spies evs"}, so can't put 
@@ -685,7 +685,7 @@
 done
 
 lemma analz_conj_parts [simp]:
-     "(X \<in> analz H & X \<in> parts H) = (X \<in> analz H)"
+     "(X \<in> analz H \<and> X \<in> parts H) = (X \<in> analz H)"
 by (blast intro: analz_subset_parts [THEN subsetD])
 
 lemma analz_disj_parts [simp]:
@@ -696,7 +696,7 @@
   redundant cases\<close>
 lemma MPair_synth_analz [iff]:
      "(\<lbrace>X,Y\<rbrace> \<in> synth (analz H)) =  
-      (X \<in> synth (analz H) & Y \<in> synth (analz H))"
+      (X \<in> synth (analz H) \<and> Y \<in> synth (analz H))"
 by blast
 
 lemma Crypt_synth_analz:
@@ -715,22 +715,22 @@
 
 subsubsection\<open>Freeness\<close>
 
-lemma Agent_neq_HPair: "Agent A ~= Hash[X] Y"
+lemma Agent_neq_HPair: "Agent A \<noteq> Hash[X] Y"
   unfolding HPair_def by simp
 
-lemma Nonce_neq_HPair: "Nonce N ~= Hash[X] Y"
+lemma Nonce_neq_HPair: "Nonce N \<noteq> Hash[X] Y"
   unfolding HPair_def by simp
 
-lemma Number_neq_HPair: "Number N ~= Hash[X] Y"
+lemma Number_neq_HPair: "Number N \<noteq> Hash[X] Y"
   unfolding HPair_def by simp
 
-lemma Key_neq_HPair: "Key K ~= Hash[X] Y"
+lemma Key_neq_HPair: "Key K \<noteq> Hash[X] Y"
   unfolding HPair_def by simp
 
-lemma Hash_neq_HPair: "Hash Z ~= Hash[X] Y"
+lemma Hash_neq_HPair: "Hash Z \<noteq> Hash[X] Y"
   unfolding HPair_def by simp
 
-lemma Crypt_neq_HPair: "Crypt K X' ~= Hash[X] Y"
+lemma Crypt_neq_HPair: "Crypt K X' \<noteq> Hash[X] Y"
   unfolding HPair_def by simp
 
 lemmas HPair_neqs = Agent_neq_HPair Nonce_neq_HPair Number_neq_HPair 
@@ -739,15 +739,15 @@
 declare HPair_neqs [iff]
 declare HPair_neqs [symmetric, iff]
 
-lemma HPair_eq [iff]: "(Hash[X'] Y' = Hash[X] Y) = (X' = X & Y'=Y)"
+lemma HPair_eq [iff]: "(Hash[X'] Y' = Hash[X] Y) = (X' = X \<and> Y'=Y)"
 by (simp add: HPair_def)
 
 lemma MPair_eq_HPair [iff]:
-     "(\<lbrace>X',Y'\<rbrace> = Hash[X] Y) = (X' = Hash\<lbrace>X,Y\<rbrace> & Y'=Y)"
+     "(\<lbrace>X',Y'\<rbrace> = Hash[X] Y) = (X' = Hash\<lbrace>X,Y\<rbrace> \<and> Y'=Y)"
 by (simp add: HPair_def)
 
 lemma HPair_eq_MPair [iff]:
-     "(Hash[X] Y = \<lbrace>X',Y'\<rbrace>) = (X' = Hash\<lbrace>X,Y\<rbrace> & Y'=Y)"
+     "(Hash[X] Y = \<lbrace>X',Y'\<rbrace>) = (X' = Hash\<lbrace>X,Y\<rbrace> \<and> Y'=Y)"
 by (auto simp add: HPair_def)
 
 
@@ -769,7 +769,7 @@
 lemma HPair_synth_analz [simp]:
      "X \<notin> synth (analz H)  
     ==> (Hash[X] Y \<in> synth (analz H)) =  
-        (Hash \<lbrace>X, Y\<rbrace> \<in> analz H & Y \<in> synth (analz H))"
+        (Hash \<lbrace>X, Y\<rbrace> \<in> analz H \<and> Y \<in> synth (analz H))"
 by (auto simp add: HPair_def)
 
 
@@ -897,12 +897,12 @@
 
 text\<open>Two generalizations of \<open>analz_insert_eq\<close>\<close>
 lemma gen_analz_insert_eq [rule_format]:
-     "X \<in> analz H ==> ALL G. H \<subseteq> G --> analz (insert X G) = analz G"
+     "X \<in> analz H \<Longrightarrow> \<forall>G. H \<subseteq> G \<longrightarrow> analz (insert X G) = analz G"
 by (blast intro: analz_cut analz_insertI analz_mono [THEN [2] rev_subsetD])
 
 lemma synth_analz_insert_eq [rule_format]:
      "X \<in> synth (analz H) 
-      ==> ALL G. H \<subseteq> G --> (Key K \<in> analz (insert X G)) = (Key K \<in> analz G)"
+      \<Longrightarrow> \<forall>G. H \<subseteq> G \<longrightarrow> (Key K \<in> analz (insert X G)) = (Key K \<in> analz G)"
 apply (erule synth.induct) 
 apply (simp_all add: gen_analz_insert_eq subset_trans [OF _ subset_insertI]) 
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/NS_Shared.thy
--- a/src/HOL/Auth/NS_Shared.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/NS_Shared.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -16,11 +16,11 @@
 definition
  (* A is the true creator of X if she has sent X and X never appeared on
     the trace before this event. Recall that traces grow from head. *)
-  Issues :: "[agent, agent, msg, event list] => bool"
+  Issues :: "[agent, agent, msg, event list] \<Rightarrow> bool"
              ("_ Issues _ with _ on _") where
    "A Issues B with X on evs =
-      (\<exists>Y. Says A B Y \<in> set evs & X \<in> parts {Y} &
-        X \<notin> parts (spies (takeWhile (% z. z  \<noteq> Says A B Y) (rev evs))))"
+      (\<exists>Y. Says A B Y \<in> set evs \<and> X \<in> parts {Y} \<and>
+        X \<notin> parts (spies (takeWhile (\<lambda>z. z  \<noteq> Says A B Y) (rev evs))))"
 
 
 inductive_set ns_shared :: "event list set"
@@ -395,7 +395,7 @@
 done
 
 lemma spies_Notes_rev: "spies (evs @ [Notes A X]) =
-          (if A:bad then insert X (spies evs) else spies evs)"
+          (if A\<in>bad then insert X (spies evs) else spies evs)"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
@@ -410,7 +410,7 @@
 
 lemmas parts_spies_evs_revD2 = spies_evs_rev [THEN equalityD2, THEN parts_mono]
 
-lemma spies_takeWhile: "spies (takeWhile P evs) <=  spies evs"
+lemma spies_takeWhile: "spies (takeWhile P evs) \<subseteq> spies evs"
 apply (induct_tac "evs")
 apply (rename_tac [2] a b)
 apply (induct_tac [2] "a", auto)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/OtwayRees.thy
--- a/src/HOL/Auth/OtwayRees.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/OtwayRees.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -37,7 +37,7 @@
 
          (*Bob's response to Alice's message.  Note that NB is encrypted.*)
  | OR2:  "\<lbrakk>evs2 \<in> otway;  Nonce NB \<notin> used evs2;
-             Gets B \<lbrace>Nonce NA, Agent A, Agent B, X\<rbrace> : set evs2\<rbrakk>
+             Gets B \<lbrace>Nonce NA, Agent A, Agent B, X\<rbrace> \<in> set evs2\<rbrakk>
           \<Longrightarrow> Says B Server
                   \<lbrace>Nonce NA, Agent A, Agent B, X,
                     Crypt (shrK B)
@@ -52,7 +52,7 @@
                   \<lbrace>Nonce NA, Agent A, Agent B,
                     Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>,
                     Crypt (shrK B) \<lbrace>Nonce NA, Nonce NB, Agent A, Agent B\<rbrace>\<rbrace>
-               : set evs3\<rbrakk>
+               \<in> set evs3\<rbrakk>
           \<Longrightarrow> Says Server B
                   \<lbrace>Nonce NA,
                     Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>,
@@ -66,16 +66,16 @@
              Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X',
                              Crypt (shrK B)
                                    \<lbrace>Nonce NA, Nonce NB, Agent A, Agent B\<rbrace>\<rbrace>
-               : set evs4;
+               \<in> set evs4;
              Gets B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace>
-               : set evs4\<rbrakk>
+               \<in> set evs4\<rbrakk>
           \<Longrightarrow> Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4 \<in> otway"
 
          (*This message models possible leaks of session keys.  The nonces
            identify the protocol run.*)
  | Oops: "\<lbrakk>evso \<in> otway;
              Says Server B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace>
-               : set evso\<rbrakk>
+               \<in> set evso\<rbrakk>
           \<Longrightarrow> Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso \<in> otway"
 
 
@@ -153,7 +153,7 @@
 lemma Says_Server_message_form:
      "\<lbrakk>Says Server B \<lbrace>NA, X, Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs;
          evs \<in> otway\<rbrakk>
-      \<Longrightarrow> K \<notin> range shrK & (\<exists>i. NA = Nonce i) & (\<exists>j. NB = Nonce j)"
+      \<Longrightarrow> K \<notin> range shrK \<and> (\<exists>i. NA = Nonce i) \<and> (\<exists>j. NB = Nonce j)"
 by (erule rev_mp, erule otway.induct, simp_all)
 
 
@@ -172,8 +172,8 @@
 text\<open>The equality makes the induction hypothesis easier to apply\<close>
 lemma analz_image_freshK [rule_format]:
  "evs \<in> otway \<Longrightarrow>
-   \<forall>K KK. KK <= -(range shrK) -->
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+   \<forall>K KK. KK \<subseteq> -(range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 apply (erule otway.induct)
 apply (frule_tac [8] Says_Server_message_form)
@@ -192,7 +192,7 @@
 lemma unique_session_keys:
      "\<lbrakk>Says Server B \<lbrace>NA, X, Crypt (shrK B) \<lbrace>NB, K\<rbrace>\<rbrace>   \<in> set evs;
          Says Server B' \<lbrace>NA',X',Crypt (shrK B') \<lbrace>NB',K\<rbrace>\<rbrace> \<in> set evs;
-         evs \<in> otway\<rbrakk> \<Longrightarrow> X=X' & B=B' & NA=NA' & NB=NB'"
+         evs \<in> otway\<rbrakk> \<Longrightarrow> X=X' \<and> B=B' \<and> NA=NA' \<and> NB=NB'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule otway.induct, simp_all)
@@ -205,7 +205,7 @@
 text\<open>Only OR1 can have caused such a part of a message to appear.\<close>
 lemma Crypt_imp_OR1 [rule_format]:
  "\<lbrakk>A \<notin> bad;  evs \<in> otway\<rbrakk>
-  \<Longrightarrow> Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace> \<in> parts (knows Spy evs) -->
+  \<Longrightarrow> Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
       Says A B \<lbrace>NA, Agent A, Agent B,
                  Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace>\<rbrace>
         \<in> set evs"
@@ -251,9 +251,9 @@
 lemma NA_Crypt_imp_Server_msg [rule_format]:
      "\<lbrakk>A \<notin> bad;  evs \<in> otway\<rbrakk>
       \<Longrightarrow> Says A B \<lbrace>NA, Agent A, Agent B,
-                     Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs -->
+                     Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs \<longrightarrow>
           Crypt (shrK A) \<lbrace>NA, Key K\<rbrace> \<in> parts (knows Spy evs)
-          --> (\<exists>NB. Says Server B
+          \<longrightarrow> (\<exists>NB. Says Server B
                          \<lbrace>NA,
                            Crypt (shrK A) \<lbrace>NA, Key K\<rbrace>,
                            Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs)"
@@ -292,8 +292,8 @@
  "\<lbrakk>A \<notin> bad;  B \<notin> bad;  evs \<in> otway\<rbrakk>
   \<Longrightarrow> Says Server B
         \<lbrace>NA, Crypt (shrK A) \<lbrace>NA, Key K\<rbrace>,
-          Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs -->
-      Notes Spy \<lbrace>NA, NB, Key K\<rbrace> \<notin> set evs -->
+          Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs \<longrightarrow>
+      Notes Spy \<lbrace>NA, NB, Key K\<rbrace> \<notin> set evs \<longrightarrow>
       Key K \<notin> analz (knows Spy evs)"
   apply (erule otway.induct, force, simp_all)
   subgoal \<comment> \<open>Fake\<close>
@@ -368,7 +368,7 @@
      "\<lbrakk>Crypt (shrK B) \<lbrace>NA, NB, Agent A, Agent B\<rbrace> \<in> parts(knows Spy evs);
          Crypt (shrK B) \<lbrace>NC, NB, Agent C, Agent B\<rbrace> \<in> parts(knows Spy evs);
            evs \<in> otway;  B \<notin> bad\<rbrakk>
-         \<Longrightarrow> NC = NA & C = A"
+         \<Longrightarrow> NC = NA \<and> C = A"
 apply (erule rev_mp, erule rev_mp)
 apply (erule otway.induct, force,
        drule_tac [4] OR2_parts_knows_Spy, simp_all)
@@ -380,11 +380,11 @@
 lemma NB_Crypt_imp_Server_msg [rule_format]:
  "\<lbrakk>B \<notin> bad;  evs \<in> otway\<rbrakk>
   \<Longrightarrow> Crypt (shrK B) \<lbrace>NB, Key K\<rbrace> \<in> parts (knows Spy evs)
-      --> (\<forall>X'. Says B Server
+      \<longrightarrow> (\<forall>X'. Says B Server
                      \<lbrace>NA, Agent A, Agent B, X',
                        Crypt (shrK B) \<lbrace>NA, NB, Agent A, Agent B\<rbrace>\<rbrace>
            \<in> set evs
-           --> Says Server B
+           \<longrightarrow> Says Server B
                 \<lbrace>NA, Crypt (shrK A) \<lbrace>NA, Key K\<rbrace>,
                       Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace>
                     \<in> set evs)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/OtwayReesBella.thy
--- a/src/HOL/Auth/OtwayReesBella.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/OtwayReesBella.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -166,7 +166,7 @@
 lemma Says_Server_message_form: 
 "\<lbrakk>Says Server B  \<lbrace>Nonce M, Crypt (shrK B) \<lbrace>X, Nonce Nb, Key K\<rbrace>\<rbrace> \<in> set evs;  
      evs \<in> orb\<rbrakk>                                            
- \<Longrightarrow> K \<notin> range shrK & (\<exists> A Na. X=(Crypt (shrK A) \<lbrace>Nonce Na, Key K\<rbrace>))"
+ \<Longrightarrow> K \<notin> range shrK \<and> (\<exists> A Na. X=(Crypt (shrK A) \<lbrace>Nonce Na, Key K\<rbrace>))"
 by (erule rev_mp, erule orb.induct, simp_all)
 
 lemma Says_Server_imp_Gets: 
@@ -212,19 +212,19 @@
 lemma Gets_Server_message_form: 
 "\<lbrakk>Gets B \<lbrace>Nonce M, Crypt (shrK B) \<lbrace>X, Nonce Nb, Key K\<rbrace>\<rbrace> \<in> set evs;  
     evs \<in> orb\<rbrakk>                                              
- \<Longrightarrow> (K \<notin> range shrK & (\<exists> A Na. X = (Crypt (shrK A) \<lbrace>Nonce Na, Key K\<rbrace>)))    
+ \<Longrightarrow> (K \<notin> range shrK \<and> (\<exists> A Na. X = (Crypt (shrK A) \<lbrace>Nonce Na, Key K\<rbrace>)))    
              | X \<in> analz (knows Spy evs)"
 by (metis B_trusts_OR3 Crypt_Spy_analz_bad Gets_imp_Says MPair_analz MPair_parts
           Says_Server_message_form Says_imp_analz_Spy Says_imp_parts_knows_Spy)
 
 lemma unique_Na: "\<lbrakk>Says A B  \<lbrace>Nonce M, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce Na, Nonce M, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs;   
          Says A B' \<lbrace>Nonce M', Agent A, Agent B', Crypt (shrK A) \<lbrace>Nonce Na, Nonce M', Agent A, Agent B'\<rbrace>\<rbrace> \<in> set evs;  
-    A \<notin> bad; evs \<in> orb\<rbrakk> \<Longrightarrow> B=B' & M=M'"
+    A \<notin> bad; evs \<in> orb\<rbrakk> \<Longrightarrow> B=B' \<and> M=M'"
 by (erule rev_mp, erule rev_mp, erule orb.induct, simp_all, blast+)
 
 lemma unique_Nb: "\<lbrakk>Says B Server \<lbrace>Nonce M, Agent A, Agent B, X, Crypt (shrK B) \<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs;   
          Says B Server \<lbrace>Nonce M', Agent A', Agent B, X', Crypt (shrK B) \<lbrace>Nonce Nb,Nonce M', Nonce M', Agent A', Agent B\<rbrace>\<rbrace> \<in> set evs;   
-    B \<notin> bad; evs \<in> orb\<rbrakk> \<Longrightarrow>   M=M' & A=A' & X=X'"
+    B \<notin> bad; evs \<in> orb\<rbrakk> \<Longrightarrow>   M=M' \<and> A=A' \<and> X=X'"
 by (erule rev_mp, erule rev_mp, erule orb.induct, simp_all, blast+)
 
 lemma analz_image_freshCryptK_lemma:
@@ -342,7 +342,7 @@
 lemma Gets_Server_message_form': 
 "\<lbrakk>Gets B \<lbrace>Nonce M, Crypt (shrK B) \<lbrace>X, Nonce Nb, Key K\<rbrace>\<rbrace>  \<in> set evs;  
    B \<notin> bad; evs \<in> orb\<rbrakk>                              
-  \<Longrightarrow> K \<notin> range shrK & (\<exists> A Na. X = (Crypt (shrK A) \<lbrace>Nonce Na, Key K\<rbrace>))"
+  \<Longrightarrow> K \<notin> range shrK \<and> (\<exists> A Na. X = (Crypt (shrK A) \<lbrace>Nonce Na, Key K\<rbrace>))"
 by (blast dest!: B_trusts_OR3 Says_Server_message_form)
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/OtwayRees_AN.thy
--- a/src/HOL/Auth/OtwayRees_AN.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/OtwayRees_AN.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -135,7 +135,7 @@
               Crypt (shrK B) \<lbrace>NB, Agent A, Agent B, Key K\<rbrace>\<rbrace>
            \<in> set evs;
          evs \<in> otway |]
-      ==> K \<notin> range shrK & (\<exists>i. NA = Nonce i) & (\<exists>j. NB = Nonce j)"
+      ==> K \<notin> range shrK \<and> (\<exists>i. NA = Nonce i) \<and> (\<exists>j. NB = Nonce j)"
 apply (erule rev_mp)
 apply (erule otway.induct, auto)
 done
@@ -157,8 +157,8 @@
 text\<open>The equality makes the induction hypothesis easier to apply\<close>
 lemma analz_image_freshK [rule_format]:
  "evs \<in> otway ==>
-   \<forall>K KK. KK <= -(range shrK) -->
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+   \<forall>K KK. KK \<subseteq> -(range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 apply (erule otway.induct) 
 apply (frule_tac [8] Says_Server_message_form)
@@ -183,7 +183,7 @@
             Crypt (shrK B') \<lbrace>NB', Agent A', Agent B', K\<rbrace>\<rbrace>
          \<in> set evs;
         evs \<in> otway |]
-     ==> A=A' & B=B' & NA=NA' & NB=NB'"
+     ==> A=A' \<and> B=B' \<and> NA=NA' \<and> NB=NB'"
 apply (erule rev_mp, erule rev_mp, erule otway.induct, simp_all)
 apply blast+  \<comment> \<open>OR3 and OR4\<close>
 done
@@ -195,7 +195,7 @@
 lemma NA_Crypt_imp_Server_msg [rule_format]:
     "[| A \<notin> bad;  A \<noteq> B;  evs \<in> otway |]
      ==> Crypt (shrK A) \<lbrace>NA, Agent A, Agent B, Key K\<rbrace> \<in> parts (knows Spy evs)
-       --> (\<exists>NB. Says Server B
+       \<longrightarrow> (\<exists>NB. Says Server B
                     \<lbrace>Crypt (shrK A) \<lbrace>NA, Agent A, Agent B, Key K\<rbrace>,
                       Crypt (shrK B) \<lbrace>NB, Agent A, Agent B, Key K\<rbrace>\<rbrace>
                     \<in> set evs)"
@@ -225,8 +225,8 @@
       ==> Says Server B
            \<lbrace>Crypt (shrK A) \<lbrace>NA, Agent A, Agent B, Key K\<rbrace>,
              Crypt (shrK B) \<lbrace>NB, Agent A, Agent B, Key K\<rbrace>\<rbrace>
-          \<in> set evs -->
-          Notes Spy \<lbrace>NA, NB, Key K\<rbrace> \<notin> set evs -->
+          \<in> set evs \<longrightarrow>
+          Notes Spy \<lbrace>NA, NB, Key K\<rbrace> \<notin> set evs \<longrightarrow>
           Key K \<notin> analz (knows Spy evs)"
 apply (erule otway.induct, force)
 apply (frule_tac [7] Says_Server_message_form)
@@ -265,7 +265,7 @@
 lemma NB_Crypt_imp_Server_msg [rule_format]:
  "[| B \<notin> bad;  A \<noteq> B;  evs \<in> otway |]
   ==> Crypt (shrK B) \<lbrace>NB, Agent A, Agent B, Key K\<rbrace> \<in> parts (knows Spy evs)
-      --> (\<exists>NA. Says Server B
+      \<longrightarrow> (\<exists>NA. Says Server B
                    \<lbrace>Crypt (shrK A) \<lbrace>NA, Agent A, Agent B, Key K\<rbrace>,
                      Crypt (shrK B) \<lbrace>NB, Agent A, Agent B, Key K\<rbrace>\<rbrace>
                    \<in> set evs)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/OtwayRees_Bad.thy
--- a/src/HOL/Auth/OtwayRees_Bad.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/OtwayRees_Bad.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -157,7 +157,7 @@
 lemma Says_Server_message_form:
      "[| Says Server B \<lbrace>NA, X, Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs;
          evs \<in> otway |]
-      ==> K \<notin> range shrK & (\<exists>i. NA = Nonce i) & (\<exists>j. NB = Nonce j)"
+      ==> K \<notin> range shrK \<and> (\<exists>i. NA = Nonce i) \<and> (\<exists>j. NB = Nonce j)"
 apply (erule rev_mp)
 apply (erule otway.induct, simp_all)
 done
@@ -178,8 +178,8 @@
 text\<open>The equality makes the induction hypothesis easier to apply\<close>
 lemma analz_image_freshK [rule_format]:
  "evs \<in> otway ==>
-   \<forall>K KK. KK <= -(range shrK) -->
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+   \<forall>K KK. KK \<subseteq> -(range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 apply (erule otway.induct)
 apply (frule_tac [8] Says_Server_message_form)
@@ -198,7 +198,7 @@
 lemma unique_session_keys:
      "[| Says Server B \<lbrace>NA, X, Crypt (shrK B) \<lbrace>NB, K\<rbrace>\<rbrace>   \<in> set evs;
          Says Server B' \<lbrace>NA',X',Crypt (shrK B') \<lbrace>NB',K\<rbrace>\<rbrace> \<in> set evs;
-         evs \<in> otway |] ==> X=X' & B=B' & NA=NA' & NB=NB'"
+         evs \<in> otway |] ==> X=X' \<and> B=B' \<and> NA=NA' \<and> NB=NB'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule otway.induct, simp_all)
@@ -213,8 +213,8 @@
  "[| A \<notin> bad;  B \<notin> bad;  evs \<in> otway |]
   ==> Says Server B
         \<lbrace>NA, Crypt (shrK A) \<lbrace>NA, Key K\<rbrace>,
-          Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs -->
-      Notes Spy \<lbrace>NA, NB, Key K\<rbrace> \<notin> set evs -->
+          Crypt (shrK B) \<lbrace>NB, Key K\<rbrace>\<rbrace> \<in> set evs \<longrightarrow>
+      Notes Spy \<lbrace>NA, NB, Key K\<rbrace> \<notin> set evs \<longrightarrow>
       Key K \<notin> analz (knows Spy evs)"
 apply (erule otway.induct, force)
 apply (frule_tac [7] Says_Server_message_form)
@@ -243,7 +243,7 @@
   up. Original Otway-Rees doesn't need it.\<close>
 lemma Crypt_imp_OR1 [rule_format]:
      "[| A \<notin> bad;  A \<noteq> B;  evs \<in> otway |]
-      ==> Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace> \<in> parts (knows Spy evs) -->
+      ==> Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
           Says A B \<lbrace>NA, Agent A, Agent B,
                      Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace>\<rbrace>  \<in> set evs"
 by (erule otway.induct, force,
@@ -256,10 +256,10 @@
 text\<open>Only it is FALSE.  Somebody could make a fake message to Server
           substituting some other nonce NA' for NB.\<close>
 lemma "[| A \<notin> bad;  A \<noteq> B;  evs \<in> otway |]
-       ==> Crypt (shrK A) \<lbrace>NA, Key K\<rbrace> \<in> parts (knows Spy evs) -->
+       ==> Crypt (shrK A) \<lbrace>NA, Key K\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
            Says A B \<lbrace>NA, Agent A, Agent B,
                       Crypt (shrK A) \<lbrace>NA, Agent A, Agent B\<rbrace>\<rbrace>
-            \<in> set evs -->
+            \<in> set evs \<longrightarrow>
            (\<exists>B NB. Says Server B
                 \<lbrace>NA,
                   Crypt (shrK A) \<lbrace>NA, Key K\<rbrace>,
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Public.thy
--- a/src/HOL/Auth/Public.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Public.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -19,27 +19,27 @@
 datatype keymode = Signature | Encryption
 
 consts
-  publicKey :: "[keymode,agent] => key"
+  publicKey :: "[keymode,agent] \<Rightarrow> key"
 
 abbreviation
-  pubEK :: "agent => key" where
+  pubEK :: "agent \<Rightarrow> key" where
   "pubEK == publicKey Encryption"
 
 abbreviation
-  pubSK :: "agent => key" where
+  pubSK :: "agent \<Rightarrow> key" where
   "pubSK == publicKey Signature"
 
 abbreviation
-  privateKey :: "[keymode, agent] => key" where
+  privateKey :: "[keymode, agent] \<Rightarrow> key" where
   "privateKey b A == invKey (publicKey b A)"
 
 abbreviation
   (*BEWARE!! priEK, priSK DON'T WORK with inj, range, image, etc.*)
-  priEK :: "agent => key" where
+  priEK :: "agent \<Rightarrow> key" where
   "priEK A == privateKey Encryption A"
 
 abbreviation
-  priSK :: "agent => key" where
+  priSK :: "agent \<Rightarrow> key" where
   "priSK A == privateKey Signature A"
 
 
@@ -47,11 +47,11 @@
 simple situation where the signature and encryption keys are the same.\<close>
 
 abbreviation
-  pubK :: "agent => key" where
+  pubK :: "agent \<Rightarrow> key" where
   "pubK A == pubEK A"
 
 abbreviation
-  priK :: "agent => key" where
+  priK :: "agent \<Rightarrow> key" where
   "priK A == invKey (pubEK A)"
 
 
@@ -59,9 +59,9 @@
   @{term "True\<noteq>False"}, no agent has identical signing and encryption keys\<close>
 specification (publicKey)
   injective_publicKey:
-    "publicKey b A = publicKey c A' ==> b=c & A=A'"
+    "publicKey b A = publicKey c A' ==> b=c \<and> A=A'"
    apply (rule exI [of _ 
-       "%b A. 2 * case_agent 0 (\<lambda>n. n + 2) 1 A + case_keymode 0 1 b"])
+       "\<lambda>b A. 2 * case_agent 0 (\<lambda>n. n + 2) 1 A + case_keymode 0 1 b"])
    apply (auto simp add: inj_on_def split: agent.split keymode.split)
    apply presburger
    apply presburger
@@ -79,7 +79,7 @@
 
 subsection\<open>Basic properties of @{term pubK} and @{term priK}\<close>
 
-lemma publicKey_inject [iff]: "(publicKey b A = publicKey c A') = (b=c & A=A')"
+lemma publicKey_inject [iff]: "(publicKey b A = publicKey c A') = (b=c \<and> A=A')"
 by (blast dest!: injective_publicKey) 
 
 lemma not_symKeys_pubK [iff]: "publicKey b A \<notin> symKeys"
@@ -111,14 +111,14 @@
 
 (*holds because invKey is injective*)
 lemma publicKey_image_eq [simp]:
-     "(publicKey b x \<in> publicKey c ` AA) = (b=c & x \<in> AA)"
+     "(publicKey b x \<in> publicKey c ` AA) = (b=c \<and> x \<in> AA)"
 by auto
 
 lemma privateKey_notin_image_publicKey [simp]: "privateKey b x \<notin> publicKey c ` AA"
 by auto
 
 lemma privateKey_image_eq [simp]:
-     "(privateKey b A \<in> invKey ` publicKey c ` AS) = (b=c & A\<in>AS)"
+     "(privateKey b A \<in> invKey ` publicKey c ` AS) = (b=c \<and> A\<in>AS)"
 by auto
 
 lemma publicKey_notin_image_privateKey [simp]: "publicKey b A \<notin> invKey ` publicKey c ` AS"
@@ -239,7 +239,7 @@
 apply (auto dest!: parts_cut simp add: used_Nil) 
 done
 
-lemma MPair_used_D: "\<lbrace>X,Y\<rbrace> \<in> used H ==> X \<in> used H & Y \<in> used H"
+lemma MPair_used_D: "\<lbrace>X,Y\<rbrace> \<in> used H ==> X \<in> used H \<and> Y \<in> used H"
 by (drule used_parts_subset_parts, simp, blast)
 
 text\<open>There was a similar theorem in Event.thy, so perhaps this one can
@@ -358,7 +358,7 @@
 subsection\<open>Supply fresh nonces for possibility theorems\<close>
 
 text\<open>In any trace, there is an upper bound N on the greatest nonce in use\<close>
-lemma Nonce_supply_lemma: "EX N. ALL n. N<=n --> Nonce n \<notin> used evs"
+lemma Nonce_supply_lemma: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Nonce n \<notin> used evs"
 apply (induct_tac "evs")
 apply (rule_tac x = 0 in exI)
 apply (simp_all (no_asm_simp) add: used_Cons split: event.split)
@@ -366,17 +366,17 @@
 apply (rule msg_Nonce_supply [THEN exE], blast elim!: add_leE)+
 done
 
-lemma Nonce_supply1: "EX N. Nonce N \<notin> used evs"
+lemma Nonce_supply1: "\<exists>N. Nonce N \<notin> used evs"
 by (rule Nonce_supply_lemma [THEN exE], blast)
 
-lemma Nonce_supply: "Nonce (@ N. Nonce N \<notin> used evs) \<notin> used evs"
+lemma Nonce_supply: "Nonce (SOME N. Nonce N \<notin> used evs) \<notin> used evs"
 apply (rule Nonce_supply_lemma [THEN exE])
 apply (rule someI, fast)
 done
 
 subsection\<open>Specialized Rewriting for Theorems About @{term analz} and Image\<close>
 
-lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} Un H"
+lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} \<union> H"
 by blast
 
 lemma insert_Key_image: "insert (Key K) (Key`KK \<union> C) = Key ` (insert K KK) \<union> C"
@@ -389,7 +389,7 @@
 text\<open>Lemma for the trivial direction of the if-and-only-if of the 
 Session Key Compromise Theorem\<close>
 lemma analz_image_freshK_lemma:
-     "(Key K \<in> analz (Key`nE \<union> H)) --> (K \<in> nE | Key K \<in> analz H)  ==>  
+     "(Key K \<in> analz (Key`nE \<union> H)) \<longrightarrow> (K \<in> nE | Key K \<in> analz H)  ==>  
          (Key K \<in> analz (Key`nE \<union> H)) = (K \<in> nE | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Recur.thy
--- a/src/HOL/Auth/Recur.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Recur.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -17,7 +17,7 @@
   Perhaps the two session keys could be bundled into a single message.
 *)
 inductive_set (*Server's response to the nested message*)
-  respond :: "event list => (msg*msg*key)set"
+  respond :: "event list \<Rightarrow> (msg*msg*key)set"
   for evs :: "event list"
   where
    One:  "Key KAB \<notin> used evs
@@ -232,11 +232,11 @@
   satisfying the inductive hypothesis.*)
 lemma resp_analz_image_freshK_lemma:
      "[| RB \<in> responses evs;
-         \<forall>K KK. KK \<subseteq> - (range shrK) -->
-                   (Key K \<in> analz (Key`KK Un H)) =
+         \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+                   (Key K \<in> analz (Key`KK \<union> H)) =
                    (K \<in> KK | Key K \<in> analz H) |]
-     ==> \<forall>K KK. KK \<subseteq> - (range shrK) -->
-                   (Key K \<in> analz (insert RB (Key`KK Un H))) =
+     ==> \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+                   (Key K \<in> analz (insert RB (Key`KK \<union> H))) =
                    (K \<in> KK | Key K \<in> analz (insert RB H))"
 apply (erule responses.induct)
 apply (simp_all del: image_insert
@@ -247,8 +247,8 @@
 text\<open>Version for the protocol.  Proof is easy, thanks to the lemma.\<close>
 lemma raw_analz_image_freshK:
  "evs \<in> recur ==>
-   \<forall>K KK. KK \<subseteq> - (range shrK) -->
-          (Key K \<in> analz (Key`KK Un (spies evs))) =
+   \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (spies evs))) =
           (K \<in> KK | Key K \<in> analz (spies evs))"
 apply (erule recur.induct)
 apply (drule_tac [4] RA2_analz_spies,
@@ -261,8 +261,8 @@
 
 (*Instance of the lemma with H replaced by (spies evs):
    [| RB \<in> responses evs;  evs \<in> recur; |]
-   ==> KK \<subseteq> - (range shrK) -->
-       Key K \<in> analz (insert RB (Key`KK Un spies evs)) =
+   ==> KK \<subseteq> - (range shrK) \<longrightarrow>
+       Key K \<in> analz (insert RB (Key`KK \<union> spies evs)) =
        (K \<in> KK | Key K \<in> analz (insert RB (spies evs)))
 *)
 lemmas resp_analz_image_freshK =  
@@ -302,7 +302,7 @@
   "[| Hash \<lbrace>Key(shrK A), Agent A, B, NA, P\<rbrace> \<in> parts (spies evs);
       Hash \<lbrace>Key(shrK A), Agent A, B',NA, P'\<rbrace> \<in> parts (spies evs);
       evs \<in> recur;  A \<notin> bad |]
-    ==> B=B' & P=P'"
+    ==> B=B' \<and> P=P'"
 apply (erule rev_mp, erule rev_mp)
 apply (erule recur.induct,
        drule_tac [5] respond_imp_responses)
@@ -322,7 +322,7 @@
 
 lemma shrK_in_analz_respond [simp]:
      "[| RB \<in> responses evs;  evs \<in> recur |]
-  ==> (Key (shrK B) \<in> analz (insert RB (spies evs))) = (B:bad)"
+  ==> (Key (shrK B) \<in> analz (insert RB (spies evs))) = (B\<in>bad)"
 apply (erule responses.induct)
 apply (simp_all del: image_insert
                 add: analz_image_freshK_simps resp_analz_image_freshK, auto) 
@@ -331,8 +331,8 @@
 
 lemma resp_analz_insert_lemma:
      "[| Key K \<in> analz (insert RB H);
-         \<forall>K KK. KK \<subseteq> - (range shrK) -->
-                   (Key K \<in> analz (Key`KK Un H)) =
+         \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+                   (Key K \<in> analz (Key`KK \<union> H)) =
                    (K \<in> KK | Key K \<in> analz H);
          RB \<in> responses evs |]
      ==> (Key K \<in> parts{RB} | Key K \<in> analz H)"
@@ -361,9 +361,9 @@
   the quantifiers appear to be necessary.*)
 lemma unique_lemma [rule_format]:
      "(PB,RB,KXY) \<in> respond evs ==>
-      \<forall>A B N. Crypt (shrK A) \<lbrace>Key K, Agent B, N\<rbrace> \<in> parts {RB} -->
-      (\<forall>A' B' N'. Crypt (shrK A') \<lbrace>Key K, Agent B', N'\<rbrace> \<in> parts {RB} -->
-      (A'=A & B'=B) | (A'=B & B'=A))"
+      \<forall>A B N. Crypt (shrK A) \<lbrace>Key K, Agent B, N\<rbrace> \<in> parts {RB} \<longrightarrow>
+      (\<forall>A' B' N'. Crypt (shrK A') \<lbrace>Key K, Agent B', N'\<rbrace> \<in> parts {RB} \<longrightarrow>
+      (A'=A \<and> B'=B) | (A'=B \<and> B'=A))"
 apply (erule respond.induct)
 apply (simp_all add: all_conj_distrib)
 apply (blast dest: respond_certificate)
@@ -373,7 +373,7 @@
      "[| Crypt (shrK A) \<lbrace>Key K, Agent B, N\<rbrace> \<in> parts {RB};
          Crypt (shrK A') \<lbrace>Key K, Agent B', N'\<rbrace> \<in> parts {RB};
          (PB,RB,KXY) \<in> respond evs |]
-      ==> (A'=A & B'=B) | (A'=B & B'=A)"
+      ==> (A'=A \<and> B'=B) | (A'=B \<and> B'=A)"
 by (rule unique_lemma, auto)
 
 
@@ -383,8 +383,8 @@
 
 lemma respond_Spy_not_see_session_key [rule_format]:
      "[| (PB,RB,KAB) \<in> respond evs;  evs \<in> recur |]
-      ==> \<forall>A A' N. A \<notin> bad & A' \<notin> bad -->
-          Crypt (shrK A) \<lbrace>Key K, Agent A', N\<rbrace> \<in> parts{RB} -->
+      ==> \<forall>A A' N. A \<notin> bad \<and> A' \<notin> bad \<longrightarrow>
+          Crypt (shrK A) \<lbrace>Key K, Agent A', N\<rbrace> \<in> parts{RB} \<longrightarrow>
           Key K \<notin> analz (insert RB (spies evs))"
 apply (erule respond.induct)
 apply (frule_tac [2] respond_imp_responses)
@@ -464,7 +464,7 @@
 lemma Cert_imp_Server_msg:
      "[| Crypt (shrK A) Y \<in> parts (spies evs);
          A \<notin> bad;  evs \<in> recur |]
-      ==> \<exists>C RC. Says Server C RC \<in> set evs  &
+      ==> \<exists>C RC. Says Server C RC \<in> set evs  \<and>
                    Crypt (shrK A) Y \<in> parts {RC}"
 apply (erule rev_mp, erule recur.induct, simp_all)
 txt\<open>Fake\<close>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Shared.thy
--- a/src/HOL/Auth/Shared.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Shared.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -12,7 +12,7 @@
 begin
 
 consts
-  shrK    :: "agent => key"  (*symmetric keys*)
+  shrK    :: "agent \<Rightarrow> key"  (*symmetric keys*)
 
 specification (shrK)
   inj_shrK: "inj shrK"
@@ -76,13 +76,13 @@
 subsection\<open>Function "knows"\<close>
 
 (*Spy sees shared keys of agents!*)
-lemma Spy_knows_Spy_bad [intro!]: "A: bad ==> Key (shrK A) \<in> knows Spy evs"
+lemma Spy_knows_Spy_bad [intro!]: "A \<in> bad \<Longrightarrow> Key (shrK A) \<in> knows Spy evs"
 apply (induct_tac "evs")
 apply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)
 done
 
 (*For case analysis on whether or not an agent is compromised*)
-lemma Crypt_Spy_analz_bad: "[| Crypt (shrK A) X \<in> analz (knows Spy evs);  A: bad |]  
+lemma Crypt_Spy_analz_bad: "[| Crypt (shrK A) X \<in> analz (knows Spy evs);  A \<in> bad |]  
       ==> X \<in> analz (knows Spy evs)"
 by (metis Spy_knows_Spy_bad analz.Inj analz_Decrypt')
 
@@ -120,7 +120,7 @@
 subsection\<open>Supply fresh nonces for possibility theorems.\<close>
 
 (*In any trace, there is an upper bound N on the greatest nonce in use.*)
-lemma Nonce_supply_lemma: "\<exists>N. ALL n. N<=n --> Nonce n \<notin> used evs"
+lemma Nonce_supply_lemma: "\<exists>N. \<forall>n. N \<le> n \<longrightarrow> Nonce n \<notin> used evs"
 apply (induct_tac "evs")
 apply (rule_tac x = 0 in exI)
 apply (simp_all (no_asm_simp) add: used_Cons split: event.split)
@@ -130,14 +130,14 @@
 lemma Nonce_supply1: "\<exists>N. Nonce N \<notin> used evs"
 by (metis Nonce_supply_lemma order_eq_iff)
 
-lemma Nonce_supply2: "\<exists>N N'. Nonce N \<notin> used evs & Nonce N' \<notin> used evs' & N \<noteq> N'"
+lemma Nonce_supply2: "\<exists>N N'. Nonce N \<notin> used evs \<and> Nonce N' \<notin> used evs' \<and> N \<noteq> N'"
 apply (cut_tac evs = evs in Nonce_supply_lemma)
 apply (cut_tac evs = "evs'" in Nonce_supply_lemma, clarify)
 apply (metis Suc_n_not_le_n nat_le_linear)
 done
 
-lemma Nonce_supply3: "\<exists>N N' N''. Nonce N \<notin> used evs & Nonce N' \<notin> used evs' &  
-                    Nonce N'' \<notin> used evs'' & N \<noteq> N' & N' \<noteq> N'' & N \<noteq> N''"
+lemma Nonce_supply3: "\<exists>N N' N''. Nonce N \<notin> used evs \<and> Nonce N' \<notin> used evs' \<and>  
+                    Nonce N'' \<notin> used evs'' \<and> N \<noteq> N' \<and> N' \<noteq> N'' \<and> N \<noteq> N''"
 apply (cut_tac evs = evs in Nonce_supply_lemma)
 apply (cut_tac evs = "evs'" in Nonce_supply_lemma)
 apply (cut_tac evs = "evs''" in Nonce_supply_lemma, clarify)
@@ -147,13 +147,13 @@
 apply (simp (no_asm_simp) add: less_not_refl3 le_add1 le_add2 less_Suc_eq_le)
 done
 
-lemma Nonce_supply: "Nonce (@ N. Nonce N \<notin> used evs) \<notin> used evs"
+lemma Nonce_supply: "Nonce (SOME N. Nonce N \<notin> used evs) \<notin> used evs"
 apply (rule Nonce_supply_lemma [THEN exE])
 apply (rule someI, blast)
 done
 
 text\<open>Unlike the corresponding property of nonces, we cannot prove
-    @{term "finite KK ==> \<exists>K. K \<notin> KK & Key K \<notin> used evs"}.
+    @{term "finite KK ==> \<exists>K. K \<notin> KK \<and> Key K \<notin> used evs"}.
     We have infinitely many agents and there is nothing to stop their
     long-term keys from exhausting all the natural numbers.  Instead,
     possibility theorems must assume the existence of a few keys.\<close>
@@ -161,7 +161,7 @@
 
 subsection\<open>Specialized Rewriting for Theorems About @{term analz} and Image\<close>
 
-lemma subset_Compl_range: "A <= - (range shrK) ==> shrK x \<notin> A"
+lemma subset_Compl_range: "A \<subseteq> - (range shrK) \<Longrightarrow> shrK x \<notin> A"
 by blast
 
 lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} \<union> H"
@@ -184,7 +184,7 @@
 
 (*Lemma for the trivial direction of the if-and-only-if*)
 lemma analz_image_freshK_lemma:
-     "(Key K \<in> analz (Key`nE \<union> H)) --> (K \<in> nE | Key K \<in> analz H)  ==>  
+     "(Key K \<in> analz (Key`nE \<union> H)) \<longrightarrow> (K \<in> nE | Key K \<in> analz H)  ==>  
          (Key K \<in> analz (Key`nE \<union> H)) = (K \<in> nE | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
@@ -250,7 +250,7 @@
     Scan.succeed (fn ctxt => SIMPLE_METHOD (Shared.basic_possibility_tac ctxt))\<close>
     "for proving possibility theorems"
 
-lemma knows_subset_knows_Cons: "knows A evs <= knows A (e # evs)"
+lemma knows_subset_knows_Cons: "knows A evs \<subseteq> knows A (e # evs)"
 by (cases e) (auto simp: knows_Cons)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Smartcard/Smartcard.thy
--- a/src/HOL/Auth/Smartcard/Smartcard.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Smartcard/Smartcard.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -299,7 +299,7 @@
 apply blast
 done
 
-lemma Nonce_supply: "Nonce (@ N. Nonce N \<notin> used evs) \<notin> used evs"
+lemma Nonce_supply: "Nonce (SOME N. Nonce N \<notin> used evs) \<notin> used evs"
 apply (rule finite.emptyI [THEN Nonce_supply_ax, THEN exE])
 apply (rule someI, blast)
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/TLS.thy
--- a/src/HOL/Auth/TLS.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/TLS.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -42,7 +42,7 @@
 
 theory TLS imports Public "HOL-Library.Nat_Bijection" begin
 
-definition certificate :: "[agent,key] => msg" where
+definition certificate :: "[agent,key] \<Rightarrow> msg" where
     "certificate A KA == Crypt (priSK Server) \<lbrace>Agent A, Key KA\<rbrace>"
 
 text\<open>TLS apparently does not require separate keypairs for encryption and
@@ -53,27 +53,27 @@
 
 consts
   (*Pseudo-random function of Section 5*)
-  PRF  :: "nat*nat*nat => nat"
+  PRF  :: "nat*nat*nat \<Rightarrow> nat"
 
   (*Client, server write keys are generated uniformly by function sessionK
     to avoid duplicating their properties.  They are distinguished by a
     tag (not a bool, to avoid the peculiarities of if-and-only-if).
     Session keys implicitly include MAC secrets.*)
-  sessionK :: "(nat*nat*nat) * role => key"
+  sessionK :: "(nat*nat*nat) * role \<Rightarrow> key"
 
 abbreviation
-  clientK :: "nat*nat*nat => key" where
+  clientK :: "nat*nat*nat \<Rightarrow> key" where
   "clientK X == sessionK(X, ClientRole)"
 
 abbreviation
-  serverK :: "nat*nat*nat => key" where
+  serverK :: "nat*nat*nat \<Rightarrow> key" where
   "serverK X == sessionK(X, ServerRole)"
 
 
 specification (PRF)
   inj_PRF: "inj PRF"
   \<comment> \<open>the pseudo-random function is collision-free\<close>
-   apply (rule exI [of _ "%(x,y,z). prod_encode(x, prod_encode(y,z))"])
+   apply (rule exI [of _ "\<lambda>(x,y,z). prod_encode(x, prod_encode(y,z))"])
    apply (simp add: inj_on_def prod_encode_eq)
    done
 
@@ -81,7 +81,7 @@
   inj_sessionK: "inj sessionK"
   \<comment> \<open>sessionK is collision-free; also, no clientK clashes with any serverK.\<close>
    apply (rule exI [of _ 
-         "%((x,y,z), r). prod_encode(case_role 0 1 r, 
+         "\<lambda>((x,y,z), r). prod_encode(case_role 0 1 r, 
                            prod_encode(x, prod_encode(y,z)))"])
    apply (simp add: inj_on_def prod_encode_eq split: role.split) 
    done
@@ -108,7 +108,7 @@
  | SpyKeys: \<comment> \<open>The spy may apply @{term PRF} and @{term sessionK}
                 to available nonces\<close>
          "[| evsSK \<in> tls;
-             {Nonce NA, Nonce NB, Nonce M} <= analz (spies evsSK) |]
+             {Nonce NA, Nonce NB, Nonce M} \<subseteq> analz (spies evsSK) |]
           ==> Notes Spy \<lbrace> Nonce (PRF(M,NA,NB)),
                            Key (sessionK((NA,NB,M),role))\<rbrace> # evsSK \<in> tls"
 
@@ -240,7 +240,7 @@
          \<comment> \<open>If A recalls the \<open>SESSION_ID\<close>, then she sends a FINISHED
              message using the new nonces and stored MASTER SECRET.\<close>
          "[| evsCR \<in> tls;
-             Says A  B \<lbrace>Agent A, Nonce NA, Number SID, Number PA\<rbrace>: set evsCR;
+             Says A  B \<lbrace>Agent A, Nonce NA, Number SID, Number PA\<rbrace> \<in> set evsCR;
              Says B' A \<lbrace>Nonce NB, Number SID, Number PB\<rbrace> \<in> set evsCR;
              Notes A \<lbrace>Number SID, Agent A, Agent B, Nonce M\<rbrace> \<in> set evsCR |]
           ==> Says A B (Crypt (clientK(NA,NB,M))
@@ -253,7 +253,7 @@
          \<comment> \<open>Resumption (7.3):  If B finds the \<open>SESSION_ID\<close> then he can 
              send a FINISHED message using the recovered MASTER SECRET\<close>
          "[| evsSR \<in> tls;
-             Says A' B \<lbrace>Agent A, Nonce NA, Number SID, Number PA\<rbrace>: set evsSR;
+             Says A' B \<lbrace>Agent A, Nonce NA, Number SID, Number PA\<rbrace> \<in> set evsSR;
              Says B  A \<lbrace>Nonce NB, Number SID, Number PB\<rbrace> \<in> set evsSR;
              Notes B \<lbrace>Number SID, Agent A, Agent B, Nonce M\<rbrace> \<in> set evsSR |]
           ==> Says B A (Crypt (serverK(NA,NB,M))
@@ -331,7 +331,7 @@
 
 
 text\<open>Possibility property ending with ClientAccepts.\<close>
-lemma "[| \<forall>evs. (@ N. Nonce N \<notin> used evs) \<notin> range PRF;  A \<noteq> B |]
+lemma "[| \<forall>evs. (SOME N. Nonce N \<notin> used evs) \<notin> range PRF;  A \<noteq> B |]
       ==> \<exists>SID M. \<exists>evs \<in> tls.
             Notes A \<lbrace>Number SID, Agent A, Agent B, Nonce M\<rbrace> \<in> set evs"
 apply (intro exI bexI)
@@ -344,7 +344,7 @@
 
 
 text\<open>And one for ServerAccepts.  Either FINISHED message may come first.\<close>
-lemma "[| \<forall>evs. (@ N. Nonce N \<notin> used evs) \<notin> range PRF; A \<noteq> B |]
+lemma "[| \<forall>evs. (SOME N. Nonce N \<notin> used evs) \<notin> range PRF; A \<noteq> B |]
       ==> \<exists>SID NA PA NB PB M. \<exists>evs \<in> tls.
            Notes B \<lbrace>Number SID, Agent A, Agent B, Nonce M\<rbrace> \<in> set evs"
 apply (intro exI bexI)
@@ -357,7 +357,7 @@
 
 
 text\<open>Another one, for CertVerify (which is optional)\<close>
-lemma "[| \<forall>evs. (@ N. Nonce N \<notin> used evs) \<notin> range PRF;  A \<noteq> B |]
+lemma "[| \<forall>evs. (SOME N. Nonce N \<notin> used evs) \<notin> range PRF;  A \<noteq> B |]
        ==> \<exists>NB PMS. \<exists>evs \<in> tls.
               Says A B (Crypt (priK A) (Hash\<lbrace>Nonce NB, Agent B, Nonce PMS\<rbrace>)) 
                 \<in> set evs"
@@ -374,13 +374,13 @@
 lemma "[| evs0 \<in> tls;
           Notes A \<lbrace>Number SID, Agent A, Agent B, Nonce M\<rbrace> \<in> set evs0;
           Notes B \<lbrace>Number SID, Agent A, Agent B, Nonce M\<rbrace> \<in> set evs0;
-          \<forall>evs. (@ N. Nonce N \<notin> used evs) \<notin> range PRF;
+          \<forall>evs. (SOME N. Nonce N \<notin> used evs) \<notin> range PRF;
           A \<noteq> B |]
       ==> \<exists>NA PA NB PB X. \<exists>evs \<in> tls.
                 X = Hash\<lbrace>Number SID, Nonce M,
                           Nonce NA, Number PA, Agent A,
-                          Nonce NB, Number PB, Agent B\<rbrace>  &
-                Says A B (Crypt (clientK(NA,NB,M)) X) \<in> set evs  &
+                          Nonce NB, Number PB, Agent B\<rbrace>  \<and>
+                Says A B (Crypt (clientK(NA,NB,M)) X) \<in> set evs  \<and>
                 Says B A (Crypt (serverK(NA,NB,M)) X) \<in> set evs"
 apply (intro exI bexI)
 apply (rule_tac [2] tls.ClientHello
@@ -548,7 +548,7 @@
      "[| Notes A  \<lbrace>Agent B,  Nonce PMS\<rbrace> \<in> set evs;
          Notes A' \<lbrace>Agent B', Nonce PMS\<rbrace> \<in> set evs;
          evs \<in> tls |]
-      ==> A=A' & B=B'"
+      ==> A=A' \<and> B=B'"
 apply (erule rev_mp, erule rev_mp)
 apply (erule tls.induct, force, simp_all)
 txt\<open>ClientKeyExch\<close>
@@ -562,7 +562,7 @@
   No collection of keys can help the spy get new private keys.\<close>
 lemma analz_image_priK [rule_format]:
      "evs \<in> tls
-      ==> \<forall>KK. (Key(priK B) \<in> analz (Key`KK Un (spies evs))) =
+      ==> \<forall>KK. (Key(priK B) \<in> analz (Key`KK \<union> (spies evs))) =
           (priK B \<in> KK | B \<in> bad)"
 apply (erule tls.induct)
 apply (simp_all (no_asm_simp)
@@ -576,25 +576,25 @@
 
 text\<open>slightly speeds up the big simplification below\<close>
 lemma range_sessionkeys_not_priK:
-     "KK <= range sessionK ==> priK B \<notin> KK"
+     "KK \<subseteq> range sessionK \<Longrightarrow> priK B \<notin> KK"
 by blast
 
 
 text\<open>Lemma for the trivial direction of the if-and-only-if\<close>
 lemma analz_image_keys_lemma:
-     "(X \<in> analz (G Un H)) --> (X \<in> analz H)  ==>
-      (X \<in> analz (G Un H))  =  (X \<in> analz H)"
+     "(X \<in> analz (G \<union> H)) \<longrightarrow> (X \<in> analz H)  ==>
+      (X \<in> analz (G \<union> H))  =  (X \<in> analz H)"
 by (blast intro: analz_mono [THEN subsetD])
 
 (** Strangely, the following version doesn't work:
-\<forall>Z. (Nonce N \<in> analz (Key`(sessionK`Z) Un (spies evs))) =
+\<forall>Z. (Nonce N \<in> analz (Key`(sessionK`Z) \<union> (spies evs))) =
     (Nonce N \<in> analz (spies evs))"
 **)
 
 lemma analz_image_keys [rule_format]:
      "evs \<in> tls ==>
-      \<forall>KK. KK <= range sessionK -->
-              (Nonce N \<in> analz (Key`KK Un (spies evs))) =
+      \<forall>KK. KK \<subseteq> range sessionK \<longrightarrow>
+              (Nonce N \<in> analz (Key`KK \<union> (spies evs))) =
               (Nonce N \<in> analz (spies evs))"
 apply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)
 apply (safe del: iffI)
@@ -631,7 +631,7 @@
      "[| Nonce PMS \<notin> parts (spies evs);
          K = sessionK((Na, Nb, PRF(PMS,NA,NB)), role);
          evs \<in> tls |]
-   ==> Key K \<notin> parts (spies evs) & (\<forall>Y. Crypt K Y \<notin> parts (spies evs))"
+   ==> Key K \<notin> parts (spies evs) \<and> (\<forall>Y. Crypt K Y \<notin> parts (spies evs))"
 apply (erule rev_mp, erule ssubst)
 apply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB) 
 apply (force, simp_all (no_asm_simp))
@@ -809,9 +809,9 @@
                       Nonce Nb, Number PB, Agent B\<rbrace>);
          M = PRF(PMS,NA,NB);
          evs \<in> tls;  A \<notin> bad;  B \<notin> bad |]
-      ==> Says B Spy (Key(serverK(Na,Nb,M))) \<notin> set evs -->
-          Notes A \<lbrace>Agent B, Nonce PMS\<rbrace> \<in> set evs -->
-          X \<in> parts (spies evs) --> Says B A X \<in> set evs"
+      ==> Says B Spy (Key(serverK(Na,Nb,M))) \<notin> set evs \<longrightarrow>
+          Notes A \<lbrace>Agent B, Nonce PMS\<rbrace> \<in> set evs \<longrightarrow>
+          X \<in> parts (spies evs) \<longrightarrow> Says B A X \<in> set evs"
 apply (erule ssubst)+
 apply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)
 apply (force, simp_all (no_asm_simp))
@@ -828,9 +828,9 @@
   to bind A's identity with PMS, then we could replace A' by A below.\<close>
 lemma TrustServerMsg [rule_format]:
      "[| M = PRF(PMS,NA,NB);  evs \<in> tls;  A \<notin> bad;  B \<notin> bad |]
-      ==> Says B Spy (Key(serverK(Na,Nb,M))) \<notin> set evs -->
-          Notes A \<lbrace>Agent B, Nonce PMS\<rbrace> \<in> set evs -->
-          Crypt (serverK(Na,Nb,M)) Y \<in> parts (spies evs)  -->
+      ==> Says B Spy (Key(serverK(Na,Nb,M))) \<notin> set evs \<longrightarrow>
+          Notes A \<lbrace>Agent B, Nonce PMS\<rbrace> \<in> set evs \<longrightarrow>
+          Crypt (serverK(Na,Nb,M)) Y \<in> parts (spies evs)  \<longrightarrow>
           (\<exists>A'. Says B A' (Crypt (serverK(Na,Nb,M)) Y) \<in> set evs)"
 apply (erule ssubst)
 apply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)
@@ -854,9 +854,9 @@
 
 lemma TrustClientMsg [rule_format]:
      "[| M = PRF(PMS,NA,NB);  evs \<in> tls;  A \<notin> bad;  B \<notin> bad |]
-      ==> Says A Spy (Key(clientK(Na,Nb,M))) \<notin> set evs -->
-          Notes A \<lbrace>Agent B, Nonce PMS\<rbrace> \<in> set evs -->
-          Crypt (clientK(Na,Nb,M)) Y \<in> parts (spies evs) -->
+      ==> Says A Spy (Key(clientK(Na,Nb,M))) \<notin> set evs \<longrightarrow>
+          Notes A \<lbrace>Agent B, Nonce PMS\<rbrace> \<in> set evs \<longrightarrow>
+          Crypt (clientK(Na,Nb,M)) Y \<in> parts (spies evs) \<longrightarrow>
           Says A B (Crypt (clientK(Na,Nb,M)) Y) \<in> set evs"
 apply (erule ssubst)
 apply (erule tls.induct, frule_tac [7] CX_KB_is_pubKB)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/WooLam.thy
--- a/src/HOL/Auth/WooLam.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/WooLam.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -142,7 +142,7 @@
   But A may have sent the nonce to some other agent and it could have reached
   the Server via the Spy.*)
 lemma B_trusts_WL5:
-     "[| Says S B (Crypt (shrK B) \<lbrace>Agent A, Nonce NB\<rbrace>): set evs;
+     "[| Says S B (Crypt (shrK B) \<lbrace>Agent A, Nonce NB\<rbrace>) \<in> set evs;
          A \<notin> bad;  B \<notin> bad;  evs \<in> woolam  |]
       ==> \<exists>B. Says A B (Crypt (shrK A) (Nonce NB)) \<in> set evs"
 by (blast dest!: NB_Crypt_imp_Server_msg)
@@ -157,9 +157,9 @@
 
 (**CANNOT be proved because A doesn't know where challenges come from...*)
 lemma "[| A \<notin> bad;  B \<noteq> Spy;  evs \<in> woolam |]
-  ==> Crypt (shrK A) (Nonce NB) \<in> parts (spies evs) &
+  ==> Crypt (shrK A) (Nonce NB) \<in> parts (spies evs) \<and>
       Says B A (Nonce NB) \<in> set evs
-      --> Says A B (Crypt (shrK A) (Nonce NB)) \<in> set evs"
+      \<longrightarrow> Says A B (Crypt (shrK A) (Nonce NB)) \<in> set evs"
 apply (erule rev_mp, erule woolam.induct, force, simp_all, blast, auto)
 oops
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Yahalom.thy
--- a/src/HOL/Auth/Yahalom.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Yahalom.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -73,7 +73,7 @@
           \<Longrightarrow> Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso \<in> yahalom"
 
 
-definition KeyWithNonce :: "[key, nat, event list] => bool" where
+definition KeyWithNonce :: "[key, nat, event list] \<Rightarrow> bool" where
   "KeyWithNonce K NB evs ==
      \<exists>A B na X. 
        Says Server A \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K, na, Nonce NB\<rbrace>, X\<rbrace>
@@ -191,8 +191,8 @@
 
 lemma analz_image_freshK [rule_format]:
  "evs \<in> yahalom \<Longrightarrow>
-   \<forall>K KK. KK <= - (range shrK) -->
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+   \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 apply (erule yahalom.induct,
        drule_tac [7] YM4_analz_knows_Spy, analz_freshK, spy_analz, blast)
@@ -214,7 +214,7 @@
         Says Server A'
           \<lbrace>Crypt (shrK A') \<lbrace>Agent B', Key K, na', nb'\<rbrace>, X'\<rbrace> \<in> set evs;
         evs \<in> yahalom\<rbrakk>
-     \<Longrightarrow> A=A' & B=B' & na=na' & nb=nb'"
+     \<Longrightarrow> A=A' \<and> B=B' \<and> na=na' \<and> nb=nb'"
 apply (erule rev_mp, erule rev_mp)
 apply (erule yahalom.induct, simp_all)
 txt\<open>YM3, by freshness, and YM4\<close>
@@ -228,8 +228,8 @@
       \<Longrightarrow> Says Server A
             \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K, na, nb\<rbrace>,
               Crypt (shrK B) \<lbrace>Agent A, Key K\<rbrace>\<rbrace>
-           \<in> set evs -->
-          Notes Spy \<lbrace>na, nb, Key K\<rbrace> \<notin> set evs -->
+           \<in> set evs \<longrightarrow>
+          Notes Spy \<lbrace>na, nb, Key K\<rbrace> \<notin> set evs \<longrightarrow>
           Key K \<notin> analz (knows Spy evs)"
 apply (erule yahalom.induct, force,
        drule_tac [6] YM4_analz_knows_Spy)
@@ -336,7 +336,7 @@
 
 lemma KeyWithNonce_Says [simp]:
    "KeyWithNonce K NB (Says S A X # evs) =
-      (Server = S &
+      (Server = S \<and>
        (\<exists>B n X'. X = \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K, n, Nonce NB\<rbrace>, X'\<rbrace>)
       | KeyWithNonce K NB evs)"
 by (simp add: KeyWithNonce_def, blast)
@@ -353,7 +353,7 @@
 text\<open>A fresh key cannot be associated with any nonce
   (with respect to a given trace).\<close>
 lemma fresh_not_KeyWithNonce:
-     "Key K \<notin> used evs \<Longrightarrow> ~ KeyWithNonce K NB evs"
+     "Key K \<notin> used evs \<Longrightarrow> \<not> KeyWithNonce K NB evs"
 by (unfold KeyWithNonce_def, blast)
 
 text\<open>The Server message associates K with NB' and therefore not with any
@@ -362,7 +362,7 @@
  "\<lbrakk>Says Server A \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K, na, Nonce NB'\<rbrace>, X\<rbrace>
        \<in> set evs;
      NB \<noteq> NB';  evs \<in> yahalom\<rbrakk>
-  \<Longrightarrow> ~ KeyWithNonce K NB evs"
+  \<Longrightarrow> \<not> KeyWithNonce K NB evs"
 by (unfold KeyWithNonce_def, blast dest: unique_session_keys)
 
 
@@ -374,15 +374,15 @@
 text\<open>As with \<open>analz_image_freshK\<close>, we take some pains to express the 
   property as a logical equivalence so that the simplifier can apply it.\<close>
 lemma Nonce_secrecy_lemma:
-     "P --> (X \<in> analz (G Un H)) --> (X \<in> analz H)  \<Longrightarrow>
-      P --> (X \<in> analz (G Un H)) = (X \<in> analz H)"
+     "P \<longrightarrow> (X \<in> analz (G \<union> H)) \<longrightarrow> (X \<in> analz H)  \<Longrightarrow>
+      P \<longrightarrow> (X \<in> analz (G \<union> H)) = (X \<in> analz H)"
 by (blast intro: analz_mono [THEN subsetD])
 
 lemma Nonce_secrecy:
      "evs \<in> yahalom \<Longrightarrow>
-      (\<forall>KK. KK <= - (range shrK) -->
-           (\<forall>K \<in> KK. K \<in> symKeys --> ~ KeyWithNonce K NB evs)   -->
-           (Nonce NB \<in> analz (Key`KK Un (knows Spy evs))) =
+      (\<forall>KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+           (\<forall>K \<in> KK. K \<in> symKeys \<longrightarrow> \<not> KeyWithNonce K NB evs)   \<longrightarrow>
+           (Nonce NB \<in> analz (Key`KK \<union> (knows Spy evs))) =
            (Nonce NB \<in> analz (knows Spy evs)))"
 apply (erule yahalom.induct,
        frule_tac [7] YM4_analz_knows_Spy)
@@ -394,7 +394,7 @@
             imp_disj_not1               (*Moves NBa\<noteq>NB to the front*)
             Says_Server_KeyWithNonce)
 txt\<open>For Oops, simplification proves @{prop "NBa\<noteq>NB"}.  By
-  @{term Says_Server_KeyWithNonce}, we get @{prop "~ KeyWithNonce K NB
+  @{term Says_Server_KeyWithNonce}, we get @{prop "\<not> KeyWithNonce K NB
   evs"}; then simplification can apply the induction hypothesis with
   @{term "KK = {K}"}.\<close>
   subgoal \<comment> \<open>Fake\<close> by spy_analz
@@ -427,7 +427,7 @@
      "\<lbrakk>Crypt (shrK B) \<lbrace>Agent A, Nonce NA, nb\<rbrace> \<in> parts (knows Spy evs);
          Crypt (shrK B') \<lbrace>Agent A', Nonce NA', nb\<rbrace> \<in> parts (knows Spy evs);
         evs \<in> yahalom;  B \<notin> bad;  B' \<notin> bad\<rbrakk>
-      \<Longrightarrow> NA' = NA & A' = A & B' = B"
+      \<Longrightarrow> NA' = NA \<and> A' = A \<and> B' = B"
 apply (erule rev_mp, erule rev_mp)
 apply (erule yahalom.induct, force,
        frule_tac [6] YM4_parts_knows_Spy, simp_all)
@@ -444,7 +444,7 @@
          Gets S' \<lbrace>X', Crypt (shrK B') \<lbrace>Agent A', Nonce NA', nb\<rbrace>\<rbrace>
            \<in> set evs;
          nb \<notin> analz (knows Spy evs);  evs \<in> yahalom\<rbrakk>
-      \<Longrightarrow> NA' = NA & A' = A & B' = B"
+      \<Longrightarrow> NA' = NA \<and> A' = A \<and> B' = B"
 by (blast dest!: Gets_imp_Says Crypt_Spy_analz_bad
           dest: Says_imp_spies unique_NB parts.Inj analz.Inj)
 
@@ -548,7 +548,7 @@
 lemma B_Said_YM2 [rule_format]:
      "\<lbrakk>Crypt (shrK B) \<lbrace>Agent A, Nonce NA, nb\<rbrace> \<in> parts (knows Spy evs);
         evs \<in> yahalom\<rbrakk>
-      \<Longrightarrow> B \<notin> bad -->
+      \<Longrightarrow> B \<notin> bad \<longrightarrow>
           Says B Server \<lbrace>Agent B, Crypt (shrK B) \<lbrace>Agent A, Nonce NA, nb\<rbrace>\<rbrace>
             \<in> set evs"
 apply (erule rev_mp, erule yahalom.induct, force,
@@ -561,7 +561,7 @@
 lemma YM3_auth_B_to_A_lemma:
      "\<lbrakk>Says Server A \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K, Nonce NA, nb\<rbrace>, X\<rbrace>
        \<in> set evs;  evs \<in> yahalom\<rbrakk>
-      \<Longrightarrow> B \<notin> bad -->
+      \<Longrightarrow> B \<notin> bad \<longrightarrow>
           Says B Server \<lbrace>Agent B, Crypt (shrK B) \<lbrace>Agent A, Nonce NA, nb\<rbrace>\<rbrace>
             \<in> set evs"
 apply (erule rev_mp, erule yahalom.induct, simp_all)
@@ -588,10 +588,10 @@
   NB matters for freshness.\<close>
 theorem A_Said_YM3_lemma [rule_format]:
      "evs \<in> yahalom
-      \<Longrightarrow> Key K \<notin> analz (knows Spy evs) -->
-          Crypt K (Nonce NB) \<in> parts (knows Spy evs) -->
-          Crypt (shrK B) \<lbrace>Agent A, Key K\<rbrace> \<in> parts (knows Spy evs) -->
-          B \<notin> bad -->
+      \<Longrightarrow> Key K \<notin> analz (knows Spy evs) \<longrightarrow>
+          Crypt K (Nonce NB) \<in> parts (knows Spy evs) \<longrightarrow>
+          Crypt (shrK B) \<lbrace>Agent A, Key K\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
+          B \<notin> bad \<longrightarrow>
           (\<exists>X. Says A B \<lbrace>X, Crypt K (Nonce NB)\<rbrace> \<in> set evs)"
 apply (erule yahalom.induct, force,
        frule_tac [6] YM4_parts_knows_Spy)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Yahalom2.thy
--- a/src/HOL/Auth/Yahalom2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Yahalom2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -172,8 +172,8 @@
 
 lemma analz_image_freshK [rule_format]:
  "evs \<in> yahalom \<Longrightarrow>
-   \<forall>K KK. KK <= - (range shrK) -->
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+   \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 apply (erule yahalom.induct)
 apply (frule_tac [8] Says_Server_message_form)
@@ -194,7 +194,7 @@
         Says Server A'
           \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs;
         evs \<in> yahalom\<rbrakk>
-     \<Longrightarrow> A=A' & B=B' & na=na' & nb=nb'"
+     \<Longrightarrow> A=A' \<and> B=B' \<and> na=na' \<and> nb=nb'"
 apply (erule rev_mp, erule rev_mp)
 apply (erule yahalom.induct, simp_all)
 txt\<open>YM3, by freshness\<close>
@@ -209,8 +209,8 @@
       \<Longrightarrow> Says Server A
             \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace>,
                   Crypt (shrK B) \<lbrace>Agent A, Agent B, Key K, nb\<rbrace>\<rbrace>
-           \<in> set evs -->
-          Notes Spy \<lbrace>na, nb, Key K\<rbrace> \<notin> set evs -->
+           \<in> set evs \<longrightarrow>
+          Notes Spy \<lbrace>na, nb, Key K\<rbrace> \<notin> set evs \<longrightarrow>
           Key K \<notin> analz (knows Spy evs)"
 apply (erule yahalom.induct, force, frule_tac [7] Says_Server_message_form,
        drule_tac [6] YM4_analz_knows_Spy)
@@ -384,18 +384,18 @@
      "\<lbrakk>Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace> \<in> analz (spies evs);
          Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace> \<in> analz (spies evs);
          Key K \<notin> analz (knows Spy evs);  evs \<in> yahalom\<rbrakk>
-     \<Longrightarrow> A=A' & B=B'"
+     \<Longrightarrow> A=A' \<and> B=B'"
 by (blast dest!: A_trusts_YM3 dest: unique_session_keys Crypt_Spy_analz_bad)
 
 
 lemma Auth_A_to_B_lemma [rule_format]:
      "evs \<in> yahalom
-      \<Longrightarrow> Key K \<notin> analz (knows Spy evs) -->
-          K \<in> symKeys -->
-          Crypt K (Nonce NB) \<in> parts (knows Spy evs) -->
+      \<Longrightarrow> Key K \<notin> analz (knows Spy evs) \<longrightarrow>
+          K \<in> symKeys \<longrightarrow>
+          Crypt K (Nonce NB) \<in> parts (knows Spy evs) \<longrightarrow>
           Crypt (shrK B) \<lbrace>Agent A, Agent B, Key K, Nonce NB\<rbrace>
-            \<in> parts (knows Spy evs) -->
-          B \<notin> bad -->
+            \<in> parts (knows Spy evs) \<longrightarrow>
+          B \<notin> bad \<longrightarrow>
           (\<exists>X. Says A B \<lbrace>X, Crypt K (Nonce NB)\<rbrace> \<in> set evs)"
 apply (erule yahalom.induct, force,
        frule_tac [6] YM4_parts_knows_Spy)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Auth/Yahalom_Bad.thy
--- a/src/HOL/Auth/Yahalom_Bad.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Auth/Yahalom_Bad.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -152,8 +152,8 @@
 
 lemma analz_image_freshK [rule_format]:
  "evs \<in> yahalom ==>
-   \<forall>K KK. KK <= - (range shrK) -->
-          (Key K \<in> analz (Key`KK Un (knows Spy evs))) =
+   \<forall>K KK. KK \<subseteq> - (range shrK) \<longrightarrow>
+          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (K \<in> KK | Key K \<in> analz (knows Spy evs))"
 by (erule yahalom.induct, 
     drule_tac [7] YM4_analz_knows_Spy, analz_freshK, spy_analz, blast) 
@@ -172,7 +172,7 @@
         Says Server A'
           \<lbrace>Crypt (shrK A') \<lbrace>Agent B', Key K, na', nb'\<rbrace>, X'\<rbrace> \<in> set evs;
         evs \<in> yahalom |]
-     ==> A=A' & B=B' & na=na' & nb=nb'"
+     ==> A=A' \<and> B=B' \<and> na=na' \<and> nb=nb'"
 apply (erule rev_mp, erule rev_mp)
 apply (erule yahalom.induct, simp_all)
 txt\<open>YM3, by freshness, and YM4\<close>
@@ -186,7 +186,7 @@
       ==> Says Server A
             \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K, na, nb\<rbrace>,
               Crypt (shrK B) \<lbrace>Agent A, Key K\<rbrace>\<rbrace>
-           \<in> set evs -->
+           \<in> set evs \<longrightarrow>
           Key K \<notin> analz (knows Spy evs)"
 apply (erule yahalom.induct, force, drule_tac [6] YM4_analz_knows_Spy)
 apply (simp_all add: pushes analz_insert_eq analz_insert_freshK, spy_analz)  (*Fake*)
@@ -260,7 +260,7 @@
   the secrecy of NB.\<close>
 lemma B_trusts_YM4_newK [rule_format]:
      "[|Key K \<notin> analz (knows Spy evs);  evs \<in> yahalom|]
-      ==> Crypt K (Nonce NB) \<in> parts (knows Spy evs) -->
+      ==> Crypt K (Nonce NB) \<in> parts (knows Spy evs) \<longrightarrow>
           (\<exists>A B NA. Says Server A
                       \<lbrace>Crypt (shrK A) \<lbrace>Agent B, Key K,
                                 Nonce NA, Nonce NB\<rbrace>,
@@ -323,10 +323,10 @@
   NB matters for freshness.\<close>
 lemma A_Said_YM3_lemma [rule_format]:
      "evs \<in> yahalom
-      ==> Key K \<notin> analz (knows Spy evs) -->
-          Crypt K (Nonce NB) \<in> parts (knows Spy evs) -->
-          Crypt (shrK B) \<lbrace>Agent A, Key K\<rbrace> \<in> parts (knows Spy evs) -->
-          B \<notin> bad -->
+      ==> Key K \<notin> analz (knows Spy evs) \<longrightarrow>
+          Crypt K (Nonce NB) \<in> parts (knows Spy evs) \<longrightarrow>
+          Crypt (shrK B) \<lbrace>Agent A, Key K\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
+          B \<notin> bad \<longrightarrow>
           (\<exists>X. Says A B \<lbrace>X, Crypt K (Nonce NB)\<rbrace> \<in> set evs)"
 apply (erule yahalom.induct, force,
        frule_tac [6] YM4_parts_knows_Spy)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Cardinal_Arithmetic.thy
--- a/src/HOL/BNF_Cardinal_Arithmetic.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Cardinal_Arithmetic.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -689,7 +689,7 @@
 
 lemma cardSuc_UNION_Cinfinite:
   assumes "Cinfinite r" "relChain (cardSuc r) As" "B \<le> (UN i : Field (cardSuc r). As i)" "|B| <=o r"
-  shows "EX i : Field (cardSuc r). B \<le> As i"
+  shows "\<exists>i \<in> Field (cardSuc r). B \<le> As i"
 using cardSuc_UNION assms unfolding cinfinite_def by blast
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Cardinal_Order_Relation.thy
--- a/src/HOL/BNF_Cardinal_Order_Relation.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Cardinal_Order_Relation.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -290,7 +290,7 @@
 using ordLeq_iff_ordLess_Restr card_of_Well_order by blast
 
 lemma card_of_underS:
-assumes r: "Card_order r" and a: "a : Field r"
+assumes r: "Card_order r" and a: "a \<in> Field r"
 shows "|underS r a| <o r"
 proof-
   let ?A = "underS r a"  let ?r' = "Restr r ?A"
@@ -878,8 +878,8 @@
 
 lemma infinite_Card_order_limit:
 assumes r: "Card_order r" and "\<not>finite (Field r)"
-and a: "a : Field r"
-shows "EX b : Field r. a \<noteq> b \<and> (a,b) : r"
+and a: "a \<in> Field r"
+shows "\<exists>b \<in> Field r. a \<noteq> b \<and> (a,b) \<in> r"
 proof-
   have "Field r \<noteq> under r a"
   using assms Card_order_infinite_not_under by blast
@@ -891,7 +891,7 @@
   moreover have ba: "b \<noteq> a"
   using 1 r unfolding card_order_on_def well_order_on_def
   linear_order_on_def partial_order_on_def preorder_on_def refl_on_def by auto
-  ultimately have "(a,b) : r"
+  ultimately have "(a,b) \<in> r"
   using a r unfolding card_order_on_def well_order_on_def linear_order_on_def
   total_on_def by blast
   thus ?thesis using 1 ba by auto
@@ -1506,7 +1506,7 @@
 
 definition cofinal where
 "cofinal A r \<equiv>
- ALL a : Field r. EX b : A. a \<noteq> b \<and> (a,b) : r"
+ \<forall>a \<in> Field r. \<exists>b \<in> A. a \<noteq> b \<and> (a,b) \<in> r"
 
 definition regularCard where
 "regularCard r \<equiv>
@@ -1521,21 +1521,21 @@
 and As: "relChain r As"
 and Bsub: "B \<le> (UN i : Field r. As i)"
 and cardB: "|B| <o r"
-shows "EX i : Field r. B \<le> As i"
+shows "\<exists>i \<in> Field r. B \<le> As i"
 proof-
   let ?phi = "\<lambda>b j. j \<in> Field r \<and> b \<in> As j"
   have "\<forall>b\<in>B. \<exists>j. ?phi b j" using Bsub by blast
-  then obtain f where f: "!! b. b : B \<Longrightarrow> ?phi b (f b)"
+  then obtain f where f: "\<And>b. b \<in> B \<Longrightarrow> ?phi b (f b)"
   using bchoice[of B ?phi] by blast
   let ?K = "f ` B"
   {assume 1: "\<And>i. i \<in> Field r \<Longrightarrow> \<not> B \<le> As i"
    have 2: "cofinal ?K r"
    unfolding cofinal_def proof auto
-     fix i assume i: "i : Field r"
-     with 1 obtain b where b: "b : B \<and> b \<notin> As i" by blast
+     fix i assume i: "i \<in> Field r"
+     with 1 obtain b where b: "b \<in> B \<and> b \<notin> As i" by blast
      hence "i \<noteq> f b \<and> \<not> (f b,i) \<in> r"
      using As f unfolding relChain_def by auto
-     hence "i \<noteq> f b \<and> (i, f b) : r" using r
+     hence "i \<noteq> f b \<and> (i, f b) \<in> r" using r
      unfolding card_order_on_def well_order_on_def linear_order_on_def
      total_on_def using i f b by auto
      with b show "\<exists>b\<in>B. i \<noteq> f b \<and> (i, f b) \<in> r" by blast
@@ -1576,11 +1576,11 @@
      hence "|K| <=o r" using r' card_of_Card_order[of K] by blast
      hence "|K| \<le>o |?J|" using rJ ordLeq_ordIso_trans by blast
      moreover
-     {have "ALL j : K. |underS ?r' j| <o ?r'"
+     {have "\<forall>j\<in>K. |underS ?r' j| <o ?r'"
       using r' 1 by (auto simp: card_of_underS)
-      hence "ALL j : K. |underS ?r' j| \<le>o r"
+      hence "\<forall>j\<in>K. |underS ?r' j| \<le>o r"
       using r' card_of_Card_order by blast
-      hence "ALL j : K. |underS ?r' j| \<le>o |?J|"
+      hence "\<forall>j\<in>K. |underS ?r' j| \<le>o |?J|"
       using rJ ordLeq_ordIso_trans by blast
      }
      ultimately have "|?L| \<le>o |?J|"
@@ -1608,7 +1608,7 @@
 and As: "relChain (cardSuc r) As"
 and Bsub: "B \<le> (UN i : Field (cardSuc r). As i)"
 and cardB: "|B| <=o r"
-shows "EX i : Field (cardSuc r). B \<le> As i"
+shows "\<exists>i \<in> Field (cardSuc r). B \<le> As i"
 proof-
   let ?r' = "cardSuc r"
   have "Card_order ?r' \<and> |B| <o ?r'"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Composition.thy
--- a/src/HOL/BNF_Composition.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Composition.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -81,10 +81,10 @@
 lemma Collect_inj: "Collect P = Collect Q \<Longrightarrow> P = Q"
   by blast
 
-lemma Grp_fst_snd: "(Grp (Collect (case_prod R)) fst)^--1 OO Grp (Collect (case_prod R)) snd = R"
+lemma Grp_fst_snd: "(Grp (Collect (case_prod R)) fst)\<inverse>\<inverse> OO Grp (Collect (case_prod R)) snd = R"
   unfolding Grp_def fun_eq_iff relcompp.simps by auto
 
-lemma OO_Grp_cong: "A = B \<Longrightarrow> (Grp A f)^--1 OO Grp A g = (Grp B f)^--1 OO Grp B g"
+lemma OO_Grp_cong: "A = B \<Longrightarrow> (Grp A f)\<inverse>\<inverse> OO Grp A g = (Grp B f)\<inverse>\<inverse> OO Grp B g"
   by (rule arg_cong)
 
 lemma vimage2p_relcompp_mono: "R OO S \<le> T \<Longrightarrow>
@@ -145,7 +145,7 @@
 qed blast
 
 lemma vimage2p_relcompp_converse:
-  "vimage2p f g (R^--1 OO S) = (vimage2p Rep f R)^--1 OO vimage2p Rep g S"
+  "vimage2p f g (R\<inverse>\<inverse> OO S) = (vimage2p Rep f R)\<inverse>\<inverse> OO vimage2p Rep g S"
   unfolding vimage2p_def relcompp.simps conversep.simps fun_eq_iff image_def
   by (auto simp: type_copy_ex_RepI)
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Def.thy
--- a/src/HOL/BNF_Def.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Def.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -105,16 +105,16 @@
 lemma eq_alt: "(=) = Grp UNIV id"
   unfolding Grp_def by auto
 
-lemma leq_conversepI: "R = (=) \<Longrightarrow> R \<le> R^--1"
+lemma leq_conversepI: "R = (=) \<Longrightarrow> R \<le> R\<inverse>\<inverse>"
   by auto
 
 lemma leq_OOI: "R = (=) \<Longrightarrow> R \<le> R OO R"
   by auto
 
-lemma OO_Grp_alt: "(Grp A f)^--1 OO Grp A g = (\<lambda>x y. \<exists>z. z \<in> A \<and> f z = x \<and> g z = y)"
+lemma OO_Grp_alt: "(Grp A f)\<inverse>\<inverse> OO Grp A g = (\<lambda>x y. \<exists>z. z \<in> A \<and> f z = x \<and> g z = y)"
   unfolding Grp_def by auto
 
-lemma Grp_UNIV_id: "f = id \<Longrightarrow> (Grp UNIV f)^--1 OO Grp UNIV f = Grp UNIV f"
+lemma Grp_UNIV_id: "f = id \<Longrightarrow> (Grp UNIV f)\<inverse>\<inverse> OO Grp UNIV f = Grp UNIV f"
   unfolding Grp_def by auto
 
 lemma Grp_UNIV_idI: "x = y \<Longrightarrow> Grp UNIV id x y"
@@ -171,7 +171,7 @@
 lemma fst_snd_flip: "fst xy = (snd \<circ> (%(x, y). (y, x))) xy"
   by (simp split: prod.split)
 
-lemma flip_pred: "A \<subseteq> Collect (case_prod (R ^--1)) \<Longrightarrow> (%(x, y). (y, x)) ` A \<subseteq> Collect (case_prod R)"
+lemma flip_pred: "A \<subseteq> Collect (case_prod (R \<inverse>\<inverse>)) \<Longrightarrow> (%(x, y). (y, x)) ` A \<subseteq> Collect (case_prod R)"
   by auto
 
 lemma predicate2_eqD: "A = B \<Longrightarrow> A a b \<longleftrightarrow> B a b"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Greatest_Fixpoint.thy
--- a/src/HOL/BNF_Greatest_Fixpoint.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Greatest_Fixpoint.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -31,7 +31,7 @@
 lemma neq_eq_eq_contradict: "\<lbrakk>t \<noteq> u; s = t; s = u\<rbrakk> \<Longrightarrow> P"
   by fast
 
-lemma converse_Times: "(A \<times> B) ^-1 = B \<times> A"
+lemma converse_Times: "(A \<times> B)\<inverse> = B \<times> A"
   by fast
 
 lemma equiv_proj:
@@ -56,7 +56,7 @@
 lemma IdD: "(a, b) \<in> Id \<Longrightarrow> a = b"
   by auto
 
-lemma image2_Gr: "image2 A f g = (Gr A f)^-1 O (Gr A g)"
+lemma image2_Gr: "image2 A f g = (Gr A f)\<inverse> O (Gr A g)"
   unfolding image2_def Gr_def by auto
 
 lemma GrD1: "(x, fx) \<in> Gr A f \<Longrightarrow> x \<in> A"
@@ -99,10 +99,10 @@
   "relInvImage A R f \<equiv> {(a1, a2) | a1 a2. a1 \<in> A \<and> a2 \<in> A \<and> (f a1, f a2) \<in> R}"
 
 lemma relImage_Gr:
-  "\<lbrakk>R \<subseteq> A \<times> A\<rbrakk> \<Longrightarrow> relImage R f = (Gr A f)^-1 O R O Gr A f"
+  "\<lbrakk>R \<subseteq> A \<times> A\<rbrakk> \<Longrightarrow> relImage R f = (Gr A f)\<inverse> O R O Gr A f"
   unfolding relImage_def Gr_def relcomp_def by auto
 
-lemma relInvImage_Gr: "\<lbrakk>R \<subseteq> B \<times> B\<rbrakk> \<Longrightarrow> relInvImage A R f = Gr A f O R O (Gr A f)^-1"
+lemma relInvImage_Gr: "\<lbrakk>R \<subseteq> B \<times> B\<rbrakk> \<Longrightarrow> relInvImage A R f = Gr A f O R O (Gr A f)\<inverse>"
   unfolding Gr_def relcomp_def image_def relInvImage_def by auto
 
 lemma relImage_mono:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Wellorder_Constructions.thy
--- a/src/HOL/BNF_Wellorder_Constructions.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Wellorder_Constructions.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -838,7 +838,7 @@
 where "ord_to_filter r0 r \<equiv> (SOME f. embed r r0 f) ` (Field r)"
 
 lemma ord_to_filter_compat:
-"compat (ordLess Int (ordLess^-1``{r0} \<times> ordLess^-1``{r0}))
+"compat (ordLess Int (ordLess\<inverse>``{r0} \<times> ordLess\<inverse>``{r0}))
         (ofilterIncl r0)
         (ord_to_filter r0)"
 proof(unfold compat_def ord_to_filter_def, clarify)
@@ -859,7 +859,7 @@
   {fix r0 :: "('a \<times> 'a) set"
    (* need to annotate here!*)
    let ?ordLess = "ordLess::('d rel * 'd rel) set"
-   let ?R = "?ordLess Int (?ordLess^-1``{r0} \<times> ?ordLess^-1``{r0})"
+   let ?R = "?ordLess Int (?ordLess\<inverse>``{r0} \<times> ?ordLess\<inverse>``{r0})"
    {assume Case1: "Well_order r0"
     hence "wf ?R"
     using wf_ofilterIncl[of r0]
@@ -934,7 +934,7 @@
   hence "b1 \<in> Field r \<and> b2 \<in> Field r"
   unfolding Field_def by auto
   hence "b1 = b2" using 1 INJ unfolding inj_on_def by auto
-  hence "(a,c): r" using 2 TRANS unfolding trans_def by blast
+  hence "(a,c) \<in> r" using 2 TRANS unfolding trans_def by blast
   thus "(a',c') \<in> dir_image r f"
   unfolding dir_image_def using 1 by auto
 qed
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/BNF_Wellorder_Embedding.thy
--- a/src/HOL/BNF_Wellorder_Embedding.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/BNF_Wellorder_Embedding.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -317,10 +317,10 @@
     using 2 by auto
     with Field_def[of r] obtain b where
     3: "b \<in> Field r" and 4: "b' = f b" by auto
-    have "(b,a): r"
+    have "(b,a) \<in> r"
     proof-
       {assume "(a,b) \<in> r"
-       with ** 4 have "(f a, b'): r'"
+       with ** 4 have "(f a, b') \<in> r'"
        by (auto simp add: compat_def)
        with ***** Antisym' have "f a = b'"
        by(auto simp add: under_def antisym_def)
@@ -799,7 +799,7 @@
 shows "a \<in> Field r \<longrightarrow> f a = g a"
 proof(rule wo_rel.well_order_induct[of r], auto simp add: WELL wo_rel_def)
   fix a
-  assume IH: "\<forall>b. b \<noteq> a \<and> (b,a): r \<longrightarrow> b \<in> Field r \<longrightarrow> f b = g b" and
+  assume IH: "\<forall>b. b \<noteq> a \<and> (b,a) \<in> r \<longrightarrow> b \<in> Field r \<longrightarrow> f b = g b" and
          *: "a \<in> Field r"
   hence "\<forall>b \<in> underS r a. f b = g b"
   unfolding underS_def by (auto simp add: Field_def)
@@ -1071,7 +1071,7 @@
     fix a b assume **: "a \<in> Field r" "b \<in> Field r" and
                   ***: "(f a, f b) \<in> r'"
     {assume "(b,a) \<in> r \<or> b = a"
-     hence "(b,a): r"using Well ** wo_rel.REFL[of r] refl_on_def[of _ r] by blast
+     hence "(b,a) \<in> r"using Well ** wo_rel.REFL[of r] refl_on_def[of _ r] by blast
      hence "(f b, f a) \<in> r'" using * unfolding compat_def by auto
      hence "f a = f b"
      using Well *** wo_rel.ANTISYM[of r'] antisym_def[of r'] by blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/AxCompl.thy
--- a/src/HOL/Bali/AxCompl.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/AxCompl.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1376,7 +1376,7 @@
 apply  (simp add: MGF_asm ax_derivs_asm)
 apply (rule MGF_asm)
 apply (rule ballI)
-apply (case_tac "mgf_call pn : A")
+apply (case_tac "mgf_call pn \<in> A")
 apply  (fast intro: ax_derivs_asm)
 apply (rule MGF_nested_Methd)
 apply (rule ballI)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/AxSem.thy
--- a/src/HOL/Bali/AxSem.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/AxSem.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -687,7 +687,7 @@
 done
 
 lemma weaken: 
- "G,(A::'a triple set)|\<turnstile>(ts'::'a triple set) \<Longrightarrow> !ts. ts \<subseteq> ts' \<longrightarrow> G,A|\<turnstile>ts"
+ "G,(A::'a triple set)|\<turnstile>(ts'::'a triple set) \<Longrightarrow> \<forall>ts. ts \<subseteq> ts' \<longrightarrow> G,A|\<turnstile>ts"
 apply (erule ax_derivs.induct)
 (*42 subgoals*)
 apply       (tactic "ALLGOALS (strip_tac @{context})")
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/AxSound.thy
--- a/src/HOL/Bali/AxSound.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/AxSound.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -300,7 +300,7 @@
    cases. Auto will then solve premise 6 and 7.
 *)
 
-lemma all_empty: "(!x. P) = P"
+lemma all_empty: "(\<forall>x. P) = P"
 by simp
 
 corollary evaln_type_sound:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/Basis.thy
--- a/src/HOL/Bali/Basis.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/Basis.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -121,7 +121,7 @@
   obtains x s where "s' = (x,s)" and "x = x'"
   using assms by (cases s') auto
 
-lemma fst_in_set_lemma: "(x, y) : set l \<Longrightarrow> x : fst ` set l"
+lemma fst_in_set_lemma: "(x, y) \<in> set l \<Longrightarrow> x \<in> fst ` set l"
   by (induct l) auto
 
 
@@ -246,7 +246,7 @@
 lemma unique_map_inj: "unique l \<Longrightarrow> inj f \<Longrightarrow> unique (map (\<lambda>(k,x). (f k, g k x)) l)"
   by (induct l) (auto dest: fst_in_set_lemma simp add: inj_eq)
 
-lemma map_of_SomeI: "unique l \<Longrightarrow> (k, x) : set l \<Longrightarrow> map_of l k = Some x"
+lemma map_of_SomeI: "unique l \<Longrightarrow> (k, x) \<in> set l \<Longrightarrow> map_of l k = Some x"
   by (induct l) auto
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/Decl.thy
--- a/src/HOL/Bali/Decl.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/Decl.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -461,11 +461,11 @@
 
 abbreviation
   subclseq_syntax :: "prog => [qtname, qtname] => bool" ("_\<turnstile>_\<preceq>\<^sub>C _"  [71,71,71] 70) 
-  where "G\<turnstile>C \<preceq>\<^sub>C D == (C,D) \<in>(subcls1 G)^*" (* cf. 8.1.3 *)
+  where "G\<turnstile>C \<preceq>\<^sub>C D == (C,D) \<in>(subcls1 G)\<^sup>*" (* cf. 8.1.3 *)
 
 abbreviation
   subcls_syntax :: "prog => [qtname, qtname] => bool" ("_\<turnstile>_\<prec>\<^sub>C _"  [71,71,71] 70)
-  where "G\<turnstile>C \<prec>\<^sub>C D == (C,D) \<in>(subcls1 G)^+"
+  where "G\<turnstile>C \<prec>\<^sub>C D == (C,D) \<in>(subcls1 G)\<^sup>+"
 
 notation (ASCII)
   subcls1_syntax  ("_|-_<:C1_" [71,71,71] 70) and
@@ -520,11 +520,11 @@
 
 definition
   ws_idecl :: "prog \<Rightarrow> qtname \<Rightarrow> qtname list \<Rightarrow> bool"
-  where "ws_idecl G I si = (\<forall>J\<in>set si.  is_iface G J   \<and> (J,I)\<notin>(subint1 G)^+)"
+  where "ws_idecl G I si = (\<forall>J\<in>set si.  is_iface G J   \<and> (J,I)\<notin>(subint1 G)\<^sup>+)"
   
 definition
   ws_cdecl :: "prog \<Rightarrow> qtname \<Rightarrow> qtname \<Rightarrow> bool"
-  where "ws_cdecl G C sc = (C\<noteq>Object \<longrightarrow> is_class G sc \<and> (sc,C)\<notin>(subcls1 G)^+)"
+  where "ws_cdecl G C sc = (C\<noteq>Object \<longrightarrow> is_class G sc \<and> (sc,C)\<notin>(subcls1 G)\<^sup>+)"
   
 definition
   ws_prog  :: "prog \<Rightarrow> bool" where
@@ -534,9 +534,9 @@
 
 lemma ws_progI: 
 "\<lbrakk>\<forall>(I,i)\<in>set (ifaces G). \<forall>J\<in>set (isuperIfs i). is_iface G J \<and> 
-                                                (J,I) \<notin> (subint1 G)^+; 
+                                                (J,I) \<notin> (subint1 G)\<^sup>+; 
   \<forall>(C,c)\<in>set (classes G). C\<noteq>Object \<longrightarrow> is_class G (super c) \<and> 
-                                        ((super c),C) \<notin> (subcls1 G)^+  
+                                        ((super c),C) \<notin> (subcls1 G)\<^sup>+  
  \<rbrakk> \<Longrightarrow> ws_prog G"
 apply (unfold ws_prog_def ws_idecl_def ws_cdecl_def)
 apply (erule_tac conjI)
@@ -545,7 +545,7 @@
 
 lemma ws_prog_ideclD: 
 "\<lbrakk>iface G I = Some i; J\<in>set (isuperIfs i); ws_prog G\<rbrakk> \<Longrightarrow>  
-  is_iface G J \<and> (J,I)\<notin>(subint1 G)^+"
+  is_iface G J \<and> (J,I)\<notin>(subint1 G)\<^sup>+"
 apply (unfold ws_prog_def ws_idecl_def)
 apply clarify
 apply (drule_tac map_of_SomeD)
@@ -554,7 +554,7 @@
 
 lemma ws_prog_cdeclD: 
 "\<lbrakk>class G C = Some c; C\<noteq>Object; ws_prog G\<rbrakk> \<Longrightarrow>  
-  is_class G (super c) \<and> (super c,C)\<notin>(subcls1 G)^+"
+  is_class G (super c) \<and> (super c,C)\<notin>(subcls1 G)\<^sup>+"
 apply (unfold ws_prog_def ws_cdecl_def)
 apply clarify
 apply (drule_tac map_of_SomeD)
@@ -590,12 +590,12 @@
 done
 
 lemma subint1_irrefl_lemma1: 
-  "ws_prog G \<Longrightarrow> (subint1 G)^-1 \<inter> (subint1 G)^+ = {}"
+  "ws_prog G \<Longrightarrow> (subint1 G)\<inverse> \<inter> (subint1 G)\<^sup>+ = {}"
 apply (force dest: subint1D ws_prog_ideclD conjunct2)
 done
 
 lemma subcls1_irrefl_lemma1: 
-  "ws_prog G \<Longrightarrow> (subcls1 G)^-1 \<inter> (subcls1 G)^+ = {}"
+  "ws_prog G \<Longrightarrow> (subcls1 G)\<inverse> \<inter> (subcls1 G)\<^sup>+ = {}"
 apply (force dest: subcls1D ws_prog_cdeclD conjunct2)
 done
 
@@ -778,7 +778,7 @@
                       else undefined)"
 by auto
 termination
-by (relation "inv_image (same_fst ws_prog (\<lambda>G. (subint1 G)^-1)) (%(x,y,z). (x,y))")
+by (relation "inv_image (same_fst ws_prog (\<lambda>G. (subint1 G)\<inverse>)) (%(x,y,z). (x,y))")
  (auto simp: wf_subint1 subint1I wf_same_fst)
 
 lemma iface_rec: 
@@ -803,7 +803,7 @@
 
 by auto
 termination
-by (relation "inv_image (same_fst ws_prog (\<lambda>G. (subcls1 G)^-1)) (%(x,y,z,w). (x,y))")
+by (relation "inv_image (same_fst ws_prog (\<lambda>G. (subcls1 G)\<inverse>)) (%(x,y,z,w). (x,y))")
  (auto simp: wf_subcls1 subcls1I wf_same_fst)
 
 lemma class_rec: "\<lbrakk>class G C = Some c; ws_prog G\<rbrakk> \<Longrightarrow>  
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/DeclConcepts.thy
--- a/src/HOL/Bali/DeclConcepts.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/DeclConcepts.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1565,7 +1565,7 @@
 lemma imethds_declI: "\<lbrakk>m \<in> imethds G I sig; ws_prog G; is_iface G I\<rbrakk> \<Longrightarrow> 
   (\<exists>i. iface G (decliface m) = Some i \<and> 
   table_of (imethods i) sig = Some (mthd m)) \<and>  
-  (I,decliface m) \<in> (subint1 G)^* \<and> m \<in> imethds G (decliface m) sig"
+  (I,decliface m) \<in> (subint1 G)\<^sup>* \<and> m \<in> imethds G (decliface m) sig"
 apply (erule rev_mp)
 apply (rule ws_subint1_induct, assumption, assumption)
 apply (subst imethds_rec, erule conjunct1, assumption)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/Example.thy
--- a/src/HOL/Bali/Example.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/Example.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -287,30 +287,30 @@
 
 subsubsection "well-structuredness"
 
-lemma not_Object_subcls_any [elim!]: "(Object, C) \<in> (subcls1 tprg)^+ \<Longrightarrow> R"
+lemma not_Object_subcls_any [elim!]: "(Object, C) \<in> (subcls1 tprg)\<^sup>+ \<Longrightarrow> R"
 apply (auto dest!: tranclD subcls1D)
 done
 
 lemma not_Throwable_subcls_SXcpt [elim!]: 
-  "(SXcpt Throwable, SXcpt xn) \<in> (subcls1 tprg)^+ \<Longrightarrow> R"
+  "(SXcpt Throwable, SXcpt xn) \<in> (subcls1 tprg)\<^sup>+ \<Longrightarrow> R"
 apply (auto dest!: tranclD subcls1D) 
 apply (simp add: Object_def SXcpt_def)
 done
 
 lemma not_SXcpt_n_subcls_SXcpt_n [elim!]: 
-  "(SXcpt xn, SXcpt xn)  \<in> (subcls1 tprg)^+ \<Longrightarrow> R"
+  "(SXcpt xn, SXcpt xn)  \<in> (subcls1 tprg)\<^sup>+ \<Longrightarrow> R"
 apply (auto dest!: tranclD subcls1D)
 apply (drule rtranclD)
 apply auto
 done
 
-lemma not_Base_subcls_Ext [elim!]: "(Base, Ext) \<in> (subcls1 tprg)^+  \<Longrightarrow> R"
+lemma not_Base_subcls_Ext [elim!]: "(Base, Ext) \<in> (subcls1 tprg)\<^sup>+  \<Longrightarrow> R"
 apply (auto dest!: tranclD subcls1D simp add: BaseCl_def)
 done
 
 lemma not_TName_n_subcls_TName_n [rule_format (no_asm), elim!]: 
   "(\<lparr>pid=java_lang,tid=TName tn\<rparr>, \<lparr>pid=java_lang,tid=TName tn\<rparr>) 
-   \<in> (subcls1 tprg)^+ \<longrightarrow> R"
+   \<in> (subcls1 tprg)\<^sup>+ \<longrightarrow> R"
 apply (rule_tac n1 = "tn" in surj_tnam' [THEN exE])
 apply (erule ssubst)
 apply (rule tnam'.induct)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/Table.thy
--- a/src/HOL/Bali/Table.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/Table.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -364,10 +364,10 @@
 primrec atleast_free :: "('a \<rightharpoonup> 'b) => nat => bool"
 where
   "atleast_free m 0 = True"
-| atleast_free_Suc: "atleast_free m (Suc n) = (\<exists>a. m a = None & (!b. atleast_free (m(a|->b)) n))"
+| atleast_free_Suc: "atleast_free m (Suc n) = (\<exists>a. m a = None \<and> (\<forall>b. atleast_free (m(a\<mapsto>b)) n))"
 
 lemma atleast_free_weaken [rule_format (no_asm)]: 
-  "!m. atleast_free m (Suc n) \<longrightarrow> atleast_free m n"
+  "\<forall>m. atleast_free m (Suc n) \<longrightarrow> atleast_free m n"
 apply (induct_tac "n")
 apply (simp (no_asm))
 apply clarify
@@ -377,13 +377,13 @@
 done
 
 lemma atleast_free_SucI: 
-"[| h a = None; !obj. atleast_free (h(a|->obj)) n |] ==> atleast_free h (Suc n)"
+"[| h a = None; \<forall>obj. atleast_free (h(a|->obj)) n |] ==> atleast_free h (Suc n)"
 by force
 
 declare fun_upd_apply [simp del]
 lemma atleast_free_SucD_lemma [rule_format (no_asm)]: 
-" !m a. m a = None --> (!c. atleast_free (m(a|->c)) n) -->  
-  (!b d. a ~= b --> atleast_free (m(b|->d)) n)"
+"\<forall>m a. m a = None \<longrightarrow> (\<forall>c. atleast_free (m(a\<mapsto>c)) n) \<longrightarrow>
+  (\<forall>b d. a \<noteq> b \<longrightarrow> atleast_free (m(b\<mapsto>d)) n)"
 apply (induct_tac "n")
 apply  auto
 apply (rule_tac x = "a" in exI)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/TypeRel.thy
--- a/src/HOL/Bali/TypeRel.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/TypeRel.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -43,7 +43,7 @@
 
 abbreviation
   subint_syntax :: "prog => [qtname, qtname] => bool" ("_\<turnstile>_\<preceq>I _"  [71,71,71] 70)
-  where "G\<turnstile>I \<preceq>I J == (I,J) \<in>(subint1 G)^*" \<comment> \<open>cf. 9.1.3\<close>
+  where "G\<turnstile>I \<preceq>I J == (I,J) \<in>(subint1 G)\<^sup>*" \<comment> \<open>cf. 9.1.3\<close>
 
 abbreviation
   implmt1_syntax :: "prog => [qtname, qtname] => bool" ("_\<turnstile>_\<leadsto>1_"  [71,71,71] 70)
@@ -116,7 +116,7 @@
 apply (auto intro: rtrancl_into_trancl3)
 done
 
-lemma subcls_is_class: "(C,D) \<in> (subcls1 G)^+ \<Longrightarrow> is_class G C"
+lemma subcls_is_class: "(C,D) \<in> (subcls1 G)\<^sup>+ \<Longrightarrow> is_class G C"
 apply (erule trancl_trans_induct)
 apply (auto dest!: subcls1D)
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Bali/WellForm.thy
--- a/src/HOL/Bali/WellForm.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Bali/WellForm.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -268,7 +268,7 @@
 
 lemma wf_idecl_supD: 
 "\<lbrakk>wf_idecl G (I,i); J \<in> set (isuperIfs i)\<rbrakk> 
- \<Longrightarrow> is_acc_iface G (pid I) J \<and> (J, I) \<notin> (subint1 G)^+"
+ \<Longrightarrow> is_acc_iface G (pid I) J \<and> (J, I) \<notin> (subint1 G)\<^sup>+"
 apply (unfold wf_idecl_def ws_idecl_def)
 apply auto
 done
@@ -451,7 +451,7 @@
 
 lemma wf_cdecl_supD: 
 "\<lbrakk>wf_cdecl G (C,c); C \<noteq> Object\<rbrakk> \<Longrightarrow>  
-  is_acc_class G (pid C) (super c) \<and> (super c,C) \<notin> (subcls1 G)^+ \<and> 
+  is_acc_class G (pid C) (super c) \<and> (super c,C) \<notin> (subcls1 G)\<^sup>+ \<and> 
    (table_of (map (\<lambda> (s,m). (s,C,m)) (methods c)) 
     entails (\<lambda> new. \<forall> old sig. 
                  (G,sig\<turnstile>new overrides\<^sub>S old 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Cardinals/Cardinal_Order_Relation.thy
--- a/src/HOL/Cardinals/Cardinal_Order_Relation.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Cardinals/Cardinal_Order_Relation.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -71,18 +71,18 @@
 
 subsection \<open>Cardinal of a set\<close>
 
-lemma card_of_inj_rel: assumes INJ: "!! x y y'. \<lbrakk>(x,y) : R; (x,y') : R\<rbrakk> \<Longrightarrow> y = y'"
-shows "|{y. EX x. (x,y) : R}| <=o |{x. EX y. (x,y) : R}|"
+lemma card_of_inj_rel: assumes INJ: "\<And>x y y'. \<lbrakk>(x,y) \<in> R; (x,y') \<in> R\<rbrakk> \<Longrightarrow> y = y'"
+shows "|{y. \<exists>x. (x,y) \<in> R}| <=o |{x. \<exists>y. (x,y) \<in> R}|"
 proof-
-  let ?Y = "{y. EX x. (x,y) : R}"  let ?X = "{x. EX y. (x,y) : R}"
-  let ?f = "% y. SOME x. (x,y) : R"
+  let ?Y = "{y. \<exists>x. (x,y) \<in> R}"  let ?X = "{x. \<exists>y. (x,y) \<in> R}"
+  let ?f = "\<lambda>y. SOME x. (x,y) \<in> R"
   have "?f ` ?Y <= ?X" by (auto dest: someI)
   moreover have "inj_on ?f ?Y"
   unfolding inj_on_def proof(auto)
     fix y1 x1 y2 x2
     assume *: "(x1, y1) \<in> R" "(x2, y2) \<in> R" and **: "?f y1 = ?f y2"
-    hence "(?f y1,y1) : R" using someI[of "% x. (x,y1) : R"] by auto
-    moreover have "(?f y2,y2) : R" using * someI[of "% x. (x,y2) : R"] by auto
+    hence "(?f y1,y1) \<in> R" using someI[of "\<lambda>x. (x,y1) \<in> R"] by auto
+    moreover have "(?f y2,y2) \<in> R" using * someI[of "\<lambda>x. (x,y2) \<in> R"] by auto
     ultimately show "y1 = y2" using ** INJ by auto
   qed
   ultimately show "|?Y| <=o |?X|" using card_of_ordLeq by blast
@@ -1629,7 +1629,7 @@
 shows "\<exists> i \<in> Field r. \<forall> b \<in> B. P i b"
 proof-
   let ?As = "\<lambda>i. {b \<in> B. P i b}"
-  have "EX i : Field r. B \<le> ?As i"
+  have "\<exists>i \<in> Field r. B \<le> ?As i"
   apply(rule regularCard_UNION) using assms unfolding relChain_def by auto
   thus ?thesis by auto
 qed
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Cardinals/Wellorder_Constructions.thy
--- a/src/HOL/Cardinals/Wellorder_Constructions.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Cardinals/Wellorder_Constructions.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -37,7 +37,7 @@
 "Restr (Restr r A) B = Restr r (A Int B)"
 by blast
 
-lemma Restr_iff: "(a,b) : Restr r A = (a : A \<and> b : A \<and> (a,b) : r)"
+lemma Restr_iff: "(a,b) \<in> Restr r A = (a \<in> A \<and> b \<in> A \<and> (a,b) \<in> r)"
 by (auto simp add: Field_def)
 
 lemma Restr_subset1: "Restr r A \<le> r"
@@ -281,7 +281,7 @@
 
 definition isOmax :: "'a rel set \<Rightarrow> 'a rel \<Rightarrow> bool"
 where
-"isOmax  R r == r \<in> R \<and> (ALL r' : R. r' \<le>o r)"
+"isOmax  R r \<equiv> r \<in> R \<and> (\<forall>r' \<in> R. r' \<le>o r)"
 
 definition omax :: "'a rel set \<Rightarrow> 'a rel"
 where
@@ -405,8 +405,8 @@
 shows "omax P \<le>o omax R"
 proof-
   let ?mp = "omax P"  let ?mr = "omax R"
-  {fix p assume "p : P"
-   then obtain r where r: "r : R" and "p \<le>o r"
+  {fix p assume "p \<in> P"
+   then obtain r where r: "r \<in> R" and "p \<le>o r"
    using LEQ by blast
    moreover have "r <=o ?mr"
    using r R Well_R omax_maxim by blast
@@ -424,8 +424,8 @@
 shows "omax P <o omax R"
 proof-
   let ?mp = "omax P"  let ?mr = "omax R"
-  {fix p assume "p : P"
-   then obtain r where r: "r : R" and "p <o r"
+  {fix p assume "p \<in> P"
+   then obtain r where r: "r \<in> R" and "p <o r"
    using LEQ by blast
    moreover have "r <=o ?mr"
    using r R Well_R omax_maxim by blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Complete_Lattices.thy
--- a/src/HOL/Complete_Lattices.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Complete_Lattices.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -392,11 +392,11 @@
   then show ?thesis by simp
 qed
 
-lemma INF_inf_const1: "I \<noteq> {} \<Longrightarrow> (INF i:I. inf x (f i)) = inf x (INF i:I. f i)"
+lemma INF_inf_const1: "I \<noteq> {} \<Longrightarrow> (\<Sqinter>i\<in>I. inf x (f i)) = inf x (\<Sqinter>i\<in>I. f i)"
   by (intro antisym INF_greatest inf_mono order_refl INF_lower)
      (auto intro: INF_lower2 le_infI2 intro!: INF_mono)
 
-lemma INF_inf_const2: "I \<noteq> {} \<Longrightarrow> (INF i:I. inf (f i) x) = inf (INF i:I. f i) x"
+lemma INF_inf_const2: "I \<noteq> {} \<Longrightarrow> (\<Sqinter>i\<in>I. inf (f i) x) = inf (\<Sqinter>i\<in>I. f i) x"
   using INF_inf_const1[of I x f] by (simp add: inf_commute)
 
 lemma INF_constant: "(\<Sqinter>y\<in>A. c) = (if A = {} then \<top> else c)"
@@ -514,10 +514,10 @@
 lemma mono_Sup: "(\<Squnion>x\<in>A. f x) \<le> f (\<Squnion>A)"
   using \<open>mono f\<close> by (auto intro: complete_lattice_class.SUP_least Sup_upper dest: monoD)
 
-lemma mono_INF: "f (INF i : I. A i) \<le> (INF x : I. f (A x))"
+lemma mono_INF: "f (\<Sqinter>i\<in>I. A i) \<le> (\<Sqinter>x\<in>I. f (A x))"
   by (intro complete_lattice_class.INF_greatest monoD[OF \<open>mono f\<close>] INF_lower)
 
-lemma mono_SUP: "(SUP x : I. f (A x)) \<le> f (SUP i : I. A i)"
+lemma mono_SUP: "(\<Squnion>x\<in>I. f (A x)) \<le> f (\<Squnion>i\<in>I. A i)"
   by (intro complete_lattice_class.SUP_least monoD[OF \<open>mono f\<close>] SUP_upper)
 
 end
@@ -1250,7 +1250,7 @@
 lemma Union_disjoint: "(\<Union>C \<inter> A = {}) \<longleftrightarrow> (\<forall>B\<in>C. B \<inter> A = {})"
   by (fact Sup_inf_eq_bot_iff)
 
-lemma SUP_UNION: "(SUP x:(UN y:A. g y). f x) = (SUP y:A. SUP x:g y. f x :: _ :: complete_lattice)"
+lemma SUP_UNION: "(\<Squnion>x\<in>(\<Union>y\<in>A. g y). f x) = (\<Squnion>y\<in>A. \<Squnion>x\<in>g y. f x :: _ :: complete_lattice)"
   by (rule order_antisym) (blast intro: SUP_least SUP_upper2)+
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Computational_Algebra/Primes.thy
--- a/src/HOL/Computational_Algebra/Primes.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Computational_Algebra/Primes.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -728,7 +728,7 @@
   define g where "g = (\<lambda>x. if x \<in> S then f x else 0)"
   define A where "A = Abs_multiset g"
   have "{x. g x > 0} \<subseteq> S" by (auto simp: g_def)
-  from finite_subset[OF this assms(1)] have [simp]: "g :  multiset"
+  from finite_subset[OF this assms(1)] have [simp]: "g \<in> multiset"
     by (simp add: multiset_def)
   from assms have count_A: "count A x = g x" for x unfolding A_def
     by simp
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Conditionally_Complete_Lattices.thy
--- a/src/HOL/Conditionally_Complete_Lattices.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Conditionally_Complete_Lattices.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -304,10 +304,10 @@
 lemma cSUP_upper2: "bdd_above (f ` A) \<Longrightarrow> x \<in> A \<Longrightarrow> u \<le> f x \<Longrightarrow> u \<le> SUPREMUM A f"
   by (auto intro: cSUP_upper order_trans)
 
-lemma cSUP_const [simp]: "A \<noteq> {} \<Longrightarrow> (SUP x:A. c) = c"
+lemma cSUP_const [simp]: "A \<noteq> {} \<Longrightarrow> (\<Squnion>x\<in>A. c) = c"
   by (intro antisym cSUP_least) (auto intro: cSUP_upper)
 
-lemma cINF_const [simp]: "A \<noteq> {} \<Longrightarrow> (INF x:A. c) = c"
+lemma cINF_const [simp]: "A \<noteq> {} \<Longrightarrow> (\<Sqinter>x\<in>A. c) = c"
   by (intro antisym cINF_greatest) (auto intro: cINF_lower)
 
 lemma le_cINF_iff: "A \<noteq> {} \<Longrightarrow> bdd_below (f ` A) \<Longrightarrow> u \<le> INFIMUM A f \<longleftrightarrow> (\<forall>x\<in>A. u \<le> f x)"
@@ -316,10 +316,10 @@
 lemma cSUP_le_iff: "A \<noteq> {} \<Longrightarrow> bdd_above (f ` A) \<Longrightarrow> SUPREMUM A f \<le> u \<longleftrightarrow> (\<forall>x\<in>A. f x \<le> u)"
   by (metis cSUP_least cSUP_upper order_trans)
 
-lemma less_cINF_D: "bdd_below (f`A) \<Longrightarrow> y < (INF i:A. f i) \<Longrightarrow> i \<in> A \<Longrightarrow> y < f i"
+lemma less_cINF_D: "bdd_below (f`A) \<Longrightarrow> y < (\<Sqinter>i\<in>A. f i) \<Longrightarrow> i \<in> A \<Longrightarrow> y < f i"
   by (metis cINF_lower less_le_trans)
 
-lemma cSUP_lessD: "bdd_above (f`A) \<Longrightarrow> (SUP i:A. f i) < y \<Longrightarrow> i \<in> A \<Longrightarrow> f i < y"
+lemma cSUP_lessD: "bdd_above (f`A) \<Longrightarrow> (\<Squnion>i\<in>A. f i) < y \<Longrightarrow> i \<in> A \<Longrightarrow> f i < y"
   by (metis cSUP_upper le_less_trans)
 
 lemma cINF_insert: "A \<noteq> {} \<Longrightarrow> bdd_below (f ` A) \<Longrightarrow> INFIMUM (insert a A) f = inf (f a) (INFIMUM A f)"
@@ -358,11 +358,11 @@
 lemma cSUP_union: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> B \<noteq> {} \<Longrightarrow> bdd_above (f`B) \<Longrightarrow> SUPREMUM (A \<union> B) f = sup (SUPREMUM A f) (SUPREMUM B f)"
   using cSup_union_distrib [of "f ` A" "f ` B"] by (simp add: image_Un [symmetric])
 
-lemma cINF_inf_distrib: "A \<noteq> {} \<Longrightarrow> bdd_below (f`A) \<Longrightarrow> bdd_below (g`A) \<Longrightarrow> inf (INFIMUM A f) (INFIMUM A g) = (INF a:A. inf (f a) (g a))"
+lemma cINF_inf_distrib: "A \<noteq> {} \<Longrightarrow> bdd_below (f`A) \<Longrightarrow> bdd_below (g`A) \<Longrightarrow> inf (INFIMUM A f) (INFIMUM A g) = (\<Sqinter>a\<in>A. inf (f a) (g a))"
   by (intro antisym le_infI cINF_greatest cINF_lower2)
      (auto intro: le_infI1 le_infI2 cINF_greatest cINF_lower le_infI)
 
-lemma SUP_sup_distrib: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> bdd_above (g`A) \<Longrightarrow> sup (SUPREMUM A f) (SUPREMUM A g) = (SUP a:A. sup (f a) (g a))"
+lemma SUP_sup_distrib: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> bdd_above (g`A) \<Longrightarrow> sup (SUPREMUM A f) (SUPREMUM A g) = (\<Squnion>a\<in>A. sup (f a) (g a))"
   by (intro antisym le_supI cSUP_least cSUP_upper2)
      (auto intro: le_supI1 le_supI2 cSUP_least cSUP_upper le_supI)
 
@@ -403,10 +403,10 @@
 lemma cInf_less_iff: "X \<noteq> {} \<Longrightarrow> bdd_below X \<Longrightarrow> Inf X < y \<longleftrightarrow> (\<exists>x\<in>X. x < y)"
   by (rule iffI) (metis cInf_greatest not_less, metis cInf_lower le_less_trans)
 
-lemma cINF_less_iff: "A \<noteq> {} \<Longrightarrow> bdd_below (f`A) \<Longrightarrow> (INF i:A. f i) < a \<longleftrightarrow> (\<exists>x\<in>A. f x < a)"
+lemma cINF_less_iff: "A \<noteq> {} \<Longrightarrow> bdd_below (f`A) \<Longrightarrow> (\<Sqinter>i\<in>A. f i) < a \<longleftrightarrow> (\<exists>x\<in>A. f x < a)"
   using cInf_less_iff[of "f`A"] by auto
 
-lemma less_cSUP_iff: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> a < (SUP i:A. f i) \<longleftrightarrow> (\<exists>x\<in>A. a < f x)"
+lemma less_cSUP_iff: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> a < (\<Squnion>i\<in>A. f i) \<longleftrightarrow> (\<exists>x\<in>A. a < f x)"
   using less_cSup_iff[of "f`A"] by auto
 
 lemma less_cSupE:
@@ -642,10 +642,10 @@
 
 lemma cSUP_eq_cINF_D:
   fixes f :: "_ \<Rightarrow> 'b::conditionally_complete_lattice"
-  assumes eq: "(SUP x:A. f x) = (INF x:A. f x)"
+  assumes eq: "(\<Squnion>x\<in>A. f x) = (\<Sqinter>x\<in>A. f x)"
      and bdd: "bdd_above (f ` A)" "bdd_below (f ` A)"
      and a: "a \<in> A"
-  shows "f a = (INF x:A. f x)"
+  shows "f a = (\<Sqinter>x\<in>A. f x)"
 apply (rule antisym)
 using a bdd
 apply (auto simp: cINF_lower)
@@ -656,17 +656,17 @@
   fixes f :: "_ \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes ne: "A \<noteq> {}" "\<And>x. x \<in> A \<Longrightarrow> B(x) \<noteq> {}"
       and bdd_UN: "bdd_above (\<Union>x\<in>A. f ` B x)"
-  shows "(SUP z : \<Union>x\<in>A. B x. f z) = (SUP x:A. SUP z:B x. f z)"
+  shows "(\<Squnion>z \<in> \<Union>x\<in>A. B x. f z) = (\<Squnion>x\<in>A. \<Squnion>z\<in>B x. f z)"
 proof -
   have bdd: "\<And>x. x \<in> A \<Longrightarrow> bdd_above (f ` B x)"
     using bdd_UN by (meson UN_upper bdd_above_mono)
   obtain M where "\<And>x y. x \<in> A \<Longrightarrow> y \<in> B(x) \<Longrightarrow> f y \<le> M"
     using bdd_UN by (auto simp: bdd_above_def)
-  then have bdd2: "bdd_above ((\<lambda>x. SUP z:B x. f z) ` A)"
+  then have bdd2: "bdd_above ((\<lambda>x. \<Squnion>z\<in>B x. f z) ` A)"
     unfolding bdd_above_def by (force simp: bdd cSUP_le_iff ne(2))
-  have "(SUP z:\<Union>x\<in>A. B x. f z) \<le> (SUP x:A. SUP z:B x. f z)"
+  have "(\<Squnion>z \<in> \<Union>x\<in>A. B x. f z) \<le> (\<Squnion>x\<in>A. \<Squnion>z\<in>B x. f z)"
     using assms by (fastforce simp add: intro!: cSUP_least intro: cSUP_upper2 simp: bdd2 bdd)
-  moreover have "(SUP x:A. SUP z:B x. f z) \<le> (SUP z:\<Union>x\<in>A. B x. f z)"
+  moreover have "(\<Squnion>x\<in>A. \<Squnion>z\<in>B x. f z) \<le> (\<Squnion> z \<in> \<Union>x\<in>A. B x. f z)"
     using assms by (fastforce simp add: intro!: cSUP_least intro: cSUP_upper simp: image_UN bdd_UN)
   ultimately show ?thesis
     by (rule order_antisym)
@@ -676,17 +676,17 @@
   fixes f :: "_ \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes ne: "A \<noteq> {}" "\<And>x. x \<in> A \<Longrightarrow> B(x) \<noteq> {}"
       and bdd_UN: "bdd_below (\<Union>x\<in>A. f ` B x)"
-  shows "(INF z : \<Union>x\<in>A. B x. f z) = (INF x:A. INF z:B x. f z)"
+  shows "(\<Sqinter>z \<in> \<Union>x\<in>A. B x. f z) = (\<Sqinter>x\<in>A. \<Sqinter>z\<in>B x. f z)"
 proof -
   have bdd: "\<And>x. x \<in> A \<Longrightarrow> bdd_below (f ` B x)"
     using bdd_UN by (meson UN_upper bdd_below_mono)
   obtain M where "\<And>x y. x \<in> A \<Longrightarrow> y \<in> B(x) \<Longrightarrow> f y \<ge> M"
     using bdd_UN by (auto simp: bdd_below_def)
-  then have bdd2: "bdd_below ((\<lambda>x. INF z:B x. f z) ` A)"
+  then have bdd2: "bdd_below ((\<lambda>x. \<Sqinter>z\<in>B x. f z) ` A)"
     unfolding bdd_below_def by (force simp: bdd le_cINF_iff ne(2))
-  have "(INF z:\<Union>x\<in>A. B x. f z) \<le> (INF x:A. INF z:B x. f z)"
+  have "(\<Sqinter>z \<in> \<Union>x\<in>A. B x. f z) \<le> (\<Sqinter>x\<in>A. \<Sqinter>z\<in>B x. f z)"
     using assms by (fastforce simp add: intro!: cINF_greatest intro: cINF_lower simp: bdd2 bdd)
-  moreover have "(INF x:A. INF z:B x. f z) \<le> (INF z:\<Union>x\<in>A. B x. f z)"
+  moreover have "(\<Sqinter>x\<in>A. \<Sqinter>z\<in>B x. f z) \<le> (\<Sqinter>z \<in> \<Union>x\<in>A. B x. f z)"
     using assms  by (fastforce simp add: intro!: cINF_greatest intro: cINF_lower2  simp: bdd bdd_UN bdd2)
   ultimately show ?thesis
     by (rule order_antisym)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Data_Structures/AA_Map.thy
--- a/src/HOL/Data_Structures/AA_Map.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Data_Structures/AA_Map.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -64,7 +64,7 @@
 qed simp
 
 lemma lvl_update_incr_iff: "(lvl(update a b t) = lvl t + 1) \<longleftrightarrow>
-  (EX l x r. update a b t = Node (lvl t + 1) l x r \<and> lvl l = lvl r)"
+  (\<exists>l x r. update a b t = Node (lvl t + 1) l x r \<and> lvl l = lvl r)"
 apply(cases t)
 apply(auto simp add: skew_case split_case split: if_splits)
 apply(auto split: tree.splits if_splits)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Data_Structures/AA_Set.thy
--- a/src/HOL/Data_Structures/AA_Set.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Data_Structures/AA_Set.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -193,7 +193,7 @@
 
 
 lemma lvl_insert_incr_iff: "(lvl(insert a t) = lvl t + 1) \<longleftrightarrow>
-  (EX l x r. insert a t = Node (lvl t + 1) l x r \<and> lvl l = lvl r)"
+  (\<exists>l x r. insert a t = Node (lvl t + 1) l x r \<and> lvl l = lvl r)"
 apply(cases t)
 apply(auto simp add: skew_case split_case split: if_splits)
 apply(auto split: tree.splits if_splits)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Data_Structures/Brother12_Set.thy
--- a/src/HOL/Data_Structures/Brother12_Set.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Data_Structures/Brother12_Set.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -456,7 +456,7 @@
   { case 2 with Suc.IH(1) show ?case by auto }
 qed auto
 
-lemma tree_type: "t \<in> T (h+1) \<Longrightarrow> tree t : B (h+1) \<union> B h"
+lemma tree_type: "t \<in> T (h+1) \<Longrightarrow> tree t \<in> B (h+1) \<union> B h"
 by(auto)
 
 lemma delete_type: "t \<in> B h \<Longrightarrow> delete x t \<in> B h \<union> B(h-1)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Decision_Procs/MIR.thy
--- a/src/HOL/Decision_Procs/MIR.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Decision_Procs/MIR.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -2755,17 +2755,17 @@
   shows "\<forall> b\<in> set (\<beta> p). isint b bs"
 using lp by (induct p rule: iszlfm.induct) (auto simp add: isint_neg isint_sub)
 
-lemma cpmi_eq: "0 < D \<Longrightarrow> (EX z::int. ALL x. x < z --> (P x = P1 x))
-==> ALL x.~(EX (j::int) : {1..D}. EX (b::int) : B. P(b+j)) --> P (x) --> P (x - D)
-==> (ALL (x::int). ALL (k::int). ((P1 x)= (P1 (x-k*D))))
-==> (EX (x::int). P(x)) = ((EX (j::int) : {1..D} . (P1(j))) | (EX (j::int) : {1..D}. EX (b::int) : B. P (b+j)))"
+lemma cpmi_eq: "0 < D \<Longrightarrow> (\<exists>z::int. \<forall>x. x < z \<longrightarrow> (P x = P1 x))
+\<Longrightarrow> \<forall>x. \<not>(\<exists>(j::int) \<in> {1..D}. \<exists>(b::int) \<in> B. P(b+j)) \<longrightarrow> P (x) \<longrightarrow> P (x - D)
+\<Longrightarrow> (\<forall>(x::int). \<forall>(k::int). ((P1 x)= (P1 (x-k*D))))
+\<Longrightarrow> (\<exists>(x::int). P(x)) = ((\<exists>(j::int) \<in> {1..D} . (P1(j))) | (\<exists>(j::int) \<in> {1..D}. \<exists>(b::int) \<in> B. P (b+j)))"
 apply(rule iffI)
 prefer 2
 apply(drule minusinfinity)
 apply assumption+
 apply(fastforce)
 apply clarsimp
-apply(subgoal_tac "!!k. 0<=k \<Longrightarrow> !x. P x \<longrightarrow> P (x - k*D)")
+apply(subgoal_tac "\<And>k. 0<=k \<Longrightarrow> \<forall>x. P x \<longrightarrow> P (x - k*D)")
 apply(frule_tac x = x and z=z in decr_lemma)
 apply(subgoal_tac "P1(x - (\<bar>x - z\<bar> + 1) * D)")
 prefer 2
@@ -5710,4 +5710,3 @@
   by mir
 
 end
-
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Decision_Procs/approximation.ML
--- a/src/HOL/Decision_Procs/approximation.ML	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Decision_Procs/approximation.ML	Thu Feb 15 13:04:36 2018 +0100
@@ -105,9 +105,9 @@
 
 fun calculated_subterms (@{const Trueprop} $ t) = calculated_subterms t
   | calculated_subterms (@{const HOL.implies} $ _ $ t) = calculated_subterms t
-  | calculated_subterms (@{term "(<=) :: real \<Rightarrow> real \<Rightarrow> bool"} $ t1 $ t2) = [t1, t2]
+  | calculated_subterms (@{term "(\<le>) :: real \<Rightarrow> real \<Rightarrow> bool"} $ t1 $ t2) = [t1, t2]
   | calculated_subterms (@{term "(<) :: real \<Rightarrow> real \<Rightarrow> bool"} $ t1 $ t2) = [t1, t2]
-  | calculated_subterms (@{term "(:) :: real \<Rightarrow> real set \<Rightarrow> bool"} $ t1 $
+  | calculated_subterms (@{term "(\<in>) :: real \<Rightarrow> real set \<Rightarrow> bool"} $ t1 $
                          (@{term "atLeastAtMost :: real \<Rightarrow> real \<Rightarrow> real set"} $ t2 $ t3)) = [t1, t2, t3]
   | calculated_subterms t = raise TERM ("calculated_subterms", [t])
 
@@ -246,7 +246,7 @@
          |> approximate ctxt
          |> HOLogic.dest_list
          |> curry ListPair.zip (HOLogic.dest_list xs @ calculated_subterms arith_term)
-         |> map (fn (elem, s) => @{term "(:) :: real \<Rightarrow> real set \<Rightarrow> bool"} $ elem $ mk_result prec (dest_ivl s))
+         |> map (fn (elem, s) => @{term "(\<in>) :: real \<Rightarrow> real set \<Rightarrow> bool"} $ elem $ mk_result prec (dest_ivl s))
          |> foldr1 HOLogic.mk_conj))
 
 fun approx_arith prec ctxt t = realify t
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Enum.thy
--- a/src/HOL/Enum.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Enum.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -61,7 +61,7 @@
   by (simp add: enum_UNIV)
 
 lemma vimage_code [code]:
-  "f -` B = set (filter (%x. f x : B) enum_class.enum)"
+  "f -` B = set (filter (\<lambda>x. f x \<in> B) enum_class.enum)"
   unfolding vimage_def Collect_code ..
 
 definition card_UNIV :: "'a itself \<Rightarrow> nat"
@@ -208,8 +208,8 @@
   shows "Wellfounded.acc r \<subseteq> (\<Union>n. bacc r n)"
 proof
   fix x
-  assume "x : Wellfounded.acc r"
-  then have "\<exists> n. x : bacc r n"
+  assume "x \<in> Wellfounded.acc r"
+  then have "\<exists>n. x \<in> bacc r n"
   proof (induct x arbitrary: rule: acc.induct)
     case (accI x)
     then have "\<forall>y. \<exists> n. (y, x) \<in> r \<longrightarrow> y \<in> bacc r n" by simp
@@ -217,16 +217,16 @@
     obtain n where "\<And>y. (y, x) \<in> r \<Longrightarrow> y \<in> bacc r n"
     proof
       fix y assume y: "(y, x) \<in> r"
-      with n have "y : bacc r (n y)" by auto
+      with n have "y \<in> bacc r (n y)" by auto
       moreover have "n y <= Max ((\<lambda>(y, x). n y) ` r)"
         using y \<open>finite r\<close> by (auto intro!: Max_ge)
       note bacc_mono[OF this, of r]
-      ultimately show "y : bacc r (Max ((\<lambda>(y, x). n y) ` r))" by auto
+      ultimately show "y \<in> bacc r (Max ((\<lambda>(y, x). n y) ` r))" by auto
     qed
     then show ?case
       by (auto simp add: Let_def intro!: exI[of _ "Suc n"])
   qed
-  then show "x : (UN n. bacc r n)" by auto
+  then show "x \<in> (\<Union>n. bacc r n)" by auto
 qed
 
 lemma acc_bacc_eq:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Filter.thy
--- a/src/HOL/Filter.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Filter.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -467,7 +467,7 @@
     by (simp add: eventually_F)
 qed
 
-lemma eventually_INF: "eventually P (INF b:B. F b) \<longleftrightarrow> (\<exists>X\<subseteq>B. finite X \<and> eventually P (INF b:X. F b))"
+lemma eventually_INF: "eventually P (\<Sqinter>b\<in>B. F b) \<longleftrightarrow> (\<exists>X\<subseteq>B. finite X \<and> eventually P (\<Sqinter>b\<in>X. F b))"
   unfolding eventually_Inf [of P "F`B"]
   by (metis finite_imageI image_mono finite_subset_image)
 
@@ -479,7 +479,7 @@
 
 lemma INF_filter_not_bot:
   fixes F :: "'i \<Rightarrow> 'a filter"
-  shows "(\<And>X. X \<subseteq> B \<Longrightarrow> finite X \<Longrightarrow> (INF b:X. F b) \<noteq> bot) \<Longrightarrow> (INF b:B. F b) \<noteq> bot"
+  shows "(\<And>X. X \<subseteq> B \<Longrightarrow> finite X \<Longrightarrow> (\<Sqinter>b\<in>X. F b) \<noteq> bot) \<Longrightarrow> (\<Sqinter>b\<in>B. F b) \<noteq> bot"
   unfolding trivial_limit_def eventually_INF [of _ _ B]
     bot_bool_def [symmetric] bot_fun_def [symmetric] bot_unique by simp
 
@@ -507,10 +507,10 @@
 
 lemma eventually_INF_base:
   "B \<noteq> {} \<Longrightarrow> (\<And>a b. a \<in> B \<Longrightarrow> b \<in> B \<Longrightarrow> \<exists>x\<in>B. F x \<le> inf (F a) (F b)) \<Longrightarrow>
-    eventually P (INF b:B. F b) \<longleftrightarrow> (\<exists>b\<in>B. eventually P (F b))"
+    eventually P (\<Sqinter>b\<in>B. F b) \<longleftrightarrow> (\<exists>b\<in>B. eventually P (F b))"
   by (subst eventually_Inf_base) auto
 
-lemma eventually_INF1: "i \<in> I \<Longrightarrow> eventually P (F i) \<Longrightarrow> eventually P (INF i:I. F i)"
+lemma eventually_INF1: "i \<in> I \<Longrightarrow> eventually P (F i) \<Longrightarrow> eventually P (\<Sqinter>i\<in>I. F i)"
   using filter_leD[OF INF_lower] .
 
 lemma eventually_INF_mono:
@@ -569,15 +569,15 @@
 lemma filtermap_inf: "filtermap f (inf F1 F2) \<le> inf (filtermap f F1) (filtermap f F2)"
   by (auto simp: le_filter_def eventually_filtermap eventually_inf)
 
-lemma filtermap_INF: "filtermap f (INF b:B. F b) \<le> (INF b:B. filtermap f (F b))"
+lemma filtermap_INF: "filtermap f (\<Sqinter>b\<in>B. F b) \<le> (\<Sqinter>b\<in>B. filtermap f (F b))"
 proof -
   { fix X :: "'c set" assume "finite X"
-    then have "filtermap f (INFIMUM X F) \<le> (INF b:X. filtermap f (F b))"
+    then have "filtermap f (INFIMUM X F) \<le> (\<Sqinter>b\<in>X. filtermap f (F b))"
     proof induct
       case (insert x X)
-      have "filtermap f (INF a:insert x X. F a) \<le> inf (filtermap f (F x)) (filtermap f (INF a:X. F a))"
+      have "filtermap f (\<Sqinter>a\<in>insert x X. F a) \<le> inf (filtermap f (F x)) (filtermap f (\<Sqinter>a\<in>X. F a))"
         by (rule order_trans[OF _ filtermap_inf]) simp
-      also have "\<dots> \<le> inf (filtermap f (F x)) (INF a:X. filtermap f (F a))"
+      also have "\<dots> \<le> inf (filtermap f (F x)) (\<Sqinter>a\<in>X. filtermap f (F a))"
         by (intro inf_mono insert order_refl)
       finally show ?case
         by simp
@@ -660,17 +660,17 @@
     by (auto simp: filter_eq_iff eventually_filtercomap eventually_sup)
 qed
 
-lemma filtercomap_INF: "filtercomap f (INF b:B. F b) = (INF b:B. filtercomap f (F b))"
+lemma filtercomap_INF: "filtercomap f (\<Sqinter>b\<in>B. F b) = (\<Sqinter>b\<in>B. filtercomap f (F b))"
 proof -
-  have *: "filtercomap f (INF b:B. F b) = (INF b:B. filtercomap f (F b))" if "finite B" for B
+  have *: "filtercomap f (\<Sqinter>b\<in>B. F b) = (\<Sqinter>b\<in>B. filtercomap f (F b))" if "finite B" for B
     using that by induction (simp_all add: filtercomap_inf)
   show ?thesis unfolding filter_eq_iff
   proof
     fix P
-    have "eventually P (INF b:B. filtercomap f (F b)) \<longleftrightarrow> 
+    have "eventually P (\<Sqinter>b\<in>B. filtercomap f (F b)) \<longleftrightarrow> 
             (\<exists>X. (X \<subseteq> B \<and> finite X) \<and> eventually P (\<Sqinter>b\<in>X. filtercomap f (F b)))"
       by (subst eventually_INF) blast
-    also have "\<dots> \<longleftrightarrow> (\<exists>X. (X \<subseteq> B \<and> finite X) \<and> eventually P (filtercomap f (INF b:X. F b)))"
+    also have "\<dots> \<longleftrightarrow> (\<exists>X. (X \<subseteq> B \<and> finite X) \<and> eventually P (filtercomap f (\<Sqinter>b\<in>X. F b)))"
       by (rule ex_cong) (simp add: *)
     also have "\<dots> \<longleftrightarrow> eventually P (filtercomap f (INFIMUM B F))"
       unfolding eventually_filtercomap by (subst eventually_INF) blast
@@ -680,7 +680,7 @@
 qed
 
 lemma filtercomap_SUP_finite: 
-  "finite B \<Longrightarrow> filtercomap f (SUP b:B. F b) \<ge> (SUP b:B. filtercomap f (F b))"
+  "finite B \<Longrightarrow> filtercomap f (\<Squnion>b\<in>B. F b) \<ge> (\<Squnion>b\<in>B. filtercomap f (F b))"
   by (induction B rule: finite_induct)
      (auto intro: order_trans[OF _ order_trans[OF _ filtercomap_sup]] filtercomap_mono)
      
@@ -738,10 +738,10 @@
   unfolding filter_eq_iff eventually_inf eventually_principal
   by (auto intro: exI[of _ "\<lambda>x. x \<in> A"] exI[of _ "\<lambda>x. x \<in> B"])
 
-lemma SUP_principal[simp]: "(SUP i : I. principal (A i)) = principal (\<Union>i\<in>I. A i)"
+lemma SUP_principal[simp]: "(\<Squnion>i\<in>I. principal (A i)) = principal (\<Union>i\<in>I. A i)"
   unfolding filter_eq_iff eventually_Sup by (auto simp: eventually_principal)
 
-lemma INF_principal_finite: "finite X \<Longrightarrow> (INF x:X. principal (f x)) = principal (\<Inter>x\<in>X. f x)"
+lemma INF_principal_finite: "finite X \<Longrightarrow> (\<Sqinter>x\<in>X. principal (f x)) = principal (\<Inter>x\<in>X. f x)"
   by (induct X rule: finite_induct) auto
 
 lemma filtermap_principal[simp]: "filtermap f (principal A) = principal (f ` A)"
@@ -753,9 +753,9 @@
 subsubsection \<open>Order filters\<close>
 
 definition at_top :: "('a::order) filter"
-  where "at_top = (INF k. principal {k ..})"
+  where "at_top = (\<Sqinter>k. principal {k ..})"
 
-lemma at_top_sub: "at_top = (INF k:{c::'a::linorder..}. principal {k ..})"
+lemma at_top_sub: "at_top = (\<Sqinter>k\<in>{c::'a::linorder..}. principal {k ..})"
   by (auto intro!: INF_eq max.cobounded1 max.cobounded2 simp: at_top_def)
 
 lemma eventually_at_top_linorder: "eventually P at_top \<longleftrightarrow> (\<exists>N::'a::linorder. \<forall>n\<ge>N. P n)"
@@ -778,9 +778,9 @@
 
 lemma eventually_at_top_dense: "eventually P at_top \<longleftrightarrow> (\<exists>N::'a::{no_top, linorder}. \<forall>n>N. P n)"
 proof -
-  have "eventually P (INF k. principal {k <..}) \<longleftrightarrow> (\<exists>N::'a. \<forall>n>N. P n)"
+  have "eventually P (\<Sqinter>k. principal {k <..}) \<longleftrightarrow> (\<exists>N::'a. \<forall>n>N. P n)"
     by (subst eventually_INF_base) (auto simp: eventually_principal intro: max.cobounded1 max.cobounded2)
-  also have "(INF k. principal {k::'a <..}) = at_top"
+  also have "(\<Sqinter>k. principal {k::'a <..}) = at_top"
     unfolding at_top_def
     by (intro INF_eq) (auto intro: less_imp_le simp: Ici_subset_Ioi_iff gt_ex)
   finally show ?thesis .
@@ -806,9 +806,9 @@
 qed
 
 definition at_bot :: "('a::order) filter"
-  where "at_bot = (INF k. principal {.. k})"
+  where "at_bot = (\<Sqinter>k. principal {.. k})"
 
-lemma at_bot_sub: "at_bot = (INF k:{.. c::'a::linorder}. principal {.. k})"
+lemma at_bot_sub: "at_bot = (\<Sqinter>k\<in>{.. c::'a::linorder}. principal {.. k})"
   by (auto intro!: INF_eq min.cobounded1 min.cobounded2 simp: at_bot_def)
 
 lemma eventually_at_bot_linorder:
@@ -826,9 +826,9 @@
 
 lemma eventually_at_bot_dense: "eventually P at_bot \<longleftrightarrow> (\<exists>N::'a::{no_bot, linorder}. \<forall>n<N. P n)"
 proof -
-  have "eventually P (INF k. principal {..< k}) \<longleftrightarrow> (\<exists>N::'a. \<forall>n<N. P n)"
+  have "eventually P (\<Sqinter>k. principal {..< k}) \<longleftrightarrow> (\<exists>N::'a. \<forall>n<N. P n)"
     by (subst eventually_INF_base) (auto simp: eventually_principal intro: min.cobounded1 min.cobounded2)
-  also have "(INF k. principal {..< k::'a}) = at_bot"
+  also have "(\<Sqinter>k. principal {..< k::'a}) = at_bot"
     unfolding at_bot_def
     by (intro INF_eq) (auto intro: less_imp_le simp: Iic_subset_Iio_iff lt_ex)
   finally show ?thesis .
@@ -943,7 +943,7 @@
 
 definition prod_filter :: "'a filter \<Rightarrow> 'b filter \<Rightarrow> ('a \<times> 'b) filter" (infixr "\<times>\<^sub>F" 80) where
   "prod_filter F G =
-    (INF (P, Q):{(P, Q). eventually P F \<and> eventually Q G}. principal {(x, y). P x \<and> Q y})"
+    (\<Sqinter>(P, Q)\<in>{(P, Q). eventually P F \<and> eventually Q G}. principal {(x, y). P x \<and> Q y})"
 
 lemma eventually_prod_filter: "eventually P (F \<times>\<^sub>F G) \<longleftrightarrow>
   (\<exists>Pf Pg. eventually Pf F \<and> eventually Pg G \<and> (\<forall>x y. Pf x \<longrightarrow> Pg y \<longrightarrow> P (x, y)))"
@@ -994,16 +994,16 @@
 lemma INF_filter_bot_base:
   fixes F :: "'a \<Rightarrow> 'b filter"
   assumes *: "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> \<exists>k\<in>I. F k \<le> F i \<sqinter> F j"
-  shows "(INF i:I. F i) = bot \<longleftrightarrow> (\<exists>i\<in>I. F i = bot)"
+  shows "(\<Sqinter>i\<in>I. F i) = bot \<longleftrightarrow> (\<exists>i\<in>I. F i = bot)"
 proof (cases "\<exists>i\<in>I. F i = bot")
   case True
-  then have "(INF i:I. F i) \<le> bot"
+  then have "(\<Sqinter>i\<in>I. F i) \<le> bot"
     by (auto intro: INF_lower2)
   with True show ?thesis
     by (auto simp: bot_unique)
 next
   case False
-  moreover have "(INF i:I. F i) \<noteq> bot"
+  moreover have "(\<Sqinter>i\<in>I. F i) \<noteq> bot"
   proof (cases "I = {}")
     case True
     then show ?thesis
@@ -1098,7 +1098,7 @@
 
 lemma prod_filter_INF:
   assumes "I \<noteq> {}" "J \<noteq> {}"
-  shows "(INF i:I. A i) \<times>\<^sub>F (INF j:J. B j) = (INF i:I. INF j:J. A i \<times>\<^sub>F B j)"
+  shows "(\<Sqinter>i\<in>I. A i) \<times>\<^sub>F (\<Sqinter>j\<in>J. B j) = (\<Sqinter>i\<in>I. \<Sqinter>j\<in>J. A i \<times>\<^sub>F B j)"
 proof (safe intro!: antisym INF_greatest)
   from \<open>I \<noteq> {}\<close> obtain i where "i \<in> I" by auto
   from \<open>J \<noteq> {}\<close> obtain j where "j \<in> J" by auto
@@ -1146,10 +1146,10 @@
   unfolding prod_filter_def
   by (intro eventually_INF1[of "(P, Q)"]) (auto simp: eventually_principal)
 
-lemma prod_filter_INF1: "I \<noteq> {} \<Longrightarrow> (INF i:I. A i) \<times>\<^sub>F B = (INF i:I. A i \<times>\<^sub>F B)"
+lemma prod_filter_INF1: "I \<noteq> {} \<Longrightarrow> (\<Sqinter>i\<in>I. A i) \<times>\<^sub>F B = (\<Sqinter>i\<in>I. A i \<times>\<^sub>F B)"
   using prod_filter_INF[of I "{B}" A "\<lambda>x. x"] by simp
 
-lemma prod_filter_INF2: "J \<noteq> {} \<Longrightarrow> A \<times>\<^sub>F (INF i:J. B i) = (INF i:J. A \<times>\<^sub>F B i)"
+lemma prod_filter_INF2: "J \<noteq> {} \<Longrightarrow> A \<times>\<^sub>F (\<Sqinter>i\<in>J. B i) = (\<Sqinter>i\<in>J. A \<times>\<^sub>F B i)"
   using prod_filter_INF[of "{A}" J "\<lambda>x. x" B] by simp
 
 subsection \<open>Limits\<close>
@@ -1228,21 +1228,21 @@
   unfolding filterlim_def by simp
 
 lemma filterlim_INF:
-  "(LIM x F. f x :> (INF b:B. G b)) \<longleftrightarrow> (\<forall>b\<in>B. LIM x F. f x :> G b)"
+  "(LIM x F. f x :> (\<Sqinter>b\<in>B. G b)) \<longleftrightarrow> (\<forall>b\<in>B. LIM x F. f x :> G b)"
   unfolding filterlim_def le_INF_iff ..
 
 lemma filterlim_INF_INF:
-  "(\<And>m. m \<in> J \<Longrightarrow> \<exists>i\<in>I. filtermap f (F i) \<le> G m) \<Longrightarrow> LIM x (INF i:I. F i). f x :> (INF j:J. G j)"
+  "(\<And>m. m \<in> J \<Longrightarrow> \<exists>i\<in>I. filtermap f (F i) \<le> G m) \<Longrightarrow> LIM x (\<Sqinter>i\<in>I. F i). f x :> (\<Sqinter>j\<in>J. G j)"
   unfolding filterlim_def by (rule order_trans[OF filtermap_INF INF_mono])
 
 lemma filterlim_base:
   "(\<And>m x. m \<in> J \<Longrightarrow> i m \<in> I) \<Longrightarrow> (\<And>m x. m \<in> J \<Longrightarrow> x \<in> F (i m) \<Longrightarrow> f x \<in> G m) \<Longrightarrow>
-    LIM x (INF i:I. principal (F i)). f x :> (INF j:J. principal (G j))"
+    LIM x (\<Sqinter>i\<in>I. principal (F i)). f x :> (\<Sqinter>j\<in>J. principal (G j))"
   by (force intro!: filterlim_INF_INF simp: image_subset_iff)
 
 lemma filterlim_base_iff:
   assumes "I \<noteq> {}" and chain: "\<And>i j. i \<in> I \<Longrightarrow> j \<in> I \<Longrightarrow> F i \<subseteq> F j \<or> F j \<subseteq> F i"
-  shows "(LIM x (INF i:I. principal (F i)). f x :> INF j:J. principal (G j)) \<longleftrightarrow>
+  shows "(LIM x (\<Sqinter>i\<in>I. principal (F i)). f x :> \<Sqinter>j\<in>J. principal (G j)) \<longleftrightarrow>
     (\<forall>j\<in>J. \<exists>i\<in>I. \<forall>x\<in>F i. f x \<in> G j)"
   unfolding filterlim_INF filterlim_principal
 proof (subst eventually_INF_base)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Fun_Def.thy
--- a/src/HOL/Fun_Def.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Fun_Def.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -198,7 +198,7 @@
 subsection \<open>Concrete orders for SCNP termination proofs\<close>
 
 definition "pair_less = less_than <*lex*> less_than"
-definition "pair_leq = pair_less^="
+definition "pair_leq = pair_less\<^sup>="
 definition "max_strict = max_ext pair_less"
 definition "max_weak = max_ext pair_leq \<union> {({}, {})}"
 definition "min_strict = min_ext pair_less"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/FOCUS/Buffer.thy
--- a/src/HOL/HOLCF/FOCUS/Buffer.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/FOCUS/Buffer.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -97,7 +97,7 @@
   "BufSt = {f. \<exists>h\<in>BufSt_P. f = h \<currency>}"
 
 
-lemma set_cong: "!!X. A = B ==> (x:A) = (x:B)"
+lemma set_cong: "\<And>X. A = B \<Longrightarrow> (x\<in>A) = (x\<in>B)"
 by (erule subst, rule refl)
 
 
@@ -108,21 +108,21 @@
 
 lemmas BufEq_fix = mono_BufEq_F [THEN BufEq_def [THEN eq_reflection, THEN def_gfp_unfold]]
 
-lemma BufEq_unfold: "(f:BufEq) = (!d. f\<cdot>(Md d\<leadsto><>) = <> &
-                 (!x. ? ff:BufEq. f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x) = d\<leadsto>(ff\<cdot>x)))"
+lemma BufEq_unfold: "(f\<in>BufEq) = (\<forall>d. f\<cdot>(Md d\<leadsto><>) = <> \<and>
+                 (\<forall>x. \<exists>ff\<in>BufEq. f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x) = d\<leadsto>(ff\<cdot>x)))"
 apply (subst BufEq_fix [THEN set_cong])
 apply (unfold BufEq_F_def)
 apply (simp)
 done
 
-lemma Buf_f_empty: "f:BufEq \<Longrightarrow> f\<cdot><> = <>"
+lemma Buf_f_empty: "f\<in>BufEq \<Longrightarrow> f\<cdot><> = <>"
 by (drule BufEq_unfold [THEN iffD1], auto)
 
-lemma Buf_f_d: "f:BufEq \<Longrightarrow> f\<cdot>(Md d\<leadsto><>) = <>"
+lemma Buf_f_d: "f\<in>BufEq \<Longrightarrow> f\<cdot>(Md d\<leadsto><>) = <>"
 by (drule BufEq_unfold [THEN iffD1], auto)
 
 lemma Buf_f_d_req:
-        "f:BufEq \<Longrightarrow> \<exists>ff. ff:BufEq \<and> f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x) = d\<leadsto>ff\<cdot>x"
+        "f\<in>BufEq \<Longrightarrow> \<exists>ff. ff\<in>BufEq \<and> f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x) = d\<leadsto>ff\<cdot>x"
 by (drule BufEq_unfold [THEN iffD1], auto)
 
 
@@ -134,21 +134,21 @@
 lemmas BufAC_Asm_fix =
   mono_BufAC_Asm_F [THEN BufAC_Asm_def [THEN eq_reflection, THEN def_gfp_unfold]]
 
-lemma BufAC_Asm_unfold: "(s:BufAC_Asm) = (s = <> | (? d x. 
-        s = Md d\<leadsto>x & (x = <> | (ft\<cdot>x = Def \<bullet> & (rt\<cdot>x):BufAC_Asm))))"
+lemma BufAC_Asm_unfold: "(s\<in>BufAC_Asm) = (s = <> \<or> (\<exists>d x.
+        s = Md d\<leadsto>x \<and> (x = <> \<or> (ft\<cdot>x = Def \<bullet> \<and> (rt\<cdot>x)\<in>BufAC_Asm))))"
 apply (subst BufAC_Asm_fix [THEN set_cong])
 apply (unfold BufAC_Asm_F_def)
 apply (simp)
 done
 
-lemma BufAC_Asm_empty: "<>     :BufAC_Asm"
+lemma BufAC_Asm_empty: "<> \<in> BufAC_Asm"
 by (rule BufAC_Asm_unfold [THEN iffD2], auto)
 
-lemma BufAC_Asm_d: "Md d\<leadsto><>:BufAC_Asm"
+lemma BufAC_Asm_d: "Md d\<leadsto><> \<in> BufAC_Asm"
 by (rule BufAC_Asm_unfold [THEN iffD2], auto)
-lemma BufAC_Asm_d_req: "x:BufAC_Asm ==> Md d\<leadsto>\<bullet>\<leadsto>x:BufAC_Asm"
+lemma BufAC_Asm_d_req: "x \<in> BufAC_Asm \<Longrightarrow> Md d\<leadsto>\<bullet>\<leadsto>x \<in> BufAC_Asm"
 by (rule BufAC_Asm_unfold [THEN iffD2], auto)
-lemma BufAC_Asm_prefix2: "a\<leadsto>b\<leadsto>s:BufAC_Asm ==> s:BufAC_Asm"
+lemma BufAC_Asm_prefix2: "a\<leadsto>b\<leadsto>s \<in> BufAC_Asm ==> s \<in> BufAC_Asm"
 by (drule BufAC_Asm_unfold [THEN iffD1], auto)
 
 
@@ -160,31 +160,31 @@
 lemmas BufAC_Cmt_fix =
   mono_BufAC_Cmt_F [THEN BufAC_Cmt_def [THEN eq_reflection, THEN def_gfp_unfold]]
 
-lemma BufAC_Cmt_unfold: "((s,t):BufAC_Cmt) = (!d x. 
-     (s = <>       -->      t = <>) & 
-     (s = Md d\<leadsto><>  -->      t = <>) & 
-     (s = Md d\<leadsto>\<bullet>\<leadsto>x --> ft\<cdot>t = Def d & (x, rt\<cdot>t):BufAC_Cmt))"
+lemma BufAC_Cmt_unfold: "((s,t) \<in> BufAC_Cmt) = (\<forall>d x.
+     (s = <>       \<longrightarrow>      t = <>) \<and>
+     (s = Md d\<leadsto><>  \<longrightarrow>      t = <>) \<and>
+     (s = Md d\<leadsto>\<bullet>\<leadsto>x \<longrightarrow> ft\<cdot>t = Def d \<and> (x, rt\<cdot>t) \<in> BufAC_Cmt))"
 apply (subst BufAC_Cmt_fix [THEN set_cong])
 apply (unfold BufAC_Cmt_F_def)
 apply (simp)
 done
 
-lemma BufAC_Cmt_empty: "f:BufEq ==> (<>, f\<cdot><>):BufAC_Cmt"
+lemma BufAC_Cmt_empty: "f \<in> BufEq \<Longrightarrow> (<>, f\<cdot><>) \<in> BufAC_Cmt"
 by (rule BufAC_Cmt_unfold [THEN iffD2], auto simp add: Buf_f_empty)
 
-lemma BufAC_Cmt_d: "f:BufEq ==> (a\<leadsto>\<bottom>, f\<cdot>(a\<leadsto>\<bottom>)):BufAC_Cmt"
+lemma BufAC_Cmt_d: "f \<in> BufEq \<Longrightarrow> (a\<leadsto>\<bottom>, f\<cdot>(a\<leadsto>\<bottom>)) \<in> BufAC_Cmt"
 by (rule BufAC_Cmt_unfold [THEN iffD2], auto simp add: Buf_f_d)
 
 lemma BufAC_Cmt_d2:
- "(Md d\<leadsto>\<bottom>, f\<cdot>(Md d\<leadsto>\<bottom>)):BufAC_Cmt ==> f\<cdot>(Md d\<leadsto>\<bottom>) = \<bottom>"
+ "(Md d\<leadsto>\<bottom>, f\<cdot>(Md d\<leadsto>\<bottom>)) \<in> BufAC_Cmt \<Longrightarrow> f\<cdot>(Md d\<leadsto>\<bottom>) = \<bottom>"
 by (drule BufAC_Cmt_unfold [THEN iffD1], auto)
 
 lemma BufAC_Cmt_d3:
-"(Md d\<leadsto>\<bullet>\<leadsto>x, f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x)):BufAC_Cmt ==> (x, rt\<cdot>(f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x))):BufAC_Cmt"
+"(Md d\<leadsto>\<bullet>\<leadsto>x, f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x)) \<in> BufAC_Cmt \<Longrightarrow> (x, rt\<cdot>(f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x))) \<in> BufAC_Cmt"
 by (drule BufAC_Cmt_unfold [THEN iffD1], auto)
 
 lemma BufAC_Cmt_d32:
-"(Md d\<leadsto>\<bullet>\<leadsto>x, f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x)):BufAC_Cmt ==> ft\<cdot>(f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x)) = Def d"
+"(Md d\<leadsto>\<bullet>\<leadsto>x, f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x)) \<in> BufAC_Cmt \<Longrightarrow> ft\<cdot>(f\<cdot>(Md d\<leadsto>\<bullet>\<leadsto>x)) = Def d"
 by (drule BufAC_Cmt_unfold [THEN iffD1], auto)
 
 (**** BufAC *******************************************************************)
@@ -194,13 +194,13 @@
 apply (fast intro: BufAC_Cmt_d2 BufAC_Asm_d)
 done
 
-lemma ex_elim_lemma: "(? ff:B. (!x. f\<cdot>(a\<leadsto>b\<leadsto>x) = d\<leadsto>ff\<cdot>x)) = 
-    ((!x. ft\<cdot>(f\<cdot>(a\<leadsto>b\<leadsto>x)) = Def d) & (LAM x. rt\<cdot>(f\<cdot>(a\<leadsto>b\<leadsto>x))):B)"
+lemma ex_elim_lemma: "(\<exists>ff\<in>B. (\<forall>x. f\<cdot>(a\<leadsto>b\<leadsto>x) = d\<leadsto>ff\<cdot>x)) =
+    ((\<forall>x. ft\<cdot>(f\<cdot>(a\<leadsto>b\<leadsto>x)) = Def d) \<and> (LAM x. rt\<cdot>(f\<cdot>(a\<leadsto>b\<leadsto>x)))\<in>B)"
 (*  this is an instance (though unification cannot handle this) of
 lemma "(? ff:B. (!x. f\<cdot>x = d\<leadsto>ff\<cdot>x)) = \
    \((!x. ft\<cdot>(f\<cdot>x) = Def d) & (LAM x. rt\<cdot>(f\<cdot>x)):B)"*)
 apply safe
-apply (  rule_tac [2] P="(%x. x:B)" in ssubst)
+apply (  rule_tac [2] P="(\<lambda>x. x\<in>B)" in ssubst)
 prefer 3
 apply (   assumption)
 apply (  rule_tac [2] cfun_eqI)
@@ -236,19 +236,19 @@
 lemmas BufSt_P_fix =
   mono_BufSt_F [THEN BufSt_P_def [THEN eq_reflection, THEN def_gfp_unfold]]
 
-lemma BufSt_P_unfold: "(h:BufSt_P) = (!s. h s\<cdot><> = <> & 
-           (!d x. h \<currency>     \<cdot>(Md d\<leadsto>x)   =    h (Sd d)\<cdot>x & 
-      (? hh:BufSt_P. h (Sd d)\<cdot>(\<bullet>\<leadsto>x)   = d\<leadsto>(hh \<currency>    \<cdot>x))))"
+lemma BufSt_P_unfold: "(h\<in>BufSt_P) = (\<forall>s. h s\<cdot><> = <> \<and>
+           (\<forall>d x. h \<currency>     \<cdot>(Md d\<leadsto>x)   =    h (Sd d)\<cdot>x \<and>
+      (\<exists>hh\<in>BufSt_P. h (Sd d)\<cdot>(\<bullet>\<leadsto>x)   = d\<leadsto>(hh \<currency>    \<cdot>x))))"
 apply (subst BufSt_P_fix [THEN set_cong])
 apply (unfold BufSt_F_def)
 apply (simp)
 done
 
-lemma BufSt_P_empty: "h:BufSt_P ==> h s     \<cdot> <>       = <>"
+lemma BufSt_P_empty: "h \<in> BufSt_P \<Longrightarrow> h s     \<cdot> <>       = <>"
 by (drule BufSt_P_unfold [THEN iffD1], auto)
-lemma BufSt_P_d: "h:BufSt_P ==> h  \<currency>    \<cdot>(Md d\<leadsto>x) = h (Sd d)\<cdot>x"
+lemma BufSt_P_d: "h \<in> BufSt_P \<Longrightarrow> h  \<currency>    \<cdot>(Md d\<leadsto>x) = h (Sd d)\<cdot>x"
 by (drule BufSt_P_unfold [THEN iffD1], auto)
-lemma BufSt_P_d_req: "h:BufSt_P ==> \<exists>hh\<in>BufSt_P.
+lemma BufSt_P_d_req: "h \<in> BufSt_P ==> \<exists>hh\<in>BufSt_P.
                                           h (Sd d)\<cdot>(\<bullet>   \<leadsto>x) = d\<leadsto>(hh \<currency>    \<cdot>x)"
 by (drule BufSt_P_unfold [THEN iffD1], auto)
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/FOCUS/Buffer_adm.thy
--- a/src/HOL/HOLCF/FOCUS/Buffer_adm.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/FOCUS/Buffer_adm.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,29 +10,29 @@
 
 declare enat_0 [simp]
 
-lemma BufAC_Asm_d2: "a\<leadsto>s:BufAC_Asm ==> ? d. a=Md d"
+lemma BufAC_Asm_d2: "a\<leadsto>s \<in> BufAC_Asm \<Longrightarrow> \<exists>d. a=Md d"
 by (drule BufAC_Asm_unfold [THEN iffD1], auto)
 
 lemma BufAC_Asm_d3:
-    "a\<leadsto>b\<leadsto>s:BufAC_Asm ==> ? d. a=Md d & b=\<bullet> & s:BufAC_Asm"
+    "a\<leadsto>b\<leadsto>s \<in> BufAC_Asm \<Longrightarrow> \<exists>d. a=Md d \<and> b=\<bullet> \<and> s \<in> BufAC_Asm"
 by (drule BufAC_Asm_unfold [THEN iffD1], auto)
 
 lemma BufAC_Asm_F_def3:
- "(s:BufAC_Asm_F A) = (s=<> | 
-  (? d. ft\<cdot>s=Def(Md d)) & (rt\<cdot>s=<> | ft\<cdot>(rt\<cdot>s)=Def \<bullet> & rt\<cdot>(rt\<cdot>s):A))"
+ "(s \<in> BufAC_Asm_F A) = (s=<> \<or>
+  (\<exists>d. ft\<cdot>s=Def(Md d)) \<and> (rt\<cdot>s=<> \<or> ft\<cdot>(rt\<cdot>s)=Def \<bullet> \<and> rt\<cdot>(rt\<cdot>s) \<in> A))"
 by (unfold BufAC_Asm_F_def, auto)
 
 lemma cont_BufAC_Asm_F: "inf_continuous BufAC_Asm_F"
 by (auto simp add: inf_continuous_def BufAC_Asm_F_def3)
 
 lemma BufAC_Cmt_F_def3:
- "((s,t):BufAC_Cmt_F C) = (!d x.
-    (s = <>       --> t = <>                   ) & 
-    (s = Md d\<leadsto><>  --> t = <>                   ) & 
-    (s = Md d\<leadsto>\<bullet>\<leadsto>x --> ft\<cdot>t = Def d & (x,rt\<cdot>t):C))"
+ "((s,t) \<in> BufAC_Cmt_F C) = (\<forall>d x.
+    (s = <>       \<longrightarrow> t = <>                   ) \<and>
+    (s = Md d\<leadsto><>  \<longrightarrow> t = <>                   ) \<and>
+    (s = Md d\<leadsto>\<bullet>\<leadsto>x \<longrightarrow> ft\<cdot>t = Def d & (x,rt\<cdot>t) \<in> C))"
 apply (unfold BufAC_Cmt_F_def)
-apply (subgoal_tac "!d x. (s = Md d\<leadsto>\<bullet>\<leadsto>x --> (? y. t = d\<leadsto>y & (x,y):C)) = 
-                     (s = Md d\<leadsto>\<bullet>\<leadsto>x --> ft\<cdot>t = Def d & (x,rt\<cdot>t):C)")
+apply (subgoal_tac "\<forall>d x. (s = Md d\<leadsto>\<bullet>\<leadsto>x \<longrightarrow> (\<exists>y. t = d\<leadsto>y \<and> (x,y) \<in> C)) = 
+                     (s = Md d\<leadsto>\<bullet>\<leadsto>x \<longrightarrow> ft\<cdot>t = Def d \<and> (x,rt\<cdot>t) \<in> C)")
 apply (simp)
 apply (auto intro: surjectiv_scons [symmetric])
 done
@@ -45,12 +45,12 @@
 
 lemma BufAC_Asm_F_stream_monoP: "stream_monoP BufAC_Asm_F"
 apply (unfold BufAC_Asm_F_def stream_monoP_def)
-apply (rule_tac x="{x. (? d. x = Md d\<leadsto>\<bullet>\<leadsto><>)}" in exI)
+apply (rule_tac x="{x. (\<exists>d. x = Md d\<leadsto>\<bullet>\<leadsto><>)}" in exI)
 apply (rule_tac x="Suc (Suc 0)" in exI)
 apply (clarsimp)
 done
 
-lemma adm_BufAC_Asm: "adm (%x. x:BufAC_Asm)"
+lemma adm_BufAC_Asm: "adm (\<lambda>x. x \<in> BufAC_Asm)"
 apply (unfold BufAC_Asm_def)
 apply (rule cont_BufAC_Asm_F [THEN BufAC_Asm_F_stream_monoP [THEN fstream_gfp_admI]])
 done
@@ -61,7 +61,7 @@
 lemma BufAC_Asm_F_stream_antiP: "stream_antiP BufAC_Asm_F"
 apply (unfold stream_antiP_def BufAC_Asm_F_def)
 apply (intro strip)
-apply (rule_tac x="{x. (? d. x = Md d\<leadsto>\<bullet>\<leadsto><>)}" in exI)
+apply (rule_tac x="{x. (\<exists>d. x = Md d\<leadsto>\<bullet>\<leadsto><>)}" in exI)
 apply (rule_tac x="Suc (Suc 0)" in exI)
 apply (rule conjI)
 prefer 2
@@ -71,7 +71,7 @@
 apply (force)+
 done
 
-lemma adm_non_BufAC_Asm: "adm (%u. u~:BufAC_Asm)"
+lemma adm_non_BufAC_Asm: "adm (\<lambda>u. u \<notin> BufAC_Asm)"
 apply (unfold BufAC_Asm_def)
 apply (rule cont_BufAC_Asm_F [THEN BufAC_Asm_F_stream_antiP [THEN fstream_non_gfp_admI]])
 done
@@ -79,7 +79,7 @@
 (**** adm_BufAC ***************************************************************)
 
 (*adm_non_BufAC_Asm*)
-lemma BufAC_Asm_cong [rule_format]: "!f ff. f:BufEq --> ff:BufEq --> s:BufAC_Asm --> f\<cdot>s = ff\<cdot>s"
+lemma BufAC_Asm_cong [rule_format]: "\<forall>f ff. f \<in> BufEq \<longrightarrow> ff \<in> BufEq \<longrightarrow> s \<in> BufAC_Asm \<longrightarrow> f\<cdot>s = ff\<cdot>s"
 apply (rule fstream_ind2)
 apply (simp add: adm_non_BufAC_Asm)
 apply   (force dest: Buf_f_empty)
@@ -92,7 +92,7 @@
 
 (*adm_non_BufAC_Asm,BufAC_Asm_cong*)
 lemma BufAC_Cmt_d_req:
-"!!X. [|f:BufEq; s:BufAC_Asm; (s, f\<cdot>s):BufAC_Cmt|] ==> (a\<leadsto>b\<leadsto>s, f\<cdot>(a\<leadsto>b\<leadsto>s)):BufAC_Cmt"
+"\<And>X. [|f \<in> BufEq; s \<in> BufAC_Asm; (s, f\<cdot>s) \<in> BufAC_Cmt|] ==> (a\<leadsto>b\<leadsto>s, f\<cdot>(a\<leadsto>b\<leadsto>s)) \<in> BufAC_Cmt"
 apply (rule BufAC_Cmt_unfold [THEN iffD2])
 apply (intro strip)
 apply (frule Buf_f_d_req)
@@ -116,9 +116,9 @@
 done
 
 (*adm_BufAC_Asm,BufAC_Asm_antiton,adm_non_BufAC_Asm,BufAC_Asm_cong*)
-lemma BufAC_Cmt_2stream_monoP: "f:BufEq ==> ? l. !i x s. s:BufAC_Asm --> x << s --> enat (l i) < #x --> 
-                     (x,f\<cdot>x):(BufAC_Cmt_F ^^ i) top --> 
-                     (s,f\<cdot>s):(BufAC_Cmt_F ^^ i) top"
+lemma BufAC_Cmt_2stream_monoP: "f \<in> BufEq \<Longrightarrow> \<exists>l. \<forall>i x s. s \<in> BufAC_Asm \<longrightarrow> x << s \<longrightarrow> enat (l i) < #x \<longrightarrow>
+                     (x,f\<cdot>x) \<in> (BufAC_Cmt_F ^^ i) top \<longrightarrow>
+                     (s,f\<cdot>s) \<in> (BufAC_Cmt_F ^^ i) top"
 apply (rule_tac x="%i. 2*i" in exI)
 apply (rule allI)
 apply (induct_tac "i")
@@ -190,7 +190,7 @@
 
 (*adm_BufAC_Asm,BufAC_Asm_antiton,adm_non_BufAC_Asm,BufAC_Asm_cong,
   BufAC_Cmt_2stream_monoP*)
-lemma adm_BufAC: "f:BufEq ==> adm (%s. s:BufAC_Asm --> (s, f\<cdot>s):BufAC_Cmt)"
+lemma adm_BufAC: "f \<in> BufEq \<Longrightarrow> adm (\<lambda>s. s \<in> BufAC_Asm \<longrightarrow> (s, f\<cdot>s) \<in> BufAC_Cmt)"
 apply (rule flatstream_admI)
 apply (subst BufAC_Cmt_iterate_all)
 apply (drule BufAC_Cmt_2stream_monoP)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/FOCUS/FOCUS.thy
--- a/src/HOL/HOLCF/FOCUS/FOCUS.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/FOCUS/FOCUS.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -8,16 +8,16 @@
 imports Fstream
 begin
 
-lemma ex_eqI [intro!]: "? xx. x = xx"
+lemma ex_eqI [intro!]: "\<exists>xx. x = xx"
 by auto
 
-lemma ex2_eqI [intro!]: "? xx yy. x = xx & y = yy"
+lemma ex2_eqI [intro!]: "\<exists>xx yy. x = xx & y = yy"
 by auto
 
 lemma eq_UU_symf: "(UU = f x) = (f x = UU)"
 by auto
 
-lemma fstream_exhaust_slen_eq: "(#x ~= 0) = (? a y. x = a~> y)"
+lemma fstream_exhaust_slen_eq: "(#x \<noteq> 0) = (\<exists>a y. x = a~> y)"
 by (simp add: slen_empty_eq fstream_exhaust_eq)
 
 lemmas [simp] =
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/FOCUS/Fstream.thy
--- a/src/HOL/HOLCF/FOCUS/Fstream.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/FOCUS/Fstream.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -52,7 +52,7 @@
 apply (simp)
 done
 
-lemma fstream_exhaust: "x = UU |  (? a y. x = a~> y)"
+lemma fstream_exhaust: "x = UU \<or> (\<exists>a y. x = a~> y)"
 apply (simp add: fscons_def2)
 apply (cut_tac stream.nchotomy)
 apply (fast dest: not_Undef_is_Def [THEN iffD1])
@@ -65,20 +65,20 @@
 apply fast
 done
 
-lemma fstream_exhaust_eq: "(x ~= UU) = (? a y. x = a~> y)"
+lemma fstream_exhaust_eq: "(x \<noteq> UU) = (\<exists>a y. x = a~> y)"
 apply (simp add: fscons_def2 stream_exhaust_eq)
 apply (fast dest: not_Undef_is_Def [THEN iffD1] elim: DefE)
 done
 
 
-lemma fscons_not_empty [simp]: "a~> s ~= <>"
+lemma fscons_not_empty [simp]: "a~> s \<noteq> <>"
 by (simp add: fscons_def2)
 
 
-lemma fscons_inject [simp]: "(a~> s = b~> t) = (a = b &  s = t)"
+lemma fscons_inject [simp]: "(a~> s = b~> t) = (a = b \<and> s = t)"
 by (simp add: fscons_def2)
 
-lemma fstream_prefix: "a~> s << t ==> ? tt. t = a~> tt &  s << tt"
+lemma fstream_prefix: "a~> s << t ==> \<exists>tt. t = a~> tt \<and> s << tt"
 apply (cases t)
 apply (cut_tac fscons_not_empty)
 apply (fast dest: bottomI)
@@ -86,7 +86,7 @@
 done
 
 lemma fstream_prefix' [simp]:
-        "x << a~> z = (x = <> |  (? y. x = a~> y &  y << z))"
+        "x << a~> z = (x = <> \<or> (\<exists>y. x = a~> y \<and> y << z))"
 apply (simp add: fscons_def2 lift.distinct(2) [THEN stream_prefix'])
 apply (safe)
 apply (erule_tac [!] contrapos_np)
@@ -110,7 +110,7 @@
 lemma rt_fscons [simp]: "rt\<cdot>(m~> s) = s"
 by (simp add: fscons_def)
 
-lemma ft_eq [simp]: "(ft\<cdot>s = Def a) = (? t. s = a~> t)"
+lemma ft_eq [simp]: "(ft\<cdot>s = Def a) = (\<exists>t. s = a~> t)"
 apply (unfold fscons_def)
 apply (simp)
 apply (safe)
@@ -144,13 +144,13 @@
 by (simp add: fscons_def)
 
 lemma slen_fscons_eq:
-        "(enat (Suc n) < #x) = (? a y. x = a~> y & enat n < #y)"
+        "(enat (Suc n) < #x) = (\<exists>a y. x = a~> y \<and> enat n < #y)"
 apply (simp add: fscons_def2 slen_scons_eq)
 apply (fast dest: not_Undef_is_Def [THEN iffD1] elim: DefE)
 done
 
 lemma slen_fscons_eq_rev:
-        "(#x < enat (Suc (Suc n))) = (!a y. x ~= a~> y | #y < enat (Suc n))"
+        "(#x < enat (Suc (Suc n))) = (\<forall>a y. x \<noteq> a~> y \<or> #y < enat (Suc n))"
 apply (simp add: fscons_def2 slen_scons_eq_rev)
 apply (tactic \<open>step_tac (put_claset HOL_cs @{context} addSEs @{thms DefE}) 1\<close>)
 apply (tactic \<open>step_tac (put_claset HOL_cs @{context} addSEs @{thms DefE}) 1\<close>)
@@ -201,7 +201,7 @@
 done
 
 lemma fsfilter_fscons:
-        "A(C)x~> xs = (if x:A then x~> (A(C)xs) else A(C)xs)"
+        "A(C)x~> xs = (if x\<in>A then x~> (A(C)xs) else A(C)xs)"
 apply (unfold fsfilter_def)
 apply (simp add: fscons_def2 If_and_if)
 done
@@ -237,10 +237,10 @@
 done
 
 lemma fstream_lub_lemma:
-      "\<lbrakk>chain Y; (\<Squnion>i. Y i) = a\<leadsto>s\<rbrakk> \<Longrightarrow> (\<exists>j t. Y j = a\<leadsto>t) & (\<exists>X. chain X & (!i. ? j. Y j = a\<leadsto>X i) & (\<Squnion>i. X i) = s)"
+      "\<lbrakk>chain Y; (\<Squnion>i. Y i) = a\<leadsto>s\<rbrakk> \<Longrightarrow> (\<exists>j t. Y j = a\<leadsto>t) \<and> (\<exists>X. chain X \<and> (\<forall>i. \<exists>j. Y j = a\<leadsto>X i) \<and> (\<Squnion>i. X i) = s)"
 apply (frule (1) fstream_lub_lemma1)
 apply (clarsimp)
-apply (rule_tac x="%i. rt\<cdot>(Y(i+j))" in exI)
+apply (rule_tac x="\<lambda>i. rt\<cdot>(Y(i+j))" in exI)
 apply (rule conjI)
 apply  (erule chain_shift [THEN chain_monofun])
 apply safe
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/FOCUS/Stream_adm.thy
--- a/src/HOL/HOLCF/FOCUS/Stream_adm.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/FOCUS/Stream_adm.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -56,15 +56,15 @@
 
 lemma flatstream_adm_lemma:
   assumes 1: "Porder.chain Y"
-  assumes 2: "!i. P (Y i)"
-  assumes 3: "(!!Y. [| Porder.chain Y; !i. P (Y i); !k. ? j. enat k < #((Y j)::'a::flat stream)|]
+  assumes 2: "\<forall>i. P (Y i)"
+  assumes 3: "(\<And>Y. [| Porder.chain Y; \<forall>i. P (Y i); \<forall>k. \<exists>j. enat k < #((Y j)::'a::flat stream)|]
   ==> P(LUB i. Y i))"
   shows "P(LUB i. Y i)"
 apply (rule increasing_chain_adm_lemma [OF 1 2])
 apply (erule 3, assumption)
 apply (erule thin_rl)
 apply (rule allI)
-apply (case_tac "!j. stream_finite (Y j)")
+apply (case_tac "\<forall>j. stream_finite (Y j)")
 apply ( rule chain_incr)
 apply ( rule allI)
 apply ( drule spec)
@@ -78,8 +78,8 @@
 done
 
 (* should be without reference to stream length? *)
-lemma flatstream_admI: "[|(!!Y. [| Porder.chain Y; !i. P (Y i); 
- !k. ? j. enat k < #((Y j)::'a::flat stream)|] ==> P(LUB i. Y i))|]==> adm P"
+lemma flatstream_admI: "[|(\<And>Y. [| Porder.chain Y; \<forall>i. P (Y i); 
+ \<forall>k. \<exists>j. enat k < #((Y j)::'a::flat stream)|] ==> P(LUB i. Y i))|]==> adm P"
 apply (unfold adm_def)
 apply (intro strip)
 apply (erule (1) flatstream_adm_lemma)
@@ -92,8 +92,8 @@
   by (rule order_trans) auto
 
 lemma stream_monoP2I:
-"!!X. stream_monoP F ==> !i. ? l. !x y. 
-  enat l <= #x --> (x::'a::flat stream) << y --> x:(F ^^ i) top --> y:(F ^^ i) top"
+"\<And>X. stream_monoP F \<Longrightarrow> \<forall>i. \<exists>l. \<forall>x y.
+  enat l \<le> #x \<longrightarrow> (x::'a::flat stream) << y --> x \<in> (F ^^ i) top \<longrightarrow> y \<in> (F ^^ i) top"
 apply (unfold stream_monoP_def)
 apply (safe)
 apply (rule_tac x="i*ia" in exI)
@@ -119,9 +119,9 @@
 apply (assumption)
 done
 
-lemma stream_monoP2_gfp_admI: "[| !i. ? l. !x y. 
- enat l <= #x --> (x::'a::flat stream) << y --> x:(F ^^ i) top --> y:(F ^^ i) top;
-    inf_continuous F |] ==> adm (%x. x:gfp F)"
+lemma stream_monoP2_gfp_admI: "[| \<forall>i. \<exists>l. \<forall>x y.
+ enat l \<le> #x \<longrightarrow> (x::'a::flat stream) << y \<longrightarrow> x \<in> (F ^^ i) top \<longrightarrow> y \<in> (F ^^ i) top;
+    inf_continuous F |] ==> adm (\<lambda>x. x \<in> gfp F)"
 apply (erule inf_continuous_gfp[of F, THEN ssubst])
 apply (simp (no_asm))
 apply (rule adm_lemmas)
@@ -143,8 +143,8 @@
 lemmas fstream_gfp_admI = stream_monoP2I [THEN stream_monoP2_gfp_admI]
 
 lemma stream_antiP2I:
-"!!X. [|stream_antiP (F::(('a::flat stream)set => ('a stream set)))|]
-  ==> !i x y. x << y --> y:(F ^^ i) top --> x:(F ^^ i) top"
+"\<And>X. [|stream_antiP (F::(('a::flat stream)set => ('a stream set)))|]
+  ==> \<forall>i x y. x << y \<longrightarrow> y \<in> (F ^^ i) top \<longrightarrow> x \<in> (F ^^ i) top"
 apply (unfold stream_antiP_def)
 apply (rule allI)
 apply (induct_tac "i")
@@ -170,8 +170,8 @@
 done
 
 lemma stream_antiP2_non_gfp_admI:
-"!!X. [|!i x y. x << y --> y:(F ^^ i) top --> x:(F ^^ i) top; inf_continuous F |] 
-  ==> adm (%u. ~ u:gfp F)"
+"\<And>X. [|\<forall>i x y. x << y \<longrightarrow> y \<in> (F ^^ i) top \<longrightarrow> x \<in> (F ^^ i) top; inf_continuous F |]
+  ==> adm (\<lambda>u. \<not> u \<in> gfp F)"
 apply (unfold adm_def)
 apply (simp add: inf_continuous_gfp)
 apply (fast dest!: is_ub_thelub)
@@ -185,17 +185,17 @@
 
 section "antitonP"
 
-lemma antitonPD: "[| antitonP P; y:P; x<<y |] ==> x:P"
+lemma antitonPD: "[| antitonP P; y \<in> P; x<<y |] ==> x \<in> P"
 apply (unfold antitonP_def)
 apply auto
 done
 
-lemma antitonPI: "!x y. y:P --> x<<y --> x:P ==> antitonP P"
+lemma antitonPI: "\<forall>x y. y \<in> P \<longrightarrow> x<<y --> x \<in> P \<Longrightarrow> antitonP P"
 apply (unfold antitonP_def)
 apply (fast)
 done
 
-lemma antitonP_adm_non_P: "antitonP P ==> adm (%u. u~:P)"
+lemma antitonP_adm_non_P: "antitonP P \<Longrightarrow> adm (\<lambda>u. u \<notin> P)"
 apply (unfold adm_def)
 apply (auto dest: antitonPD elim: is_ub_thelub)
 done
@@ -210,7 +210,7 @@
 done
 
 lemma adm_set:
-"{\<Squnion>i. Y i |Y. Porder.chain Y & (\<forall>i. Y i \<in> P)} \<subseteq> P \<Longrightarrow> adm (\<lambda>x. x\<in>P)"
+"{\<Squnion>i. Y i |Y. Porder.chain Y \<and> (\<forall>i. Y i \<in> P)} \<subseteq> P \<Longrightarrow> adm (\<lambda>x. x\<in>P)"
 apply (unfold adm_def)
 apply (fast)
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IMP/Denotational.thy
--- a/src/HOL/HOLCF/IMP/Denotational.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IMP/Denotational.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -11,9 +11,9 @@
 
 definition
   dlift :: "(('a::type) discr -> 'b::pcpo) => ('a lift -> 'b)" where
-  "dlift f = (LAM x. case x of UU => UU | Def y => f\<cdot>(Discr y))"
+  "dlift f = (LAM x. case x of UU \<Rightarrow> UU | Def y \<Rightarrow> f\<cdot>(Discr y))"
 
-primrec D :: "com => state discr -> state lift"
+primrec D :: "com \<Rightarrow> state discr \<rightarrow> state lift"
 where
   "D(SKIP) = (LAM s. Def(undiscr s))"
 | "D(X ::= a) = (LAM s. Def((undiscr s)(X := aval a (undiscr s))))"
@@ -37,7 +37,7 @@
     "(dlift f\<cdot>l = Def y) = (\<exists>x. l = Def x \<and> f\<cdot>(Discr x) = Def y)"
   by (simp add: dlift_def split: lift.split)
 
-lemma eval_implies_D: "(c,s) \<Rightarrow> t ==> D c\<cdot>(Discr s) = (Def t)"
+lemma eval_implies_D: "(c,s) \<Rightarrow> t \<Longrightarrow> D c\<cdot>(Discr s) = (Def t)"
 apply (induct rule: big_step_induct)
       apply (auto)
  apply (subst fix_eq)
@@ -46,7 +46,7 @@
 apply simp
 done
 
-lemma D_implies_eval: "!s t. D c\<cdot>(Discr s) = (Def t) --> (c,s) \<Rightarrow> t"
+lemma D_implies_eval: "\<forall>s t. D c\<cdot>(Discr s) = (Def t) \<longrightarrow> (c,s) \<Rightarrow> t"
 apply (induct c)
     apply fastforce
    apply fastforce
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/ABP/Lemmas.thy
--- a/src/HOL/HOLCF/IOA/ABP/Lemmas.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/ABP/Lemmas.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -8,37 +8,37 @@
 
 subsection \<open>Logic\<close>
 
-lemma and_de_morgan_and_absorbe: "(~(A&B)) = ((~A)&B| ~B)"
+lemma and_de_morgan_and_absorbe: "(\<not>(A\<and>B)) = ((\<not>A)\<and>B\<or> \<not>B)"
   by blast
 
-lemma bool_if_impl_or: "(if C then A else B) --> (A|B)"
+lemma bool_if_impl_or: "(if C then A else B) \<longrightarrow> (A\<or>B)"
   by auto
 
-lemma exis_elim: "(? x. x=P & Q(x)) = Q(P)"
+lemma exis_elim: "(\<exists>x. x=P \<and> Q(x)) = Q(P)"
   by blast
 
 
 subsection \<open>Sets\<close>
 
 lemma set_lemmas:
-    "f(x) : (UN x. {f(x)})"
-    "f x y : (UN x y. {f x y})"
-    "!!a. (!x. a ~= f(x)) ==> a ~: (UN x. {f(x)})"
-    "!!a. (!x y. a ~= f x y) ==> a ~: (UN x y. {f x y})"
+    "f(x) \<in> (\<Union>x. {f(x)})"
+    "f x y \<in> (\<Union>x y. {f x y})"
+    "\<And>a. (\<forall>x. a \<noteq> f(x)) \<Longrightarrow> a \<notin> (\<Union>x. {f(x)})"
+    "\<And>a. (\<forall>x y. a \<noteq> f x y) ==> a \<notin> (\<Union>x y. {f x y})"
   by auto
 
 text \<open>2 Lemmas to add to \<open>set_lemmas\<close>, used also for action handling, 
    namely for Intersections and the empty list (compatibility of IOA!).\<close>
-lemma singleton_set: "(UN b.{x. x=f(b)})= (UN b.{f(b)})"
+lemma singleton_set: "(\<Union>b.{x. x=f(b)}) = (\<Union>b.{f(b)})"
   by blast
 
-lemma de_morgan: "((A|B)=False) = ((~A)&(~B))"
+lemma de_morgan: "((A\<or>B)=False) = ((\<not>A)\<and>(\<not>B))"
   by blast
 
 
 subsection \<open>Lists\<close>
 
-lemma cons_not_nil: "l ~= [] --> (? x xs. l = (x#xs))"
+lemma cons_not_nil: "l \<noteq> [] \<longrightarrow> (\<exists>x xs. l = (x#xs))"
   by (induct l) simp_all
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/CompoExecs.thy
--- a/src/HOL/HOLCF/IOA/CompoExecs.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/CompoExecs.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -213,8 +213,8 @@
 
 theorem compositionality_ex:
   "ex \<in> executions (A \<parallel> B) \<longleftrightarrow>
-    Filter_ex (asig_of A) (ProjA ex) : executions A \<and>
-    Filter_ex (asig_of B) (ProjB ex) : executions B \<and>
+    Filter_ex (asig_of A) (ProjA ex) \<in> executions A \<and>
+    Filter_ex (asig_of B) (ProjB ex) \<in> executions B \<and>
     stutter (asig_of A) (ProjA ex) \<and>
     stutter (asig_of B) (ProjB ex) \<and>
     Forall (\<lambda>x. fst x \<in> act (A \<parallel> B)) (snd ex)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/CompoScheds.thy
--- a/src/HOL/HOLCF/IOA/CompoScheds.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/CompoScheds.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -52,9 +52,9 @@
       schA = fst SchedsA; sigA = snd SchedsA;
       schB = fst SchedsB; sigB = snd SchedsB
      in
-      ({sch. Filter (%a. a:actions sigA)\<cdot>sch : schA} \<inter>
-       {sch. Filter (%a. a:actions sigB)\<cdot>sch : schB} \<inter>
-       {sch. Forall (%x. x:(actions sigA Un actions sigB)) sch},
+      ({sch. Filter (\<lambda>a. a\<in>actions sigA)\<cdot>sch \<in> schA} \<inter>
+       {sch. Filter (\<lambda>a. a\<in>actions sigB)\<cdot>sch \<in> schB} \<inter>
+       {sch. Forall (\<lambda>x. x\<in>(actions sigA Un actions sigB)) sch},
         asig_comp sigA sigB))"
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/CompoTraces.thy
--- a/src/HOL/HOLCF/IOA/CompoTraces.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/CompoTraces.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -185,7 +185,7 @@
   apply simp
   apply (rule Forall_Conc_impl [THEN mp])
   apply (simp add: intA_is_not_actB int_is_act)
-  apply (case_tac "a:act B")
+  apply (case_tac "a\<in>act B")
   text \<open>\<open>a \<notin> A\<close>, \<open>a \<in> B\<close>\<close>
   apply simp
   apply (rule Forall_Conc_impl [THEN mp])
@@ -604,7 +604,7 @@
   apply (frule_tac y = "y2" in sym [THEN eq_imp_below, THEN divide_Seq])
   apply (erule conjE)+
   text \<open>assumption \<open>schA\<close>\<close>
-  apply (drule_tac x = "schA" and g = "Filter (%a. a:act A) \<cdot>rs" in subst_lemma2)
+  apply (drule_tac x = "schA" and g = "Filter (\<lambda>a. a\<in>act A) \<cdot>rs" in subst_lemma2)
   apply assumption
   apply (simp add: int_is_not_ext)
 
@@ -841,10 +841,10 @@
   apply (simp add: intA_is_not_actB int_is_not_ext)
 
   text \<open>conclusions concerning \<open>LastActExtsch\<close>, cannot be rewritten, as \<open>LastActExtsmalli\<close> are looping\<close>
-  apply (drule_tac sch = "schB" and P = "%a. a:int B" in LastActExtsmall1)
+  apply (drule_tac sch = "schB" and P = "\<lambda>a. a\<in>int B" in LastActExtsmall1)
   apply (frule_tac ?sch1.0 = "x1" in LastActExtsmall2)
   apply assumption
-  apply (drule_tac sch = "x2" and P = "%a. a:int A" in LastActExtsmall1)
+  apply (drule_tac sch = "x2" and P = "\<lambda>a. a\<in>int A" in LastActExtsmall1)
 
   text \<open>assumption \<open>Forall schA\<close>, and \<open>Forall schA\<close> are performed by \<open>ForallTL\<close>, \<open>ForallDropwhile\<close>\<close>
   apply (simp add: ForallTL ForallDropwhile)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Abschannel.thy
--- a/src/HOL/HOLCF/IOA/NTP/Abschannel.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Abschannel.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -102,28 +102,28 @@
   trans_of_def asig_projections
 
 lemma in_srch_asig: 
-     "S_msg(m) ~: actions(srch_asig)        &     
-       R_msg(m) ~: actions(srch_asig)        &     
-       S_pkt(pkt) : actions(srch_asig)    &     
-       R_pkt(pkt) : actions(srch_asig)    &     
-       S_ack(b) ~: actions(srch_asig)     &     
-       R_ack(b) ~: actions(srch_asig)     &     
-       C_m_s ~: actions(srch_asig)           &     
-       C_m_r ~: actions(srch_asig)           &     
-       C_r_s ~: actions(srch_asig)  & C_r_r(m) ~: actions(srch_asig)"
+     "S_msg(m) \<notin> actions(srch_asig)        \<and>
+       R_msg(m) \<notin> actions(srch_asig)        \<and>
+       S_pkt(pkt) \<in> actions(srch_asig)    \<and>
+       R_pkt(pkt) \<in> actions(srch_asig)    \<and>     
+       S_ack(b) \<notin> actions(srch_asig)     \<and>     
+       R_ack(b) \<notin> actions(srch_asig)     \<and>     
+       C_m_s \<notin> actions(srch_asig)           \<and>     
+       C_m_r \<notin> actions(srch_asig)           \<and>     
+       C_r_s \<notin> actions(srch_asig)  & C_r_r(m) \<notin> actions(srch_asig)"
   by (simp add: unfold_renaming)
 
 lemma in_rsch_asig: 
-      "S_msg(m) ~: actions(rsch_asig)         &  
-       R_msg(m) ~: actions(rsch_asig)         &  
-       S_pkt(pkt) ~: actions(rsch_asig)    &  
-       R_pkt(pkt) ~: actions(rsch_asig)    &  
-       S_ack(b) : actions(rsch_asig)       &  
-       R_ack(b) : actions(rsch_asig)       &  
-       C_m_s ~: actions(rsch_asig)            &  
-       C_m_r ~: actions(rsch_asig)            &  
-       C_r_s ~: actions(rsch_asig)            &  
-       C_r_r(m) ~: actions(rsch_asig)"
+      "S_msg(m) \<notin> actions(rsch_asig)         \<and>
+       R_msg(m) \<notin> actions(rsch_asig)         \<and>
+       S_pkt(pkt) \<notin> actions(rsch_asig)    \<and>
+       R_pkt(pkt) \<notin> actions(rsch_asig)    \<and>
+       S_ack(b) \<in> actions(rsch_asig)       \<and>
+       R_ack(b) \<in> actions(rsch_asig)       \<and>
+       C_m_s \<notin> actions(rsch_asig)            \<and>
+       C_m_r \<notin> actions(rsch_asig)            \<and>
+       C_r_s \<notin> actions(rsch_asig)            \<and>
+       C_r_r(m) \<notin> actions(rsch_asig)"
   by (simp add: unfold_renaming)
 
 lemma srch_ioa_thm: "srch_ioa =  
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Correctness.thy
--- a/src/HOL/HOLCF/IOA/NTP/Correctness.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Correctness.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -27,18 +27,18 @@
 \<close>
 
 lemma externals_lemma: 
- "a:externals(asig_of(Automata.restrict impl_ioa (externals spec_sig))) =  
+ "a\<in>externals(asig_of(Automata.restrict impl_ioa (externals spec_sig))) =  
   (case a of                   
-      S_msg(m) => True         
-    | R_msg(m) => True         
-    | S_pkt(pkt) => False   
-    | R_pkt(pkt) => False   
-    | S_ack(b) => False     
-    | R_ack(b) => False     
-    | C_m_s => False           
-    | C_m_r => False           
-    | C_r_s => False           
-    | C_r_r(m) => False)"
+      S_msg(m) \<Rightarrow> True         
+    | R_msg(m) \<Rightarrow> True         
+    | S_pkt(pkt) \<Rightarrow> False   
+    | R_pkt(pkt) \<Rightarrow> False   
+    | S_ack(b) \<Rightarrow> False     
+    | R_ack(b) \<Rightarrow> False     
+    | C_m_s \<Rightarrow> False           
+    | C_m_r \<Rightarrow> False           
+    | C_r_s \<Rightarrow> False           
+    | C_r_r(m) \<Rightarrow> False)"
  apply (simp (no_asm) add: externals_def restrict_def restrict_asig_def Spec.sig_def asig_projections)
 
   apply (induct_tac "a")
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Impl.thy
--- a/src/HOL/HOLCF/IOA/NTP/Impl.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Impl.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -28,9 +28,9 @@
 
 (* Lemma 5.1 *)
 definition
-  "inv1(s) ==
-     (!b. count (rsent(rec s)) b = count (srcvd(sen s)) b + count (rsch s) b)
-   & (!b. count (ssent(sen s)) b
+  "inv1(s) \<equiv>
+     (\<forall>b. count (rsent(rec s)) b = count (srcvd(sen s)) b + count (rsch s) b)
+   \<and> (\<forall>b. count (ssent(sen s)) b
           = hdr_sum (rrcvd(rec s)) b + hdr_sum (srch s) b)"
 
 (* Lemma 5.2 *)
@@ -48,12 +48,12 @@
 
 (* Lemma 5.3 *)
 definition
-  "inv3(s) ==
+  "inv3(s) \<equiv>
    rbit(rec(s)) = sbit(sen(s))
-   --> (!m. sq(sen(s))=[] | m ~= hd(sq(sen(s)))
-        -->  count (rrcvd(rec s)) (sbit(sen(s)),m)
+   \<longrightarrow> (\<forall>m. sq(sen(s))=[] | m \<noteq> hd(sq(sen(s)))
+        \<longrightarrow>  count (rrcvd(rec s)) (sbit(sen(s)),m)
              + count (srch s) (sbit(sen(s)),m)
-            <= count (rsent(rec s)) (~sbit(sen s)))"
+            \<le> count (rsent(rec s)) (~sbit(sen s)))"
 
 (* Lemma 5.4 *)
 definition "inv4(s) == rbit(rec(s)) = (~sbit(sen(s))) --> sq(sen(s)) ~= []"
@@ -85,10 +85,10 @@
   by (simp_all add: sen_def rec_def srch_def rsch_def)
 
 lemma [simp]:
-  "a:actions(sender_asig)
-  | a:actions(receiver_asig)
-  | a:actions(srch_asig)
-  | a:actions(rsch_asig)"
+  "a\<in>actions(sender_asig)
+  \<or> a\<in>actions(receiver_asig)
+  \<or> a\<in>actions(srch_asig)
+  \<or> a\<in>actions(rsch_asig)"
   by (induct a) simp_all
 
 declare split_paired_All [simp del]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Lemmas.thy
--- a/src/HOL/HOLCF/IOA/NTP/Lemmas.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Lemmas.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -8,17 +8,17 @@
 
 subsubsection \<open>Logic\<close>
 
-lemma neg_flip: "(X = (~ Y)) = ((~X) = Y)"
+lemma neg_flip: "(X = (\<not> Y)) = ((\<not>X) = Y)"
   by blast
 
 
 subsection \<open>Sets\<close>
 
 lemma set_lemmas:
-  "f(x) : (UN x. {f(x)})"
-  "f x y : (UN x y. {f x y})"
-  "!!a. (!x. a ~= f(x)) ==> a ~: (UN x. {f(x)})"
-  "!!a. (!x y. a ~= f x y) ==> a ~: (UN x y. {f x y})"
+  "f(x) \<in> (\<Union>x. {f(x)})"
+  "f x y \<in> (\<Union>x y. {f x y})"
+  "\<And>a. (\<forall>x. a \<noteq> f(x)) \<Longrightarrow> a \<notin> (\<Union>x. {f(x)})"
+  "\<And>a. (\<forall>x y. a \<noteq> f x y) \<Longrightarrow> a \<notin> (\<Union>x y. {f x y})"
   by auto
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Multiset.thy
--- a/src/HOL/HOLCF/IOA/NTP/Multiset.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Multiset.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -60,7 +60,7 @@
 apply simp
 done
 
-lemma countm_props: "!!M. (!x. P(x) --> Q(x)) ==> (countm M P <= countm M Q)"
+lemma countm_props: "\<And>M. (\<forall>x. P(x) \<longrightarrow> Q(x)) \<Longrightarrow> (countm M P \<le> countm M Q)"
 apply (rule_tac M = "M" in Multiset.induction)
  apply (simp (no_asm) add: Multiset.countm_empty_def)
 apply (simp (no_asm) add: Multiset.countm_nonempty_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Packet.thy
--- a/src/HOL/HOLCF/IOA/NTP/Packet.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Packet.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,16 +10,16 @@
   'msg packet = "bool * 'msg"
 
 definition
-  hdr :: "'msg packet => bool" where
-  "hdr == fst"
+  hdr :: "'msg packet \<Rightarrow> bool" where
+  "hdr \<equiv> fst"
 
 definition
-  msg :: "'msg packet => 'msg" where
-  "msg == snd"
+  msg :: "'msg packet \<Rightarrow> 'msg" where
+  "msg \<equiv> snd"
 
 
 text \<open>Instantiation of a tautology?\<close>
-lemma eq_packet_imp_eq_hdr: "!x. x = packet --> hdr(x) = hdr(packet)"
+lemma eq_packet_imp_eq_hdr: "\<forall>x. x = packet \<longrightarrow> hdr(x) = hdr(packet)"
   by simp
 
 declare hdr_def [simp] msg_def [simp]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Receiver.thy
--- a/src/HOL/HOLCF/IOA/NTP/Receiver.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Receiver.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -79,16 +79,16 @@
     (receiver_asig, {([],{|},{|},False,False)}, receiver_trans,{},{})"
 
 lemma in_receiver_asig:
-  "S_msg(m) ~: actions(receiver_asig)"
-  "R_msg(m) : actions(receiver_asig)"
-  "S_pkt(pkt) ~: actions(receiver_asig)"
-  "R_pkt(pkt) : actions(receiver_asig)"
-  "S_ack(b) : actions(receiver_asig)"
-  "R_ack(b) ~: actions(receiver_asig)"
-  "C_m_s ~: actions(receiver_asig)"
-  "C_m_r : actions(receiver_asig)"
-  "C_r_s ~: actions(receiver_asig)"
-  "C_r_r(m) : actions(receiver_asig)"
+  "S_msg(m) \<notin> actions(receiver_asig)"
+  "R_msg(m) \<in> actions(receiver_asig)"
+  "S_pkt(pkt) \<notin> actions(receiver_asig)"
+  "R_pkt(pkt) \<in> actions(receiver_asig)"
+  "S_ack(b) \<in> actions(receiver_asig)"
+  "R_ack(b) \<notin> actions(receiver_asig)"
+  "C_m_s \<notin> actions(receiver_asig)"
+  "C_m_r \<in> actions(receiver_asig)"
+  "C_r_s \<notin> actions(receiver_asig)"
+  "C_r_r(m) \<in> actions(receiver_asig)"
   by (simp_all add: receiver_asig_def actions_def asig_projections)
 
 lemmas receiver_projections = rq_def rsent_def rrcvd_def rbit_def rsending_def
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Sender.thy
--- a/src/HOL/HOLCF/IOA/NTP/Sender.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Sender.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -31,41 +31,41 @@
           t = snd(snd(tr))
       in case fst(snd(tr))
       of
-      S_msg(m) => sq(t)=sq(s)@[m]   &
-                  ssent(t)=ssent(s) &
-                  srcvd(t)=srcvd(s) &
-                  sbit(t)=sbit(s)   &
+      S_msg(m) => sq(t)=sq(s)@[m]   \<and>
+                  ssent(t)=ssent(s) \<and>
+                  srcvd(t)=srcvd(s) \<and>
+                  sbit(t)=sbit(s)   \<and>
                   ssending(t)=ssending(s) |
       R_msg(m) => False |
-      S_pkt(pkt) => hdr(pkt) = sbit(s)      &
-                       (? Q. sq(s) = (msg(pkt)#Q))  &
-                       sq(t) = sq(s)           &
-                       ssent(t) = addm (ssent s) (sbit s) &
-                       srcvd(t) = srcvd(s) &
-                       sbit(t) = sbit(s)   &
-                       ssending(s)         &
+      S_pkt(pkt) => hdr(pkt) = sbit(s)      \<and>
+                       (\<exists>Q. sq(s) = (msg(pkt)#Q))  \<and>
+                       sq(t) = sq(s)           \<and>
+                       ssent(t) = addm (ssent s) (sbit s) \<and>
+                       srcvd(t) = srcvd(s) \<and>
+                       sbit(t) = sbit(s)   \<and>
+                       ssending(s)         \<and>
                        ssending(t) |
     R_pkt(pkt) => False |
     S_ack(b)   => False |
-      R_ack(b) => sq(t)=sq(s)                  &
-                     ssent(t)=ssent(s)            &
-                     srcvd(t) = addm (srcvd s) b  &
-                     sbit(t)=sbit(s)              &
+      R_ack(b) => sq(t)=sq(s)                  \<and>
+                     ssent(t)=ssent(s)            \<and>
+                     srcvd(t) = addm (srcvd s) b  \<and>
+                     sbit(t)=sbit(s)              \<and>
                      ssending(t)=ssending(s) |
-      C_m_s => count (ssent s) (~sbit s) < count (srcvd s) (~sbit s) &
-               sq(t)=sq(s)       &
-               ssent(t)=ssent(s) &
-               srcvd(t)=srcvd(s) &
-               sbit(t)=sbit(s)   &
-               ssending(s)       &
+      C_m_s => count (ssent s) (~sbit s) < count (srcvd s) (~sbit s) \<and>
+               sq(t)=sq(s)       \<and>
+               ssent(t)=ssent(s) \<and>
+               srcvd(t)=srcvd(s) \<and>
+               sbit(t)=sbit(s)   \<and>
+               ssending(s)       \<and>
                ~ssending(t) |
       C_m_r => False |
-      C_r_s => count (ssent s) (sbit s) <= count (srcvd s) (~sbit s) &
-               sq(t)=tl(sq(s))      &
-               ssent(t)=ssent(s)    &
-               srcvd(t)=srcvd(s)    &
-               sbit(t) = (~sbit(s)) &
-               ~ssending(s)         &
+      C_r_s => count (ssent s) (sbit s) <= count (srcvd s) (~sbit s) \<and>
+               sq(t)=tl(sq(s))      \<and>
+               ssent(t)=ssent(s)    \<and>
+               srcvd(t)=srcvd(s)    \<and>
+               sbit(t) = (~sbit(s)) \<and>
+               ~ssending(s)         \<and>
                ssending(t) |
       C_r_r(m) => False}"
 
@@ -74,17 +74,17 @@
   "sender_ioa =
    (sender_asig, {([],{|},{|},False,True)}, sender_trans,{},{})"
 
-lemma in_sender_asig: 
-  "S_msg(m) : actions(sender_asig)"
-  "R_msg(m) ~: actions(sender_asig)"
-  "S_pkt(pkt) : actions(sender_asig)"
-  "R_pkt(pkt) ~: actions(sender_asig)"
-  "S_ack(b) ~: actions(sender_asig)"
-  "R_ack(b) : actions(sender_asig)"
-  "C_m_s : actions(sender_asig)"
-  "C_m_r ~: actions(sender_asig)"
-  "C_r_s : actions(sender_asig)"
-  "C_r_r(m) ~: actions(sender_asig)"
+lemma in_sender_asig:
+  "S_msg(m) \<in> actions(sender_asig)"
+  "R_msg(m) \<notin> actions(sender_asig)"
+  "S_pkt(pkt) \<in> actions(sender_asig)"
+  "R_pkt(pkt) \<notin> actions(sender_asig)"
+  "S_ack(b) \<notin> actions(sender_asig)"
+  "R_ack(b) \<in> actions(sender_asig)"
+  "C_m_s \<in> actions(sender_asig)"
+  "C_m_r \<notin> actions(sender_asig)"
+  "C_r_s \<in> actions(sender_asig)"
+  "C_r_r(m) \<notin> actions(sender_asig)"
   by (simp_all add: sender_asig_def actions_def asig_projections)
 
 lemmas sender_projections = sq_def ssent_def srcvd_def sbit_def ssending_def
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/NTP/Spec.thy
--- a/src/HOL/HOLCF/IOA/NTP/Spec.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/NTP/Spec.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,8 +10,8 @@
 
 definition
   spec_sig :: "'m action signature" where
-  sig_def: "spec_sig = (UN m.{S_msg(m)}, 
-                        UN m.{R_msg(m)}, 
+  sig_def: "spec_sig = (\<Union>m.{S_msg(m)}, 
+                        \<Union>m.{R_msg(m)}, 
                         {})"
 
 definition
@@ -22,16 +22,16 @@
         in                                          
         case fst(snd(tr))                           
         of                                          
-        S_msg(m) => t = s@[m]  |                    
-        R_msg(m) => s = (m#t)  |                    
-        S_pkt(pkt) => False |                    
-        R_pkt(pkt) => False |                    
-        S_ack(b) => False |                      
-        R_ack(b) => False |                      
-        C_m_s => False |                            
-        C_m_r => False |                            
-        C_r_s => False |                            
-        C_r_r(m) => False}"
+        S_msg(m) \<Rightarrow> t = s@[m]  |                    
+        R_msg(m) \<Rightarrow> s = (m#t)  |                    
+        S_pkt(pkt) \<Rightarrow> False |                    
+        R_pkt(pkt) \<Rightarrow> False |                    
+        S_ack(b) \<Rightarrow> False |                      
+        R_ack(b) \<Rightarrow> False |                      
+        C_m_s \<Rightarrow> False |                            
+        C_m_r \<Rightarrow> False |                            
+        C_r_s \<Rightarrow> False |                            
+        C_r_r(m) \<Rightarrow> False}"
 
 definition
   spec_ioa :: "('m action, 'm list)ioa" where
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/RefCorrectness.thy
--- a/src/HOL/HOLCF/IOA/RefCorrectness.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/RefCorrectness.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -147,7 +147,7 @@
 
 lemma move_subprop3:
   "is_ref_map f C A \<Longrightarrow> reachable C s \<Longrightarrow> (s, a, t) \<in> trans_of C \<Longrightarrow>
-     laststate (f s,@x. move A x (f s) a (f t)) = (f t)"
+     laststate (f s, SOME x. move A x (f s) a (f t)) = (f t)"
   apply (cut_tac move_is_move)
   defer
   apply assumption+
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/SimCorrectness.thy
--- a/src/HOL/HOLCF/IOA/SimCorrectness.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/SimCorrectness.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -223,7 +223,7 @@
 \<close>
 
 lemma simulation_starts:
-  "is_simulation R C A \<Longrightarrow> s:starts_of C \<Longrightarrow>
+  "is_simulation R C A \<Longrightarrow> s\<in>starts_of C \<Longrightarrow>
     let S' = SOME s'. (s, s') \<in> R \<and> s' \<in> starts_of A
     in (s, S') \<in> R \<and> S' \<in> starts_of A"
   apply (simp add: is_simulation_def corresp_ex_sim_def Int_non_empty Image_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/Simulations.thy
--- a/src/HOL/HOLCF/IOA/Simulations.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/Simulations.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -38,11 +38,11 @@
 
 definition is_history_relation :: "('s1 \<times> 's2) set \<Rightarrow> ('a, 's1) ioa \<Rightarrow> ('a, 's2) ioa \<Rightarrow> bool"
   where "is_history_relation R C A \<longleftrightarrow>
-    is_simulation R C A \<and> is_ref_map (\<lambda>x. (SOME y. (x, y) \<in> R^-1)) A C"
+    is_simulation R C A \<and> is_ref_map (\<lambda>x. (SOME y. (x, y) \<in> R\<inverse>)) A C"
 
 definition is_prophecy_relation :: "('s1 \<times> 's2) set \<Rightarrow> ('a, 's1) ioa \<Rightarrow> ('a, 's2) ioa \<Rightarrow> bool"
   where "is_prophecy_relation R C A \<longleftrightarrow>
-    is_backward_simulation R C A \<and> is_ref_map (\<lambda>x. (SOME y. (x, y) \<in> R^-1)) A C"
+    is_backward_simulation R C A \<and> is_ref_map (\<lambda>x. (SOME y. (x, y) \<in> R\<inverse>)) A C"
 
 
 lemma set_non_empty: "A \<noteq> {} \<longleftrightarrow> (\<exists>x. x \<in> A)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/Storage/Action.thy
--- a/src/HOL/HOLCF/IOA/Storage/Action.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/Storage/Action.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,7 +10,7 @@
 
 datatype action = New | Loc nat | Free nat
 
-lemma [cong]: "!!x. x = y ==> case_action a b c x = case_action a b c y"
+lemma [cong]: "\<And>x. x = y \<Longrightarrow> case_action a b c x = case_action a b c y"
   by simp
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/Storage/Correctness.thy
--- a/src/HOL/HOLCF/IOA/Storage/Correctness.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/Storage/Correctness.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -16,7 +16,7 @@
                             k = fst c;   b = snd c;
                             used = fst a; c = snd a
                         in
-                        (! l:used. l < k) & b=c}"
+                        (\<forall>l\<in>used. l < k) \<and> b=c}"
 
 declare split_paired_Ex [simp del]
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/Storage/Impl.thy
--- a/src/HOL/HOLCF/IOA/Storage/Impl.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/Storage/Impl.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,8 +10,8 @@
 
 definition
   impl_sig :: "action signature" where
-  "impl_sig = (UN l.{Free l} Un {New},
-               UN l.{Loc l},
+  "impl_sig = (\<Union>l.{Free l} \<union> {New},
+               \<Union>l.{Loc l},
                {})"
 
 definition
@@ -22,18 +22,18 @@
          in
          case fst(snd(tr))
          of
-         New       => k' = k & b'  |
-         Loc l     => b & l= k & k'= (Suc k) & ~b' |
-         Free l    => k'=k & b'=b}"
+         New       \<Rightarrow> k' = k \<and> b'  |
+         Loc l     \<Rightarrow> b \<and> l= k \<and> k'= (Suc k) \<and> \<not>b' |
+         Free l    \<Rightarrow> k'=k \<and> b'=b}"
 
 definition
   impl_ioa :: "(action, nat * bool)ioa" where
   "impl_ioa = (impl_sig, {(0,False)}, impl_trans,{},{})"
 
 lemma in_impl_asig:
-  "New : actions(impl_sig) &
-    Loc l : actions(impl_sig) &
-    Free l : actions(impl_sig) "
+  "New \<in> actions(impl_sig) \<and>
+    Loc l \<in> actions(impl_sig) \<and>
+    Free l \<in> actions(impl_sig) "
   by (simp add: impl_sig_def actions_def asig_projections)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/IOA/Storage/Spec.thy
--- a/src/HOL/HOLCF/IOA/Storage/Spec.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/IOA/Storage/Spec.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,24 +10,24 @@
 
 definition
   spec_sig :: "action signature" where
-  "spec_sig = (UN l.{Free l} Un {New},
-               UN l.{Loc l},
+  "spec_sig = (\<Union>l.{Free l} \<union> {New},
+               \<Union>l.{Loc l},
                {})"
 
 definition
-  spec_trans :: "(action, nat set * bool)transition set" where
+  spec_trans :: "(action, nat set \<times> bool)transition set" where
   "spec_trans =
    {tr. let s = fst(tr); used = fst s; c = snd s;
             t = snd(snd(tr)); used' = fst t; c' = snd t
         in
         case fst(snd(tr))
         of
-        New       => used' = used & c'  |
-        Loc l     => c & l~:used  & used'= used Un {l} & ~c'   |
-        Free l    => used'=used - {l} & c'=c}"
+        New       \<Rightarrow> used' = used \<and> c'  |
+        Loc l     \<Rightarrow> c \<and> l \<notin> used \<and> used'= used \<union> {l} \<and> \<not>c'   |
+        Free l    \<Rightarrow> used'=used - {l} \<and> c'=c}"
 
 definition
-  spec_ioa :: "(action, nat set * bool)ioa" where
+  spec_ioa :: "(action, nat set \<times> bool)ioa" where
   "spec_ioa = (spec_sig, {({},False)}, spec_trans,{},{})"
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/Library/Stream.thy
--- a/src/HOL/HOLCF/Library/Stream.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/Library/Stream.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -361,7 +361,7 @@
 lemma slen_empty_eq: "(#x = 0) = (x = \<bottom>)"
 by (cases x) auto
 
-lemma slen_scons_eq: "(enat (Suc n) < #x) = (? a y. x = a && y \<and> a \<noteq> \<bottom> \<and> enat n < #y)"
+lemma slen_scons_eq: "(enat (Suc n) < #x) = (\<exists>a y. x = a && y \<and> a \<noteq> \<bottom> \<and> enat n < #y)"
 apply (auto, case_tac "x=UU",auto)
 apply (drule stream_exhaust_eq [THEN iffD1], auto)
 apply (case_tac "#y") apply simp_all
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/Tools/Domain/domain_induction.ML
--- a/src/HOL/HOLCF/Tools/Domain/domain_induction.ML	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/Tools/Domain/domain_induction.ML	Thu Feb 15 13:04:36 2018 +0100
@@ -91,7 +91,7 @@
 (******************************************************************************)
 
 val case_UU_allI =
-    @{lemma "(!!x. x ~= UU ==> P x) ==> P UU ==> ALL x. P x" by metis}
+    @{lemma "(\<And>x. x \<noteq> UU \<Longrightarrow> P x) \<Longrightarrow> P UU \<Longrightarrow> \<forall>x. P x" by metis}
 
 fun prove_induction
     (comp_dbind : binding)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/HOLCF/ex/Loop.thy
--- a/src/HOL/HOLCF/ex/Loop.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/HOLCF/ex/Loop.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -75,7 +75,7 @@
 (* properties of while and iterations                                        *)
 (* ------------------------------------------------------------------------- *)
 
-lemma loop_lemma1: "\<lbrakk>EX y. b\<cdot>y = FF; iterate k\<cdot>(step\<cdot>b\<cdot>g)\<cdot>x = UU\<rbrakk>
+lemma loop_lemma1: "\<lbrakk>\<exists>y. b\<cdot>y = FF; iterate k\<cdot>(step\<cdot>b\<cdot>g)\<cdot>x = UU\<rbrakk>
      \<Longrightarrow> iterate(Suc k)\<cdot>(step\<cdot>b\<cdot>g)\<cdot>x = UU"
 apply (simp (no_asm))
 apply (rule trans)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hilbert_Choice.thy
--- a/src/HOL/Hilbert_Choice.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hilbert_Choice.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -144,7 +144,7 @@
 lemma inv_f_f: "inj f \<Longrightarrow> inv f (f x) = x"
   by simp
 
-lemma f_inv_into_f: "y : f`A \<Longrightarrow> f (inv_into A f y) = y"
+lemma f_inv_into_f: "y \<in> f`A \<Longrightarrow> f (inv_into A f y) = y"
   by (simp add: inv_into_def) (fast intro: someI2)
 
 lemma inv_into_f_eq: "inj_on f A \<Longrightarrow> x \<in> A \<Longrightarrow> f x = y \<Longrightarrow> inv_into A f y = x"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Arith2.thy
--- a/src/HOL/Hoare/Arith2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Arith2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -9,13 +9,13 @@
 imports Main
 begin
 
-definition cd :: "[nat, nat, nat] => bool"
-  where "cd x m n \<longleftrightarrow> x dvd m & x dvd n"
+definition cd :: "[nat, nat, nat] \<Rightarrow> bool"
+  where "cd x m n \<longleftrightarrow> x dvd m \<and> x dvd n"
 
-definition gcd :: "[nat, nat] => nat"
-  where "gcd m n = (SOME x. cd x m n & (!y.(cd y m n) --> y<=x))"
+definition gcd :: "[nat, nat] \<Rightarrow> nat"
+  where "gcd m n = (SOME x. cd x m n & (\<forall>y.(cd y m n) \<longrightarrow> y\<le>x))"
 
-primrec fac :: "nat => nat"
+primrec fac :: "nat \<Rightarrow> nat"
 where
   "fac 0 = Suc 0"
 | "fac (Suc n) = Suc n * fac n"
@@ -23,7 +23,7 @@
 
 subsubsection \<open>cd\<close>
 
-lemma cd_nnn: "0<n ==> cd n n n"
+lemma cd_nnn: "0<n \<Longrightarrow> cd n n n"
   apply (simp add: cd_def)
   done
 
@@ -37,12 +37,12 @@
   apply blast
   done
 
-lemma cd_diff_l: "n<=m ==> cd x m n = cd x (m-n) n"
+lemma cd_diff_l: "n\<le>m \<Longrightarrow> cd x m n = cd x (m-n) n"
   apply (unfold cd_def)
   apply (fastforce dest: dvd_diffD)
   done
 
-lemma cd_diff_r: "m<=n ==> cd x m n = cd x m (n-m)"
+lemma cd_diff_r: "m\<le>n \<Longrightarrow> cd x m n = cd x m (n-m)"
   apply (unfold cd_def)
   apply (fastforce dest: dvd_diffD)
   done
@@ -50,7 +50,7 @@
 
 subsubsection \<open>gcd\<close>
 
-lemma gcd_nnn: "0<n ==> n = gcd n n"
+lemma gcd_nnn: "0<n \<Longrightarrow> n = gcd n n"
   apply (unfold gcd_def)
   apply (frule cd_nnn)
   apply (rule some_equality [symmetric])
@@ -62,17 +62,17 @@
   apply (simp add: gcd_def cd_swap)
   done
 
-lemma gcd_diff_l: "n<=m ==> gcd m n = gcd (m-n) n"
+lemma gcd_diff_l: "n\<le>m \<Longrightarrow> gcd m n = gcd (m-n) n"
   apply (unfold gcd_def)
-  apply (subgoal_tac "n<=m ==> !x. cd x m n = cd x (m-n) n")
+  apply (subgoal_tac "n\<le>m \<Longrightarrow> \<forall>x. cd x m n = cd x (m-n) n")
   apply simp
   apply (rule allI)
   apply (erule cd_diff_l)
   done
 
-lemma gcd_diff_r: "m<=n ==> gcd m n = gcd m (n-m)"
+lemma gcd_diff_r: "m\<le>n \<Longrightarrow> gcd m n = gcd m (n-m)"
   apply (unfold gcd_def)
-  apply (subgoal_tac "m<=n ==> !x. cd x m n = cd x m (n-m) ")
+  apply (subgoal_tac "m\<le>n \<Longrightarrow> \<forall>x. cd x m n = cd x m (n-m) ")
   apply simp
   apply (rule allI)
   apply (erule cd_diff_r)
@@ -82,7 +82,7 @@
 subsubsection \<open>pow\<close>
 
 lemma sq_pow_div2 [simp]:
-    "m mod 2 = 0 ==> ((n::nat)*n)^(m div 2) = n^m"
+    "m mod 2 = 0 \<Longrightarrow> ((n::nat)*n)^(m div 2) = n^m"
   apply (simp add: power2_eq_square [symmetric] power_mult [symmetric] minus_mod_eq_mult_div [symmetric])
   done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Examples.thy
--- a/src/HOL/Hoare/Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -12,29 +12,29 @@
 subsection \<open>multiplication by successive addition\<close>
 
 lemma multiply_by_add: "VARS m s a b
-  {a=A & b=B}
+  {a=A \<and> b=B}
   m := 0; s := 0;
-  WHILE m~=a
-  INV {s=m*b & a=A & b=B}
+  WHILE m\<noteq>a
+  INV {s=m*b \<and> a=A \<and> b=B}
   DO s := s+b; m := m+(1::nat) OD
   {s = A*B}"
 by vcg_simp
 
 lemma multiply_by_add_time: "VARS m s a b t
-  {a=A & b=B & t=0}
+  {a=A \<and> b=B \<and> t=0}
   m := 0; t := t+1; s := 0; t := t+1;
-  WHILE m~=a
-  INV {s=m*b & a=A & b=B & t = 2*m + 2}
+  WHILE m\<noteq>a
+  INV {s=m*b \<and> a=A \<and> b=B \<and> t = 2*m + 2}
   DO s := s+b; t := t+1; m := m+(1::nat); t := t+1 OD
   {s = A*B \<and> t = 2*A + 2}"
 by vcg_simp
 
 lemma multiply_by_add2: "VARS M N P :: int
- {m=M & n=N}
+ {m=M \<and> n=N}
  IF M < 0 THEN M := -M; N := -N ELSE SKIP FI;
  P := 0;
  WHILE 0 < M
- INV {0 <= M & (EX p. p = (if m<0 then -m else m) & p*N = m*n & P = (p-M)*N)}
+ INV {0 \<le> M \<and> (\<exists>p. p = (if m<0 then -m else m) & p*N = m*n & P = (p-M)*N)}
  DO P := P+N; M := M - 1 OD
  {P = m*n}"
 apply vcg_simp
@@ -42,11 +42,11 @@
 done
 
 lemma multiply_by_add2_time: "VARS M N P t :: int
- {m=M & n=N & t=0}
+ {m=M \<and> n=N \<and> t=0}
  IF M < 0 THEN M := -M; t := t+1; N := -N; t := t+1 ELSE SKIP FI;
  P := 0; t := t+1;
  WHILE 0 < M
- INV {0 \<le> M & (EX p. p = (if m<0 then -m else m) & p*N = m*n & P = (p-M)*N & t \<ge> 0 & t \<le> 2*(p-M)+3)}
+ INV {0 \<le> M & (\<exists>p. p = (if m<0 then -m else m) & p*N = m*n & P = (p-M)*N & t \<ge> 0 & t \<le> 2*(p-M)+3)}
  DO P := P+N; t := t+1; M := M - 1; t := t+1 OD
  {P = m*n & t \<le> 2*abs m + 3}"
 apply vcg_simp
@@ -283,11 +283,11 @@
 lemma zero_search: "VARS A i
  {True}
  i := 0;
- WHILE i < length A & A!i ~= key
- INV {!j. j<i --> A!j ~= key}
+ WHILE i < length A & A!i \<noteq> key
+ INV {\<forall>j. j<i --> A!j \<noteq> key}
  DO i := i+1 OD
  {(i < length A --> A!i = key) &
-  (i = length A --> (!j. j < length A --> A!j ~= key))}"
+  (i = length A --> (\<forall>j. j < length A \<longrightarrow> A!j \<noteq> key))}"
 apply vcg_simp
 apply(blast elim!: less_SucE)
 done
@@ -295,11 +295,11 @@
 lemma zero_search_time: "VARS A i t
  {t=0}
  i := 0; t := t+1;
- WHILE i < length A & A!i ~= key
- INV {(\<forall>j. j<i --> A!j ~= key) & i \<le> length A & t = i+1}
+ WHILE i < length A \<and> A!i \<noteq> key
+ INV {(\<forall>j. j<i \<longrightarrow> A!j \<noteq> key) \<and> i \<le> length A \<and> t = i+1}
  DO i := i+1; t := t+1 OD
- {(i < length A --> A!i = key) &
-  (i = length A --> (!j. j < length A --> A!j ~= key)) & t \<le> length A + 1}"
+ {(i < length A \<longrightarrow> A!i = key) \<and>
+  (i = length A \<longrightarrow> (\<forall>j. j < length A --> A!j \<noteq> key)) \<and> t \<le> length A + 1}"
 apply vcg_simp
 apply(blast elim!: less_SucE)
 done
@@ -318,22 +318,22 @@
 
 
 lemma Partition:
-"[| leq == %A i. !k. k<i --> A!k <= pivot;
-    geq == %A i. !k. i<k & k<length A --> pivot <= A!k |] ==>
+"[| leq == \<lambda>A i. \<forall>k. k<i \<longrightarrow> A!k \<le> pivot;
+    geq == \<lambda>A i. \<forall>k. i<k \<and> k<length A \<longrightarrow> pivot \<le> A!k |] ==>
  VARS A u l
  {0 < length(A::('a::order)list)}
  l := 0; u := length A - Suc 0;
- WHILE l <= u
-  INV {leq A l & geq A u & u<length A & l<=length A}
-  DO WHILE l < length A & A!l <= pivot
-     INV {leq A l & geq A u & u<length A & l<=length A}
+ WHILE l \<le> u
+  INV {leq A l \<and> geq A u \<and> u<length A \<and> l\<le>length A}
+  DO WHILE l < length A \<and> A!l \<le> pivot
+     INV {leq A l & geq A u \<and> u<length A \<and> l\<le>length A}
      DO l := l+1 OD;
-     WHILE 0 < u & pivot <= A!u
-     INV {leq A l & geq A u  & u<length A & l<=length A}
+     WHILE 0 < u & pivot \<le> A!u
+     INV {leq A l & geq A u  \<and> u<length A \<and> l\<le>length A}
      DO u := u - 1 OD;
-     IF l <= u THEN A := A[l := A!u, u := A!l] ELSE SKIP FI
+     IF l \<le> u THEN A := A[l := A!u, u := A!l] ELSE SKIP FI
   OD
- {leq A u & (!k. u<k & k<l --> A!k = pivot) & geq A l}"
+ {leq A u & (\<forall>k. u<k \<and> k<l --> A!k = pivot) \<and> geq A l}"
 \<comment> \<open>expand and delete abbreviations first\<close>
 apply (simp)
 apply (erule thin_rl)+
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Heap.thy
--- a/src/HOL/Hoare/Heap.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Heap.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -12,10 +12,10 @@
 
 datatype 'a ref = Null | Ref 'a
 
-lemma not_Null_eq [iff]: "(x ~= Null) = (EX y. x = Ref y)"
+lemma not_Null_eq [iff]: "(x \<noteq> Null) = (\<exists>y. x = Ref y)"
   by (induct x) auto
 
-lemma not_Ref_eq [iff]: "(ALL y. x ~= Ref y) = (x = Null)"
+lemma not_Ref_eq [iff]: "(\<forall>y. x \<noteq> Ref y) = (x = Null)"
   by (induct x) auto
 
 primrec addr :: "'a ref \<Rightarrow> 'a" where
@@ -68,12 +68,12 @@
 cycle.\<close>
 
 lemma neq_dP: "p \<noteq> q \<Longrightarrow> Path h p Ps q \<Longrightarrow> distinct Ps \<Longrightarrow>
- EX a Qs. p = Ref a & Ps = a#Qs & a \<notin> set Qs"
+ \<exists>a Qs. p = Ref a \<and> Ps = a#Qs \<and> a \<notin> set Qs"
 by (case_tac Ps, auto)
 
 
 lemma neq_dP_disp: "\<lbrakk> p \<noteq> q; distPath h p Ps q \<rbrakk> \<Longrightarrow>
- EX a Qs. p = Ref a \<and> Ps = a#Qs \<and> a \<notin> set Qs"
+ \<exists>a Qs. p = Ref a \<and> Ps = a#Qs \<and> a \<notin> set Qs"
 apply (simp only:distPath_def)
 by (case_tac Ps, auto)
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Hoare_Logic.thy
--- a/src/HOL/Hoare/Hoare_Logic.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Hoare_Logic.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -40,7 +40,7 @@
   "Sem (IF b THEN c1 ELSE c2 FI) s s'"
 
 definition Valid :: "'a bexp \<Rightarrow> 'a com \<Rightarrow> 'a bexp \<Rightarrow> bool"
-  where "Valid p c q \<longleftrightarrow> (!s s'. Sem c s s' --> s : p --> s' : q)"
+  where "Valid p c q \<longleftrightarrow> (\<forall>s s'. Sem c s s' \<longrightarrow> s \<in> p \<longrightarrow> s' \<in> q)"
 
 
 syntax
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Hoare_Logic_Abort.thy
--- a/src/HOL/Hoare/Hoare_Logic_Abort.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Hoare_Logic_Abort.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -42,7 +42,7 @@
   "Sem (IF b THEN c1 ELSE c2 FI) s s'"
 
 definition Valid :: "'a bexp \<Rightarrow> 'a com \<Rightarrow> 'a bexp \<Rightarrow> bool" where
-  "Valid p c q == \<forall>s s'. Sem c s s' \<longrightarrow> s : Some ` p \<longrightarrow> s' : Some ` q"
+  "Valid p c q \<equiv> \<forall>s s'. Sem c s s' \<longrightarrow> s \<in> Some ` p \<longrightarrow> s' \<in> Some ` q"
 
 
 syntax
@@ -101,7 +101,7 @@
 
 subsection \<open>Derivation of the proof rules and, most importantly, the VCG tactic\<close>
 
-lemma Compl_Collect: "-(Collect b) = {x. ~(b x)}"
+lemma Compl_Collect: "-(Collect b) = {x. \<not>(b x)}"
   by blast
 
 ML_file "hoare_tac.ML"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Pointer_Examples.thy
--- a/src/HOL/Hoare/Pointer_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Pointer_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -148,9 +148,9 @@
 first version uses a relation on @{typ"'a ref"}:\<close>
 
 lemma "VARS tl p
-  {(p,X) \<in> {(Ref x,tl x) |x. True}^*}
+  {(p,X) \<in> {(Ref x,tl x) |x. True}\<^sup>*}
   WHILE p \<noteq> Null \<and> p \<noteq> X
-  INV {(p,X) \<in> {(Ref x,tl x) |x. True}^*}
+  INV {(p,X) \<in> {(Ref x,tl x) |x. True}\<^sup>*}
   DO p := p^.tl OD
   {p = X}"
 apply vcg_simp
@@ -164,9 +164,9 @@
 text\<open>Finally, a version based on a relation on type @{typ 'a}:\<close>
 
 lemma "VARS tl p
-  {p \<noteq> Null \<and> (addr p,X) \<in> {(x,y). tl x = Ref y}^*}
+  {p \<noteq> Null \<and> (addr p,X) \<in> {(x,y). tl x = Ref y}\<^sup>*}
   WHILE p \<noteq> Null \<and> p \<noteq> Ref X
-  INV {p \<noteq> Null \<and> (addr p,X) \<in> {(x,y). tl x = Ref y}^*}
+  INV {p \<noteq> Null \<and> (addr p,X) \<in> {(x,y). tl x = Ref y}\<^sup>*}
   DO p := p^.tl OD
   {p = Ref X}"
 apply vcg_simp
@@ -241,7 +241,7 @@
  THEN r := p; p := p^.tl ELSE r := q; q := q^.tl FI;
  s := r;
  WHILE p \<noteq> Null \<or> q \<noteq> Null
- INV {EX rs ps qs a. Path tl r rs s \<and> List tl p ps \<and> List tl q qs \<and>
+ INV {\<exists>rs ps qs a. Path tl r rs s \<and> List tl p ps \<and> List tl q qs \<and>
       distinct(a # ps @ qs @ rs) \<and> s = Ref a \<and>
       merge(Ps,Qs,\<lambda>x y. hd x \<le> hd y) =
       rs @ a # merge(ps,qs,\<lambda>x y. hd x \<le> hd y) \<and>
@@ -367,15 +367,15 @@
 by (rule unproven)
 
 lemma "VARS hd tl p q r s
- {islist tl p & Ps = list tl p \<and> islist tl q & Qs = list tl q \<and>
+ {islist tl p \<and> Ps = list tl p \<and> islist tl q \<and> Qs = list tl q \<and>
   set Ps \<inter> set Qs = {} \<and>
   (p \<noteq> Null \<or> q \<noteq> Null)}
  IF cor (q = Null) (cand (p \<noteq> Null) (p^.hd \<le> q^.hd))
  THEN r := p; p := p^.tl ELSE r := q; q := q^.tl FI;
  s := r;
  WHILE p \<noteq> Null \<or> q \<noteq> Null
- INV {EX rs ps qs a. ispath tl r s & rs = path tl r s \<and>
-      islist tl p & ps = list tl p \<and> islist tl q & qs = list tl q \<and>
+ INV {\<exists>rs ps qs a. ispath tl r s \<and> rs = path tl r s \<and>
+      islist tl p \<and> ps = list tl p \<and> islist tl q \<and> qs = list tl q \<and>
       distinct(a # ps @ qs @ rs) \<and> s = Ref a \<and>
       merge(Ps,Qs,\<lambda>x y. hd x \<le> hd y) =
       rs @ a # merge(ps,qs,\<lambda>x y. hd x \<le> hd y) \<and>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare/Pointers0.thy
--- a/src/HOL/Hoare/Pointers0.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare/Pointers0.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -300,9 +300,9 @@
 suffices to talk about reachability, i.e.\ we can use relations directly.\<close>
 
 lemma "VARS tl p
-  {(p,X) \<in> {(x,y). y = tl x & x \<noteq> Null}^*}
+  {(p,X) \<in> {(x,y). y = tl x & x \<noteq> Null}\<^sup>*}
   WHILE p \<noteq> Null \<and> p \<noteq> X
-  INV {(p,X) \<in> {(x,y). y = tl x & x \<noteq> Null}^*}
+  INV {(p,X) \<in> {(x,y). y = tl x & x \<noteq> Null}\<^sup>*}
   DO p := p^.tl OD
   {p = X}"
 apply vcg_simp
@@ -337,7 +337,7 @@
  THEN r := p; p := p^.tl ELSE r := q; q := q^.tl FI;
  s := r;
  WHILE p \<noteq> Null \<or> q \<noteq> Null
- INV {EX rs ps qs. Path tl r rs s \<and> List tl p ps \<and> List tl q qs \<and>
+ INV {\<exists>rs ps qs. Path tl r rs s \<and> List tl p ps \<and> List tl q qs \<and>
       distinct(s # ps @ qs @ rs) \<and> s \<noteq> Null \<and>
       merge(Ps,Qs,\<lambda>x y. hd x \<le> hd y) =
       rs @ s # merge(ps,qs,\<lambda>x y. hd x \<le> hd y) \<and>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Hoare_Parallel/RG_Tran.thy
--- a/src/HOL/Hoare_Parallel/RG_Tran.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Hoare_Parallel/RG_Tran.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -28,7 +28,7 @@
   and ctrans :: "'a conf \<Rightarrow> 'a conf \<Rightarrow> bool"   ("_ -c*\<rightarrow> _" [81,81] 80)
 where
   "P -c\<rightarrow> Q \<equiv> (P,Q) \<in> ctran"
-| "P -c*\<rightarrow> Q \<equiv> (P,Q) \<in> ctran^*"
+| "P -c*\<rightarrow> Q \<equiv> (P,Q) \<in> ctran\<^sup>*"
 
 | Basic:  "(Some(Basic f), s) -c\<rightarrow> (None, f s)"
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/ACom.thy
--- a/src/HOL/IMP/ACom.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/ACom.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -133,25 +133,25 @@
 done
 
 lemma strip_eq_SKIP:
-  "strip C = SKIP \<longleftrightarrow> (EX P. C = SKIP {P})"
+  "strip C = SKIP \<longleftrightarrow> (\<exists>P. C = SKIP {P})"
 by (cases C) simp_all
 
 lemma strip_eq_Assign:
-  "strip C = x::=e \<longleftrightarrow> (EX P. C = x::=e {P})"
+  "strip C = x::=e \<longleftrightarrow> (\<exists>P. C = x::=e {P})"
 by (cases C) simp_all
 
 lemma strip_eq_Seq:
-  "strip C = c1;;c2 \<longleftrightarrow> (EX C1 C2. C = C1;;C2 & strip C1 = c1 & strip C2 = c2)"
+  "strip C = c1;;c2 \<longleftrightarrow> (\<exists>C1 C2. C = C1;;C2 & strip C1 = c1 & strip C2 = c2)"
 by (cases C) simp_all
 
 lemma strip_eq_If:
   "strip C = IF b THEN c1 ELSE c2 \<longleftrightarrow>
-  (EX P1 P2 C1 C2 Q. C = IF b THEN {P1} C1 ELSE {P2} C2 {Q} & strip C1 = c1 & strip C2 = c2)"
+  (\<exists>P1 P2 C1 C2 Q. C = IF b THEN {P1} C1 ELSE {P2} C2 {Q} & strip C1 = c1 & strip C2 = c2)"
 by (cases C) simp_all
 
 lemma strip_eq_While:
   "strip C = WHILE b DO c1 \<longleftrightarrow>
-  (EX I P C1 Q. C = {I} WHILE b DO {P} C1 {Q} & strip C1 = c1)"
+  (\<exists>I P C1 Q. C = {I} WHILE b DO {P} C1 {Q} & strip C1 = c1)"
 by (cases C) simp_all
 
 lemma [simp]: "shift (\<lambda>p. a) n = (\<lambda>p. a)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Abs_Int0.thy
--- a/src/HOL/IMP/Abs_Int0.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Abs_Int0.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -212,14 +212,14 @@
 
 text\<open>Correctness:\<close>
 
-lemma aval'_correct: "s : \<gamma>\<^sub>s S \<Longrightarrow> aval a s : \<gamma>(aval' a S)"
+lemma aval'_correct: "s \<in> \<gamma>\<^sub>s S \<Longrightarrow> aval a s \<in> \<gamma>(aval' a S)"
 by (induct a) (auto simp: gamma_num' gamma_plus' \<gamma>_fun_def)
 
-lemma in_gamma_update: "\<lbrakk> s : \<gamma>\<^sub>s S; i : \<gamma> a \<rbrakk> \<Longrightarrow> s(x := i) : \<gamma>\<^sub>s(S(x := a))"
+lemma in_gamma_update: "\<lbrakk> s \<in> \<gamma>\<^sub>s S; i \<in> \<gamma> a \<rbrakk> \<Longrightarrow> s(x := i) \<in> \<gamma>\<^sub>s(S(x := a))"
 by(simp add: \<gamma>_fun_def)
 
 lemma gamma_Step_subcomm:
-  assumes "!!x e S. f1 x e (\<gamma>\<^sub>o S) \<subseteq> \<gamma>\<^sub>o (f2 x e S)"  "!!b S. g1 b (\<gamma>\<^sub>o S) \<subseteq> \<gamma>\<^sub>o (g2 b S)"
+  assumes "\<And>x e S. f1 x e (\<gamma>\<^sub>o S) \<subseteq> \<gamma>\<^sub>o (f2 x e S)"  "\<And>b S. g1 b (\<gamma>\<^sub>o S) \<subseteq> \<gamma>\<^sub>o (g2 b S)"
   shows "Step f1 g1 (\<gamma>\<^sub>o S) (\<gamma>\<^sub>c C) \<le> \<gamma>\<^sub>c (Step f2 g2 S C)"
 by (induction C arbitrary: S) (auto simp: mono_gamma_o assms)
 
@@ -406,7 +406,7 @@
 shows "(\<Sum>x\<in>X. m (S2 x)) < (\<Sum>x\<in>X. m (S1 x))"
 proof-
   from assms(3) have 1: "\<forall>x\<in>X. m(S1 x) \<ge> m(S2 x)" by (simp add: m1)
-  from assms(2,3,4) have "EX x:X. S1 x < S2 x"
+  from assms(2,3,4) have "\<exists>x\<in>X. S1 x < S2 x"
     by(simp add: fun_eq_iff) (metis Compl_iff le_neq_trans)
   hence 2: "\<exists>x\<in>X. m(S1 x) > m(S2 x)" by (metis m2)
   from sum_strict_mono_ex1[OF \<open>finite X\<close> 1 2]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Abs_Int1.thy
--- a/src/HOL/IMP/Abs_Int1.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Abs_Int1.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -16,7 +16,7 @@
 "aval' (V x) S = fun S x" |
 "aval' (Plus a1 a2) S = plus' (aval' a1 S) (aval' a2 S)"
 
-lemma aval'_correct: "s : \<gamma>\<^sub>s S \<Longrightarrow> aval a s : \<gamma>(aval' a S)"
+lemma aval'_correct: "s \<in> \<gamma>\<^sub>s S \<Longrightarrow> aval a s \<in> \<gamma>(aval' a S)"
 by (induction a) (auto simp: gamma_num' gamma_plus' \<gamma>_st_def)
 
 lemma gamma_Step_subcomm: fixes C1 C2 :: "'a::semilattice_sup acom"
@@ -26,7 +26,7 @@
 proof(induction C arbitrary: S)
 qed (auto simp: assms intro!: mono_gamma_o sup_ge1 sup_ge2)
 
-lemma in_gamma_update: "\<lbrakk> s : \<gamma>\<^sub>s S; i : \<gamma> a \<rbrakk> \<Longrightarrow> s(x := i) : \<gamma>\<^sub>s(update S x a)"
+lemma in_gamma_update: "\<lbrakk> s \<in> \<gamma>\<^sub>s S; i \<in> \<gamma> a \<rbrakk> \<Longrightarrow> s(x := i) \<in> \<gamma>\<^sub>s(update S x a)"
 by(simp add: \<gamma>_st_def)
 
 end
@@ -188,7 +188,7 @@
 shows "(\<Sum>x\<in>X. m (S2 x)) < (\<Sum>x\<in>X. m (S1 x))"
 proof-
   from assms(3) have 1: "\<forall>x\<in>X. m(S1 x) \<ge> m(S2 x)" by (simp add: m1)
-  from assms(2,3,4) have "EX x:X. S1 x < S2 x"
+  from assms(2,3,4) have "\<exists>x\<in>X. S1 x < S2 x"
     by(simp add: fun_eq_iff) (metis Compl_iff le_neq_trans)
   hence 2: "\<exists>x\<in>X. m(S1 x) > m(S2 x)" by (metis m2)
   from sum_strict_mono_ex1[OF \<open>finite X\<close> 1 2]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Abs_Int2.thy
--- a/src/HOL/IMP/Abs_Int2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Abs_Int2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -35,7 +35,7 @@
 and gamma_bot[simp]: "\<gamma> \<bottom> = {}"
 begin
 
-lemma in_gamma_inf: "x : \<gamma> a1 \<Longrightarrow> x : \<gamma> a2 \<Longrightarrow> x : \<gamma>(a1 \<sqinter> a2)"
+lemma in_gamma_inf: "x \<in> \<gamma> a1 \<Longrightarrow> x \<in> \<gamma> a2 \<Longrightarrow> x \<in> \<gamma>(a1 \<sqinter> a2)"
 by (metis IntI inter_gamma_subset_gamma_inf set_mp)
 
 lemma gamma_inf: "\<gamma>(a1 \<sqinter> a2) = \<gamma> a1 \<inter> \<gamma> a2"
@@ -50,11 +50,11 @@
 fixes test_num' :: "val \<Rightarrow> 'av \<Rightarrow> bool"
 and inv_plus' :: "'av \<Rightarrow> 'av \<Rightarrow> 'av \<Rightarrow> 'av * 'av"
 and inv_less' :: "bool \<Rightarrow> 'av \<Rightarrow> 'av \<Rightarrow> 'av * 'av"
-assumes test_num': "test_num' i a = (i : \<gamma> a)"
+assumes test_num': "test_num' i a = (i \<in> \<gamma> a)"
 and inv_plus': "inv_plus' a a1 a2 = (a\<^sub>1',a\<^sub>2') \<Longrightarrow>
-  i1 : \<gamma> a1 \<Longrightarrow> i2 : \<gamma> a2 \<Longrightarrow> i1+i2 : \<gamma> a \<Longrightarrow> i1 : \<gamma> a\<^sub>1' \<and> i2 : \<gamma> a\<^sub>2'"
+  i1 \<in> \<gamma> a1 \<Longrightarrow> i2 \<in> \<gamma> a2 \<Longrightarrow> i1+i2 \<in> \<gamma> a \<Longrightarrow> i1 \<in> \<gamma> a\<^sub>1' \<and> i2 \<in> \<gamma> a\<^sub>2'"
 and inv_less': "inv_less' (i1<i2) a1 a2 = (a\<^sub>1',a\<^sub>2') \<Longrightarrow>
-  i1 : \<gamma> a1 \<Longrightarrow> i2 : \<gamma> a2 \<Longrightarrow> i1 : \<gamma> a\<^sub>1' \<and> i2 : \<gamma> a\<^sub>2'"
+  i1 \<in> \<gamma> a1 \<Longrightarrow> i2 \<in> \<gamma> a2 \<Longrightarrow> i1 \<in> \<gamma> a\<^sub>1' \<and> i2 \<in> \<gamma> a\<^sub>2'"
 
 
 locale Abs_Int_inv = Val_inv where \<gamma> = \<gamma>
@@ -62,14 +62,14 @@
 begin
 
 lemma in_gamma_sup_UpI:
-  "s : \<gamma>\<^sub>o S1 \<or> s : \<gamma>\<^sub>o S2 \<Longrightarrow> s : \<gamma>\<^sub>o(S1 \<squnion> S2)"
+  "s \<in> \<gamma>\<^sub>o S1 \<or> s \<in> \<gamma>\<^sub>o S2 \<Longrightarrow> s \<in> \<gamma>\<^sub>o(S1 \<squnion> S2)"
 by (metis (hide_lams, no_types) sup_ge1 sup_ge2 mono_gamma_o subsetD)
 
 fun aval'' :: "aexp \<Rightarrow> 'av st option \<Rightarrow> 'av" where
 "aval'' e None = \<bottom>" |
 "aval'' e (Some S) = aval' e S"
 
-lemma aval''_correct: "s : \<gamma>\<^sub>o S \<Longrightarrow> aval a s : \<gamma>(aval'' a S)"
+lemma aval''_correct: "s \<in> \<gamma>\<^sub>o S \<Longrightarrow> aval a s \<in> \<gamma>(aval'' a S)"
 by(cases S)(auto simp add: aval'_correct split: option.splits)
 
 subsubsection "Backward analysis"
@@ -103,16 +103,16 @@
   (let (a1,a2) = inv_less' res (aval'' e1 S) (aval'' e2 S)
    in inv_aval' e1 a1 (inv_aval' e2 a2 S))"
 
-lemma inv_aval'_correct: "s : \<gamma>\<^sub>o S \<Longrightarrow> aval e s : \<gamma> a \<Longrightarrow> s : \<gamma>\<^sub>o (inv_aval' e a S)"
+lemma inv_aval'_correct: "s \<in> \<gamma>\<^sub>o S \<Longrightarrow> aval e s \<in> \<gamma> a \<Longrightarrow> s \<in> \<gamma>\<^sub>o (inv_aval' e a S)"
 proof(induction e arbitrary: a S)
   case N thus ?case by simp (metis test_num')
 next
   case (V x)
-  obtain S' where "S = Some S'" and "s : \<gamma>\<^sub>s S'" using \<open>s : \<gamma>\<^sub>o S\<close>
+  obtain S' where "S = Some S'" and "s \<in> \<gamma>\<^sub>s S'" using \<open>s \<in> \<gamma>\<^sub>o S\<close>
     by(auto simp: in_gamma_option_iff)
-  moreover hence "s x : \<gamma> (fun S' x)"
+  moreover hence "s x \<in> \<gamma> (fun S' x)"
     by(simp add: \<gamma>_st_def)
-  moreover have "s x : \<gamma> a" using V(2) by simp
+  moreover have "s x \<in> \<gamma> a" using V(2) by simp
   ultimately show ?case
     by(simp add: Let_def \<gamma>_st_def)
       (metis mono_gamma emptyE in_gamma_inf gamma_bot subset_empty)
@@ -122,7 +122,7 @@
     by (auto split: prod.split)
 qed
 
-lemma inv_bval'_correct: "s : \<gamma>\<^sub>o S \<Longrightarrow> bv = bval b s \<Longrightarrow> s : \<gamma>\<^sub>o(inv_bval' b bv S)"
+lemma inv_bval'_correct: "s \<in> \<gamma>\<^sub>o S \<Longrightarrow> bv = bval b s \<Longrightarrow> s \<in> \<gamma>\<^sub>o(inv_bval' b bv S)"
 proof(induction b arbitrary: S bv)
   case Bc thus ?case by simp
 next
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Abs_Int2_ivl.thy
--- a/src/HOL/IMP/Abs_Int2_ivl.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Abs_Int2_ivl.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -229,7 +229,7 @@
 definition uminus_rep :: "eint2 \<Rightarrow> eint2" where
 "uminus_rep p = (let (l,h) = p in (-h, -l))"
 
-lemma \<gamma>_uminus_rep: "i : \<gamma>_rep p \<Longrightarrow> -i \<in> \<gamma>_rep(uminus_rep p)"
+lemma \<gamma>_uminus_rep: "i \<in> \<gamma>_rep p \<Longrightarrow> -i \<in> \<gamma>_rep(uminus_rep p)"
 by(auto simp: uminus_rep_def \<gamma>_rep_def image_def uminus_le_Fin_iff Fin_uminus_le_iff
         split: prod.split)
 
@@ -240,7 +240,7 @@
 instance ..
 end
 
-lemma \<gamma>_uminus: "i : \<gamma>_ivl iv \<Longrightarrow> -i \<in> \<gamma>_ivl(- iv)"
+lemma \<gamma>_uminus: "i \<in> \<gamma>_ivl iv \<Longrightarrow> -i \<in> \<gamma>_ivl(- iv)"
 by transfer (rule \<gamma>_uminus_rep)
 
 lemma uminus_nice: "-[l,h] = [-h,-l]"
@@ -276,7 +276,7 @@
    (auto simp add: above_rep_def \<gamma>_rep_cases is_empty_rep_def
          split: extended.splits)
 
-lemma \<gamma>_belowI: "i : \<gamma>_ivl iv \<Longrightarrow> j \<le> i \<Longrightarrow> j : \<gamma>_ivl(below iv)"
+lemma \<gamma>_belowI: "i \<in> \<gamma>_ivl iv \<Longrightarrow> j \<le> i \<Longrightarrow> j \<in> \<gamma>_ivl(below iv)"
 by transfer 
    (auto simp add: below_rep_def \<gamma>_rep_cases is_empty_rep_def
          split: extended.splits)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Abs_Int3.thy
--- a/src/HOL/IMP/Abs_Int3.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Abs_Int3.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -466,7 +466,7 @@
 assumes P_f: "\<And>C. P C \<Longrightarrow> P(f C)"
 and P_widen: "\<And>C1 C2. P C1 \<Longrightarrow> P C2 \<Longrightarrow> P(C1 \<nabla> C2)"
 and m_widen: "\<And>C1 C2. P C1 \<Longrightarrow> P C2 \<Longrightarrow> ~ C2 \<le> C1 \<Longrightarrow> m(C1 \<nabla> C2) < m C1"
-and "P C" shows "EX C'. iter_widen f C = Some C'"
+and "P C" shows "\<exists>C'. iter_widen f C = Some C'"
 proof(simp add: iter_widen_def,
       rule measure_while_option_Some[where P = P and f=m])
   show "P C" by(rule \<open>P C\<close>)
@@ -481,7 +481,7 @@
 and P_narrow: "\<And>C1 C2. P C1 \<Longrightarrow> P C2 \<Longrightarrow> P(C1 \<triangle> C2)"
 and mono: "\<And>C1 C2. P C1 \<Longrightarrow> P C2 \<Longrightarrow> C1 \<le> C2 \<Longrightarrow> f C1 \<le> f C2"
 and n_narrow: "\<And>C1 C2. P C1 \<Longrightarrow> P C2 \<Longrightarrow> C2 \<le> C1 \<Longrightarrow> C1 \<triangle> C2 < C1 \<Longrightarrow> n(C1 \<triangle> C2) < n C1"
-and init: "P C" "f C \<le> C" shows "EX C'. iter_narrow f C = Some C'"
+and init: "P C" "f C \<le> C" shows "\<exists>C'. iter_narrow f C = Some C'"
 proof(simp add: iter_narrow_def,
       rule measure_while_option_Some[where f=n and P = "%C. P C \<and> f C \<le> C"])
   show "P C \<and> f C \<le> C" using init by blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Abs_State.thy
--- a/src/HOL/IMP/Abs_State.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Abs_State.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -157,7 +157,7 @@
 by (simp add: less_eq_acom_def mono_gamma_o size_annos anno_map_acom size_annos_same[of C1 C2])
 
 lemma in_gamma_option_iff:
-  "x : \<gamma>_option r u \<longleftrightarrow> (\<exists>u'. u = Some u' \<and> x : r u')"
+  "x \<in> \<gamma>_option r u \<longleftrightarrow> (\<exists>u'. u = Some u' \<and> x \<in> r u')"
 by (cases u) auto
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Collecting.thy
--- a/src/HOL/IMP/Collecting.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Collecting.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -109,7 +109,7 @@
 
 subsubsection "Collecting semantics"
 
-definition "step = Step (\<lambda>x e S. {s(x := aval e s) |s. s : S}) (\<lambda>b S. {s:S. bval b s})"
+definition "step = Step (\<lambda>x e S. {s(x := aval e s) |s. s \<in> S}) (\<lambda>b S. {s:S. bval b s})"
 
 definition CS :: "com \<Rightarrow> state set acom" where
 "CS c = lfp c (step UNIV)"
@@ -195,7 +195,7 @@
     by (auto simp: step_def post_def)
   have "step {s \<in> I. bval b s} C' \<le> C'"
     by (rule order_trans[OF mono2_step[OF order_refl \<open>{s \<in> I. bval b s} \<le> P\<close>] \<open>step P C' \<le> C'\<close>])
-  have "s1: {s:I. bval b s}" using \<open>s1 \<in> S\<close> \<open>S \<subseteq> I\<close> \<open>bval b s1\<close> by auto
+  have "s1 \<in> {s\<in>I. bval b s}" using \<open>s1 \<in> S\<close> \<open>S \<subseteq> I\<close> \<open>bval b s1\<close> by auto
   note s2_in_post_C' = WhileTrue.IH(1)[OF \<open>strip C' = c'\<close> this \<open>step {s \<in> I. bval b s} C' \<le> C'\<close>]
   from WhileTrue.IH(2)[OF WhileTrue.prems(1) s2_in_post_C' \<open>step (post C') C \<le> C\<close>]
   show ?case .
@@ -207,7 +207,7 @@
 lemma big_step_lfp: "\<lbrakk> (c,s) \<Rightarrow> t;  s \<in> S \<rbrakk> \<Longrightarrow> t \<in> post(lfp c (step S))"
 by(auto simp add: post_lfp intro: big_step_post_step)
 
-lemma big_step_CS: "(c,s) \<Rightarrow> t \<Longrightarrow> t : post(CS c)"
+lemma big_step_CS: "(c,s) \<Rightarrow> t \<Longrightarrow> t \<in> post(CS c)"
 by(simp add: CS_def big_step_lfp)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Collecting1.thy
--- a/src/HOL/IMP/Collecting1.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Collecting1.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -27,12 +27,12 @@
 definition steps :: "state \<Rightarrow> com \<Rightarrow> nat \<Rightarrow> state set acom" where
 "steps s c n = ((step {})^^n) (step {s} (annotate (\<lambda>p. {}) c))"
 
-lemma steps_approx_fix_step: assumes "step S cs = cs" and "s:S"
+lemma steps_approx_fix_step: assumes "step S cs = cs" and "s \<in> S"
 shows "steps s (strip cs) n \<le> cs"
 proof-
   let ?bot = "annotate (\<lambda>p. {}) (strip cs)"
   have "?bot \<le> cs" by(induction cs) auto
-  from step_preserves_le[OF assms(1)_ this, of "{s}"] \<open>s:S\<close>
+  from step_preserves_le[OF assms(1)_ this, of "{s}"] \<open>s \<in> S\<close>
   have 1: "step {s} ?bot \<le> cs" by simp
   from steps_empty_preserves_le[OF assms(1) 1]
   show ?thesis by(simp add: steps_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Complete_Lattice.thy
--- a/src/HOL/IMP/Complete_Lattice.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Complete_Lattice.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -7,25 +7,25 @@
 locale Complete_Lattice =
 fixes L :: "'a::order set" and Glb :: "'a set \<Rightarrow> 'a"
 assumes Glb_lower: "A \<subseteq> L \<Longrightarrow> a \<in> A \<Longrightarrow> Glb A \<le> a"
-and Glb_greatest: "b : L \<Longrightarrow> \<forall>a\<in>A. b \<le> a \<Longrightarrow> b \<le> Glb A"
-and Glb_in_L: "A \<subseteq> L \<Longrightarrow> Glb A : L"
+and Glb_greatest: "b \<in> L \<Longrightarrow> \<forall>a\<in>A. b \<le> a \<Longrightarrow> b \<le> Glb A"
+and Glb_in_L: "A \<subseteq> L \<Longrightarrow> Glb A \<in> L"
 begin
 
 definition lfp :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a" where
 "lfp f = Glb {a : L. f a \<le> a}"
 
-lemma index_lfp: "lfp f : L"
+lemma index_lfp: "lfp f \<in> L"
 by(auto simp: lfp_def intro: Glb_in_L)
 
 lemma lfp_lowerbound:
-  "\<lbrakk> a : L;  f a \<le> a \<rbrakk> \<Longrightarrow> lfp f \<le> a"
+  "\<lbrakk> a \<in> L;  f a \<le> a \<rbrakk> \<Longrightarrow> lfp f \<le> a"
 by (auto simp add: lfp_def intro: Glb_lower)
 
 lemma lfp_greatest:
-  "\<lbrakk> a : L;  \<And>u. \<lbrakk> u : L; f u \<le> u\<rbrakk> \<Longrightarrow> a \<le> u \<rbrakk> \<Longrightarrow> a \<le> lfp f"
+  "\<lbrakk> a \<in> L;  \<And>u. \<lbrakk> u \<in> L; f u \<le> u\<rbrakk> \<Longrightarrow> a \<le> u \<rbrakk> \<Longrightarrow> a \<le> lfp f"
 by (auto simp add: lfp_def intro: Glb_greatest)
 
-lemma lfp_unfold: assumes "\<And>x. f x : L \<longleftrightarrow> x : L"
+lemma lfp_unfold: assumes "\<And>x. f x \<in> L \<longleftrightarrow> x \<in> L"
 and mono: "mono f" shows "lfp f = f (lfp f)"
 proof-
   note assms(1)[simp] index_lfp[simp]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Def_Init_Small.thy
--- a/src/HOL/IMP/Def_Init_Small.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Def_Init_Small.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -28,7 +28,7 @@
 subsection "Soundness wrt Small Steps"
 
 theorem progress:
-  "D (dom s) c A' \<Longrightarrow> c \<noteq> SKIP \<Longrightarrow> EX cs'. (c,s) \<rightarrow> cs'"
+  "D (dom s) c A' \<Longrightarrow> c \<noteq> SKIP \<Longrightarrow> \<exists>cs'. (c,s) \<rightarrow> cs'"
 proof (induction c arbitrary: s A')
   case Assign thus ?case by auto (metis aval_Some small_step.Assign)
 next
@@ -38,7 +38,7 @@
     by(cases bv)(auto intro: small_step.IfTrue small_step.IfFalse)
 qed (fastforce intro: small_step.intros)+
 
-lemma D_mono:  "D A c M \<Longrightarrow> A \<subseteq> A' \<Longrightarrow> EX M'. D A' c M' & M <= M'"
+lemma D_mono:  "D A c M \<Longrightarrow> A \<subseteq> A' \<Longrightarrow> \<exists>M'. D A' c M' & M <= M'"
 proof (induction c arbitrary: A A' M)
   case Seq thus ?case by auto (metis D.intros(3))
 next
@@ -55,7 +55,7 @@
 qed (auto intro: D.intros)
 
 theorem D_preservation:
-  "(c,s) \<rightarrow> (c',s') \<Longrightarrow> D (dom s) c A \<Longrightarrow> EX A'. D (dom s') c' A' & A <= A'"
+  "(c,s) \<rightarrow> (c',s') \<Longrightarrow> D (dom s) c A \<Longrightarrow> \<exists>A'. D (dom s') c' A' & A <= A'"
 proof (induction arbitrary: A rule: small_step_induct)
   case (While b c s)
   then obtain A' where A': "vars b \<subseteq> dom s" "A = dom s" "D (dom s) c A'" by blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Denotational.thy
--- a/src/HOL/IMP/Denotational.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Denotational.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -44,7 +44,7 @@
 abbreviation Big_step :: "com \<Rightarrow> com_den" where
 "Big_step c \<equiv> {(s,t). (c,s) \<Rightarrow> t}"
 
-lemma Big_step_if_D:  "(s,t) \<in> D(c) \<Longrightarrow> (s,t) : Big_step c"
+lemma Big_step_if_D:  "(s,t) \<in> D(c) \<Longrightarrow> (s,t) \<in> Big_step c"
 proof (induction c arbitrary: s t)
   case Seq thus ?case by fastforce
 next
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Fold.thy
--- a/src/HOL/IMP/Fold.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Fold.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -11,7 +11,7 @@
 "afold (Plus e1 e2) t = (case (afold e1 t, afold e2 t) of
   (N n1, N n2) \<Rightarrow> N(n1+n2) | (e1',e2') \<Rightarrow> Plus e1' e2')"
 
-definition "approx t s \<longleftrightarrow> (ALL x k. t x = Some k \<longrightarrow> s x = k)"
+definition "approx t s \<longleftrightarrow> (\<forall>x k. t x = Some k \<longrightarrow> s x = k)"
 
 theorem aval_afold[simp]:
 assumes "approx t s"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Live.thy
--- a/src/HOL/IMP/Live.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Live.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -176,23 +176,23 @@
 text\<open>Now the opposite direction.\<close>
 
 lemma SKIP_bury[simp]:
-  "SKIP = bury c X \<longleftrightarrow> c = SKIP | (EX x a. c = x::=a & x \<notin> X)"
+  "SKIP = bury c X \<longleftrightarrow> c = SKIP | (\<exists>x a. c = x::=a & x \<notin> X)"
 by (cases c) auto
 
-lemma Assign_bury[simp]: "x::=a = bury c X \<longleftrightarrow> c = x::=a & x : X"
+lemma Assign_bury[simp]: "x::=a = bury c X \<longleftrightarrow> c = x::=a \<and> x \<in> X"
 by (cases c) auto
 
 lemma Seq_bury[simp]: "bc\<^sub>1;;bc\<^sub>2 = bury c X \<longleftrightarrow>
-  (EX c\<^sub>1 c\<^sub>2. c = c\<^sub>1;;c\<^sub>2 & bc\<^sub>2 = bury c\<^sub>2 X & bc\<^sub>1 = bury c\<^sub>1 (L c\<^sub>2 X))"
+  (\<exists>c\<^sub>1 c\<^sub>2. c = c\<^sub>1;;c\<^sub>2 & bc\<^sub>2 = bury c\<^sub>2 X & bc\<^sub>1 = bury c\<^sub>1 (L c\<^sub>2 X))"
 by (cases c) auto
 
 lemma If_bury[simp]: "IF b THEN bc1 ELSE bc2 = bury c X \<longleftrightarrow>
-  (EX c1 c2. c = IF b THEN c1 ELSE c2 &
+  (\<exists>c1 c2. c = IF b THEN c1 ELSE c2 &
      bc1 = bury c1 X & bc2 = bury c2 X)"
 by (cases c) auto
 
 lemma While_bury[simp]: "WHILE b DO bc' = bury c X \<longleftrightarrow>
-  (EX c'. c = WHILE b DO c' & bc' = bury c' (L (WHILE b DO c') X))"
+  (\<exists>c'. c = WHILE b DO c' & bc' = bury c' (L (WHILE b DO c') X))"
 by (cases c) auto
 
 theorem bury_correct2:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/Small_Step.thy
--- a/src/HOL/IMP/Small_Step.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/Small_Step.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -173,7 +173,7 @@
 
 subsection "Final configurations and infinite reductions"
 
-definition "final cs \<longleftrightarrow> \<not>(EX cs'. cs \<rightarrow> cs')"
+definition "final cs \<longleftrightarrow> \<not>(\<exists>cs'. cs \<rightarrow> cs')"
 
 lemma finalD: "final (c,s) \<Longrightarrow> c = SKIP"
 apply(simp add: final_def)
@@ -188,7 +188,7 @@
 terminates:\<close>
 
 lemma big_iff_small_termination:
-  "(EX t. cs \<Rightarrow> t) \<longleftrightarrow> (EX cs'. cs \<rightarrow>* cs' \<and> final cs')"
+  "(\<exists>t. cs \<Rightarrow> t) \<longleftrightarrow> (\<exists>cs'. cs \<rightarrow>* cs' \<and> final cs')"
 by(simp add: big_iff_small final_iff_SKIP)
 
 text\<open>This is the same as saying that the absence of a big step result is
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/VCG_Total_EX.thy
--- a/src/HOL/IMP/VCG_Total_EX.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/VCG_Total_EX.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -36,7 +36,7 @@
 "pre (C\<^sub>1;; C\<^sub>2) Q = pre C\<^sub>1 (pre C\<^sub>2 Q)" |
 "pre (IF b THEN C\<^sub>1 ELSE C\<^sub>2) Q =
   (\<lambda>s. if bval b s then pre C\<^sub>1 Q s else pre C\<^sub>2 Q s)" |
-"pre ({I} WHILE b DO C) Q = (\<lambda>s. EX n. I n s)"
+"pre ({I} WHILE b DO C) Q = (\<lambda>s. \<exists>n. I n s)"
 
 text\<open>Verification condition:\<close>
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMP/VCG_Total_EX2.thy
--- a/src/HOL/IMP/VCG_Total_EX2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMP/VCG_Total_EX2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -42,7 +42,7 @@
 "pre (C\<^sub>1;; C\<^sub>2) Q = pre C\<^sub>1 (pre C\<^sub>2 Q)" |
 "pre (IF b THEN C\<^sub>1 ELSE C\<^sub>2) Q =
   (\<lambda>l s. if bval b s then pre C\<^sub>1 Q l s else pre C\<^sub>2 Q l s)" |
-"pre ({I/x} WHILE b DO C) Q = (\<lambda>l s. EX n. I (l(x:=n)) s)"
+"pre ({I/x} WHILE b DO C) Q = (\<lambda>l s. \<exists>n. I (l(x:=n)) s)"
 
 text\<open>Verification condition:\<close>
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMPP/Com.thy
--- a/src/HOL/IMPP/Com.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMPP/Com.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -80,7 +80,7 @@
 
 definition
   WT_bodies :: bool where
-  "WT_bodies = (!(pn,b):set bodies. WT b)"
+  "WT_bodies = (\<forall>(pn,b) \<in> set bodies. WT b)"
 
 
 ML \<open>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMPP/Hoare.thy
--- a/src/HOL/IMPP/Hoare.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMPP/Hoare.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -34,14 +34,14 @@
 definition
   triple_valid :: "nat => 'a triple     => bool" ( "|=_:_" [0 , 58] 57) where
   "|=n:t = (case t of {P}.c.{Q} =>
-             !Z s. P Z s --> (!s'. <c,s> -n-> s' --> Q Z s'))"
+             \<forall>Z s. P Z s \<longrightarrow> (\<forall>s'. <c,s> -n-> s' \<longrightarrow> Q Z s'))"
 abbreviation
   triples_valid :: "nat => 'a triple set => bool" ("||=_:_" [0 , 58] 57) where
   "||=n:G == Ball G (triple_valid n)"
 
 definition
   hoare_valids :: "'a triple set => 'a triple set => bool" ("_||=_"  [58, 58] 57) where
-  "G||=ts = (!n. ||=n:G --> ||=n:ts)"
+  "G||=ts = (\<forall>n. ||=n:G --> ||=n:ts)"
 abbreviation
   hoare_valid :: "'a triple set => 'a triple     => bool" ("_|=_"   [58, 58] 57) where
   "G |=t == G||={t}"
@@ -68,8 +68,8 @@
 
 | weaken: "[| G||-ts' ; ts <= ts' |] ==> G||-ts"
 
-| conseq: "!Z s. P  Z  s --> (? P' Q'. G|-{P'}.c.{Q'} &
-                                   (!s'. (!Z'. P' Z' s --> Q' Z' s') --> Q Z s'))
+| conseq: "\<forall>Z s. P  Z  s \<longrightarrow> (\<exists>P' Q'. G|-{P'}.c.{Q'} \<and>
+                                   (\<forall>s'. (\<forall>Z'. P' Z' s \<longrightarrow> Q' Z' s') \<longrightarrow> Q Z s'))
           ==> G|-{P}.c.{Q}"
 
 
@@ -108,7 +108,7 @@
 section \<open>Soundness and relative completeness of Hoare rules wrt operational semantics\<close>
 
 lemma single_stateE:
-  "state_not_singleton ==> !t. (!s::state. s = t) --> False"
+  "state_not_singleton \<Longrightarrow> \<forall>t. (\<forall>s::state. s = t) \<longrightarrow> False"
 apply (unfold state_not_singleton_def)
 apply clarify
 apply (case_tac "ta = t")
@@ -122,7 +122,7 @@
 subsection "validity"
 
 lemma triple_valid_def2:
-  "|=n:{P}.c.{Q} = (!Z s. P Z s --> (!s'. <c,s> -n-> s' --> Q Z s'))"
+  "|=n:{P}.c.{Q} = (\<forall>Z s. P Z s \<longrightarrow> (\<forall>s'. <c,s> -n-> s' \<longrightarrow> Q Z s'))"
 apply (unfold triple_valid_def)
 apply auto
 done
@@ -152,26 +152,26 @@
 
 subsection "derived rules"
 
-lemma conseq12: "[| G|-{P'}.c.{Q'}; !Z s. P Z s -->
-                         (!s'. (!Z'. P' Z' s --> Q' Z' s') --> Q Z s') |]
+lemma conseq12: "[| G|-{P'}.c.{Q'}; \<forall>Z s. P Z s \<longrightarrow>
+                         (\<forall>s'. (\<forall>Z'. P' Z' s \<longrightarrow> Q' Z' s') --> Q Z s') |]
        ==> G|-{P}.c.{Q}"
 apply (rule hoare_derivs.conseq)
 apply blast
 done
 
-lemma conseq1: "[| G|-{P'}.c.{Q}; !Z s. P Z s --> P' Z s |] ==> G|-{P}.c.{Q}"
+lemma conseq1: "[| G|-{P'}.c.{Q}; \<forall>Z s. P Z s \<longrightarrow> P' Z s |] ==> G|-{P}.c.{Q}"
 apply (erule conseq12)
 apply fast
 done
 
-lemma conseq2: "[| G|-{P}.c.{Q'}; !Z s. Q' Z s --> Q Z s |] ==> G|-{P}.c.{Q}"
+lemma conseq2: "[| G|-{P}.c.{Q'}; \<forall>Z s. Q' Z s \<longrightarrow> Q Z s |] ==> G|-{P}.c.{Q}"
 apply (erule conseq12)
 apply fast
 done
 
-lemma Body1: "[| G Un (%p. {P p}.      BODY p  .{Q p})`Procs
-          ||- (%p. {P p}. the (body p) .{Q p})`Procs;
-    pn:Procs |] ==> G|-{P pn}. BODY pn .{Q pn}"
+lemma Body1: "[| G Un (\<lambda>p. {P p}.      BODY p  .{Q p})`Procs
+          ||- (\<lambda>p. {P p}. the (body p) .{Q p})`Procs;
+    pn \<in> Procs |] ==> G|-{P pn}. BODY pn .{Q pn}"
 apply (drule hoare_derivs.Body)
 apply (erule hoare_derivs.weaken)
 apply fast
@@ -184,17 +184,17 @@
 apply clarsimp
 done
 
-lemma escape: "[| !Z s. P Z s --> G|-{%Z s'. s'=s}.c.{%Z'. Q Z} |] ==> G|-{P}.c.{Q}"
+lemma escape: "[| \<forall>Z s. P Z s \<longrightarrow> G|-{\<lambda>Z s'. s'=s}.c.{\<lambda>Z'. Q Z} |] ==> G|-{P}.c.{Q}"
 apply (rule hoare_derivs.conseq)
 apply fast
 done
 
-lemma "constant": "[| C ==> G|-{P}.c.{Q} |] ==> G|-{%Z s. P Z s & C}.c.{Q}"
+lemma "constant": "[| C ==> G|-{P}.c.{Q} |] ==> G|-{\<lambda>Z s. P Z s & C}.c.{Q}"
 apply (rule hoare_derivs.conseq)
 apply fast
 done
 
-lemma LoopF: "G|-{%Z s. P Z s & ~b s}.WHILE b DO c.{P}"
+lemma LoopF: "G|-{\<lambda>Z s. P Z s \<and> \<not>b s}.WHILE b DO c.{P}"
 apply (rule hoare_derivs.Loop [THEN conseq2])
 apply  (simp_all (no_asm))
 apply (rule hoare_derivs.conseq)
@@ -207,7 +207,7 @@
 by (etac hoare_derivs.asm 1);
 qed "thin";
 *)
-lemma thin [rule_format]: "G'||-ts ==> !G. G' <= G --> G||-ts"
+lemma thin [rule_format]: "G'||-ts \<Longrightarrow> \<forall>G. G' <= G \<longrightarrow> G||-ts"
 apply (erule hoare_derivs.induct)
 apply                (tactic \<open>ALLGOALS (EVERY'[clarify_tac @{context}, REPEAT o smp_tac @{context} 1])\<close>)
 apply (rule hoare_derivs.empty)
@@ -232,7 +232,7 @@
 done
 
 lemma finite_pointwise [rule_format (no_asm)]: "[| finite U;
-  !p. G |-     {P' p}.c0 p.{Q' p}       --> G |-     {P p}.c0 p.{Q p} |] ==>
+  \<forall>p. G |-     {P' p}.c0 p.{Q' p}       --> G |-     {P p}.c0 p.{Q p} |] ==>
       G||-(%p. {P' p}.c0 p.{Q' p}) ` U --> G||-(%p. {P p}.c0 p.{Q p}) ` U"
 apply (erule finite_induct)
 apply simp
@@ -251,7 +251,7 @@
 apply (unfold hoare_valids_def)
 apply (simp (no_asm_use) add: triple_valid_def2)
 apply (rule allI)
-apply (subgoal_tac "!d s s'. <d,s> -n-> s' --> d = WHILE b DO c --> ||=n:G --> (!Z. P Z s --> P Z s' & ~b s') ")
+apply (subgoal_tac "\<forall>d s s'. <d,s> -n-> s' --> d = WHILE b DO c --> ||=n:G --> (\<forall>Z. P Z s --> P Z s' & ~b s') ")
 apply  (erule thin_rl, fast)
 apply ((rule allI)+, rule impI)
 apply (erule evaln.induct)
@@ -302,16 +302,16 @@
 (* Both versions *)
 
 (*unused*)
-lemma MGT_alternI: "G|-MGT c ==>
-  G|-{%Z s0. !s1. <c,s0> -c-> s1 --> Z=s1}. c .{%Z s1. Z=s1}"
+lemma MGT_alternI: "G|-MGT c \<Longrightarrow>
+  G|-{\<lambda>Z s0. \<forall>s1. <c,s0> -c-> s1 \<longrightarrow> Z=s1}. c .{\<lambda>Z s1. Z=s1}"
 apply (unfold MGT_def)
 apply (erule conseq12)
 apply auto
 done
 
 (* requires com_det *)
-lemma MGT_alternD: "state_not_singleton ==>
-  G|-{%Z s0. !s1. <c,s0> -c-> s1 --> Z=s1}. c .{%Z s1. Z=s1} ==> G|-MGT c"
+lemma MGT_alternD: "state_not_singleton \<Longrightarrow>
+  G|-{\<lambda>Z s0. \<forall>s1. <c,s0> -c-> s1 \<longrightarrow> Z=s1}. c .{\<lambda>Z s1. Z=s1} \<Longrightarrow> G|-MGT c"
 apply (unfold MGT_def)
 apply (erule conseq12)
 apply auto
@@ -332,8 +332,8 @@
 declare WTs_elim_cases [elim!]
 declare not_None_eq [iff]
 (* requires com_det, escape (i.e. hoare_derivs.conseq) *)
-lemma MGF_lemma1 [rule_format (no_asm)]: "state_not_singleton ==>
-  !pn:dom body. G|-{=}.BODY pn.{->} ==> WT c --> G|-{=}.c.{->}"
+lemma MGF_lemma1 [rule_format (no_asm)]: "state_not_singleton \<Longrightarrow>
+  \<forall>pn \<in> dom body. G|-{=}.BODY pn.{->} \<Longrightarrow> WT c --> G|-{=}.c.{->}"
 apply (induct_tac c)
 apply        (tactic \<open>ALLGOALS (clarsimp_tac @{context})\<close>)
 prefer 7 apply        (fast intro: domI)
@@ -362,10 +362,10 @@
 lemma nesting_lemma [rule_format]:
   assumes "!!G ts. ts <= G ==> P G ts"
     and "!!G pn. P (insert (mgt_call pn) G) {mgt(the(body pn))} ==> P G {mgt_call pn}"
-    and "!!G c. [| wt c; !pn:U. P G {mgt_call pn} |] ==> P G {mgt c}"
-    and "!!pn. pn : U ==> wt (the (body pn))"
+    and "!!G c. [| wt c; \<forall>pn\<in>U. P G {mgt_call pn} |] ==> P G {mgt c}"
+    and "!!pn. pn \<in> U ==> wt (the (body pn))"
   shows "finite U ==> uG = mgt_call`U ==>
-  !G. G <= uG --> n <= card uG --> card G = card uG - n --> (!c. wt c --> P G {mgt c})"
+  \<forall>G. G <= uG --> n <= card uG --> card G = card uG - n --> (\<forall>c. wt c --> P G {mgt c})"
 apply (induct_tac n)
 apply  (tactic \<open>ALLGOALS (clarsimp_tac @{context})\<close>)
 apply  (subgoal_tac "G = mgt_call ` U")
@@ -378,7 +378,7 @@
 apply  fast
 apply (erule assms(3-)) (*MGF_lemma1*)
 apply (rule ballI)
-apply (case_tac "mgt_call pn : G")
+apply (case_tac "mgt_call pn \<in> G")
 apply  (rule assms) (*hoare_derivs.asm*)
 apply  fast
 apply (rule assms(2-)) (*MGT_BodyN*)
@@ -484,7 +484,7 @@
 apply (fast elim: conseq12)
 done (* analogue conj non-derivable *)
 
-lemma hoare_SkipI: "(!Z s. P Z s --> Q Z s) ==> G|-{P}. SKIP .{Q}"
+lemma hoare_SkipI: "(\<forall>Z s. P Z s \<longrightarrow> Q Z s) \<Longrightarrow> G|-{P}. SKIP .{Q}"
 apply (rule conseq12)
 apply (rule hoare_derivs.Skip)
 apply fast
@@ -504,7 +504,7 @@
 done
 
 
-lemma weak_Local: "[| G|-{P}. c .{Q}; !k Z s. Q Z s --> Q Z (s[Loc Y::=k]) |] ==>
+lemma weak_Local: "[| G|-{P}. c .{Q}; \<forall>k Z s. Q Z s --> Q Z (s[Loc Y::=k]) |] ==>
     G|-{%Z s. P Z (s[Loc Y::=a s])}. LOCAL Y:=a IN c .{Q}"
 apply (rule export_s)
 apply (rule hoare_derivs.Local)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMPP/Misc.thy
--- a/src/HOL/IMPP/Misc.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMPP/Misc.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -81,7 +81,7 @@
 
 (*unused*)
 lemma classic_Local_valid: 
-"!v. G|={%Z s. P Z (s[Loc Y::=v]) & s<Y> = a (s[Loc Y::=v])}.  
+"\<forall>v. G|={%Z s. P Z (s[Loc Y::=v]) & s<Y> = a (s[Loc Y::=v])}.  
   c .{%Z s. Q Z (s[Loc Y::=v])} ==> G|={P}. LOCAL Y:=a IN c .{Q}"
 apply (unfold hoare_valids_def)
 apply (simp (no_asm_use) add: triple_valid_def2)
@@ -96,7 +96,7 @@
 apply simp
 done
 
-lemma classic_Local: "!v. G|-{%Z s. P Z (s[Loc Y::=v]) & s<Y> = a (s[Loc Y::=v])}.  
+lemma classic_Local: "\<forall>v. G|-{%Z s. P Z (s[Loc Y::=v]) & s<Y> = a (s[Loc Y::=v])}.  
   c .{%Z s. Q Z (s[Loc Y::=v])} ==> G|-{P}. LOCAL Y:=a IN c .{Q}"
 apply (rule export_s)
 apply (rule hoare_derivs.Local [THEN conseq1])
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IMPP/Natural.thy
--- a/src/HOL/IMPP/Natural.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IMPP/Natural.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -103,7 +103,7 @@
 declare evaln_elim_cases [elim!]
 
 (* evaluation of com is deterministic *)
-lemma com_det [rule_format (no_asm)]: "<c,s> -c-> t ==> (!u. <c,s> -c-> u --> u=t)"
+lemma com_det [rule_format (no_asm)]: "<c,s> -c-> t \<Longrightarrow> (\<forall>u. <c,s> -c-> u \<longrightarrow> u=t)"
 apply (erule evalc.induct)
 apply (erule_tac [8] V = "<c,s1> -c-> s2" for c in thin_rl)
 apply (blast elim: evalc_WHILE_case)+
@@ -121,7 +121,7 @@
 apply blast
 done
 
-lemma evaln_nonstrict [rule_format]: "<c,s> -n-> t ==> !m. n<=m --> <c,s> -m-> t"
+lemma evaln_nonstrict [rule_format]: "<c,s> -n-> t \<Longrightarrow> \<forall>m. n<=m \<longrightarrow> <c,s> -m-> t"
 apply (erule evaln.induct)
 apply (auto elim!: Suc_le_D_lemma)
 done
@@ -132,12 +132,12 @@
 done
 
 lemma evaln_max2: "[| <c1,s1> -n1-> t1;  <c2,s2> -n2-> t2 |] ==>  
-    ? n. <c1,s1> -n -> t1 & <c2,s2> -n -> t2"
+    \<exists>n. <c1,s1> -n -> t1 \<and> <c2,s2> -n -> t2"
 apply (cut_tac m = "n1" and n = "n2" in nat_le_linear)
 apply (blast dest: evaln_nonstrict)
 done
 
-lemma evalc_evaln: "<c,s> -c-> t ==> ? n. <c,s> -n-> t"
+lemma evalc_evaln: "<c,s> -c-> t \<Longrightarrow> \<exists>n. <c,s> -n-> t"
 apply (erule evalc.induct)
 apply (tactic \<open>ALLGOALS (REPEAT o eresolve_tac @{context} [exE])\<close>)
 apply (tactic \<open>TRYALL (EVERY' [dresolve_tac @{context} @{thms evaln_max2}, assume_tac @{context},
@@ -147,7 +147,7 @@
     resolve_tac @{context} @{thms evaln.intros} THEN_ALL_NEW assume_tac @{context})\<close>)
 done
 
-lemma eval_eq: "<c,s> -c-> t = (? n. <c,s> -n-> t)"
+lemma eval_eq: "<c,s> -c-> t = (\<exists>n. <c,s> -n-> t)"
 apply (fast elim: evalc_evaln evaln_evalc)
 done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IOA/Asig.thy
--- a/src/HOL/IOA/Asig.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IOA/Asig.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -9,40 +9,40 @@
 imports Main
 begin
 
-type_synonym 'a signature = "('a set * 'a set * 'a set)"
+type_synonym 'a signature = "('a set \<times> 'a set \<times> 'a set)"
 
-definition "inputs" :: "'action signature => 'action set"
-  where asig_inputs_def: "inputs == fst"
+definition "inputs" :: "'action signature \<Rightarrow> 'action set"
+  where asig_inputs_def: "inputs \<equiv> fst"
 
-definition "outputs" :: "'action signature => 'action set"
-  where asig_outputs_def: "outputs == (fst o snd)"
+definition "outputs" :: "'action signature \<Rightarrow> 'action set"
+  where asig_outputs_def: "outputs \<equiv> (fst \<circ> snd)"
 
-definition "internals" :: "'action signature => 'action set"
-  where asig_internals_def: "internals == (snd o snd)"
+definition "internals" :: "'action signature \<Rightarrow> 'action set"
+  where asig_internals_def: "internals \<equiv> (snd \<circ> snd)"
 
-definition "actions" :: "'action signature => 'action set"
-  where actions_def: "actions(asig) == (inputs(asig) Un outputs(asig) Un internals(asig))"
+definition "actions" :: "'action signature \<Rightarrow> 'action set"
+  where actions_def: "actions(asig) \<equiv> (inputs(asig) \<union> outputs(asig) \<union> internals(asig))"
 
-definition externals :: "'action signature => 'action set"
-  where externals_def: "externals(asig) == (inputs(asig) Un outputs(asig))"
+definition externals :: "'action signature \<Rightarrow> 'action set"
+  where externals_def: "externals(asig) \<equiv> (inputs(asig) \<union> outputs(asig))"
 
 definition is_asig :: "'action signature => bool"
-  where "is_asig(triple) ==
-    ((inputs(triple) Int outputs(triple) = {})    &
-     (outputs(triple) Int internals(triple) = {}) &
-     (inputs(triple) Int internals(triple) = {}))"
+  where "is_asig(triple) \<equiv>
+    ((inputs(triple) \<inter> outputs(triple) = {})    \<and>
+     (outputs(triple) \<inter> internals(triple) = {}) \<and>
+     (inputs(triple) \<inter> internals(triple) = {}))"
 
-definition mk_ext_asig :: "'action signature => 'action signature"
-  where "mk_ext_asig(triple) == (inputs(triple), outputs(triple), {})"
+definition mk_ext_asig :: "'action signature \<Rightarrow> 'action signature"
+  where "mk_ext_asig(triple) \<equiv> (inputs(triple), outputs(triple), {})"
 
 
 lemmas asig_projections = asig_inputs_def asig_outputs_def asig_internals_def
 
-lemma int_and_ext_is_act: "[| a~:internals(S) ;a~:externals(S)|] ==> a~:actions(S)"
+lemma int_and_ext_is_act: "\<lbrakk>a\<notin>internals(S); a\<notin>externals(S)\<rbrakk> \<Longrightarrow> a\<notin>actions(S)"
   apply (simp add: externals_def actions_def)
   done
 
-lemma ext_is_act: "[|a:externals(S)|] ==> a:actions(S)"
+lemma ext_is_act: "a\<in>externals(S) \<Longrightarrow> a\<in>actions(S)"
   apply (simp add: externals_def actions_def)
   done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IOA/IOA.thy
--- a/src/HOL/IOA/IOA.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IOA/IOA.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -18,9 +18,9 @@
 (* IO automata *)
 
 definition state_trans :: "['action signature, ('action,'state)transition set] => bool"
-  where "state_trans asig R ==
-     (!triple. triple:R --> fst(snd(triple)):actions(asig)) &
-     (!a. (a:inputs(asig)) --> (!s1. ? s2. (s1,a,s2):R))"
+  where "state_trans asig R \<equiv>
+     (\<forall>triple. triple \<in> R \<longrightarrow> fst(snd(triple)) \<in> actions(asig)) \<and>
+     (\<forall>a. (a \<in> inputs(asig)) \<longrightarrow> (\<forall>s1. \<exists>s2. (s1,a,s2) \<in> R))"
 
 definition asig_of :: "('action,'state)ioa => 'action signature"
   where "asig_of == fst"
@@ -43,60 +43,60 @@
    the first is the action options, the second the state sequence.
    Finite executions have None actions from some point on. *)
 definition is_execution_fragment :: "[('action,'state)ioa, ('action,'state)execution] => bool"
-  where "is_execution_fragment A ex ==
+  where "is_execution_fragment A ex \<equiv>
      let act = fst(ex); state = snd(ex)
-     in !n a. (act(n)=None --> state(Suc(n)) = state(n)) &
-              (act(n)=Some(a) --> (state(n),a,state(Suc(n))):trans_of(A))"
+     in \<forall>n a. (act(n)=None \<longrightarrow> state(Suc(n)) = state(n)) \<and>
+              (act(n)=Some(a) \<longrightarrow> (state(n),a,state(Suc(n))) \<in> trans_of(A))"
 
 definition executions :: "('action,'state)ioa => ('action,'state)execution set"
-  where "executions(ioa) == {e. snd e 0:starts_of(ioa) & is_execution_fragment ioa e}"
+  where "executions(ioa) \<equiv> {e. snd e 0 \<in> starts_of(ioa) \<and> is_execution_fragment ioa e}"
 
 
 definition reachable :: "[('action,'state)ioa, 'state] => bool"
-  where "reachable ioa s == (? ex:executions(ioa). ? n. (snd ex n) = s)"
+  where "reachable ioa s \<equiv> (\<exists>ex\<in>executions(ioa). \<exists>n. (snd ex n) = s)"
 
 definition invariant :: "[('action,'state)ioa, 'state=>bool] => bool"
-  where "invariant A P == (!s. reachable A s --> P(s))"
+  where "invariant A P \<equiv> (\<forall>s. reachable A s \<longrightarrow> P(s))"
 
 
 (* Composition of action signatures and automata *)
 
 consts
-  compatible_asigs ::"('a => 'action signature) => bool"
-  asig_composition ::"('a => 'action signature) => 'action signature"
-  compatible_ioas  ::"('a => ('action,'state)ioa) => bool"
-  ioa_composition  ::"('a => ('action, 'state)ioa) =>('action,'a => 'state)ioa"
+  compatible_asigs ::"('a \<Rightarrow> 'action signature) \<Rightarrow> bool"
+  asig_composition ::"('a \<Rightarrow> 'action signature) \<Rightarrow> 'action signature"
+  compatible_ioas  ::"('a \<Rightarrow> ('action,'state)ioa) \<Rightarrow> bool"
+  ioa_composition  ::"('a \<Rightarrow> ('action, 'state)ioa) \<Rightarrow> ('action,'a \<Rightarrow> 'state)ioa"
 
 
 (* binary composition of action signatures and automata *)
 
 definition compat_asigs ::"['action signature, 'action signature] => bool"
   where "compat_asigs a1 a2 ==
-   (((outputs(a1) Int outputs(a2)) = {}) &
-    ((internals(a1) Int actions(a2)) = {}) &
+   (((outputs(a1) Int outputs(a2)) = {}) \<and>
+    ((internals(a1) Int actions(a2)) = {}) \<and>
     ((internals(a2) Int actions(a1)) = {}))"
 
-definition compat_ioas  ::"[('action,'s)ioa, ('action,'t)ioa] => bool"
-  where "compat_ioas ioa1 ioa2 == compat_asigs (asig_of(ioa1)) (asig_of(ioa2))"
+definition compat_ioas  ::"[('action,'s)ioa, ('action,'t)ioa] \<Rightarrow> bool"
+  where "compat_ioas ioa1 ioa2 \<equiv> compat_asigs (asig_of(ioa1)) (asig_of(ioa2))"
 
-definition asig_comp :: "['action signature, 'action signature] => 'action signature"
-  where "asig_comp a1 a2 ==
-      (((inputs(a1) Un inputs(a2)) - (outputs(a1) Un outputs(a2)),
-        (outputs(a1) Un outputs(a2)),
-        (internals(a1) Un internals(a2))))"
+definition asig_comp :: "['action signature, 'action signature] \<Rightarrow> 'action signature"
+  where "asig_comp a1 a2 \<equiv>
+      (((inputs(a1) \<union> inputs(a2)) - (outputs(a1) \<union> outputs(a2)),
+        (outputs(a1) \<union> outputs(a2)),
+        (internals(a1) \<union> internals(a2))))"
 
-definition par :: "[('a,'s)ioa, ('a,'t)ioa] => ('a,'s*'t)ioa"  (infixr "||" 10)
-  where "(ioa1 || ioa2) ==
+definition par :: "[('a,'s)ioa, ('a,'t)ioa] \<Rightarrow> ('a,'s*'t)ioa"  (infixr "||" 10)
+  where "(ioa1 || ioa2) \<equiv>
      (asig_comp (asig_of ioa1) (asig_of ioa2),
-      {pr. fst(pr):starts_of(ioa1) & snd(pr):starts_of(ioa2)},
+      {pr. fst(pr) \<in> starts_of(ioa1) \<and> snd(pr) \<in> starts_of(ioa2)},
       {tr. let s = fst(tr); a = fst(snd(tr)); t = snd(snd(tr))
-           in (a:actions(asig_of(ioa1)) | a:actions(asig_of(ioa2))) &
-              (if a:actions(asig_of(ioa1)) then
-                 (fst(s),a,fst(t)):trans_of(ioa1)
+           in (a \<in> actions(asig_of(ioa1)) | a \<in> actions(asig_of(ioa2))) &
+              (if a \<in> actions(asig_of(ioa1)) then
+                 (fst(s),a,fst(t)) \<in> trans_of(ioa1)
                else fst(t) = fst(s))
               &
-              (if a:actions(asig_of(ioa2)) then
-                 (snd(s),a,snd(t)):trans_of(ioa2)
+              (if a \<in> actions(asig_of(ioa2)) then
+                 (snd(s),a,snd(t)) \<in> trans_of(ioa2)
                else snd(t) = snd(s))})"
 
 
@@ -104,35 +104,35 @@
 
 (* Restrict the trace to those members of the set s *)
 definition filter_oseq :: "('a => bool) => 'a oseq => 'a oseq"
-  where "filter_oseq p s ==
-   (%i. case s(i)
-         of None => None
-          | Some(x) => if p x then Some x else None)"
+  where "filter_oseq p s \<equiv>
+   (\<lambda>i. case s(i)
+         of None \<Rightarrow> None
+          | Some(x) \<Rightarrow> if p x then Some x else None)"
 
-definition mk_trace :: "[('action,'state)ioa, 'action oseq] => 'action oseq"
-  where "mk_trace(ioa) == filter_oseq(%a. a:externals(asig_of(ioa)))"
+definition mk_trace :: "[('action,'state)ioa, 'action oseq] \<Rightarrow> 'action oseq"
+  where "mk_trace(ioa) \<equiv> filter_oseq(\<lambda>a. a \<in> externals(asig_of(ioa)))"
 
 (* Does an ioa have an execution with the given trace *)
-definition has_trace :: "[('action,'state)ioa, 'action oseq] => bool"
-  where "has_trace ioa b == (? ex:executions(ioa). b = mk_trace ioa (fst ex))"
+definition has_trace :: "[('action,'state)ioa, 'action oseq] \<Rightarrow> bool"
+  where "has_trace ioa b \<equiv> (\<exists>ex\<in>executions(ioa). b = mk_trace ioa (fst ex))"
 
 definition NF :: "'a oseq => 'a oseq"
-  where "NF(tr) == @nf. ? f. mono(f) & (!i. nf(i)=tr(f(i))) &
-                    (!j. j ~: range(f) --> nf(j)= None) &
-                    (!i. nf(i)=None --> (nf (Suc i)) = None)"
+  where "NF(tr) \<equiv> SOME nf. \<exists>f. mono(f) \<and> (\<forall>i. nf(i)=tr(f(i))) \<and>
+                    (\<forall>j. j \<notin> range(f) \<longrightarrow> nf(j)= None) &
+                    (\<forall>i. nf(i)=None --> (nf (Suc i)) = None)"
 
 (* All the traces of an ioa *)
 definition traces :: "('action,'state)ioa => 'action oseq set"
-  where "traces(ioa) == {trace. ? tr. trace=NF(tr) & has_trace ioa tr}"
+  where "traces(ioa) \<equiv> {trace. \<exists>tr. trace=NF(tr) \<and> has_trace ioa tr}"
 
 
 definition restrict_asig :: "['a signature, 'a set] => 'a signature"
-  where "restrict_asig asig actns ==
-    (inputs(asig) Int actns, outputs(asig) Int actns,
-     internals(asig) Un (externals(asig) - actns))"
+  where "restrict_asig asig actns \<equiv>
+    (inputs(asig) \<inter> actns, outputs(asig) \<inter> actns,
+     internals(asig) \<union> (externals(asig) - actns))"
 
 definition restrict :: "[('a,'s)ioa, 'a set] => ('a,'s)ioa"
-  where "restrict ioa actns ==
+  where "restrict ioa actns \<equiv>
     (restrict_asig (asig_of ioa) actns, starts_of(ioa), trans_of(ioa))"
 
 
@@ -140,23 +140,23 @@
 (* Notions of correctness *)
 
 definition ioa_implements :: "[('action,'state1)ioa, ('action,'state2)ioa] => bool"
-  where "ioa_implements ioa1 ioa2 ==
-  ((inputs(asig_of(ioa1)) = inputs(asig_of(ioa2))) &
-     (outputs(asig_of(ioa1)) = outputs(asig_of(ioa2))) &
-      traces(ioa1) <= traces(ioa2))"
+  where "ioa_implements ioa1 ioa2 \<equiv>
+  ((inputs(asig_of(ioa1)) = inputs(asig_of(ioa2))) \<and>
+     (outputs(asig_of(ioa1)) = outputs(asig_of(ioa2))) \<and>
+      traces(ioa1) \<subseteq> traces(ioa2))"
 
 
 (* Instantiation of abstract IOA by concrete actions *)
 
-definition rename :: "('a, 'b)ioa => ('c => 'a option) => ('c,'b)ioa"
-  where "rename ioa ren ==
-    (({b. ? x. Some(x)= ren(b) & x : inputs(asig_of(ioa))},
-      {b. ? x. Some(x)= ren(b) & x : outputs(asig_of(ioa))},
-      {b. ? x. Some(x)= ren(b) & x : internals(asig_of(ioa))}),
+definition rename :: "('a, 'b)ioa \<Rightarrow> ('c \<Rightarrow> 'a option) \<Rightarrow> ('c,'b)ioa"
+  where "rename ioa ren \<equiv>
+    (({b. \<exists>x. Some(x)= ren(b) \<and> x \<in> inputs(asig_of(ioa))},
+      {b. \<exists>x. Some(x)= ren(b) \<and> x \<in> outputs(asig_of(ioa))},
+      {b. \<exists>x. Some(x)= ren(b) \<and> x \<in> internals(asig_of(ioa))}),
                 starts_of(ioa)   ,
      {tr. let s = fst(tr); a = fst(snd(tr));  t = snd(snd(tr))
           in
-          ? x. Some(x) = ren(a) & (s,x,t):trans_of(ioa)})"
+          \<exists>x. Some(x) = ren(a) \<and> (s,x,t) \<in> trans_of(ioa)})"
 
 
 declare Let_def [simp]
@@ -170,7 +170,7 @@
   done
 
 lemma trans_in_actions:
-  "[| IOA(A); (s1,a,s2):trans_of(A) |] ==> a:actions(asig_of(A))"
+  "[| IOA(A); (s1,a,s2) \<in> trans_of(A) |] ==> a \<in> actions(asig_of(A))"
   apply (unfold IOA_def state_trans_def actions_def is_asig_def)
   apply (erule conjE)+
   apply (erule allE, erule impE, assumption)
@@ -187,16 +187,16 @@
 
 lemma mk_trace_thm:
 "(mk_trace A s n = None) =
-   (s(n)=None | (? a. s(n)=Some(a) & a ~: externals(asig_of(A))))
+   (s(n)=None | (\<exists>a. s(n)=Some(a) \<and> a \<notin> externals(asig_of(A))))
    &
    (mk_trace A s n = Some(a)) =
-    (s(n)=Some(a) & a : externals(asig_of(A)))"
+    (s(n)=Some(a) \<and> a \<in> externals(asig_of(A)))"
   apply (unfold mk_trace_def filter_oseq_def)
   apply (case_tac "s n")
   apply auto
   done
 
-lemma reachable_0: "s:starts_of(A) ==> reachable A s"
+lemma reachable_0: "s \<in> starts_of(A) \<Longrightarrow> reachable A s"
   apply (unfold reachable_def)
   apply (rule_tac x = "(%i. None, %i. s)" in bexI)
   apply simp
@@ -204,7 +204,7 @@
   done
 
 lemma reachable_n:
-  "!!A. [| reachable A s; (s,a,t) : trans_of(A) |] ==> reachable A t"
+  "\<And>A. [| reachable A s; (s,a,t) \<in> trans_of(A) |] ==> reachable A t"
   apply (unfold reachable_def exec_rws)
   apply (simp del: bex_simps)
   apply (simp (no_asm_simp) only: split_tupled_all)
@@ -219,8 +219,8 @@
 
 
 lemma invariantI:
-  assumes p1: "!!s. s:starts_of(A) ==> P(s)"
-    and p2: "!!s t a. [|reachable A s; P(s)|] ==> (s,a,t): trans_of(A) --> P(t)"
+  assumes p1: "\<And>s. s \<in> starts_of(A) \<Longrightarrow> P(s)"
+    and p2: "\<And>s t a. [|reachable A s; P(s)|] ==> (s,a,t) \<in> trans_of(A) \<longrightarrow> P(t)"
   shows "invariant A P"
   apply (unfold invariant_def reachable_def Let_def exec_rws)
   apply safe
@@ -237,8 +237,8 @@
   done
 
 lemma invariantI1:
- "[| !!s. s : starts_of(A) ==> P(s);
-     !!s t a. reachable A s ==> P(s) --> (s,a,t):trans_of(A) --> P(t)
+ "[| \<And>s. s \<in> starts_of(A) \<Longrightarrow> P(s);
+     \<And>s t a. reachable A s \<Longrightarrow> P(s) \<longrightarrow> (s,a,t) \<in> trans_of(A) \<longrightarrow> P(t)
   |] ==> invariant A P"
   apply (blast intro!: invariantI)
   done
@@ -250,36 +250,36 @@
   done
 
 lemma actions_asig_comp:
-  "actions(asig_comp a b) = actions(a) Un actions(b)"
+  "actions(asig_comp a b) = actions(a) \<union> actions(b)"
   apply (auto simp add: actions_def asig_comp_def asig_projections)
   done
 
 lemma starts_of_par:
-  "starts_of(A || B) = {p. fst(p):starts_of(A) & snd(p):starts_of(B)}"
+  "starts_of(A || B) = {p. fst(p) \<in> starts_of(A) \<and> snd(p) \<in> starts_of(B)}"
   apply (simp add: par_def ioa_projections)
   done
 
 (* Every state in an execution is reachable *)
 lemma states_of_exec_reachable:
-  "ex:executions(A) ==> !n. reachable A (snd ex n)"
+  "ex \<in> executions(A) \<Longrightarrow> \<forall>n. reachable A (snd ex n)"
   apply (unfold reachable_def)
   apply fast
   done
 
 
 lemma trans_of_par4:
-"(s,a,t) : trans_of(A || B || C || D) =
-  ((a:actions(asig_of(A)) | a:actions(asig_of(B)) | a:actions(asig_of(C)) |
-    a:actions(asig_of(D))) &
-   (if a:actions(asig_of(A)) then (fst(s),a,fst(t)):trans_of(A)
-    else fst t=fst s) &
-   (if a:actions(asig_of(B)) then (fst(snd(s)),a,fst(snd(t))):trans_of(B)
-    else fst(snd(t))=fst(snd(s))) &
-   (if a:actions(asig_of(C)) then
-      (fst(snd(snd(s))),a,fst(snd(snd(t)))):trans_of(C)
-    else fst(snd(snd(t)))=fst(snd(snd(s)))) &
-   (if a:actions(asig_of(D)) then
-      (snd(snd(snd(s))),a,snd(snd(snd(t)))):trans_of(D)
+"(s,a,t) \<in> trans_of(A || B || C || D) =
+  ((a \<in> actions(asig_of(A)) | a \<in> actions(asig_of(B)) | a \<in> actions(asig_of(C)) |
+    a \<in> actions(asig_of(D))) \<and>
+   (if a \<in> actions(asig_of(A)) then (fst(s),a,fst(t)) \<in> trans_of(A)
+    else fst t=fst s) \<and>
+   (if a \<in> actions(asig_of(B)) then (fst(snd(s)),a,fst(snd(t))) \<in> trans_of(B)
+    else fst(snd(t))=fst(snd(s))) \<and>
+   (if a \<in> actions(asig_of(C)) then
+      (fst(snd(snd(s))),a,fst(snd(snd(t)))) \<in> trans_of(C)
+    else fst(snd(snd(t)))=fst(snd(snd(s)))) \<and>
+   (if a \<in> actions(asig_of(D)) then
+      (snd(snd(snd(s))),a,snd(snd(snd(t)))) \<in> trans_of(D)
     else snd(snd(snd(t)))=snd(snd(snd(s)))))"
   (*SLOW*)
   apply (simp (no_asm) add: par_def actions_asig_comp prod_eq_iff ioa_projections)
@@ -298,20 +298,20 @@
 
 
 lemma externals_of_par: "externals(asig_of(A1||A2)) =
-   (externals(asig_of(A1)) Un externals(asig_of(A2)))"
+   (externals(asig_of(A1)) \<union> externals(asig_of(A2)))"
   apply (simp add: externals_def asig_of_par asig_comp_def
     asig_inputs_def asig_outputs_def Un_def set_diff_eq)
   apply blast
   done
 
 lemma ext1_is_not_int2:
-  "[| compat_ioas A1 A2; a:externals(asig_of(A1))|] ==> a~:internals(asig_of(A2))"
+  "[| compat_ioas A1 A2; a \<in> externals(asig_of(A1))|] ==> a \<notin> internals(asig_of(A2))"
   apply (unfold externals_def actions_def compat_ioas_def compat_asigs_def)
   apply auto
   done
 
 lemma ext2_is_not_int1:
- "[| compat_ioas A2 A1 ; a:externals(asig_of(A1))|] ==> a~:internals(asig_of(A2))"
+ "[| compat_ioas A2 A1 ; a \<in> externals(asig_of(A1))|] ==> a \<notin> internals(asig_of(A2))"
   apply (unfold externals_def actions_def compat_ioas_def compat_asigs_def)
   apply auto
   done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/IOA/Solve.thy
--- a/src/HOL/IOA/Solve.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/IOA/Solve.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -9,20 +9,20 @@
 imports IOA
 begin
 
-definition is_weak_pmap :: "['c => 'a, ('action,'c)ioa,('action,'a)ioa] => bool" where
-  "is_weak_pmap f C A ==
-   (!s:starts_of(C). f(s):starts_of(A)) &
-   (!s t a. reachable C s &
-            (s,a,t):trans_of(C)
-            --> (if a:externals(asig_of(C)) then
-                   (f(s),a,f(t)):trans_of(A)
+definition is_weak_pmap :: "['c \<Rightarrow> 'a, ('action,'c)ioa,('action,'a)ioa] \<Rightarrow> bool" where
+  "is_weak_pmap f C A \<equiv>
+   (\<forall>s\<in>starts_of(C). f(s)\<in>starts_of(A)) \<and>
+   (\<forall>s t a. reachable C s \<and>
+            (s,a,t)\<in>trans_of(C)
+            \<longrightarrow> (if a\<in>externals(asig_of(C)) then
+                   (f(s),a,f(t))\<in>trans_of(A)
                  else f(s)=f(t)))"
 
 declare mk_trace_thm [simp] trans_in_actions [simp]
 
 lemma trace_inclusion: 
   "[| IOA(C); IOA(A); externals(asig_of(C)) = externals(asig_of(A));  
-           is_weak_pmap f C A |] ==> traces(C) <= traces(A)"
+           is_weak_pmap f C A |] ==> traces(C) \<subseteq> traces(A)"
   apply (unfold is_weak_pmap_def traces_def)
 
   apply (simp (no_asm) add: has_trace_def)
@@ -34,7 +34,7 @@
   apply simp
 
   (* give execution of abstract automata *)
-  apply (rule_tac x = "(mk_trace A ex1,%i. f (ex2 i))" in bexI)
+  apply (rule_tac x = "(mk_trace A ex1,\<lambda>i. f (ex2 i))" in bexI)
 
   (* Traces coincide *)
    apply (simp (no_asm_simp) add: mk_trace_def filter_oseq_idemp)
@@ -62,16 +62,16 @@
 
 (* Lemmata *)
 
-lemma imp_conj_lemma: "(P ==> Q-->R) ==> P&Q --> R"
+lemma imp_conj_lemma: "(P \<Longrightarrow> Q\<longrightarrow>R) \<Longrightarrow> P\<and>Q \<longrightarrow> R"
   by blast
 
 
 (* fist_order_tautology of externals_of_par *)
 lemma externals_of_par_extra:
-  "a:externals(asig_of(A1||A2)) =     
-   (a:externals(asig_of(A1)) & a:externals(asig_of(A2)) |   
-   a:externals(asig_of(A1)) & a~:externals(asig_of(A2)) |   
-   a~:externals(asig_of(A1)) & a:externals(asig_of(A2)))"
+  "a\<in>externals(asig_of(A1||A2)) =     
+   (a\<in>externals(asig_of(A1)) \<and> a\<in>externals(asig_of(A2)) \<or>
+   a\<in>externals(asig_of(A1)) \<and> a\<notin>externals(asig_of(A2)) \<or>
+   a\<notin>externals(asig_of(A1)) \<and> a\<in>externals(asig_of(A2)))"
   apply (auto simp add: externals_def asig_of_par asig_comp_def asig_inputs_def asig_outputs_def)
   done
 
@@ -79,7 +79,7 @@
   apply (simp add: reachable_def)
   apply (erule bexE)
   apply (rule_tac x =
-    "(filter_oseq (%a. a:actions (asig_of (C1))) (fst ex) , %i. fst (snd ex i))" in bexI)
+    "(filter_oseq (\<lambda>a. a\<in>actions (asig_of (C1))) (fst ex) , \<lambda>i. fst (snd ex i))" in bexI)
 (* fst(s) is in projected execution *)
   apply force
 (* projected execution is indeed an execution *)
@@ -96,7 +96,7 @@
   apply (simp add: reachable_def)
   apply (erule bexE)
   apply (rule_tac x =
-    "(filter_oseq (%a. a:actions (asig_of (C2))) (fst ex) , %i. snd (snd ex i))" in bexI)
+    "(filter_oseq (\<lambda>a. a\<in>actions (asig_of (C2))) (fst ex) , \<lambda>i. snd (snd ex i))" in bexI)
 (* fst(s) is in projected execution *)
   apply force
 (* projected execution is indeed an execution *)
@@ -115,7 +115,7 @@
          is_weak_pmap g C2 A2;   
          externals(asig_of(A2))=externals(asig_of(C2));  
          compat_ioas C1 C2; compat_ioas A1 A2  |]      
-   ==> is_weak_pmap (%p.(f(fst(p)),g(snd(p)))) (C1||C2) (A1||A2)"
+   ==> is_weak_pmap (\<lambda>p.(f(fst(p)),g(snd(p)))) (C1||C2) (A1||A2)"
   apply (unfold is_weak_pmap_def)
   apply (rule conjI)
 (* start_states *)
@@ -139,7 +139,7 @@
   apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act1)
 (* case 4      a:~e(A1) | a~:e(A2) *)
   apply (rule impI)
-  apply (subgoal_tac "a~:externals (asig_of (A1)) & a~:externals (asig_of (A2))")
+  apply (subgoal_tac "a\<notin>externals (asig_of (A1)) & a\<notin>externals (asig_of (A2))")
 (* delete auxiliary subgoal *)
   prefer 2
   apply force
@@ -153,7 +153,7 @@
 lemma reachable_rename_ioa: "[| reachable (rename C g) s |] ==> reachable C s"
   apply (simp add: reachable_def)
   apply (erule bexE)
-  apply (rule_tac x = "((%i. case (fst ex i) of None => None | Some (x) => g x) ,snd ex)" in bexI)
+  apply (rule_tac x = "((\<lambda>i. case (fst ex i) of None \<Rightarrow> None | Some (x) => g x) ,snd ex)" in bexI)
   apply (simp (no_asm))
 (* execution is indeed an execution of C *)
   apply (simp add: executions_def is_execution_fragment_def par_def
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Induct/SList.thy
--- a/src/HOL/Induct/SList.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Induct/SList.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -49,8 +49,8 @@
   list :: "'a item set => 'a item set"
   for A :: "'a item set"
   where
-    NIL_I:  "NIL: list A"
-  | CONS_I: "[| a: A;  M: list A |] ==> CONS a M : list A"
+    NIL_I:  "NIL \<in> list A"
+  | CONS_I: "[| a \<in> A;  M \<in> list A |] ==> CONS a M \<in> list A"
 
 
 definition "List = list (range Leaf)"
@@ -68,7 +68,7 @@
   
 definition
   List_rec  :: "['a item, 'b, ['a item, 'a item, 'b]=>'b] => 'b" where
-  "List_rec M c d = wfrec (pred_sexp^+)
+  "List_rec M c d = wfrec (pred_sexp\<^sup>+)
                            (%g. List_case c (%x y. d x y (g y))) M"
 
 
@@ -139,10 +139,10 @@
   take_0:  "take xs 0 = []"
 | take_Suc: "take xs (Suc n) = list_case [] (%x l. x # take l n) xs"
 
-lemma ListI: "x : list (range Leaf) ==> x : List"
+lemma ListI: "x \<in> list (range Leaf) \<Longrightarrow> x \<in> List"
 by (simp add: List_def)
 
-lemma ListD: "x : List ==> x : list (range Leaf)"
+lemma ListD: "x \<in> List \<Longrightarrow> x \<in> list (range Leaf)"
 by (simp add: List_def)
 
 lemma list_unfold: "list(A) = usum {Numb(0)} (uprod A (list(A)))"
@@ -225,10 +225,10 @@
 
 lemmas Cons_inject2 = Cons_Cons_eq [THEN iffD1, THEN conjE]
 
-lemma CONS_D: "CONS M N: list(A) ==> M: A & N: list(A)"
+lemma CONS_D: "CONS M N \<in> list(A) \<Longrightarrow> M \<in> A & N \<in> list(A)"
   by (induct L == "CONS M N" rule: list.induct) auto
 
-lemma sexp_CONS_D: "CONS M N: sexp ==> M: sexp & N: sexp"
+lemma sexp_CONS_D: "CONS M N \<in> sexp \<Longrightarrow> M \<in> sexp \<and> N \<in> sexp"
 apply (simp add: CONS_def In1_def)
 apply (fast dest!: Scons_D)
 done
@@ -237,14 +237,14 @@
 (*Reasoning about constructors and their freeness*)
 
 
-lemma not_CONS_self: "N: list(A) ==> !M. N ~= CONS M N"
+lemma not_CONS_self: "N \<in> list(A) \<Longrightarrow> \<forall>M. N \<noteq> CONS M N"
 apply (erule list.induct) apply simp_all done
 
-lemma not_Cons_self2: "\<forall>x. l ~= x#l"
+lemma not_Cons_self2: "\<forall>x. l \<noteq> x#l"
 by (induct l rule: list_induct) simp_all
 
 
-lemma neq_Nil_conv2: "(xs ~= []) = (\<exists>y ys. xs = y#ys)"
+lemma neq_Nil_conv2: "(xs \<noteq> []) = (\<exists>y ys. xs = y#ys)"
 by (induct xs rule: list_induct) auto
 
 (** Conversion rules for List_case: case analysis operator **)
@@ -262,8 +262,8 @@
    hold if pred_sexp^+ were changed to pred_sexp. *)
 
 lemma List_rec_unfold_lemma:
-     "(%M. List_rec M c d) == 
-      wfrec (pred_sexp^+) (%g. List_case c (%x y. d x y (g y)))"
+     "(\<lambda>M. List_rec M c d) \<equiv>
+      wfrec (pred_sexp\<^sup>+) (\<lambda>g. List_case c (\<lambda>x y. d x y (g y)))"
 by (simp add: List_rec_def)
 
 lemmas List_rec_unfold = 
@@ -273,16 +273,16 @@
 (** pred_sexp lemmas **)
 
 lemma pred_sexp_CONS_I1: 
-    "[| M: sexp;  N: sexp |] ==> (M, CONS M N) : pred_sexp^+"
+    "[| M \<in> sexp;  N \<in> sexp |] ==> (M, CONS M N) \<in> pred_sexp\<^sup>+"
 by (simp add: CONS_def In1_def)
 
 lemma pred_sexp_CONS_I2: 
-    "[| M: sexp;  N: sexp |] ==> (N, CONS M N) : pred_sexp^+"
+    "[| M \<in> sexp;  N \<in> sexp |] ==> (N, CONS M N) \<in> pred_sexp\<^sup>+"
 by (simp add: CONS_def In1_def)
 
 lemma pred_sexp_CONS_D: 
-    "(CONS M1 M2, N) : pred_sexp^+ ==>  
-     (M1,N) : pred_sexp^+ & (M2,N) : pred_sexp^+"
+    "(CONS M1 M2, N) \<in> pred_sexp\<^sup>+ \<Longrightarrow>
+     (M1,N) \<in> pred_sexp\<^sup>+ \<and> (M2,N) \<in> pred_sexp\<^sup>+"
 apply (frule pred_sexp_subset_Sigma [THEN trancl_subset_Sigma, THEN subsetD])
 apply (blast dest!: sexp_CONS_D intro: pred_sexp_CONS_I1 pred_sexp_CONS_I2 
                     trans_trancl [THEN transD])
@@ -297,7 +297,7 @@
 done
 
 lemma List_rec_CONS [simp]:
-     "[| M: sexp;  N: sexp |] 
+     "[| M \<in> sexp;  N \<in> sexp |] 
       ==> List_rec (CONS M N) c h = h M N (List_rec N c h)"
 apply (rule List_rec_unfold [THEN trans])
 apply (simp add: pred_sexp_CONS_I2)
@@ -322,11 +322,11 @@
 
 (*Type checking.  Useful?*)
 lemma List_rec_type:
-     "[| M: list(A);      
+     "[| M \<in> list(A);      
          A<=sexp;         
-         c: C(NIL);       
-         !!x y r. [| x: A;  y: list(A);  r: C(y) |] ==> h x y r: C(CONS x y)  
-      |] ==> List_rec M c h : C(M :: 'a item)"
+         c \<in> C(NIL);       
+         \<And>x y r. [| x \<in> A;  y \<in> list(A);  r \<in> C(y) |] ==> h x y r \<in> C(CONS x y)  
+      |] ==> List_rec M c h \<in> C(M :: 'a item)"
 apply (erule list.induct, simp) 
 apply (insert list_subset_sexp) 
 apply (subst List_rec_CONS, blast+)
@@ -343,7 +343,7 @@
     "Rep_map f(x#xs) = CONS(f x)(Rep_map f xs)"
 by (simp add: Rep_map_def)
 
-lemma Rep_map_type: "(!!x. f(x): A) ==> Rep_map f xs: list(A)"
+lemma Rep_map_type: "(\<And>x. f(x) \<in> A) \<Longrightarrow> Rep_map f xs \<in> list(A)"
 apply (simp add: Rep_map_def)
 apply (rule list_induct, auto)
 done
@@ -352,17 +352,17 @@
 by (simp add: Abs_map_def)
 
 lemma Abs_map_CONS [simp]: 
-    "[| M: sexp;  N: sexp |] ==> Abs_map g (CONS M N) = g(M) # Abs_map g N"
+    "[| M \<in> sexp;  N \<in> sexp |] ==> Abs_map g (CONS M N) = g(M) # Abs_map g N"
 by (simp add: Abs_map_def)
 
 (*Eases the use of primitive recursion.*)
 lemma def_list_rec_NilCons:
-    "[| !!xs. f(xs) = list_rec xs c h  |] 
-     ==> f [] = c & f(x#xs) = h x xs (f xs)"
+    "[| \<And>xs. f(xs) = list_rec xs c h  |] 
+     ==> f [] = c \<and> f(x#xs) = h x xs (f xs)"
 by simp 
 
 lemma Abs_map_inverse:
-     "[| M: list(A);  A<=sexp;  !!z. z: A ==> f(g(z)) = z |]  
+     "[| M \<in> list(A);  A<=sexp;  \<And>z. z \<in> A ==> f(g(z)) = z |]  
       ==> Rep_map f (Abs_map g M) = M"
 apply (erule list.induct, simp_all)
 apply (insert list_subset_sexp) 
@@ -383,7 +383,7 @@
 (** list_case **)
 
 lemma expand_list_case: 
- "P(list_case a f xs) = ((xs=[] --> P a ) & (!y ys. xs=y#ys --> P(f y ys)))"
+ "P(list_case a f xs) = ((xs=[] \<longrightarrow> P a ) \<and> (\<forall>y ys. xs=y#ys \<longrightarrow> P(f y ys)))"
 by (induct xs rule: list_induct) simp_all
 
 
@@ -394,8 +394,8 @@
 (** The functional "map" and the generalized functionals **)
 
 lemma Abs_Rep_map: 
-     "(!!x. f(x): sexp) ==>  
-        Abs_map g (Rep_map f xs) = map (%t. g(f(t))) xs"
+     "(\<And>x. f(x)\<in> sexp) ==>  
+        Abs_map g (Rep_map f xs) = map (\<lambda>t. g(f(t))) xs"
 apply (induct xs rule: list_induct)
 apply (simp_all add: Rep_map_type list_sexp [THEN subsetD])
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Induct/Sexp.thy
--- a/src/HOL/Induct/Sexp.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Induct/Sexp.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -24,9 +24,9 @@
 definition
   sexp_case :: "['a=>'b, nat=>'b, ['a item, 'a item]=>'b, 
                 'a item] => 'b" where
-  "sexp_case c d e M = (THE z. (EX x.   M=Leaf(x) & z=c(x))  
-                             | (EX k.   M=Numb(k) & z=d(k))  
-                             | (EX N1 N2. M = Scons N1 N2  & z=e N1 N2))"
+  "sexp_case c d e M = (THE z. (\<exists>x.   M=Leaf(x) & z=c(x))  
+                             | (\<exists>k.   M=Numb(k) & z=d(k))  
+                             | (\<exists>N1 N2. M = Scons N1 N2  & z=e N1 N2))"
 
 definition
   pred_sexp :: "('a item * 'a item)set" where
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Isar_Examples/Hoare.thy
--- a/src/HOL/Isar_Examples/Hoare.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Isar_Examples/Hoare.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -101,7 +101,7 @@
   assume cmd: "\<turnstile> P c Q"
   fix s s' :: 'a
   assume sem: "Sem c s s'"
-  assume "s : P'" with P'P have "s \<in> P" ..
+  assume "s \<in> P'" with P'P have "s \<in> P" ..
   with cmd sem have "s' \<in> Q" ..
   with QQ' show "s' \<in> Q'" ..
 qed
@@ -132,7 +132,7 @@
     from case_nb show ?thesis
     proof
       from sem nb show "Sem c2 s s'" by simp
-      from s nb show "s : P \<inter> -b" by simp
+      from s nb show "s \<in> P \<inter> -b" by simp
     qed
   qed
 qed
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Lattices_Big.thy
--- a/src/HOL/Lattices_Big.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Lattices_Big.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -711,7 +711,7 @@
     let ?A = "insert (Max A) ?B"
     have "finite ?B" using \<open>finite A\<close> by simp
     assume "A \<noteq> {}"
-    with \<open>finite A\<close> have "Max A : A" by auto
+    with \<open>finite A\<close> have "Max A \<in> A" by auto
     then have A: "?A = A" using insert_Diff_single insert_absorb by auto
     then have "P ?B" using \<open>P {}\<close> step IH [of ?B] by blast
     moreover 
@@ -905,7 +905,7 @@
 by(induction rule: finite.induct) (auto intro: order.strict_trans)
 
 lemma ex_is_arg_min_if_finite: fixes f :: "'a \<Rightarrow> 'b :: order"
-shows "\<lbrakk> finite S; S \<noteq> {} \<rbrakk> \<Longrightarrow> \<exists>x. is_arg_min f (\<lambda>x. x : S) x"
+shows "\<lbrakk> finite S; S \<noteq> {} \<rbrakk> \<Longrightarrow> \<exists>x. is_arg_min f (\<lambda>x. x \<in> S) x"
 unfolding is_arg_min_def
 using ex_min_if_finite[of "f ` S"]
 by auto
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/BNF_Corec.thy
--- a/src/HOL/Library/BNF_Corec.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/BNF_Corec.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -72,7 +72,7 @@
 lemma self_bounded_weaken_right: "(a :: 'a :: semilattice_inf) \<le> inf b a \<Longrightarrow> a \<le> b"
   by (erule le_infE)
 
-lemma symp_iff: "symp R \<longleftrightarrow> R = R^--1"
+lemma symp_iff: "symp R \<longleftrightarrow> R = R\<inverse>\<inverse>"
   by (metis antisym conversep.cases conversep_le_swap predicate2I symp_def)
 
 lemma equivp_inf: "\<lbrakk>equivp R; equivp S\<rbrakk> \<Longrightarrow> equivp (inf R S)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/Countable_Set.thy
--- a/src/HOL/Library/Countable_Set.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/Countable_Set.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -266,7 +266,7 @@
 by(induction n)(simp_all add: assms)
 
 lemma countable_rtrancl:
-  "(\<And>Y. countable Y \<Longrightarrow> countable (X `` Y)) \<Longrightarrow> countable Y \<Longrightarrow> countable (X^* `` Y)"
+  "(\<And>Y. countable Y \<Longrightarrow> countable (X `` Y)) \<Longrightarrow> countable Y \<Longrightarrow> countable (X\<^sup>* `` Y)"
   unfolding rtrancl_is_UN_relpow UN_Image by (intro countable_UN countableI_type countable_relpow)
 
 lemma countable_lists[intro, simp]:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/IArray.thy
--- a/src/HOL/Library/IArray.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/IArray.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -31,10 +31,10 @@
 [simp]: "length as = List.length (IArray.list_of as)"
 
 qualified fun all :: "('a \<Rightarrow> bool) \<Rightarrow> 'a iarray \<Rightarrow> bool" where
-"all p (IArray as) = (ALL a : set as. p a)"
+"all p (IArray as) = (\<forall>a \<in> set as. p a)"
 
 qualified fun exists :: "('a \<Rightarrow> bool) \<Rightarrow> 'a iarray \<Rightarrow> bool" where
-"exists p (IArray as) = (EX a : set as. p a)"
+"exists p (IArray as) = (\<exists>a \<in> set as. p a)"
 
 lemma list_of_code [code]:
 "IArray.list_of as = map (\<lambda>n. as !! n) [0 ..< IArray.length as]"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/Lub_Glb.thy
--- a/src/HOL/Library/Lub_Glb.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/Lub_Glb.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -11,24 +11,24 @@
 text \<open>Thanks to suggestions by James Margetson\<close>
 
 definition setle :: "'a set \<Rightarrow> 'a::ord \<Rightarrow> bool"  (infixl "*<=" 70)
-  where "S *<= x = (ALL y: S. y \<le> x)"
+  where "S *<= x = (\<forall>y\<in>S. y \<le> x)"
 
 definition setge :: "'a::ord \<Rightarrow> 'a set \<Rightarrow> bool"  (infixl "<=*" 70)
-  where "x <=* S = (ALL y: S. x \<le> y)"
+  where "x <=* S = (\<forall>y\<in>S. x \<le> y)"
 
 
 subsection \<open>Rules for the Relations \<open>*<=\<close> and \<open><=*\<close>\<close>
 
-lemma setleI: "ALL y: S. y \<le> x \<Longrightarrow> S *<= x"
+lemma setleI: "\<forall>y\<in>S. y \<le> x \<Longrightarrow> S *<= x"
   by (simp add: setle_def)
 
-lemma setleD: "S *<= x \<Longrightarrow> y: S \<Longrightarrow> y \<le> x"
+lemma setleD: "S *<= x \<Longrightarrow> y\<in>S \<Longrightarrow> y \<le> x"
   by (simp add: setle_def)
 
-lemma setgeI: "ALL y: S. x \<le> y \<Longrightarrow> x <=* S"
+lemma setgeI: "\<forall>y\<in>S. x \<le> y \<Longrightarrow> x <=* S"
   by (simp add: setge_def)
 
-lemma setgeD: "x <=* S \<Longrightarrow> y: S \<Longrightarrow> x \<le> y"
+lemma setgeD: "x <=* S \<Longrightarrow> y\<in>S \<Longrightarrow> x \<le> y"
   by (simp add: setge_def)
 
 
@@ -36,7 +36,7 @@
   where "leastP P x = (P x \<and> x <=* Collect P)"
 
 definition isUb :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a::ord \<Rightarrow> bool"
-  where "isUb R S x = (S *<= x \<and> x: R)"
+  where "isUb R S x = (S *<= x \<and> x \<in> R)"
 
 definition isLub :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a::ord \<Rightarrow> bool"
   where "isLub R S x = leastP (isUb R S) x"
@@ -53,19 +53,19 @@
 lemma leastPD2: "leastP P x \<Longrightarrow> x <=* Collect P"
   by (simp add: leastP_def)
 
-lemma leastPD3: "leastP P x \<Longrightarrow> y: Collect P \<Longrightarrow> x \<le> y"
+lemma leastPD3: "leastP P x \<Longrightarrow> y \<in> Collect P \<Longrightarrow> x \<le> y"
   by (blast dest!: leastPD2 setgeD)
 
 lemma isLubD1: "isLub R S x \<Longrightarrow> S *<= x"
   by (simp add: isLub_def isUb_def leastP_def)
 
-lemma isLubD1a: "isLub R S x \<Longrightarrow> x: R"
+lemma isLubD1a: "isLub R S x \<Longrightarrow> x \<in> R"
   by (simp add: isLub_def isUb_def leastP_def)
 
 lemma isLub_isUb: "isLub R S x \<Longrightarrow> isUb R S x"
   unfolding isUb_def by (blast dest: isLubD1 isLubD1a)
 
-lemma isLubD2: "isLub R S x \<Longrightarrow> y : S \<Longrightarrow> y \<le> x"
+lemma isLubD2: "isLub R S x \<Longrightarrow> y \<in> S \<Longrightarrow> y \<le> x"
   by (blast dest!: isLubD1 setleD)
 
 lemma isLubD3: "isLub R S x \<Longrightarrow> leastP (isUb R S) x"
@@ -77,16 +77,16 @@
 lemma isLubI2: "isUb R S x \<Longrightarrow> x <=* Collect (isUb R S) \<Longrightarrow> isLub R S x"
   by (simp add: isLub_def leastP_def)
 
-lemma isUbD: "isUb R S x \<Longrightarrow> y : S \<Longrightarrow> y \<le> x"
+lemma isUbD: "isUb R S x \<Longrightarrow> y \<in> S \<Longrightarrow> y \<le> x"
   by (simp add: isUb_def setle_def)
 
 lemma isUbD2: "isUb R S x \<Longrightarrow> S *<= x"
   by (simp add: isUb_def)
 
-lemma isUbD2a: "isUb R S x \<Longrightarrow> x: R"
+lemma isUbD2a: "isUb R S x \<Longrightarrow> x \<in> R"
   by (simp add: isUb_def)
 
-lemma isUbI: "S *<= x \<Longrightarrow> x: R \<Longrightarrow> isUb R S x"
+lemma isUbI: "S *<= x \<Longrightarrow> x \<in> R \<Longrightarrow> isUb R S x"
   by (simp add: isUb_def)
 
 lemma isLub_le_isUb: "isLub R S x \<Longrightarrow> isUb R S y \<Longrightarrow> x \<le> y"
@@ -109,7 +109,7 @@
   where "greatestP P x = (P x \<and> Collect P *<=  x)"
 
 definition isLb :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a::ord \<Rightarrow> bool"
-  where "isLb R S x = (x <=* S \<and> x: R)"
+  where "isLb R S x = (x <=* S \<and> x \<in> R)"
 
 definition isGlb :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a::ord \<Rightarrow> bool"
   where "isGlb R S x = greatestP (isLb R S) x"
@@ -126,19 +126,19 @@
 lemma greatestPD2: "greatestP P x \<Longrightarrow> Collect P *<= x"
   by (simp add: greatestP_def)
 
-lemma greatestPD3: "greatestP P x \<Longrightarrow> y: Collect P \<Longrightarrow> x \<ge> y"
+lemma greatestPD3: "greatestP P x \<Longrightarrow> y \<in> Collect P \<Longrightarrow> x \<ge> y"
   by (blast dest!: greatestPD2 setleD)
 
 lemma isGlbD1: "isGlb R S x \<Longrightarrow> x <=* S"
   by (simp add: isGlb_def isLb_def greatestP_def)
 
-lemma isGlbD1a: "isGlb R S x \<Longrightarrow> x: R"
+lemma isGlbD1a: "isGlb R S x \<Longrightarrow> x \<in> R"
   by (simp add: isGlb_def isLb_def greatestP_def)
 
 lemma isGlb_isLb: "isGlb R S x \<Longrightarrow> isLb R S x"
   unfolding isLb_def by (blast dest: isGlbD1 isGlbD1a)
 
-lemma isGlbD2: "isGlb R S x \<Longrightarrow> y : S \<Longrightarrow> y \<ge> x"
+lemma isGlbD2: "isGlb R S x \<Longrightarrow> y \<in> S \<Longrightarrow> y \<ge> x"
   by (blast dest!: isGlbD1 setgeD)
 
 lemma isGlbD3: "isGlb R S x \<Longrightarrow> greatestP (isLb R S) x"
@@ -150,16 +150,16 @@
 lemma isGlbI2: "isLb R S x \<Longrightarrow> Collect (isLb R S) *<= x \<Longrightarrow> isGlb R S x"
   by (simp add: isGlb_def greatestP_def)
 
-lemma isLbD: "isLb R S x \<Longrightarrow> y : S \<Longrightarrow> y \<ge> x"
+lemma isLbD: "isLb R S x \<Longrightarrow> y \<in> S \<Longrightarrow> y \<ge> x"
   by (simp add: isLb_def setge_def)
 
 lemma isLbD2: "isLb R S x \<Longrightarrow> x <=* S "
   by (simp add: isLb_def)
 
-lemma isLbD2a: "isLb R S x \<Longrightarrow> x: R"
+lemma isLbD2a: "isLb R S x \<Longrightarrow> x \<in> R"
   by (simp add: isLb_def)
 
-lemma isLbI: "x <=* S \<Longrightarrow> x: R \<Longrightarrow> isLb R S x"
+lemma isLbI: "x <=* S \<Longrightarrow> x \<in> R \<Longrightarrow> isLb R S x"
   by (simp add: isLb_def)
 
 lemma isGlb_le_isLb: "isGlb R S x \<Longrightarrow> isLb R S y \<Longrightarrow> x \<ge> y"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/Old_Datatype.thy
--- a/src/HOL/Library/Old_Datatype.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/Old_Datatype.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -59,7 +59,7 @@
 definition ndepth :: "('a, 'b) node => nat"
   where "ndepth(n) == (%(f,x). LEAST k. f k = Inr 0) (Rep_Node n)"
 definition ntrunc :: "[nat, ('a, 'b) dtree] => ('a, 'b) dtree"
-  where "ntrunc k N == {n. n:N \<and> ndepth(n)<k}"
+  where "ntrunc k N == {n. n\<in>N \<and> ndepth(n)<k}"
 
 (*products and sums for the "universe"*)
 definition uprod :: "[('a, 'b) dtree set, ('a, 'b) dtree set]=> ('a, 'b) dtree set"
@@ -115,10 +115,10 @@
 
 (*** Introduction rules for Node ***)
 
-lemma Node_K0_I: "(%k. Inr 0, a) : Node"
+lemma Node_K0_I: "(\<lambda>k. Inr 0, a) \<in> Node"
 by (simp add: Node_def)
 
-lemma Node_Push_I: "p: Node ==> apfst (Push i) p : Node"
+lemma Node_Push_I: "p \<in> Node \<Longrightarrow> apfst (Push i) p \<in> Node"
 apply (simp add: Node_def Push_def) 
 apply (fast intro!: apfst_conv nat.case(2)[THEN trans])
 done
@@ -299,35 +299,35 @@
 
 (*** Cartesian Product ***)
 
-lemma uprodI [intro!]: "[| M:A;  N:B |] ==> Scons M N : uprod A B"
+lemma uprodI [intro!]: "\<lbrakk>M\<in>A; N\<in>B\<rbrakk> \<Longrightarrow> Scons M N \<in> uprod A B"
 by (simp add: uprod_def)
 
 (*The general elimination rule*)
 lemma uprodE [elim!]:
-    "[| c : uprod A B;   
-        !!x y. [| x:A;  y:B;  c = Scons x y |] ==> P  
-     |] ==> P"
+    "\<lbrakk>c \<in> uprod A B;   
+        \<And>x y. \<lbrakk>x \<in> A; y \<in> B; c = Scons x y\<rbrakk> \<Longrightarrow> P  
+     \<rbrakk> \<Longrightarrow> P"
 by (auto simp add: uprod_def) 
 
 
 (*Elimination of a pair -- introduces no eigenvariables*)
-lemma uprodE2: "[| Scons M N : uprod A B;  [| M:A;  N:B |] ==> P |] ==> P"
+lemma uprodE2: "\<lbrakk>Scons M N \<in> uprod A B; \<lbrakk>M \<in> A; N \<in> B\<rbrakk> \<Longrightarrow> P\<rbrakk> \<Longrightarrow> P"
 by (auto simp add: uprod_def)
 
 
 (*** Disjoint Sum ***)
 
-lemma usum_In0I [intro]: "M:A ==> In0(M) : usum A B"
+lemma usum_In0I [intro]: "M \<in> A \<Longrightarrow> In0(M) \<in> usum A B"
 by (simp add: usum_def)
 
-lemma usum_In1I [intro]: "N:B ==> In1(N) : usum A B"
+lemma usum_In1I [intro]: "N \<in> B \<Longrightarrow> In1(N) \<in> usum A B"
 by (simp add: usum_def)
 
 lemma usumE [elim!]: 
-    "[| u : usum A B;   
-        !!x. [| x:A;  u=In0(x) |] ==> P;  
-        !!y. [| y:B;  u=In1(y) |] ==> P  
-     |] ==> P"
+    "\<lbrakk>u \<in> usum A B;   
+        \<And>x. \<lbrakk>x \<in> A; u=In0(x)\<rbrakk> \<Longrightarrow> P;  
+        \<And>y. \<lbrakk>y \<in> B; u=In1(y)\<rbrakk> \<Longrightarrow> P  
+     \<rbrakk> \<Longrightarrow> P"
 by (auto simp add: usum_def)
 
 
@@ -440,31 +440,31 @@
 (*** Equality for Cartesian Product ***)
 
 lemma dprodI [intro!]: 
-    "[| (M,M'):r;  (N,N'):s |] ==> (Scons M N, Scons M' N') : dprod r s"
+    "\<lbrakk>(M,M') \<in> r; (N,N') \<in> s\<rbrakk> \<Longrightarrow> (Scons M N, Scons M' N') \<in> dprod r s"
 by (auto simp add: dprod_def)
 
 (*The general elimination rule*)
 lemma dprodE [elim!]: 
-    "[| c : dprod r s;   
-        !!x y x' y'. [| (x,x') : r;  (y,y') : s;  
-                        c = (Scons x y, Scons x' y') |] ==> P  
-     |] ==> P"
+    "\<lbrakk>c \<in> dprod r s;   
+        \<And>x y x' y'. \<lbrakk>(x,x') \<in> r; (y,y') \<in> s;  
+                        c = (Scons x y, Scons x' y')\<rbrakk> \<Longrightarrow> P  
+     \<rbrakk> \<Longrightarrow> P"
 by (auto simp add: dprod_def)
 
 
 (*** Equality for Disjoint Sum ***)
 
-lemma dsum_In0I [intro]: "(M,M'):r ==> (In0(M), In0(M')) : dsum r s"
+lemma dsum_In0I [intro]: "(M,M') \<in> r \<Longrightarrow> (In0(M), In0(M')) \<in> dsum r s"
 by (auto simp add: dsum_def)
 
-lemma dsum_In1I [intro]: "(N,N'):s ==> (In1(N), In1(N')) : dsum r s"
+lemma dsum_In1I [intro]: "(N,N') \<in> s \<Longrightarrow> (In1(N), In1(N')) \<in> dsum r s"
 by (auto simp add: dsum_def)
 
 lemma dsumE [elim!]: 
-    "[| w : dsum r s;   
-        !!x x'. [| (x,x') : r;  w = (In0(x), In0(x')) |] ==> P;  
-        !!y y'. [| (y,y') : s;  w = (In1(y), In1(y')) |] ==> P  
-     |] ==> P"
+    "\<lbrakk>w \<in> dsum r s;   
+        \<And>x x'. \<lbrakk> (x,x') \<in> r;  w = (In0(x), In0(x')) \<rbrakk> \<Longrightarrow> P;  
+        \<And>y y'. \<lbrakk> (y,y') \<in> s;  w = (In1(y), In1(y')) \<rbrakk> \<Longrightarrow> P  
+     \<rbrakk> \<Longrightarrow> P"
 by (auto simp add: dsum_def)
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/Stream.thy
--- a/src/HOL/Library/Stream.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/Stream.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -457,7 +457,7 @@
 lemma sset_flat[simp]: "\<forall>xs \<in> sset s. xs \<noteq> [] \<Longrightarrow>
   sset (flat s) = (\<Union>xs \<in> sset s. set xs)" (is "?P \<Longrightarrow> ?L = ?R")
 proof safe
-  fix x assume ?P "x : ?L"
+  fix x assume ?P "x \<in> ?L"
   then obtain m where "x = flat s !! m" by (metis image_iff sset_range)
   with \<open>?P\<close> obtain n m' where "x = s !! n ! m'" "m' < length (s !! n)"
   proof (atomize_elim, induct m arbitrary: s rule: less_induct)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/Sublist.thy
--- a/src/HOL/Library/Sublist.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/Sublist.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -298,7 +298,7 @@
   (is "_ \<Longrightarrow> \<exists>ps. ?P L ps")
 proof(induction "LEAST n. \<exists>xs \<in>L. n = length xs" arbitrary: L)
   case 0
-  have "[] : L" using "0.hyps" LeastI[of "\<lambda>n. \<exists>xs\<in>L. n = length xs"] \<open>L \<noteq> {}\<close>
+  have "[] \<in> L" using "0.hyps" LeastI[of "\<lambda>n. \<exists>xs\<in>L. n = length xs"] \<open>L \<noteq> {}\<close>
     by auto
   hence "?P L []" by(auto)
   thus ?case ..
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Library/While_Combinator.thy
--- a/src/HOL/Library/While_Combinator.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Library/While_Combinator.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -387,7 +387,7 @@
 qualified fun rtrancl_while_invariant :: "'a list \<times> 'a set \<Rightarrow> bool"
 where "rtrancl_while_invariant (ws, Z) =
    (x \<in> Z \<and> set ws \<subseteq> Z \<and> distinct ws \<and> {(x,y). y \<in> set(f x)} `` (Z - set ws) \<subseteq> Z \<and>
-    Z \<subseteq> {(x,y). y \<in> set(f x)}^* `` {x} \<and> (\<forall>z\<in>Z - set ws. p z))"
+    Z \<subseteq> {(x,y). y \<in> set(f x)}\<^sup>* `` {x} \<and> (\<forall>z\<in>Z - set ws. p z))"
 
 qualified lemma rtrancl_while_invariant: 
   assumes inv: "rtrancl_while_invariant st" and test: "rtrancl_while_test st"
@@ -400,8 +400,8 @@
 
 lemma rtrancl_while_Some: assumes "rtrancl_while = Some(ws,Z)"
 shows "if ws = []
-       then Z = {(x,y). y \<in> set(f x)}^* `` {x} \<and> (\<forall>z\<in>Z. p z)
-       else \<not>p(hd ws) \<and> hd ws \<in> {(x,y). y \<in> set(f x)}^* `` {x}"
+       then Z = {(x,y). y \<in> set(f x)}\<^sup>* `` {x} \<and> (\<forall>z\<in>Z. p z)
+       else \<not>p(hd ws) \<and> hd ws \<in> {(x,y). y \<in> set(f x)}\<^sup>* `` {x}"
 proof -
   have "rtrancl_while_invariant ([x],{x})" by simp
   with rtrancl_while_invariant have I: "rtrancl_while_invariant (ws,Z)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/List.thy
--- a/src/HOL/List.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/List.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -834,7 +834,7 @@
 lemma length_greater_0_conv [iff]: "(0 < length xs) = (xs \<noteq> [])"
 by (induct xs) auto
 
-lemma length_pos_if_in_set: "x : set xs \<Longrightarrow> length xs > 0"
+lemma length_pos_if_in_set: "x \<in> set xs \<Longrightarrow> length xs > 0"
 by auto
 
 lemma length_Suc_conv:
@@ -1118,7 +1118,7 @@
 lemma rev_map: "rev (map f xs) = map f (rev xs)"
 by (induct xs) auto
 
-lemma map_eq_conv[simp]: "(map f xs = map g xs) = (!x : set xs. f x = g x)"
+lemma map_eq_conv[simp]: "(map f xs = map g xs) = (\<forall>x \<in> set xs. f x = g x)"
 by (induct xs) auto
 
 lemma map_cong [fundef_cong]:
@@ -1296,7 +1296,7 @@
 lemma set_append [simp]: "set (xs @ ys) = (set xs \<union> set ys)"
 by (induct xs) auto
 
-lemma hd_in_set[simp]: "xs \<noteq> [] \<Longrightarrow> hd xs : set xs"
+lemma hd_in_set[simp]: "xs \<noteq> [] \<Longrightarrow> hd xs \<in> set xs"
 by(cases xs) auto
 
 lemma set_subset_Cons: "set xs \<subseteq> set (x # xs)"
@@ -1317,14 +1317,14 @@
 lemma set_map [simp]: "set (map f xs) = f`(set xs)"
 by (induct xs) auto
 
-lemma set_filter [simp]: "set (filter P xs) = {x. x : set xs \<and> P x}"
+lemma set_filter [simp]: "set (filter P xs) = {x. x \<in> set xs \<and> P x}"
 by (induct xs) auto
 
 lemma set_upt [simp]: "set[i..<j] = {i..<j}"
 by (induct j) auto
 
 
-lemma split_list: "x : set xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs"
+lemma split_list: "x \<in> set xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs"
 proof (induct xs)
   case Nil thus ?case by simp
 next
@@ -1334,7 +1334,7 @@
 lemma in_set_conv_decomp: "x \<in> set xs \<longleftrightarrow> (\<exists>ys zs. xs = ys @ x # zs)"
   by (auto elim: split_list)
 
-lemma split_list_first: "x : set xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set ys"
+lemma split_list_first: "x \<in> set xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set ys"
 proof (induct xs)
   case Nil thus ?case by simp
 next
@@ -1348,7 +1348,7 @@
 qed
 
 lemma in_set_conv_decomp_first:
-  "(x : set xs) = (\<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set ys)"
+  "(x \<in> set xs) = (\<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set ys)"
   by (auto dest!: split_list_first)
 
 lemma split_list_last: "x \<in> set xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set zs"
@@ -1365,7 +1365,7 @@
 qed
 
 lemma in_set_conv_decomp_last:
-  "(x : set xs) = (\<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set zs)"
+  "(x \<in> set xs) = (\<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set zs)"
   by (auto dest!: split_list_last)
 
 lemma split_list_prop: "\<exists>x \<in> set xs. P x \<Longrightarrow> \<exists>ys x zs. xs = ys @ x # zs \<and> P x"
@@ -1761,14 +1761,14 @@
   assume "?rhs" then show "?lhs" by simp
 qed
 
-lemma list_ball_nth: "[| n < length xs; !x : set xs. P x|] ==> P(xs!n)"
+lemma list_ball_nth: "\<lbrakk>n < length xs; \<forall>x \<in> set xs. P x\<rbrakk> \<Longrightarrow> P(xs!n)"
 by (auto simp add: set_conv_nth)
 
-lemma nth_mem [simp]: "n < length xs ==> xs!n : set xs"
+lemma nth_mem [simp]: "n < length xs \<Longrightarrow> xs!n \<in> set xs"
 by (auto simp add: set_conv_nth)
 
 lemma all_nth_imp_all_set:
-  "[| !i < length xs. P(xs!i); x : set xs|] ==> P x"
+  "\<lbrakk>!i < length xs. P(xs!i); x \<in> set xs\<rbrakk> \<Longrightarrow> P x"
 by (auto simp add: set_conv_nth)
 
 lemma all_set_conv_all_nth:
@@ -1873,7 +1873,7 @@
 lemma set_update_subset_insert: "set(xs[i:=x]) <= insert x (set xs)"
 by (induct xs arbitrary: i) (auto split: nat.split)
 
-lemma set_update_subsetI: "[| set xs <= A; x:A |] ==> set(xs[i := x]) <= A"
+lemma set_update_subsetI: "\<lbrakk>set xs \<subseteq> A; x \<in> A\<rbrakk> \<Longrightarrow> set(xs[i := x]) \<subseteq> A"
 by (blast dest!: set_update_subset_insert [THEN subsetD])
 
 lemma set_update_memI: "n < length xs \<Longrightarrow> x \<in> set (xs[n := x])"
@@ -1948,10 +1948,10 @@
 by (induct xs arbitrary: ys) auto
 
 lemma append_butlast_last_id [simp]:
-  "xs \<noteq> [] ==> butlast xs @ [last xs] = xs"
+  "xs \<noteq> [] \<Longrightarrow> butlast xs @ [last xs] = xs"
 by (induct xs) auto
 
-lemma in_set_butlastD: "x : set (butlast xs) ==> x : set xs"
+lemma in_set_butlastD: "x \<in> set (butlast xs) \<Longrightarrow> x \<in> set xs"
 by (induct xs) (auto split: if_split_asm)
 
 lemma in_set_butlast_appendI:
@@ -2184,10 +2184,10 @@
  apply(auto simp:drop_Cons split:nat.split)
 by (metis set_drop_subset subset_iff)
 
-lemma in_set_takeD: "x : set(take n xs) \<Longrightarrow> x : set xs"
+lemma in_set_takeD: "x \<in> set(take n xs) \<Longrightarrow> x \<in> set xs"
 using set_take_subset by fast
 
-lemma in_set_dropD: "x : set(drop n xs) \<Longrightarrow> x : set xs"
+lemma in_set_dropD: "x \<in> set(drop n xs) \<Longrightarrow> x \<in> set xs"
 using set_drop_subset by fast
 
 lemma append_eq_conv_conj:
@@ -2277,10 +2277,10 @@
 by (induct xs) auto
 
 lemma takeWhile_append2 [simp]:
-  "(!!x. x : set xs ==> P x) ==> takeWhile P (xs @ ys) = xs @ takeWhile P ys"
+  "(\<And>x. x \<in> set xs \<Longrightarrow> P x) \<Longrightarrow> takeWhile P (xs @ ys) = xs @ takeWhile P ys"
 by (induct xs) auto
 
-lemma takeWhile_tail: "\<not> P x ==> takeWhile P (xs @ (x#l)) = takeWhile P xs"
+lemma takeWhile_tail: "\<not> P x \<Longrightarrow> takeWhile P (xs @ (x#l)) = takeWhile P xs"
 by (induct xs) auto
 
 lemma takeWhile_nth: "j < length (takeWhile P xs) \<Longrightarrow> takeWhile P xs ! j = xs ! j"
@@ -2298,7 +2298,7 @@
 by (induct xs) auto
 
 lemma dropWhile_append2 [simp]:
-  "(!!x. x:set xs ==> P(x)) ==> dropWhile P (xs @ ys) = dropWhile P ys"
+  "(\<And>x. x \<in> set xs \<Longrightarrow> P(x)) ==> dropWhile P (xs @ ys) = dropWhile P ys"
 by (induct xs) auto
 
 lemma dropWhile_append3:
@@ -2312,7 +2312,7 @@
 lemma set_dropWhileD: "x \<in> set (dropWhile P xs) \<Longrightarrow> x \<in> set xs"
 by (induct xs) (auto split: if_split_asm)
 
-lemma set_takeWhileD: "x : set (takeWhile P xs) ==> x : set xs \<and> P x"
+lemma set_takeWhileD: "x \<in> set (takeWhile P xs) \<Longrightarrow> x \<in> set xs \<and> P x"
 by (induct xs) (auto split: if_split_asm)
 
 lemma takeWhile_eq_all_conv[simp]:
@@ -2421,13 +2421,13 @@
 by(induction xs rule: induct_list012) auto
 
 lemma takeWhile_cong [fundef_cong]:
-  "[| l = k; !!x. x : set l ==> P x = Q x |]
-  ==> takeWhile P l = takeWhile Q k"
+  "\<lbrakk>l = k; \<And>x. x \<in> set l \<Longrightarrow> P x = Q x\<rbrakk>
+  \<Longrightarrow> takeWhile P l = takeWhile Q k"
 by (induct k arbitrary: l) (simp_all)
 
 lemma dropWhile_cong [fundef_cong]:
-  "[| l = k; !!x. x : set l ==> P x = Q x |]
-  ==> dropWhile P l = dropWhile Q k"
+  "\<lbrakk>l = k; \<And>x. x \<in> set l \<Longrightarrow> P x = Q x\<rbrakk>
+  \<Longrightarrow> dropWhile P l = dropWhile Q k"
 by (induct k arbitrary: l, simp_all)
 
 lemma takeWhile_idem [simp]:
@@ -2590,7 +2590,7 @@
 by (induct xs ys rule:list_induct2') auto
 
 lemma in_set_zipE:
-  "(x,y) : set(zip xs ys) \<Longrightarrow> (\<lbrakk> x : set xs; y : set ys \<rbrakk> \<Longrightarrow> R) \<Longrightarrow> R"
+  "(x,y) \<in> set(zip xs ys) \<Longrightarrow> (\<lbrakk> x \<in> set xs; y \<in> set ys \<rbrakk> \<Longrightarrow> R) \<Longrightarrow> R"
 by(blast dest: set_zip_leftD set_zip_rightD)
 
 lemma zip_map_fst_snd: "zip (map fst zs) (map snd zs) = zs"
@@ -3921,19 +3921,19 @@
 by (induct zs) auto
 
 lemma in_set_remove1[simp]:
-  "a \<noteq> b \<Longrightarrow> a : set(remove1 b xs) = (a : set xs)"
+  "a \<noteq> b \<Longrightarrow> a \<in> set(remove1 b xs) = (a \<in> set xs)"
 apply (induct xs)
  apply auto
 done
 
-lemma set_remove1_subset: "set(remove1 x xs) <= set xs"
+lemma set_remove1_subset: "set(remove1 x xs) \<subseteq> set xs"
 apply(induct xs)
  apply simp
 apply simp
 apply blast
 done
 
-lemma set_remove1_eq [simp]: "distinct xs ==> set(remove1 x xs) = set xs - {x}"
+lemma set_remove1_eq [simp]: "distinct xs \<Longrightarrow> set(remove1 x xs) = set xs - {x}"
 apply(induct xs)
  apply simp
 apply simp
@@ -3941,7 +3941,7 @@
 done
 
 lemma length_remove1:
-  "length(remove1 x xs) = (if x : set xs then length xs - 1 else length xs)"
+  "length(remove1 x xs) = (if x \<in> set xs then length xs - 1 else length xs)"
 by (induct xs) (auto dest!:length_pos_if_in_set)
 
 lemma remove1_filter_not[simp]:
@@ -3952,10 +3952,10 @@
   "filter Q (remove1 x xs) = remove1 x (filter Q xs)"
 by (induct xs) auto
 
-lemma notin_set_remove1[simp]: "x ~: set xs ==> x ~: set(remove1 y xs)"
+lemma notin_set_remove1[simp]: "x \<notin> set xs \<Longrightarrow> x \<notin> set(remove1 y xs)"
 by(insert set_remove1_subset) fast
 
-lemma distinct_remove1[simp]: "distinct xs ==> distinct(remove1 x xs)"
+lemma distinct_remove1[simp]: "distinct xs \<Longrightarrow> distinct(remove1 x xs)"
 by (induct xs) simp_all
 
 lemma remove1_remdups:
@@ -4000,7 +4000,7 @@
 by (simp add: removeAll_filter_not_eq)
 
 lemma distinct_remove1_removeAll:
-  "distinct xs ==> remove1 x xs = removeAll x xs"
+  "distinct xs \<Longrightarrow> remove1 x xs = removeAll x xs"
 by (induct xs) simp_all
 
 lemma map_removeAll_inj_on: "inj_on f (insert x (set xs)) \<Longrightarrow>
@@ -4028,7 +4028,8 @@
 lemma replicate_eqI:
   assumes "length xs = n" and "\<And>y. y \<in> set xs \<Longrightarrow> y = x"
   shows "xs = replicate n x"
-using assms proof (induct xs arbitrary: n)
+  using assms
+proof (induct xs arbitrary: n)
   case Nil then show ?case by simp
 next
   case (Cons x xs) then show ?case by (cases n) simp_all
@@ -4393,7 +4394,7 @@
 by (auto simp add: nths_def)
 
 lemma length_nths:
-  "length (nths xs I) = card{i. i < length xs \<and> i : I}"
+  "length (nths xs I) = card{i. i < length xs \<and> i \<in> I}"
 by(simp add: nths_def length_filter_conv_card cong:conj_cong)
 
 lemma nths_shift_lemma_Suc:
@@ -4407,12 +4408,12 @@
 done
 
 lemma nths_shift_lemma:
-  "map fst [p<-zip xs [i..<i + length xs] . snd p : A] =
-   map fst [p<-zip xs [0..<length xs] . snd p + i : A]"
+  "map fst [p<-zip xs [i..<i + length xs] . snd p \<in> A] =
+   map fst [p<-zip xs [0..<length xs] . snd p + i \<in> A]"
 by (induct xs rule: rev_induct) (simp_all add: add.commute)
 
 lemma nths_append:
-  "nths (l @ l') A = nths l A @ nths l' {j. j + length l : A}"
+  "nths (l @ l') A = nths l A @ nths l' {j. j + length l \<in> A}"
 apply (unfold nths_def)
 apply (induct l' rule: rev_induct, simp)
 apply (simp add: upt_add_eq_append[of 0] nths_shift_lemma)
@@ -4420,7 +4421,7 @@
 done
 
 lemma nths_Cons:
-  "nths (x # l) A = (if 0:A then [x] else []) @ nths l {j. Suc j : A}"
+  "nths (x # l) A = (if 0 \<in> A then [x] else []) @ nths l {j. Suc j \<in> A}"
 apply (induct l rule: rev_induct)
  apply (simp add: nths_def)
 apply (simp del: append_Cons add: append_Cons[symmetric] nths_append)
@@ -4443,7 +4444,7 @@
 lemma in_set_nthsD: "x \<in> set(nths xs I) \<Longrightarrow> x \<in> set xs"
 by(auto simp add:set_nths)
 
-lemma nths_singleton [simp]: "nths [x] A = (if 0 : A then [x] else [])"
+lemma nths_singleton [simp]: "nths [x] A = (if 0 \<in> A then [x] else [])"
 by (simp add: nths_Cons)
 
 lemma distinct_nthsI[simp]: "distinct xs \<Longrightarrow> distinct (nths xs I)"
@@ -4819,7 +4820,7 @@
 next
   case (insertI M xs)
   then obtain n where "\<forall>s\<in>M. length s < n" by blast
-  hence "ALL s:insert xs M. size s < max n (size xs) + 1" by auto
+  hence "\<forall>s\<in>insert xs M. size s < max n (size xs) + 1" by auto
   thus ?case ..
 qed
 
@@ -5654,10 +5655,10 @@
   lists :: "'a set => 'a list set"
   for A :: "'a set"
 where
-    Nil [intro!, simp]: "[]: lists A"
-  | Cons [intro!, simp]: "[| a: A; l: lists A|] ==> a#l : lists A"
-
-inductive_cases listsE [elim!]: "x#l : lists A"
+    Nil [intro!, simp]: "[] \<in> lists A"
+  | Cons [intro!, simp]: "\<lbrakk>a \<in> A; l \<in> lists A\<rbrakk> \<Longrightarrow> a#l \<in> lists A"
+
+inductive_cases listsE [elim!]: "x#l \<in> lists A"
 inductive_cases listspE [elim!]: "listsp A (x # l)"
 
 inductive_simps listsp_simps[code]:
@@ -5685,7 +5686,7 @@
 
 lemmas lists_Int_eq [simp] = listsp_inf_eq [to_set]
 
-lemma Cons_in_lists_iff[simp]: "x#xs : lists A \<longleftrightarrow> x:A \<and> xs : lists A"
+lemma Cons_in_lists_iff[simp]: "x#xs \<in> lists A \<longleftrightarrow> x \<in> A \<and> xs \<in> lists A"
 by auto
 
 lemma append_in_listsp_conv [iff]:
@@ -5791,7 +5792,7 @@
 done
 
 lemma lexn_length:
-  "(xs, ys) : lexn r n ==> length xs = n \<and> length ys = n"
+  "(xs, ys) \<in> lexn r n \<Longrightarrow> length xs = n \<and> length ys = n"
 by (induct n arbitrary: xs ys) auto
 
 lemma wf_lex [intro!]: "wf r ==> wf (lex r)"
@@ -5807,7 +5808,7 @@
 lemma lexn_conv:
   "lexn r n =
     {(xs,ys). length xs = n \<and> length ys = n \<and>
-    (\<exists>xys x y xs' ys'. xs= xys @ x#xs' \<and> ys= xys @ y # ys' \<and> (x, y):r)}"
+    (\<exists>xys x y xs' ys'. xs= xys @ x#xs' \<and> ys= xys @ y # ys' \<and> (x, y) \<in> r)}"
 apply (induct n, simp)
 apply (simp add: image_Collect lex_prod_def, safe, blast)
  apply (rule_tac x = "ab # xys" in exI, simp)
@@ -5883,7 +5884,7 @@
 lemma lex_conv:
   "lex r =
     {(xs,ys). length xs = length ys \<and>
-    (\<exists>xys x y xs' ys'. xs = xys @ x # xs' \<and> ys = xys @ y # ys' \<and> (x, y):r)}"
+    (\<exists>xys x y xs' ys'. xs = xys @ x # xs' \<and> ys = xys @ y # ys' \<and> (x, y) \<in> r)}"
 by (force simp add: lex_def lexn_conv)
 
 lemma wf_lenlex [intro!]: "wf r ==> wf (lenlex r)"
@@ -6364,11 +6365,11 @@
 unfolding listrel1_def by blast
 
 
-lemma listrel1_converse: "listrel1 (r^-1) = (listrel1 r)^-1"
+lemma listrel1_converse: "listrel1 (r\<inverse>) = (listrel1 r)\<inverse>"
 unfolding listrel1_def by blast
 
 lemma in_listrel1_converse:
-  "(x,y) : listrel1 (r^-1) \<longleftrightarrow> (x,y) : (listrel1 r)^-1"
+  "(x,y) \<in> listrel1 (r\<inverse>) \<longleftrightarrow> (x,y) \<in> (listrel1 r)\<inverse>"
 unfolding listrel1_def by blast
 
 lemma listrel1_iff_update:
@@ -6489,13 +6490,13 @@
 theorem equiv_listrel: "equiv A r \<Longrightarrow> equiv (lists A) (listrel r)"
 by (simp add: equiv_def listrel_refl_on listrel_sym listrel_trans)
 
-lemma listrel_rtrancl_refl[iff]: "(xs,xs) : listrel(r^*)"
+lemma listrel_rtrancl_refl[iff]: "(xs,xs) \<in> listrel(r\<^sup>*)"
 using listrel_refl_on[of UNIV, OF refl_rtrancl]
 by(auto simp: refl_on_def)
 
 lemma listrel_rtrancl_trans:
-  "\<lbrakk> (xs,ys) : listrel(r^*);  (ys,zs) : listrel(r^*) \<rbrakk>
-  \<Longrightarrow> (xs,zs) : listrel(r^*)"
+  "\<lbrakk>(xs,ys) \<in> listrel(r\<^sup>*);  (ys,zs) \<in> listrel(r\<^sup>*)\<rbrakk>
+  \<Longrightarrow> (xs,zs) \<in> listrel(r\<^sup>*)"
 by (metis listrel_trans trans_def trans_rtrancl)
 
 
@@ -6509,32 +6510,32 @@
 text \<open>Relating @{term listrel1}, @{term listrel} and closures:\<close>
 
 lemma listrel1_rtrancl_subset_rtrancl_listrel1:
-  "listrel1 (r^*) \<subseteq> (listrel1 r)^*"
+  "listrel1 (r\<^sup>*) \<subseteq> (listrel1 r)\<^sup>*"
 proof (rule subrelI)
-  fix xs ys assume 1: "(xs,ys) \<in> listrel1 (r^*)"
+  fix xs ys assume 1: "(xs,ys) \<in> listrel1 (r\<^sup>*)"
   { fix x y us vs
-    have "(x,y) : r^* \<Longrightarrow> (us @ x # vs, us @ y # vs) : (listrel1 r)^*"
+    have "(x,y) \<in> r\<^sup>* \<Longrightarrow> (us @ x # vs, us @ y # vs) \<in> (listrel1 r)\<^sup>*"
     proof(induct rule: rtrancl.induct)
       case rtrancl_refl show ?case by simp
     next
       case rtrancl_into_rtrancl thus ?case
         by (metis listrel1I rtrancl.rtrancl_into_rtrancl)
     qed }
-  thus "(xs,ys) \<in> (listrel1 r)^*" using 1 by(blast elim: listrel1E)
+  thus "(xs,ys) \<in> (listrel1 r)\<^sup>*" using 1 by(blast elim: listrel1E)
 qed
 
-lemma rtrancl_listrel1_eq_len: "(x,y) \<in> (listrel1 r)^* \<Longrightarrow> length x = length y"
+lemma rtrancl_listrel1_eq_len: "(x,y) \<in> (listrel1 r)\<^sup>* \<Longrightarrow> length x = length y"
 by (induct rule: rtrancl.induct) (auto intro: listrel1_eq_len)
 
 lemma rtrancl_listrel1_ConsI1:
-  "(xs,ys) : (listrel1 r)^* \<Longrightarrow> (x#xs,x#ys) : (listrel1 r)^*"
+  "(xs,ys) \<in> (listrel1 r)\<^sup>* \<Longrightarrow> (x#xs,x#ys) \<in> (listrel1 r)\<^sup>*"
 apply(induct rule: rtrancl.induct)
  apply simp
 by (metis listrel1I2 rtrancl.rtrancl_into_rtrancl)
 
 lemma rtrancl_listrel1_ConsI2:
-  "(x,y) \<in> r^* \<Longrightarrow> (xs, ys) \<in> (listrel1 r)^*
-  \<Longrightarrow> (x # xs, y # ys) \<in> (listrel1 r)^*"
+  "(x,y) \<in> r\<^sup>* \<Longrightarrow> (xs, ys) \<in> (listrel1 r)\<^sup>*
+  \<Longrightarrow> (x # xs, y # ys) \<in> (listrel1 r)\<^sup>*"
   by (blast intro: rtrancl_trans rtrancl_listrel1_ConsI1
     subsetD[OF listrel1_rtrancl_subset_rtrancl_listrel1 listrel1I1])
 
@@ -6543,21 +6544,21 @@
 by(auto elim!: listrel1E simp add: listrel_iff_zip set_zip refl_on_def)
 
 lemma listrel_reflcl_if_listrel1:
-  "(xs,ys) : listrel1 r \<Longrightarrow> (xs,ys) : listrel(r^*)"
+  "(xs,ys) \<in> listrel1 r \<Longrightarrow> (xs,ys) \<in> listrel(r\<^sup>*)"
 by(erule listrel1E)(auto simp add: listrel_iff_zip set_zip)
 
-lemma listrel_rtrancl_eq_rtrancl_listrel1: "listrel (r^*) = (listrel1 r)^*"
+lemma listrel_rtrancl_eq_rtrancl_listrel1: "listrel (r\<^sup>*) = (listrel1 r)\<^sup>*"
 proof
-  { fix x y assume "(x,y) \<in> listrel (r^*)"
-    then have "(x,y) \<in> (listrel1 r)^*"
+  { fix x y assume "(x,y) \<in> listrel (r\<^sup>*)"
+    then have "(x,y) \<in> (listrel1 r)\<^sup>*"
     by induct (auto intro: rtrancl_listrel1_ConsI2) }
-  then show "listrel (r^*) \<subseteq> (listrel1 r)^*"
+  then show "listrel (r\<^sup>*) \<subseteq> (listrel1 r)\<^sup>*"
     by (rule subrelI)
 next
-  show "listrel (r^*) \<supseteq> (listrel1 r)^*"
+  show "listrel (r\<^sup>*) \<supseteq> (listrel1 r)\<^sup>*"
   proof(rule subrelI)
-    fix xs ys assume "(xs,ys) \<in> (listrel1 r)^*"
-    then show "(xs,ys) \<in> listrel (r^*)"
+    fix xs ys assume "(xs,ys) \<in> (listrel1 r)\<^sup>*"
+    then show "(xs,ys) \<in> listrel (r\<^sup>*)"
     proof induct
       case base show ?case by(auto simp add: listrel_iff_zip set_zip)
     next
@@ -6568,10 +6569,10 @@
 qed
 
 lemma rtrancl_listrel1_if_listrel:
-  "(xs,ys) : listrel r \<Longrightarrow> (xs,ys) : (listrel1 r)^*"
+  "(xs,ys) \<in> listrel r \<Longrightarrow> (xs,ys) \<in> (listrel1 r)\<^sup>*"
 by(metis listrel_rtrancl_eq_rtrancl_listrel1 subsetD[OF listrel_mono] r_into_rtrancl subsetI)
 
-lemma listrel_subset_rtrancl_listrel1: "listrel r \<subseteq> (listrel1 r)^*"
+lemma listrel_subset_rtrancl_listrel1: "listrel r \<subseteq> (listrel1 r)\<^sup>*"
 by(fast intro:rtrancl_listrel1_if_listrel)
 
 
@@ -6833,8 +6834,8 @@
     show "x \<in> set xs \<and> P x"
       by (metis Cons Cons_eq_filter_iff in_set_conv_decomp set_sort)
     next
-      fix y assume "y : set xs \<and> P y"
-      hence "y : set (filter P xs)" by auto
+      fix y assume "y \<in> set xs \<and> P y"
+      hence "y \<in> set (filter P xs)" by auto
       thus "x \<le> y"
         by (metis Cons eq_iff filter_sort set_ConsD set_sort sorted_Cons sorted_sort)
   qed
@@ -7190,7 +7191,7 @@
   by (auto simp add: Id_on_def)
 
 lemma [code]:
-  "R `` S = List.map_project (%(x, y). if x : S then Some y else None) R"
+  "R `` S = List.map_project (\<lambda>(x, y). if x \<in> S then Some y else None) R"
 unfolding map_project_def by (auto split: prod.split if_split_asm)
 
 lemma trancl_set_ntrancl [code]:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Matrix_LP/ComputeFloat.thy
--- a/src/HOL/Matrix_LP/ComputeFloat.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Matrix_LP/ComputeFloat.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -16,7 +16,7 @@
   where "int_of_real x = (SOME y. real_of_int y = x)"
 
 definition real_is_int :: "real \<Rightarrow> bool"
-  where "real_is_int x = (EX (u::int). x = real_of_int u)"
+  where "real_is_int x = (\<exists>(u::int). x = real_of_int u)"
 
 lemma real_is_int_def2: "real_is_int x = (x = real_of_int (int_of_real x))"
   by (auto simp add: real_is_int_def int_of_real_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Matrix_LP/Matrix.thy
--- a/src/HOL/Matrix_LP/Matrix.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Matrix_LP/Matrix.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -138,7 +138,7 @@
   thus "Rep_matrix A m n = 0" by (simp add: transpose_matrix_def)
 qed
 
-lemma ncols_le: "(ncols A <= n) = (! j i. n <= i \<longrightarrow> (Rep_matrix A j i) = 0)" (is "_ = ?st")
+lemma ncols_le: "(ncols A <= n) = (\<forall>j i. n <= i \<longrightarrow> (Rep_matrix A j i) = 0)" (is "_ = ?st")
 apply (auto)
 apply (simp add: ncols)
 proof (simp add: ncols_def, auto)
@@ -152,13 +152,13 @@
   assume "(a,b) \<in> ?P"
   then have "?p \<noteq> {}" by (auto)
   with a have "?m \<in>  ?p" by (simp)
-  moreover have "!x. (x \<in> ?p \<longrightarrow> (? y. (Rep_matrix A y x) \<noteq> 0))" by (simp add: nonzero_positions_def image_def)
-  ultimately have "? y. (Rep_matrix A y ?m) \<noteq> 0" by (simp)
+  moreover have "\<forall>x. (x \<in> ?p \<longrightarrow> (\<exists>y. (Rep_matrix A y x) \<noteq> 0))" by (simp add: nonzero_positions_def image_def)
+  ultimately have "\<exists>y. (Rep_matrix A y ?m) \<noteq> 0" by (simp)
   moreover assume ?st
   ultimately show "False" using b by (simp)
 qed
 
-lemma less_ncols: "(n < ncols A) = (? j i. n <= i & (Rep_matrix A j i) \<noteq> 0)"
+lemma less_ncols: "(n < ncols A) = (\<exists>j i. n <= i & (Rep_matrix A j i) \<noteq> 0)"
 proof -
   have a: "!! (a::nat) b. (a < b) = (~(b <= a))" by arith
   show ?thesis by (simp add: a ncols_le)
@@ -172,15 +172,15 @@
 apply (drule_tac x="ncols A" in spec)
 by (simp add: ncols)
 
-lemma nrows_le: "(nrows A <= n) = (! j i. n <= j \<longrightarrow> (Rep_matrix A j i) = 0)" (is ?s)
+lemma nrows_le: "(nrows A <= n) = (\<forall>j i. n <= j \<longrightarrow> (Rep_matrix A j i) = 0)" (is ?s)
 proof -
   have "(nrows A <= n) = (ncols (transpose_matrix A) <= n)" by (simp)
-  also have "\<dots> = (! j i. n <= i \<longrightarrow> (Rep_matrix (transpose_matrix A) j i = 0))" by (rule ncols_le)
-  also have "\<dots> = (! j i. n <= i \<longrightarrow> (Rep_matrix A i j) = 0)" by (simp)
-  finally show "(nrows A <= n) = (! j i. n <= j \<longrightarrow> (Rep_matrix A j i) = 0)" by (auto)
+  also have "\<dots> = (\<forall>j i. n <= i \<longrightarrow> (Rep_matrix (transpose_matrix A) j i = 0))" by (rule ncols_le)
+  also have "\<dots> = (\<forall>j i. n <= i \<longrightarrow> (Rep_matrix A i j) = 0)" by (simp)
+  finally show "(nrows A <= n) = (\<forall>j i. n <= j \<longrightarrow> (Rep_matrix A j i) = 0)" by (auto)
 qed
 
-lemma less_nrows: "(m < nrows A) = (? j i. m <= j & (Rep_matrix A j i) \<noteq> 0)"
+lemma less_nrows: "(m < nrows A) = (\<exists>j i. m <= j & (Rep_matrix A j i) \<noteq> 0)"
 proof -
   have a: "!! (a::nat) b. (a < b) = (~(b <= a))" by arith
   show ?thesis by (simp add: a nrows_le)
@@ -218,13 +218,13 @@
 by simp
 
 lemma RepAbs_matrix:
-  assumes aem: "? m. ! j i. m <= j \<longrightarrow> x j i = 0" (is ?em) and aen:"? n. ! j i. (n <= i \<longrightarrow> x j i = 0)" (is ?en)
+  assumes aem: "\<exists>m. \<forall>j i. m <= j \<longrightarrow> x j i = 0" (is ?em) and aen:"\<exists>n. \<forall>j i. (n <= i \<longrightarrow> x j i = 0)" (is ?en)
   shows "(Rep_matrix (Abs_matrix x)) = x"
 apply (rule Abs_matrix_inverse)
 apply (simp add: matrix_def nonzero_positions_def)
 proof -
-  from aem obtain m where a: "! j i. m <= j \<longrightarrow> x j i = 0" by (blast)
-  from aen obtain n where b: "! j i. n <= i \<longrightarrow> x j i = 0" by (blast)
+  from aem obtain m where a: "\<forall>j i. m <= j \<longrightarrow> x j i = 0" by (blast)
+  from aen obtain n where b: "\<forall>j i. n <= i \<longrightarrow> x j i = 0" by (blast)
   let ?u = "{(i, j). x i j \<noteq> 0}"
   let ?v = "{(i, j). i < m & j < n}"
   have c: "!! (m::nat) a. ~(m <= a) \<Longrightarrow> a < m" by (arith)
@@ -260,10 +260,10 @@
 by (simp add: combine_infmatrix_def)
 
 definition commutative :: "('a \<Rightarrow> 'a \<Rightarrow> 'b) \<Rightarrow> bool" where
-"commutative f == ! x y. f x y = f y x"
+"commutative f == \<forall>x y. f x y = f y x"
 
 definition associative :: "('a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> bool" where
-"associative f == ! x y z. f (f x y) z = f x (f y z)"
+"associative f == \<forall>x y z. f (f x y) z = f x (f y z)"
 
 text\<open>
 To reason about associativity and commutativity of operations on matrices,
@@ -344,13 +344,13 @@
   by (simp add: ncols_le)
 
 definition zero_r_neutral :: "('a \<Rightarrow> 'b::zero \<Rightarrow> 'a) \<Rightarrow> bool" where
-  "zero_r_neutral f == ! a. f a 0 = a"
+  "zero_r_neutral f == \<forall>a. f a 0 = a"
 
 definition zero_l_neutral :: "('a::zero \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> bool" where
-  "zero_l_neutral f == ! a. f 0 a = a"
+  "zero_l_neutral f == \<forall>a. f 0 a = a"
 
 definition zero_closed :: "(('a::zero) \<Rightarrow> ('b::zero) \<Rightarrow> ('c::zero)) \<Rightarrow> bool" where
-  "zero_closed f == (!x. f x 0 = 0) & (!y. f 0 y = 0)"
+  "zero_closed f == (\<forall>x. f x 0 = 0) & (\<forall>y. f 0 y = 0)"
 
 primrec foldseq :: "('a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> (nat \<Rightarrow> 'a) \<Rightarrow> nat \<Rightarrow> 'a"
 where
@@ -365,17 +365,17 @@
 lemma foldseq_assoc : "associative f \<Longrightarrow> foldseq f = foldseq_transposed f"
 proof -
   assume a:"associative f"
-  then have sublemma: "!! n. ! N s. N <= n \<longrightarrow> foldseq f s N = foldseq_transposed f s N"
+  then have sublemma: "\<And>n. \<forall>N s. N <= n \<longrightarrow> foldseq f s N = foldseq_transposed f s N"
   proof -
     fix n
-    show "!N s. N <= n \<longrightarrow> foldseq f s N = foldseq_transposed f s N"
+    show "\<forall>N s. N <= n \<longrightarrow> foldseq f s N = foldseq_transposed f s N"
     proof (induct n)
-      show "!N s. N <= 0 \<longrightarrow> foldseq f s N = foldseq_transposed f s N" by simp
+      show "\<forall>N s. N <= 0 \<longrightarrow> foldseq f s N = foldseq_transposed f s N" by simp
     next
       fix n
-      assume b:"! N s. N <= n \<longrightarrow> foldseq f s N = foldseq_transposed f s N"
-      have c:"!!N s. N <= n \<Longrightarrow> foldseq f s N = foldseq_transposed f s N" by (simp add: b)
-      show "! N t. N <= Suc n \<longrightarrow> foldseq f t N = foldseq_transposed f t N"
+      assume b: "\<forall>N s. N <= n \<longrightarrow> foldseq f s N = foldseq_transposed f s N"
+      have c:"\<And>N s. N <= n \<Longrightarrow> foldseq f s N = foldseq_transposed f s N" by (simp add: b)
+      show "\<forall>N t. N <= Suc n \<longrightarrow> foldseq f t N = foldseq_transposed f t N"
       proof (auto)
         fix N t
         assume Nsuc: "N <= Suc n"
@@ -386,7 +386,7 @@
         next
           assume "~(N <= n)"
           with Nsuc have Nsuceq: "N = Suc n" by simp
-          have neqz: "n \<noteq> 0 \<Longrightarrow> ? m. n = Suc m & Suc m <= n" by arith
+          have neqz: "n \<noteq> 0 \<Longrightarrow> \<exists>m. n = Suc m & Suc m <= n" by arith
           have assocf: "!! x y z. f x (f y z) = f (f x y) z" by (insert a, simp add: associative_def)
           show "foldseq f t N = foldseq_transposed f t N"
             apply (simp add: Nsuceq)
@@ -426,14 +426,14 @@
   from assoc have a:"!! x y z. f (f x y) z = f x (f y z)" by (simp add: associative_def)
   from comm have b: "!! x y. f x y = f y x" by (simp add: commutative_def)
   from assoc comm have c: "!! x y z. f x (f y z) = f y (f x z)" by (simp add: commutative_def associative_def)
-  have "!! n. (! u v. foldseq f (%k. f (u k) (v k)) n = f (foldseq f u n) (foldseq f v n))"
+  have "\<And>n. (\<forall>u v. foldseq f (%k. f (u k) (v k)) n = f (foldseq f u n) (foldseq f v n))"
     apply (induct_tac n)
     apply (simp+, auto)
     by (simp add: a b c)
   then show "foldseq f (% k. f (u k) (v k)) n = f (foldseq f u n) (foldseq f v n)" by simp
 qed
 
-theorem "\<lbrakk>associative f; associative g; \<forall>a b c d. g (f a b) (f c d) = f (g a c) (g b d); ? x y. (f x) \<noteq> (f y); ? x y. (g x) \<noteq> (g y); f x x = x; g x x = x\<rbrakk> \<Longrightarrow> f=g | (! y. f y x = y) | (! y. g y x = y)"
+theorem "\<lbrakk>associative f; associative g; \<forall>a b c d. g (f a b) (f c d) = f (g a c) (g b d); \<exists>x y. (f x) \<noteq> (f y); \<exists>x y. (g x) \<noteq> (g y); f x x = x; g x x = x\<rbrakk> \<Longrightarrow> f=g | (\<forall>y. f y x = y) | (\<forall>y. g y x = y)"
 oops
 (* Model found
 
@@ -452,10 +452,10 @@
 *)
 
 lemma foldseq_zero:
-assumes fz: "f 0 0 = 0" and sz: "! i. i <= n \<longrightarrow> s i = 0"
+assumes fz: "f 0 0 = 0" and sz: "\<forall>i. i <= n \<longrightarrow> s i = 0"
 shows "foldseq f s n = 0"
 proof -
-  have "!! n. ! s. (! i. i <= n \<longrightarrow> s i = 0) \<longrightarrow> foldseq f s n = 0"
+  have "\<And>n. \<forall>s. (\<forall>i. i <= n \<longrightarrow> s i = 0) \<longrightarrow> foldseq f s n = 0"
     apply (induct_tac n)
     apply (simp)
     by (simp add: fz)
@@ -463,10 +463,10 @@
 qed
 
 lemma foldseq_significant_positions:
-  assumes p: "! i. i <= N \<longrightarrow> S i = T i"
+  assumes p: "\<forall>i. i <= N \<longrightarrow> S i = T i"
   shows "foldseq f S N = foldseq f T N"
 proof -
-  have "!! m . ! s t. (! i. i<=m \<longrightarrow> s i = t i) \<longrightarrow> foldseq f s m = foldseq f t m"
+  have "\<And>m. \<forall>s t. (\<forall>i. i<=m \<longrightarrow> s i = t i) \<longrightarrow> foldseq f s m = foldseq f t m"
     apply (induct_tac m)
     apply (simp)
     apply (simp)
@@ -488,9 +488,9 @@
   assumes "M <= N"
   shows "foldseq f S N = foldseq f (% k. (if k < M then (S k) else (foldseq f (% k. S(k+M)) (N-M)))) M"
 proof -
-  have suc: "!! a b. \<lbrakk>a <= Suc b; a \<noteq> Suc b\<rbrakk> \<Longrightarrow> a <= b" by arith
-  have a:"!! a b c . a = b \<Longrightarrow> f c a = f c b" by blast
-  have "!! n. ! m s. m <= n \<longrightarrow> foldseq f s n = foldseq f (% k. (if k < m then (s k) else (foldseq f (% k. s(k+m)) (n-m)))) m"
+  have suc: "\<And>a b. \<lbrakk>a <= Suc b; a \<noteq> Suc b\<rbrakk> \<Longrightarrow> a <= b" by arith
+  have a: "\<And>a b c . a = b \<Longrightarrow> f c a = f c b" by blast
+  have "\<And>n. \<forall>m s. m <= n \<longrightarrow> foldseq f s n = foldseq f (% k. (if k < m then (s k) else (foldseq f (% k. s(k+m)) (n-m)))) m"
     apply (induct_tac n)
     apply (simp)
     apply (simp)
@@ -509,7 +509,7 @@
       have subd: "foldseq f (\<lambda>k. if k < m then s (Suc k) else foldseq f (\<lambda>k. s (Suc (k + m))) (na - m)) m =
         foldseq f (% k. s(Suc k)) na"
         by (rule subc[of m "% k. s(Suc k)", THEN sym], simp add: subb)
-      from subb have sube: "m \<noteq> 0 \<Longrightarrow> ? mm. m = Suc mm & mm <= na" by arith
+      from subb have sube: "m \<noteq> 0 \<Longrightarrow> \<exists>mm. m = Suc mm & mm <= na" by arith
       show "f (s 0) (foldseq f (\<lambda>k. if k < m then s (Suc k) else foldseq f (\<lambda>k. s (Suc (k + m))) (na - m)) m) =
         foldseq f (\<lambda>k. if k < m then s k else foldseq f (\<lambda>k. s (k + m)) (Suc na - m)) m"
         apply (simp add: subd)
@@ -527,7 +527,7 @@
 lemma foldseq_zerotail:
   assumes
   fz: "f 0 0 = 0"
-  and sz: "! i.  n <= i \<longrightarrow> s i = 0"
+  and sz: "\<forall>i.  n <= i \<longrightarrow> s i = 0"
   and nm: "n <= m"
   shows
   "foldseq f s n = foldseq f s m"
@@ -541,15 +541,15 @@
 qed
 
 lemma foldseq_zerotail2:
-  assumes "! x. f x 0 = x"
-  and "! i. n < i \<longrightarrow> s i = 0"
+  assumes "\<forall>x. f x 0 = x"
+  and "\<forall>i. n < i \<longrightarrow> s i = 0"
   and nm: "n <= m"
   shows "foldseq f s n = foldseq f s m"
 proof -
   have "f 0 0 = 0" by (simp add: assms)
-  have b:"!! m n. n <= m \<Longrightarrow> m \<noteq> n \<Longrightarrow> ? k. m-n = Suc k" by arith
+  have b: "\<And>m n. n <= m \<Longrightarrow> m \<noteq> n \<Longrightarrow> \<exists>k. m-n = Suc k" by arith
   have c: "0 <= m" by simp
-  have d: "!! k. k \<noteq> 0 \<Longrightarrow> ? l. k = Suc l" by arith
+  have d: "\<And>k. k \<noteq> 0 \<Longrightarrow> \<exists>l. k = Suc l" by arith
   show ?thesis
     apply (subst foldseq_tail[OF nm])
     apply (rule foldseq_significant_positions)
@@ -567,10 +567,10 @@
 qed
 
 lemma foldseq_zerostart:
-  "! x. f 0 (f 0 x) = f 0 x \<Longrightarrow>  ! i. i <= n \<longrightarrow> s i = 0 \<Longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))"
+  "\<forall>x. f 0 (f 0 x) = f 0 x \<Longrightarrow> \<forall>i. i <= n \<longrightarrow> s i = 0 \<Longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))"
 proof -
-  assume f00x: "! x. f 0 (f 0 x) = f 0 x"
-  have "! s. (! i. i<=n \<longrightarrow> s i = 0) \<longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))"
+  assume f00x: "\<forall>x. f 0 (f 0 x) = f 0 x"
+  have "\<forall>s. (\<forall>i. i<=n \<longrightarrow> s i = 0) \<longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))"
     apply (induct n)
     apply (simp)
     apply (rule allI, rule impI)
@@ -578,25 +578,25 @@
       fix n
       fix s
       have a:"foldseq f s (Suc (Suc n)) = f (s 0) (foldseq f (% k. s(Suc k)) (Suc n))" by simp
-      assume b: "! s. ((\<forall>i\<le>n. s i = 0) \<longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n)))"
+      assume b: "\<forall>s. ((\<forall>i\<le>n. s i = 0) \<longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n)))"
       from b have c:"!! s. (\<forall>i\<le>n. s i = 0) \<Longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))" by simp
-      assume d: "! i. i <= Suc n \<longrightarrow> s i = 0"
+      assume d: "\<forall>i. i <= Suc n \<longrightarrow> s i = 0"
       show "foldseq f s (Suc (Suc n)) = f 0 (s (Suc (Suc n)))"
         apply (subst a)
         apply (subst c)
         by (simp add: d f00x)+
     qed
-  then show "! i. i <= n \<longrightarrow> s i = 0 \<Longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))" by simp
+  then show "\<forall>i. i <= n \<longrightarrow> s i = 0 \<Longrightarrow> foldseq f s (Suc n) = f 0 (s (Suc n))" by simp
 qed
 
 lemma foldseq_zerostart2:
-  "! x. f 0 x = x \<Longrightarrow>  ! i. i < n \<longrightarrow> s i = 0 \<Longrightarrow> foldseq f s n = s n"
+  "\<forall>x. f 0 x = x \<Longrightarrow> \<forall>i. i < n \<longrightarrow> s i = 0 \<Longrightarrow> foldseq f s n = s n"
 proof -
-  assume a:"! i. i<n \<longrightarrow> s i = 0"
-  assume x:"! x. f 0 x = x"
-  from x have f00x: "! x. f 0 (f 0 x) = f 0 x" by blast
-  have b: "!! i l. i < Suc l = (i <= l)" by arith
-  have d: "!! k. k \<noteq> 0 \<Longrightarrow> ? l. k = Suc l" by arith
+  assume a: "\<forall>i. i<n \<longrightarrow> s i = 0"
+  assume x: "\<forall>x. f 0 x = x"
+  from x have f00x: "\<forall>x. f 0 (f 0 x) = f 0 x" by blast
+  have b: "\<And>i l. i < Suc l = (i <= l)" by arith
+  have d: "\<And>k. k \<noteq> 0 \<Longrightarrow> \<exists>l. k = Suc l" by arith
   show "foldseq f s n = s n"
   apply (case_tac "n=0")
   apply (simp)
@@ -610,11 +610,11 @@
 qed
 
 lemma foldseq_almostzero:
-  assumes f0x:"! x. f 0 x = x" and fx0: "! x. f x 0 = x" and s0:"! i. i \<noteq> j \<longrightarrow> s i = 0"
+  assumes f0x: "\<forall>x. f 0 x = x" and fx0: "\<forall>x. f x 0 = x" and s0: "\<forall>i. i \<noteq> j \<longrightarrow> s i = 0"
   shows "foldseq f s n = (if (j <= n) then (s j) else 0)"
 proof -
-  from s0 have a: "! i. i < j \<longrightarrow> s i = 0" by simp
-  from s0 have b: "! i. j < i \<longrightarrow> s i = 0" by simp
+  from s0 have a: "\<forall>i. i < j \<longrightarrow> s i = 0" by simp
+  from s0 have b: "\<forall>i. j < i \<longrightarrow> s i = 0" by simp
   show ?thesis
     apply auto
     apply (subst foldseq_zerotail2[of f, OF fx0, of j, OF b, of n, THEN sym])
@@ -629,7 +629,7 @@
   assumes "!! a b. g (f a b) = f (g a) (g b)"
   shows "g(foldseq f s n) = foldseq f (% x. g(s x)) n"
 proof -
-  have "! s. g(foldseq f s n) = foldseq f (% x. g(s x)) n"
+  have "\<forall>s. g(foldseq f s n) = foldseq f (% x. g(s x)) n"
     apply (induct_tac n)
     apply (simp)
     apply (simp)
@@ -668,10 +668,10 @@
 qed
 
 definition r_distributive :: "('a \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> ('b \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> bool" where
-  "r_distributive fmul fadd == ! a u v. fmul a (fadd u v) = fadd (fmul a u) (fmul a v)"
+  "r_distributive fmul fadd == \<forall>a u v. fmul a (fadd u v) = fadd (fmul a u) (fmul a v)"
 
 definition l_distributive :: "('a \<Rightarrow> 'b \<Rightarrow> 'a) \<Rightarrow> ('a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> bool" where
-  "l_distributive fmul fadd == ! a u v. fmul (fadd u v) a = fadd (fmul u a) (fmul v a)"
+  "l_distributive fmul fadd == \<forall>a u v. fmul (fadd u v) a = fadd (fmul u a) (fmul v a)"
 
 definition distributive :: "('a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> ('a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> bool" where
   "distributive fmul fadd == l_distributive fmul fadd & r_distributive fmul fadd"
@@ -685,8 +685,8 @@
   "associative fadd"
   "commutative fadd"
   "fadd 0 0 = 0"
-  "! a. fmul a 0 = 0"
-  "! a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
+  "\<forall>a. fmul 0 a = 0"
  shows "r_distributive (mult_matrix fmul fadd) (combine_matrix fadd)"
 proof -
   from assms show ?thesis
@@ -725,8 +725,8 @@
   "associative fadd"
   "commutative fadd"
   "fadd 0 0 = 0"
-  "! a. fmul a 0 = 0"
-  "! a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
+  "\<forall>a. fmul 0 a = 0"
  shows "l_distributive (mult_matrix fmul fadd) (combine_matrix fadd)"
 proof -
   from assms show ?thesis
@@ -796,20 +796,20 @@
   apply (auto)
   by (subst foldseq_zero, (simp add: zero_matrix_def)+)+
 
-lemma mult_matrix_n_zero_right[simp]: "\<lbrakk>fadd 0 0 = 0; !a. fmul a 0 = 0\<rbrakk> \<Longrightarrow> mult_matrix_n n fmul fadd A 0 = 0"
+lemma mult_matrix_n_zero_right[simp]: "\<lbrakk>fadd 0 0 = 0; \<forall>a. fmul a 0 = 0\<rbrakk> \<Longrightarrow> mult_matrix_n n fmul fadd A 0 = 0"
   apply (simp add: mult_matrix_n_def)
   apply (subst foldseq_zero)
   by (simp_all add: zero_matrix_def)
 
-lemma mult_matrix_n_zero_left[simp]: "\<lbrakk>fadd 0 0 = 0; !a. fmul 0 a = 0\<rbrakk> \<Longrightarrow> mult_matrix_n n fmul fadd 0 A = 0"
+lemma mult_matrix_n_zero_left[simp]: "\<lbrakk>fadd 0 0 = 0; \<forall>a. fmul 0 a = 0\<rbrakk> \<Longrightarrow> mult_matrix_n n fmul fadd 0 A = 0"
   apply (simp add: mult_matrix_n_def)
   apply (subst foldseq_zero)
   by (simp_all add: zero_matrix_def)
 
-lemma mult_matrix_zero_left[simp]: "\<lbrakk>fadd 0 0 = 0; !a. fmul 0 a = 0\<rbrakk> \<Longrightarrow> mult_matrix fmul fadd 0 A = 0"
+lemma mult_matrix_zero_left[simp]: "\<lbrakk>fadd 0 0 = 0; \<forall>a. fmul 0 a = 0\<rbrakk> \<Longrightarrow> mult_matrix fmul fadd 0 A = 0"
 by (simp add: mult_matrix_def)
 
-lemma mult_matrix_zero_right[simp]: "\<lbrakk>fadd 0 0 = 0; !a. fmul a 0 = 0\<rbrakk> \<Longrightarrow> mult_matrix fmul fadd A 0 = 0"
+lemma mult_matrix_zero_right[simp]: "\<lbrakk>fadd 0 0 = 0; \<forall>a. fmul a 0 = 0\<rbrakk> \<Longrightarrow> mult_matrix fmul fadd A 0 = 0"
 by (simp add: mult_matrix_def)
 
 lemma apply_matrix_zero[simp]: "f 0 = 0 \<Longrightarrow> apply_matrix f 0 = 0"
@@ -987,10 +987,10 @@
 
 lemma mult_matrix_singleton_right[simp]:
   assumes
-  "! x. fmul x 0 = 0"
-  "! x. fmul 0 x = 0"
-  "! x. fadd 0 x = x"
-  "! x. fadd x 0 = x"
+  "\<forall>x. fmul x 0 = 0"
+  "\<forall>x. fmul 0 x = 0"
+  "\<forall>x. fadd 0 x = x"
+  "\<forall>x. fadd x 0 = x"
   shows "(mult_matrix fmul fadd A (singleton_matrix j i e)) = apply_matrix (% x. fmul x e) (move_matrix (column_of_matrix A j) 0 (int i))"
   apply (simp add: mult_matrix_def)
   apply (subst mult_matrix_nm[of _ _ _ "max (ncols A) (Suc j)"])
@@ -1006,25 +1006,25 @@
 lemma mult_matrix_ext:
   assumes
   eprem:
-  "? e. (! a b. a \<noteq> b \<longrightarrow> fmul a e \<noteq> fmul b e)"
+  "\<exists>e. (\<forall>a b. a \<noteq> b \<longrightarrow> fmul a e \<noteq> fmul b e)"
   and fprems:
-  "! a. fmul 0 a = 0"
-  "! a. fmul a 0 = 0"
-  "! a. fadd a 0 = a"
-  "! a. fadd 0 a = a"
+  "\<forall>a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
+  "\<forall>a. fadd a 0 = a"
+  "\<forall>a. fadd 0 a = a"
   and contraprems:
   "mult_matrix fmul fadd A = mult_matrix fmul fadd B"
   shows
   "A = B"
 proof(rule contrapos_np[of "False"], simp)
   assume a: "A \<noteq> B"
-  have b: "!! f g. (! x y. f x y = g x y) \<Longrightarrow> f = g" by ((rule ext)+, auto)
-  have "? j i. (Rep_matrix A j i) \<noteq> (Rep_matrix B j i)"
+  have b: "\<And>f g. (\<forall>x y. f x y = g x y) \<Longrightarrow> f = g" by ((rule ext)+, auto)
+  have "\<exists>j i. (Rep_matrix A j i) \<noteq> (Rep_matrix B j i)"
     apply (rule contrapos_np[of "False"], simp+)
     apply (insert b[of "Rep_matrix A" "Rep_matrix B"], simp)
     by (simp add: Rep_matrix_inject a)
   then obtain J I where c:"(Rep_matrix A J I) \<noteq> (Rep_matrix B J I)" by blast
-  from eprem obtain e where eprops:"(! a b. a \<noteq> b \<longrightarrow> fmul a e \<noteq> fmul b e)" by blast
+  from eprem obtain e where eprops:"(\<forall>a b. a \<noteq> b \<longrightarrow> fmul a e \<noteq> fmul b e)" by blast
   let ?S = "singleton_matrix I 0 e"
   let ?comp = "mult_matrix fmul fadd"
   have d: "!!x f g. f = g \<Longrightarrow> f x = g x" by blast
@@ -1046,12 +1046,12 @@
 
 lemma foldmatrix_transpose:
   assumes
-  "! a b c d. g(f a b) (f c d) = f (g a c) (g b d)"
+  "\<forall>a b c d. g(f a b) (f c d) = f (g a c) (g b d)"
   shows
   "foldmatrix f g A m n = foldmatrix_transposed g f (transpose_infmatrix A) n m"
 proof -
-  have forall:"!! P x. (! x. P x) \<Longrightarrow> P x" by auto
-  have tworows:"! A. foldmatrix f g A 1 n = foldmatrix_transposed g f (transpose_infmatrix A) n 1"
+  have forall:"\<And>P x. (\<forall>x. P x) \<Longrightarrow> P x" by auto
+  have tworows:"\<forall>A. foldmatrix f g A 1 n = foldmatrix_transposed g f (transpose_infmatrix A) n 1"
     apply (induct n)
     apply (simp add: foldmatrix_def foldmatrix_transposed_def assms)+
     apply (auto)
@@ -1069,7 +1069,7 @@
 assumes
   "associative f"
   "associative g"
-  "! a b c d. g(f a b) (f c d) = f (g a c) (g b d)"
+  "\<forall>a b c d. g(f a b) (f c d) = f (g a c) (g b d)"
 shows
   "foldseq g (% j. foldseq f (A j) n) m = foldseq f (% j. foldseq g ((transpose_infmatrix A) j) m) n"
   apply (insert foldmatrix_transpose[of g f A m n])
@@ -1077,8 +1077,8 @@
 
 lemma mult_n_nrows:
 assumes
-"! a. fmul 0 a = 0"
-"! a. fmul a 0 = 0"
+"\<forall>a. fmul 0 a = 0"
+"\<forall>a. fmul a 0 = 0"
 "fadd 0 0 = 0"
 shows "nrows (mult_matrix_n n fmul fadd A B) \<le> nrows A"
 apply (subst nrows_le)
@@ -1093,8 +1093,8 @@
 
 lemma mult_n_ncols:
 assumes
-"! a. fmul 0 a = 0"
-"! a. fmul a 0 = 0"
+"\<forall>a. fmul 0 a = 0"
+"\<forall>a. fmul a 0 = 0"
 "fadd 0 0 = 0"
 shows "ncols (mult_matrix_n n fmul fadd A B) \<le> ncols B"
 apply (subst ncols_le)
@@ -1109,16 +1109,16 @@
 
 lemma mult_nrows:
 assumes
-"! a. fmul 0 a = 0"
-"! a. fmul a 0 = 0"
+"\<forall>a. fmul 0 a = 0"
+"\<forall>a. fmul a 0 = 0"
 "fadd 0 0 = 0"
 shows "nrows (mult_matrix fmul fadd A B) \<le> nrows A"
 by (simp add: mult_matrix_def mult_n_nrows assms)
 
 lemma mult_ncols:
 assumes
-"! a. fmul 0 a = 0"
-"! a. fmul a 0 = 0"
+"\<forall>a. fmul 0 a = 0"
+"\<forall>a. fmul a 0 = 0"
 "fadd 0 0 = 0"
 shows "ncols (mult_matrix fmul fadd A B) \<le> ncols B"
 by (simp add: mult_matrix_def mult_n_ncols assms)
@@ -1137,18 +1137,18 @@
 
 lemma mult_matrix_assoc:
   assumes
-  "! a. fmul1 0 a = 0"
-  "! a. fmul1 a 0 = 0"
-  "! a. fmul2 0 a = 0"
-  "! a. fmul2 a 0 = 0"
+  "\<forall>a. fmul1 0 a = 0"
+  "\<forall>a. fmul1 a 0 = 0"
+  "\<forall>a. fmul2 0 a = 0"
+  "\<forall>a. fmul2 a 0 = 0"
   "fadd1 0 0 = 0"
   "fadd2 0 0 = 0"
-  "! a b c d. fadd2 (fadd1 a b) (fadd1 c d) = fadd1 (fadd2 a c) (fadd2 b d)"
+  "\<forall>a b c d. fadd2 (fadd1 a b) (fadd1 c d) = fadd1 (fadd2 a c) (fadd2 b d)"
   "associative fadd1"
   "associative fadd2"
-  "! a b c. fmul2 (fmul1 a b) c = fmul1 a (fmul2 b c)"
-  "! a b c. fmul2 (fadd1 a b) c = fadd1 (fmul2 a c) (fmul2 b c)"
-  "! a b c. fmul1 c (fadd2 a b) = fadd2 (fmul1 c a) (fmul1 c b)"
+  "\<forall>a b c. fmul2 (fmul1 a b) c = fmul1 a (fmul2 b c)"
+  "\<forall>a b c. fmul2 (fadd1 a b) c = fadd1 (fmul2 a c) (fmul2 b c)"
+  "\<forall>a b c. fmul1 c (fadd2 a b) = fadd2 (fmul1 c a) (fmul1 c b)"
   shows "mult_matrix fmul2 fadd2 (mult_matrix fmul1 fadd1 A B) C = mult_matrix fmul1 fadd1 A (mult_matrix fmul2 fadd2 B C)"
 proof -
   have comb_left:  "!! A B x y. A = B \<Longrightarrow> (Rep_matrix (Abs_matrix A)) x y = (Rep_matrix(Abs_matrix B)) x y" by blast
@@ -1195,18 +1195,18 @@
 
 lemma
   assumes
-  "! a. fmul1 0 a = 0"
-  "! a. fmul1 a 0 = 0"
-  "! a. fmul2 0 a = 0"
-  "! a. fmul2 a 0 = 0"
+  "\<forall>a. fmul1 0 a = 0"
+  "\<forall>a. fmul1 a 0 = 0"
+  "\<forall>a. fmul2 0 a = 0"
+  "\<forall>a. fmul2 a 0 = 0"
   "fadd1 0 0 = 0"
   "fadd2 0 0 = 0"
-  "! a b c d. fadd2 (fadd1 a b) (fadd1 c d) = fadd1 (fadd2 a c) (fadd2 b d)"
+  "\<forall>a b c d. fadd2 (fadd1 a b) (fadd1 c d) = fadd1 (fadd2 a c) (fadd2 b d)"
   "associative fadd1"
   "associative fadd2"
-  "! a b c. fmul2 (fmul1 a b) c = fmul1 a (fmul2 b c)"
-  "! a b c. fmul2 (fadd1 a b) c = fadd1 (fmul2 a c) (fmul2 b c)"
-  "! a b c. fmul1 c (fadd2 a b) = fadd2 (fmul1 c a) (fmul1 c b)"
+  "\<forall>a b c. fmul2 (fmul1 a b) c = fmul1 a (fmul2 b c)"
+  "\<forall>a b c. fmul2 (fadd1 a b) c = fadd1 (fmul2 a c) (fmul2 b c)"
+  "\<forall>a b c. fmul1 c (fadd2 a b) = fadd2 (fmul1 c a) (fmul1 c b)"
   shows
   "(mult_matrix fmul1 fadd1 A) o (mult_matrix fmul2 fadd2 B) = mult_matrix fmul2 fadd2 (mult_matrix fmul1 fadd1 A B)"
 apply (rule ext)+
@@ -1216,8 +1216,8 @@
 
 lemma mult_matrix_assoc_simple:
   assumes
-  "! a. fmul 0 a = 0"
-  "! a. fmul a 0 = 0"
+  "\<forall>a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
   "fadd 0 0 = 0"
   "associative fadd"
   "commutative fadd"
@@ -1247,8 +1247,8 @@
 
 lemma Rep_mult_matrix:
   assumes
-  "! a. fmul 0 a = 0"
-  "! a. fmul a 0 = 0"
+  "\<forall>a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
   "fadd 0 0 = 0"
   shows
   "Rep_matrix(mult_matrix fmul fadd A B) j i =
@@ -1262,10 +1262,10 @@
 
 lemma transpose_mult_matrix:
   assumes
-  "! a. fmul 0 a = 0"
-  "! a. fmul a 0 = 0"
+  "\<forall>a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
   "fadd 0 0 = 0"
-  "! x y. fmul y x = fmul x y"
+  "\<forall>x y. fmul y x = fmul x y"
   shows
   "transpose_matrix (mult_matrix fmul fadd A B) = mult_matrix fmul fadd (transpose_matrix B) (transpose_matrix A)"
   apply (simp add: Rep_matrix_inject[THEN sym])
@@ -1314,7 +1314,7 @@
 lemma le_apply_matrix:
   assumes
   "f 0 = 0"
-  "! x y. x <= y \<longrightarrow> f x <= f y"
+  "\<forall>x y. x <= y \<longrightarrow> f x <= f y"
   "(a::('a::{ord, zero}) matrix) <= b"
   shows
   "apply_matrix f a <= apply_matrix f b"
@@ -1323,7 +1323,7 @@
 lemma le_combine_matrix:
   assumes
   "f 0 0 = 0"
-  "! a b c d. a <= b & c <= d \<longrightarrow> f a c <= f b d"
+  "\<forall>a b c d. a <= b & c <= d \<longrightarrow> f a c <= f b d"
   "A <= B"
   "C <= D"
   shows
@@ -1333,7 +1333,7 @@
 lemma le_left_combine_matrix:
   assumes
   "f 0 0 = 0"
-  "! a b c. a <= b \<longrightarrow> f c a <= f c b"
+  "\<forall>a b c. a <= b \<longrightarrow> f c a <= f c b"
   "A <= B"
   shows
   "combine_matrix f C A <= combine_matrix f C B"
@@ -1342,7 +1342,7 @@
 lemma le_right_combine_matrix:
   assumes
   "f 0 0 = 0"
-  "! a b c. a <= b \<longrightarrow> f a c <= f b c"
+  "\<forall>a b c. a <= b \<longrightarrow> f a c <= f b c"
   "A <= B"
   shows
   "combine_matrix f A C <= combine_matrix f B C"
@@ -1353,22 +1353,22 @@
 
 lemma le_foldseq:
   assumes
-  "! a b c d . a <= b & c <= d \<longrightarrow> f a c <= f b d"
-  "! i. i <= n \<longrightarrow> s i <= t i"
+  "\<forall>a b c d . a <= b & c <= d \<longrightarrow> f a c <= f b d"
+  "\<forall>i. i <= n \<longrightarrow> s i <= t i"
   shows
   "foldseq f s n <= foldseq f t n"
 proof -
-  have "! s t. (! i. i<=n \<longrightarrow> s i <= t i) \<longrightarrow> foldseq f s n <= foldseq f t n"
+  have "\<forall>s t. (\<forall>i. i<=n \<longrightarrow> s i <= t i) \<longrightarrow> foldseq f s n <= foldseq f t n"
     by (induct n) (simp_all add: assms)
   then show "foldseq f s n <= foldseq f t n" using assms by simp
 qed
 
 lemma le_left_mult:
   assumes
-  "! a b c d. a <= b & c <= d \<longrightarrow> fadd a c <= fadd b d"
-  "! c a b.   0 <= c & a <= b \<longrightarrow> fmul c a <= fmul c b"
-  "! a. fmul 0 a = 0"
-  "! a. fmul a 0 = 0"
+  "\<forall>a b c d. a <= b & c <= d \<longrightarrow> fadd a c <= fadd b d"
+  "\<forall>c a b.   0 <= c & a <= b \<longrightarrow> fmul c a <= fmul c b"
+  "\<forall>a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
   "fadd 0 0 = 0"
   "0 <= C"
   "A <= B"
@@ -1384,10 +1384,10 @@
 
 lemma le_right_mult:
   assumes
-  "! a b c d. a <= b & c <= d \<longrightarrow> fadd a c <= fadd b d"
-  "! c a b. 0 <= c & a <= b \<longrightarrow> fmul a c <= fmul b c"
-  "! a. fmul 0 a = 0"
-  "! a. fmul a 0 = 0"
+  "\<forall>a b c d. a <= b & c <= d \<longrightarrow> fadd a c <= fadd b d"
+  "\<forall>c a b. 0 <= c & a <= b \<longrightarrow> fmul a c <= fmul b c"
+  "\<forall>a. fmul 0 a = 0"
+  "\<forall>a. fmul a 0 = 0"
   "fadd 0 0 = 0"
   "0 <= C"
   "A <= B"
@@ -1401,7 +1401,7 @@
   apply (auto)
   done
 
-lemma spec2: "! j i. P j i \<Longrightarrow> P j i" by blast
+lemma spec2: "\<forall>j i. P j i \<Longrightarrow> P j i" by blast
 lemma neg_imp: "(\<not> Q \<longrightarrow> \<not> P) \<Longrightarrow> P \<longrightarrow> Q" by blast
 
 lemma singleton_matrix_le[simp]: "(singleton_matrix j i a <= singleton_matrix j i b) = (a <= (b::_::order))"
@@ -1628,7 +1628,7 @@
 apply (simp add: Rep_mult_matrix)
 done
 
-lemma apply_matrix_add: "! x y. f (x+y) = (f x) + (f y) \<Longrightarrow> f 0 = (0::'a)
+lemma apply_matrix_add: "\<forall>x y. f (x+y) = (f x) + (f y) \<Longrightarrow> f 0 = (0::'a)
   \<Longrightarrow> apply_matrix f ((a::('a::monoid_add) matrix) + b) = (apply_matrix f a) + (apply_matrix f b)"
 apply (subst Rep_matrix_inject[symmetric])
 apply (rule ext)+
@@ -1751,7 +1751,7 @@
 by auto
 
 lemma Rep_matrix_zero_imp_mult_zero:
-  "! j i k. (Rep_matrix A j k = 0) | (Rep_matrix B k i) = 0  \<Longrightarrow> A * B = (0::('a::lattice_ring) matrix)"
+  "\<forall>j i k. (Rep_matrix A j k = 0) | (Rep_matrix B k i) = 0  \<Longrightarrow> A * B = (0::('a::lattice_ring) matrix)"
 apply (subst Rep_matrix_inject[symmetric])
 apply (rule ext)+
 apply (auto simp add: Rep_matrix_mult foldseq_zero zero_imp_mult_zero)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Matrix_LP/SparseMatrix.thy
--- a/src/HOL/Matrix_LP/SparseMatrix.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Matrix_LP/SparseMatrix.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -25,7 +25,7 @@
 
 lemmas [code] = sparse_row_vector_empty [symmetric]
 
-lemma foldl_distrstart: "! a x y. (f (g x y) a = g x (f y a)) \<Longrightarrow> (foldl f (g x y) l = g x (foldl f y l))"
+lemma foldl_distrstart: "\<forall>a x y. (f (g x y) a = g x (f y a)) \<Longrightarrow> (foldl f (g x y) l = g x (foldl f y l))"
   by (induct l arbitrary: x y, auto)
 
 lemma sparse_row_vector_cons[simp]:
@@ -180,7 +180,7 @@
 lemma addmult_spvec_empty2[simp]: "addmult_spvec y a [] = a"
   by (induct a) auto
 
-lemma sparse_row_vector_map: "(! x y. f (x+y) = (f x) + (f y)) \<Longrightarrow> (f::'a\<Rightarrow>('a::lattice_ring)) 0 = 0 \<Longrightarrow> 
+lemma sparse_row_vector_map: "(\<forall>x y. f (x+y) = (f x) + (f y)) \<Longrightarrow> (f::'a\<Rightarrow>('a::lattice_ring)) 0 = 0 \<Longrightarrow> 
   sparse_row_vector (map (% x. (fst x, f (snd x))) a) = apply_matrix f (sparse_row_vector a)"
   apply (induct a)
   apply (simp_all add: apply_matrix_add)
@@ -417,7 +417,7 @@
 
 lemma sorted_add_spvec_helper1[rule_format]: "add_spvec ((a,b)#arr) brr = (ab, bb) # list \<longrightarrow> (ab = a | (brr \<noteq> [] & ab = fst (hd brr)))"
   proof - 
-    have "(! x ab a. x = (a,b)#arr \<longrightarrow> add_spvec x brr = (ab, bb) # list \<longrightarrow> (ab = a | (ab = fst (hd brr))))"
+    have "(\<forall>x ab a. x = (a,b)#arr \<longrightarrow> add_spvec x brr = (ab, bb) # list \<longrightarrow> (ab = a | (ab = fst (hd brr))))"
       by (induct brr rule: add_spvec.induct) (auto split:if_splits)
     then show ?thesis
       by (case_tac brr, auto)
@@ -425,7 +425,7 @@
 
 lemma sorted_add_spmat_helper1[rule_format]: "add_spmat ((a,b)#arr) brr = (ab, bb) # list \<longrightarrow> (ab = a | (brr \<noteq> [] & ab = fst (hd brr)))"
   proof - 
-    have "(! x ab a. x = (a,b)#arr \<longrightarrow> add_spmat x brr = (ab, bb) # list \<longrightarrow> (ab = a | (ab = fst (hd brr))))"
+    have "(\<forall>x ab a. x = (a,b)#arr \<longrightarrow> add_spmat x brr = (ab, bb) # list \<longrightarrow> (ab = a | (ab = fst (hd brr))))"
       by (rule add_spmat.induct) (auto split:if_splits)
     then show ?thesis
       by (case_tac brr, auto)
@@ -559,7 +559,7 @@
 
 definition disj_matrices :: "('a::zero) matrix \<Rightarrow> 'a matrix \<Rightarrow> bool" where
   "disj_matrices A B \<longleftrightarrow>
-    (! j i. (Rep_matrix A j i \<noteq> 0) \<longrightarrow> (Rep_matrix B j i = 0)) & (! j i. (Rep_matrix B j i \<noteq> 0) \<longrightarrow> (Rep_matrix A j i = 0))"  
+    (\<forall>j i. (Rep_matrix A j i \<noteq> 0) \<longrightarrow> (Rep_matrix B j i = 0)) & (\<forall>j i. (Rep_matrix B j i \<noteq> 0) \<longrightarrow> (Rep_matrix A j i = 0))"  
 
 declare [[simp_depth_limit = 6]]
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Metis_Examples/Big_O.thy
--- a/src/HOL/Metis_Examples/Big_O.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Metis_Examples/Big_O.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -128,17 +128,17 @@
 lemma bigo_alt_def: "O(f) = {h. \<exists>c. (0 < c \<and> (\<forall>x. \<bar>h x\<bar> <= c * \<bar>f x\<bar>))}"
 by (auto simp add: bigo_def bigo_pos_const)
 
-lemma bigo_elt_subset [intro]: "f : O(g) \<Longrightarrow> O(f) \<le> O(g)"
+lemma bigo_elt_subset [intro]: "f \<in> O(g) \<Longrightarrow> O(f) \<le> O(g)"
 apply (auto simp add: bigo_alt_def)
 apply (rule_tac x = "ca * c" in exI)
 apply (metis algebra_simps mult_le_cancel_left_pos order_trans mult_pos_pos)
 done
 
-lemma bigo_refl [intro]: "f : O(f)"
+lemma bigo_refl [intro]: "f \<in> O(f)"
 unfolding bigo_def mem_Collect_eq
 by (metis mult_1 order_refl)
 
-lemma bigo_zero: "0 : O(g)"
+lemma bigo_zero: "0 \<in> O(g)"
 apply (auto simp add: bigo_def func_zero)
 by (metis mult_zero_left order_refl)
 
@@ -210,12 +210,12 @@
  apply (metis max.cobounded2 linorder_linear max.absorb1 mult_right_mono xt1(6))
 by (metis max.cobounded2 linorder_not_le mult_le_cancel_right order_trans)
 
-lemma bigo_bounded_alt: "\<forall>x. 0 <= f x \<Longrightarrow> \<forall>x. f x <= c * g x \<Longrightarrow> f : O(g)"
+lemma bigo_bounded_alt: "\<forall>x. 0 \<le> f x \<Longrightarrow> \<forall>x. f x \<le> c * g x \<Longrightarrow> f \<in> O(g)"
 apply (auto simp add: bigo_def)
 (* Version 1: one-line proof *)
 by (metis abs_le_D1 linorder_class.not_less order_less_le Orderings.xt1(12) abs_mult)
 
-lemma "\<forall>x. 0 <= f x \<Longrightarrow> \<forall>x. f x <= c * g x \<Longrightarrow> f : O(g)"
+lemma "\<forall>x. 0 \<le> f x \<Longrightarrow> \<forall>x. f x \<le> c * g x \<Longrightarrow> f \<in> O(g)"
 apply (auto simp add: bigo_def)
 (* Version 2: structured proof *)
 proof -
@@ -223,11 +223,11 @@
   thus "\<exists>c. \<forall>x. f x \<le> c * \<bar>g x\<bar>" by (metis abs_mult abs_ge_self order_trans)
 qed
 
-lemma bigo_bounded: "\<forall>x. 0 <= f x \<Longrightarrow> \<forall>x. f x <= g x \<Longrightarrow> f : O(g)"
+lemma bigo_bounded: "\<forall>x. 0 \<le> f x \<Longrightarrow> \<forall>x. f x \<le> g x \<Longrightarrow> f \<in> O(g)"
 apply (erule bigo_bounded_alt [of f 1 g])
 by (metis mult_1)
 
-lemma bigo_bounded2: "\<forall>x. lb x <= f x \<Longrightarrow> \<forall>x. f x <= lb x + g x \<Longrightarrow> f : lb +o O(g)"
+lemma bigo_bounded2: "\<forall>x. lb x \<le> f x \<Longrightarrow> \<forall>x. f x \<le> lb x + g x \<Longrightarrow> f \<in> lb +o O(g)"
 apply (rule set_minus_imp_plus)
 apply (rule bigo_bounded)
  apply (metis add_le_cancel_left diff_add_cancel diff_self minus_apply
@@ -258,40 +258,40 @@
   apply (rule set_minus_imp_plus)
   apply (subst fun_diff_def)
 proof -
-  assume a: "f - g : O(h)"
+  assume a: "f - g \<in> O(h)"
   have "(\<lambda>x. \<bar>f x\<bar> - \<bar>g x\<bar>) =o O(\<lambda>x. \<bar>\<bar>f x\<bar> - \<bar>g x\<bar>\<bar>)"
     by (rule bigo_abs2)
-  also have "... <= O(\<lambda>x. \<bar>f x - g x\<bar>)"
+  also have "\<dots> <= O(\<lambda>x. \<bar>f x - g x\<bar>)"
     apply (rule bigo_elt_subset)
     apply (rule bigo_bounded)
      apply (metis abs_ge_zero)
     by (metis abs_triangle_ineq3)
-  also have "... <= O(f - g)"
+  also have "\<dots> <= O(f - g)"
     apply (rule bigo_elt_subset)
     apply (subst fun_diff_def)
     apply (rule bigo_abs)
     done
-  also have "... <= O(h)"
+  also have "\<dots> <= O(h)"
     using a by (rule bigo_elt_subset)
-  finally show "(\<lambda>x. \<bar>f x\<bar> - \<bar>g x\<bar>) : O(h)" .
+  finally show "(\<lambda>x. \<bar>f x\<bar> - \<bar>g x\<bar>) \<in> O(h)" .
 qed
 
 lemma bigo_abs5: "f =o O(g) \<Longrightarrow> (\<lambda>x. \<bar>f x\<bar>) =o O(g)"
 by (unfold bigo_def, auto)
 
-lemma bigo_elt_subset2 [intro]: "f : g +o O(h) \<Longrightarrow> O(f) <= O(g) + O(h)"
+lemma bigo_elt_subset2 [intro]: "f \<in> g +o O(h) \<Longrightarrow> O(f) \<le> O(g) + O(h)"
 proof -
-  assume "f : g +o O(h)"
-  also have "... <= O(g) + O(h)"
+  assume "f \<in> g +o O(h)"
+  also have "\<dots> \<le> O(g) + O(h)"
     by (auto del: subsetI)
-  also have "... = O(\<lambda>x. \<bar>g x\<bar>) + O(\<lambda>x. \<bar>h x\<bar>)"
+  also have "\<dots> = O(\<lambda>x. \<bar>g x\<bar>) + O(\<lambda>x. \<bar>h x\<bar>)"
     by (metis bigo_abs3)
   also have "... = O((\<lambda>x. \<bar>g x\<bar>) + (\<lambda>x. \<bar>h x\<bar>))"
     by (rule bigo_plus_eq [symmetric], auto)
-  finally have "f : ...".
-  then have "O(f) <= ..."
+  finally have "f \<in> \<dots>".
+  then have "O(f) \<le> \<dots>"
     by (elim bigo_elt_subset)
-  also have "... = O(\<lambda>x. \<bar>g x\<bar>) + O(\<lambda>x. \<bar>h x\<bar>)"
+  also have "\<dots> = O(\<lambda>x. \<bar>g x\<bar>) + O(\<lambda>x. \<bar>h x\<bar>)"
     by (rule bigo_plus_eq, auto)
   finally show ?thesis
     by (simp add: bigo_abs3 [symmetric])
@@ -313,32 +313,32 @@
 lemma bigo_mult2 [intro]: "f *o O(g) <= O(f * g)"
 by (metis bigo_mult bigo_refl set_times_mono3 subset_trans)
 
-lemma bigo_mult3: "f : O(h) \<Longrightarrow> g : O(j) \<Longrightarrow> f * g : O(h * j)"
+lemma bigo_mult3: "f \<in> O(h) \<Longrightarrow> g \<in> O(j) \<Longrightarrow> f * g \<in> O(h * j)"
 by (metis bigo_mult set_rev_mp set_times_intro)
 
-lemma bigo_mult4 [intro]:"f : k +o O(h) \<Longrightarrow> g * f : (g * k) +o O(g * h)"
+lemma bigo_mult4 [intro]:"f \<in> k +o O(h) \<Longrightarrow> g * f \<in> (g * k) +o O(g * h)"
 by (metis bigo_mult2 set_plus_mono_b set_times_intro2 set_times_plus_distrib)
 
 lemma bigo_mult5: "\<forall>x. f x ~= 0 \<Longrightarrow>
     O(f * g) <= (f::'a => ('b::linordered_field)) *o O(g)"
 proof -
-  assume a: "\<forall>x. f x ~= 0"
+  assume a: "\<forall>x. f x \<noteq> 0"
   show "O(f * g) <= f *o O(g)"
   proof
     fix h
-    assume h: "h : O(f * g)"
-    then have "(\<lambda>x. 1 / (f x)) * h : (\<lambda>x. 1 / f x) *o O(f * g)"
+    assume h: "h \<in> O(f * g)"
+    then have "(\<lambda>x. 1 / (f x)) * h \<in> (\<lambda>x. 1 / f x) *o O(f * g)"
       by auto
     also have "... <= O((\<lambda>x. 1 / f x) * (f * g))"
       by (rule bigo_mult2)
     also have "(\<lambda>x. 1 / f x) * (f * g) = g"
       by (simp add: fun_eq_iff a)
-    finally have "(\<lambda>x. (1::'b) / f x) * h : O(g)".
-    then have "f * ((\<lambda>x. (1::'b) / f x) * h) : f *o O(g)"
+    finally have "(\<lambda>x. (1::'b) / f x) * h \<in> O(g)".
+    then have "f * ((\<lambda>x. (1::'b) / f x) * h) \<in> f *o O(g)"
       by auto
     also have "f * ((\<lambda>x. (1::'b) / f x) * h) = h"
       by (simp add: func_times fun_eq_iff a)
-    finally show "h : f *o O(g)".
+    finally show "h \<in> f *o O(g)".
   qed
 qed
 
@@ -360,61 +360,61 @@
 "\<forall>x. f x \<noteq> 0 \<Longrightarrow> O(f * g) = O(f::'a \<Rightarrow> ('b::linordered_field)) * O(g)"
 by (metis bigo_mult bigo_mult7 order_antisym_conv)
 
-lemma bigo_minus [intro]: "f : O(g) \<Longrightarrow> - f : O(g)"
+lemma bigo_minus [intro]: "f \<in> O(g) \<Longrightarrow> - f \<in> O(g)"
 by (auto simp add: bigo_def fun_Compl_def)
 
-lemma bigo_minus2: "f : g +o O(h) \<Longrightarrow> -f : -g +o O(h)"
+lemma bigo_minus2: "f \<in> g +o O(h) \<Longrightarrow> -f \<in> -g +o O(h)"
 by (metis (no_types, lifting) bigo_minus diff_minus_eq_add minus_add_distrib
     minus_minus set_minus_imp_plus set_plus_imp_minus)
 
 lemma bigo_minus3: "O(-f) = O(f)"
 by (metis bigo_elt_subset bigo_minus bigo_refl equalityI minus_minus)
 
-lemma bigo_plus_absorb_lemma1: "f : O(g) \<Longrightarrow> f +o O(g) \<le> O(g)"
+lemma bigo_plus_absorb_lemma1: "f \<in> O(g) \<Longrightarrow> f +o O(g) \<le> O(g)"
 by (metis bigo_plus_idemp set_plus_mono3)
 
-lemma bigo_plus_absorb_lemma2: "f : O(g) \<Longrightarrow> O(g) \<le> f +o O(g)"
+lemma bigo_plus_absorb_lemma2: "f \<in> O(g) \<Longrightarrow> O(g) \<le> f +o O(g)"
 by (metis (no_types) bigo_minus bigo_plus_absorb_lemma1 right_minus
           set_plus_mono set_plus_rearrange2 set_zero_plus subsetD subset_refl
           subset_trans)
 
-lemma bigo_plus_absorb [simp]: "f : O(g) \<Longrightarrow> f +o O(g) = O(g)"
+lemma bigo_plus_absorb [simp]: "f \<in> O(g) \<Longrightarrow> f +o O(g) = O(g)"
 by (metis bigo_plus_absorb_lemma1 bigo_plus_absorb_lemma2 order_eq_iff)
 
-lemma bigo_plus_absorb2 [intro]: "f : O(g) \<Longrightarrow> A <= O(g) \<Longrightarrow> f +o A \<le> O(g)"
+lemma bigo_plus_absorb2 [intro]: "f \<in> O(g) \<Longrightarrow> A \<subseteq> O(g) \<Longrightarrow> f +o A \<subseteq> O(g)"
 by (metis bigo_plus_absorb set_plus_mono)
 
-lemma bigo_add_commute_imp: "f : g +o O(h) \<Longrightarrow> g : f +o O(h)"
+lemma bigo_add_commute_imp: "f \<in> g +o O(h) \<Longrightarrow> g \<in> f +o O(h)"
 by (metis bigo_minus minus_diff_eq set_plus_imp_minus set_minus_plus)
 
-lemma bigo_add_commute: "(f : g +o O(h)) = (g : f +o O(h))"
+lemma bigo_add_commute: "(f \<in> g +o O(h)) = (g \<in> f +o O(h))"
 by (metis bigo_add_commute_imp)
 
-lemma bigo_const1: "(\<lambda>x. c) : O(\<lambda>x. 1)"
+lemma bigo_const1: "(\<lambda>x. c) \<in> O(\<lambda>x. 1)"
 by (auto simp add: bigo_def ac_simps)
 
 lemma bigo_const2 [intro]: "O(\<lambda>x. c) \<le> O(\<lambda>x. 1)"
 by (metis bigo_const1 bigo_elt_subset)
 
-lemma bigo_const3: "(c::'a::linordered_field) ~= 0 \<Longrightarrow> (\<lambda>x. 1) : O(\<lambda>x. c)"
+lemma bigo_const3: "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow> (\<lambda>x. 1) \<in> O(\<lambda>x. c)"
 apply (simp add: bigo_def)
 by (metis abs_eq_0 left_inverse order_refl)
 
-lemma bigo_const4: "(c::'a::linordered_field) ~= 0 \<Longrightarrow> O(\<lambda>x. 1) <= O(\<lambda>x. c)"
+lemma bigo_const4: "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow> O(\<lambda>x. 1) \<subseteq> O(\<lambda>x. c)"
 by (metis bigo_elt_subset bigo_const3)
 
 lemma bigo_const [simp]: "(c::'a::linordered_field) ~= 0 \<Longrightarrow>
     O(\<lambda>x. c) = O(\<lambda>x. 1)"
 by (metis bigo_const2 bigo_const4 equalityI)
 
-lemma bigo_const_mult1: "(\<lambda>x. c * f x) : O(f)"
+lemma bigo_const_mult1: "(\<lambda>x. c * f x) \<in> O(f)"
 apply (simp add: bigo_def abs_mult)
 by (metis le_less)
 
 lemma bigo_const_mult2: "O(\<lambda>x. c * f x) \<le> O(f)"
 by (rule bigo_elt_subset, rule bigo_const_mult1)
 
-lemma bigo_const_mult3: "(c::'a::linordered_field) ~= 0 \<Longrightarrow> f : O(\<lambda>x. c * f x)"
+lemma bigo_const_mult3: "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow> f \<in> O(\<lambda>x. c * f x)"
 apply (simp add: bigo_def)
 by (metis (no_types) abs_mult mult.assoc mult_1 order_refl left_inverse)
 
@@ -422,11 +422,11 @@
 "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow> O(f) \<le> O(\<lambda>x. c * f x)"
 by (metis bigo_elt_subset bigo_const_mult3)
 
-lemma bigo_const_mult [simp]: "(c::'a::linordered_field) ~= 0 \<Longrightarrow>
+lemma bigo_const_mult [simp]: "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow>
     O(\<lambda>x. c * f x) = O(f)"
 by (metis equalityI bigo_const_mult2 bigo_const_mult4)
 
-lemma bigo_const_mult5 [simp]: "(c::'a::linordered_field) ~= 0 \<Longrightarrow>
+lemma bigo_const_mult5 [simp]: "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow>
     (\<lambda>x. c) *o O(f) = O(f)"
   apply (auto del: subsetI)
   apply (rule order_trans)
@@ -491,7 +491,7 @@
 
 subsection \<open>Sum\<close>
 
-lemma bigo_sum_main: "\<forall>x. \<forall>y \<in> A x. 0 <= h x y \<Longrightarrow>
+lemma bigo_sum_main: "\<forall>x. \<forall>y \<in> A x. 0 \<le> h x y \<Longrightarrow>
     \<exists>c. \<forall>x. \<forall>y \<in> A x. \<bar>f x y\<bar> <= c * (h x y) \<Longrightarrow>
       (\<lambda>x. \<Sum>y \<in> A x. f x y) =o O(\<lambda>x. \<Sum>y \<in> A x. h x y)"
 apply (auto simp add: bigo_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Metis_Examples/Clausification.thy
--- a/src/HOL/Metis_Examples/Clausification.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Metis_Examples/Clausification.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -137,7 +137,7 @@
    (\<exists>ys x zs. xs = ys @ x # zs \<and> P x \<and> (\<forall>z \<in> set zs. \<not> P z))"
 by (metis split_list_last_prop[where P = P] in_set_conv_decomp)
 
-lemma ex_tl: "EX ys. tl ys = xs"
+lemma ex_tl: "\<exists>ys. tl ys = xs"
 using list.sel(3) by fast
 
 lemma "(\<exists>ys::nat list. tl ys = xs) \<and> (\<exists>bs::int list. tl bs = as)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Metis_Examples/Message.thy
--- a/src/HOL/Metis_Examples/Message.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Metis_Examples/Message.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -84,7 +84,7 @@
 by (metis parts.Body)
 
 text\<open>Equations hold because constructors are injective.\<close>
-lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x:A)"
+lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x\<in>A)"
 by (metis agent.inject image_iff)
 
 lemma Key_image_eq [simp]: "(Key x \<in> Key`A) = (x \<in> A)"
@@ -324,7 +324,7 @@
   | Fst:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> X \<in> analz H"
   | Snd:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> Y \<in> analz H"
   | Decrypt [dest]:
-             "[|Crypt K X \<in> analz H; Key(invKey K): analz H|] ==> X \<in> analz H"
+             "[|Crypt K X \<in> analz H; Key(invKey K) \<in> analz H|] ==> X \<in> analz H"
 
 
 text\<open>Monotonicity; Lemma 1 of Lowe's paper\<close>
@@ -723,7 +723,7 @@
 qed
 
 lemma Fake_parts_insert_in_Un:
-     "[|Z \<in> parts (insert X H);  X: synth (analz H)|]
+     "[|Z \<in> parts (insert X H);  X \<in> synth (analz H)|]
       ==> Z \<in>  synth (analz H) \<union> parts H"
 by (blast dest: Fake_parts_insert [THEN subsetD, dest])
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Metis_Examples/Sets.thy
--- a/src/HOL/Metis_Examples/Sets.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Metis_Examples/Sets.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -13,12 +13,12 @@
 
 declare [[metis_new_skolem]]
 
-lemma "EX x X. ALL y. EX z Z. (~P(y,y) | P(x,x) | ~S(z,x)) &
+lemma "\<exists>x X. \<forall>y. \<exists>z Z. (~P(y,y) | P(x,x) | ~S(z,x)) &
                (S(x,y) | ~S(y,z) | Q(Z,Z))  &
                (Q(X,y) | ~Q(y,Z) | S(X,X))"
 by metis
 
-lemma "P(n::nat) ==> ~P(0) ==> n ~= 0"
+lemma "P(n::nat) ==> \<not>P(0) ==> n \<noteq> 0"
 by metis
 
 sledgehammer_params [isar_proofs, compress = 1]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Metis_Examples/Tarski.thy
--- a/src/HOL/Metis_Examples/Tarski.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Metis_Examples/Tarski.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -23,35 +23,35 @@
   order :: "('a * 'a) set"
 
 definition monotone :: "['a => 'a, 'a set, ('a *'a)set] => bool" where
-  "monotone f A r == \<forall>x\<in>A. \<forall>y\<in>A. (x, y): r --> ((f x), (f y)) : r"
+  "monotone f A r == \<forall>x\<in>A. \<forall>y\<in>A. (x, y) \<in> r --> ((f x), (f y)) \<in> r"
 
 definition least :: "['a => bool, 'a potype] => 'a" where
-  "least P po == @ x. x: pset po & P x &
-                       (\<forall>y \<in> pset po. P y --> (x,y): order po)"
+  "least P po \<equiv> SOME x. x \<in> pset po \<and> P x \<and>
+                       (\<forall>y \<in> pset po. P y \<longrightarrow> (x,y) \<in> order po)"
 
 definition greatest :: "['a => bool, 'a potype] => 'a" where
-  "greatest P po == @ x. x: pset po & P x &
-                          (\<forall>y \<in> pset po. P y --> (y,x): order po)"
+  "greatest P po \<equiv> SOME x. x \<in> pset po \<and> P x \<and>
+                          (\<forall>y \<in> pset po. P y \<longrightarrow> (y,x) \<in> order po)"
 
 definition lub  :: "['a set, 'a potype] => 'a" where
-  "lub S po == least (\<lambda>x. \<forall>y\<in>S. (y,x): order po) po"
+  "lub S po == least (\<lambda>x. \<forall>y\<in>S. (y,x) \<in> order po) po"
 
 definition glb  :: "['a set, 'a potype] => 'a" where
-  "glb S po == greatest (\<lambda>x. \<forall>y\<in>S. (x,y): order po) po"
+  "glb S po \<equiv> greatest (\<lambda>x. \<forall>y\<in>S. (x,y) \<in> order po) po"
 
 definition isLub :: "['a set, 'a potype, 'a] => bool" where
-  "isLub S po == \<lambda>L. (L: pset po & (\<forall>y\<in>S. (y,L): order po) &
-                   (\<forall>z\<in>pset po. (\<forall>y\<in>S. (y,z): order po) --> (L,z): order po))"
+  "isLub S po \<equiv> \<lambda>L. (L \<in> pset po \<and> (\<forall>y\<in>S. (y,L) \<in> order po) \<and>
+                   (\<forall>z\<in>pset po. (\<forall>y\<in>S. (y,z) \<in> order po) \<longrightarrow> (L,z) \<in> order po))"
 
 definition isGlb :: "['a set, 'a potype, 'a] => bool" where
-  "isGlb S po == \<lambda>G. (G: pset po & (\<forall>y\<in>S. (G,y): order po) &
-                 (\<forall>z \<in> pset po. (\<forall>y\<in>S. (z,y): order po) --> (z,G): order po))"
+  "isGlb S po \<equiv> \<lambda>G. (G \<in> pset po \<and> (\<forall>y\<in>S. (G,y) \<in> order po) \<and>
+                 (\<forall>z \<in> pset po. (\<forall>y\<in>S. (z,y) \<in> order po) \<longrightarrow> (z,G) \<in> order po))"
 
 definition "fix"    :: "[('a => 'a), 'a set] => 'a set" where
-  "fix f A  == {x. x: A & f x = x}"
+  "fix f A  \<equiv> {x. x \<in> A \<and> f x = x}"
 
 definition interval :: "[('a*'a) set,'a, 'a ] => 'a set" where
-  "interval r a b == {x. (a,x): r & (x,b): r}"
+  "interval r a b == {x. (a,x) \<in> r & (x,b) \<in> r}"
 
 definition Bot :: "'a potype => 'a" where
   "Bot po == least (\<lambda>x. True) po"
@@ -64,22 +64,22 @@
                        trans (order P)}"
 
 definition CompleteLattice :: "('a potype) set" where
-  "CompleteLattice == {cl. cl: PartialOrder &
-                        (\<forall>S. S \<subseteq> pset cl --> (\<exists>L. isLub S cl L)) &
-                        (\<forall>S. S \<subseteq> pset cl --> (\<exists>G. isGlb S cl G))}"
+  "CompleteLattice == {cl. cl \<in> PartialOrder \<and>
+                        (\<forall>S. S \<subseteq> pset cl \<longrightarrow> (\<exists>L. isLub S cl L)) \<and>
+                        (\<forall>S. S \<subseteq> pset cl \<longrightarrow> (\<exists>G. isGlb S cl G))}"
 
 definition induced :: "['a set, ('a * 'a) set] => ('a *'a)set" where
-  "induced A r == {(a,b). a : A & b: A & (a,b): r}"
+  "induced A r \<equiv> {(a,b). a \<in> A \<and> b \<in> A \<and> (a,b) \<in> r}"
 
 definition sublattice :: "('a potype * 'a set)set" where
-  "sublattice ==
-      SIGMA cl: CompleteLattice.
-          {S. S \<subseteq> pset cl &
-           (| pset = S, order = induced S (order cl) |): CompleteLattice }"
+  "sublattice \<equiv>
+      SIGMA cl : CompleteLattice.
+          {S. S \<subseteq> pset cl \<and>
+           \<lparr>pset = S, order = induced S (order cl)\<rparr> \<in> CompleteLattice}"
 
 abbreviation
   sublattice_syntax :: "['a set, 'a potype] => bool" ("_ <<= _" [51, 50] 50)
-  where "S <<= cl \<equiv> S : sublattice `` {cl}"
+  where "S <<= cl \<equiv> S \<in> sublattice `` {cl}"
 
 definition dual :: "'a potype => 'a potype" where
   "dual po == (| pset = pset po, order = converse (order po) |)"
@@ -88,21 +88,21 @@
   fixes cl :: "'a potype"
     and A  :: "'a set"
     and r  :: "('a * 'a) set"
-  assumes cl_po:  "cl : PartialOrder"
+  assumes cl_po:  "cl \<in> PartialOrder"
   defines A_def: "A == pset cl"
      and  r_def: "r == order cl"
 
 locale CL = PO +
-  assumes cl_co:  "cl : CompleteLattice"
+  assumes cl_co:  "cl \<in> CompleteLattice"
 
 definition CLF_set :: "('a potype * ('a => 'a)) set" where
   "CLF_set = (SIGMA cl: CompleteLattice.
-            {f. f: pset cl \<rightarrow> pset cl & monotone f (pset cl) (order cl)})"
+            {f. f \<in> pset cl \<rightarrow> pset cl \<and> monotone f (pset cl) (order cl)})"
 
 locale CLF = CL +
   fixes f :: "'a => 'a"
     and P :: "'a set"
-  assumes f_cl:  "(cl,f) : CLF_set" (*was the equivalent "f : CLF``{cl}"*)
+  assumes f_cl:  "(cl,f) \<in> CLF_set" (*was the equivalent "f : CLF``{cl}"*)
   defines P_def: "P == fix f A"
 
 locale Tarski = CLF +
@@ -113,9 +113,9 @@
     Y_ss: "Y \<subseteq> P"
   defines
     intY1_def: "intY1 == interval r (lub Y cl) (Top cl)"
-    and v_def: "v == glb {x. ((\<lambda>x \<in> intY1. f x) x, x): induced intY1 r &
-                             x: intY1}
-                      (| pset=intY1, order=induced intY1 r|)"
+    and v_def: "v == glb {x. ((\<lambda>x \<in> intY1. f x) x, x) \<in> induced intY1 r \<and>
+                             x \<in> intY1}
+                      \<lparr>pset=intY1, order=induced intY1 r\<rparr>"
 
 subsection \<open>Partial Order\<close>
 
@@ -362,8 +362,8 @@
 by (simp add: isLub_def A_def r_def)
 
 lemma (in CL) isLubI:
-     "[| L \<in> A; \<forall>y \<in> S. (y, L) \<in> r;
-         (\<forall>z \<in> A. (\<forall>y \<in> S. (y, z):r) --> (L, z) \<in> r)|] ==> isLub S cl L"
+     "\<lbrakk>L \<in> A; \<forall>y \<in> S. (y, L) \<in> r;
+         (\<forall>z \<in> A. (\<forall>y \<in> S. (y, z) \<in> r) \<longrightarrow> (L, z) \<in> r)\<rbrakk> \<Longrightarrow> isLub S cl L"
 by (simp add: isLub_def A_def r_def)
 
 subsection \<open>glb\<close>
@@ -402,7 +402,7 @@
 declare (in CLF) f_cl [simp]
 
 lemma (in CLF) [simp]:
-    "f: pset cl \<rightarrow> pset cl & monotone f (pset cl) (order cl)"
+    "f \<in> pset cl \<rightarrow> pset cl \<and> monotone f (pset cl) (order cl)"
 proof -
   have "\<forall>u v. (v, u) \<in> CLF_set \<longrightarrow> u \<in> {R \<in> pset v \<rightarrow> pset v. monotone R (pset v) (order v)}"
     unfolding CLF_set_def using SigmaE2 by blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/BV/BVExample.thy
--- a/src/HOL/MicroJava/BV/BVExample.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/BV/BVExample.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -433,7 +433,7 @@
 qed
 
 definition some_elem :: "'a set \<Rightarrow> 'a" where [code del]:
-  "some_elem = (%S. SOME x. x : S)"
+  "some_elem = (\<lambda>S. SOME x. x \<in> S)"
 code_printing
   constant some_elem \<rightharpoonup> (SML) "(case/ _ of/ Set/ xs/ =>/ hd/ xs)"
 
@@ -486,4 +486,3 @@
 \<close>
 
 end
-
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/BV/JType.thy
--- a/src/HOL/MicroJava/BV/JType.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/BV/JType.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -33,7 +33,7 @@
 
 definition is_ty :: "'c prog \<Rightarrow> ty \<Rightarrow> bool" where
   "is_ty G T == case T of PrimT P \<Rightarrow> True | RefT R \<Rightarrow>
-               (case R of NullT \<Rightarrow> True | ClassT C \<Rightarrow> (C, Object) \<in> (subcls1 G)^*)"
+               (case R of NullT \<Rightarrow> True | ClassT C \<Rightarrow> (C, Object) \<in> (subcls1 G)\<^sup>*)"
 
 abbreviation "types G == Collect (is_type G)"
 
@@ -102,16 +102,16 @@
   done
 
 lemma wf_converse_subcls1_impl_acc_subtype:
-  "wf ((subcls1 G)^-1) \<Longrightarrow> acc (subtype G)"
+  "wf ((subcls1 G)\<inverse>) \<Longrightarrow> acc (subtype G)"
 apply (unfold Semilat.acc_def lesssub_def)
-apply (drule_tac p = "((subcls1 G)^-1) - Id" in wf_subset)
+apply (drule_tac p = "((subcls1 G)\<inverse>) - Id" in wf_subset)
  apply auto
 apply (drule wf_trancl)
 apply (simp add: wf_eq_minimal)
 apply clarify
 apply (unfold lesub_def subtype_def)
 apply (rename_tac M T) 
-apply (case_tac "EX C. Class C : M")
+apply (case_tac "\<exists>C. Class C \<in> M")
  prefer 2
  apply (case_tac T)
   apply (fastforce simp add: PrimT_PrimT2)
@@ -131,7 +131,7 @@
  apply (case_tac ref_ty)
   apply simp
  apply simp
-apply (erule_tac x = "{C. Class C : M}" in allE)
+apply (erule_tac x = "{C. Class C \<in> M}" in allE)
 apply auto
 apply (rename_tac D)
 apply (rule_tac x = "Class D" in bexI)
@@ -148,7 +148,7 @@
 apply (erule rtrancl.cases)
  apply blast
 apply (drule rtrancl_converseI)
-apply (subgoal_tac "(subcls1 G - Id)^-1 = (subcls1 G)^-1 - Id")
+apply (subgoal_tac "(subcls1 G - Id)\<inverse> = (subcls1 G)\<inverse> - Id")
  prefer 2
  apply (simp add: converse_Int) apply safe[1]
 apply simp
@@ -185,7 +185,7 @@
       by (blast intro: subcls_C_Object)
     with ws_prog single_valued
     obtain u where
-      "is_lub ((subcls1 G)^* ) c1 c2 u"
+      "is_lub ((subcls1 G)\<^sup>*) c1 c2 u"
       by (blast dest: single_valued_has_lubs)
     moreover
     note acyclic
@@ -226,7 +226,7 @@
       by (blast intro: subcls_C_Object)
     with ws_prog single_valued
     obtain u where
-      lub: "is_lub ((subcls1 G)^*) c1 c2 u"
+      lub: "is_lub ((subcls1 G)\<^sup>*) c1 c2 u"
       by (blast dest: single_valued_has_lubs)   
     with acyclic
     have "exec_lub (subcls1 G) (super G) c1 c2 = u"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/BV/Typing_Framework_JVM.thy
--- a/src/HOL/MicroJava/BV/Typing_Framework_JVM.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/BV/Typing_Framework_JVM.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -53,7 +53,7 @@
   by (unfold bounded_def) (blast dest: check_boundedD)
 
 lemma special_ex_swap_lemma [iff]: 
-  "(? X. (? n. X = A n & P n) & Q X) = (? n. Q(A n) & P n)"
+  "(\<exists>X. (\<exists>n. X = A n \<and> P n) & Q X) = (\<exists>n. Q(A n) \<and> P n)"
   by blast
 
 lemmas [iff del] = not_None_eq
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/Comp/CorrComp.thy
--- a/src/HOL/MicroJava/Comp/CorrComp.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/Comp/CorrComp.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -740,7 +740,7 @@
 
                     (* case NewC *)
                     apply clarify
-                    apply (frule wf_prog_ws_prog [THEN wf_subcls1]) (* establish  wf ((subcls1 G)^-1) *)
+                    apply (frule wf_prog_ws_prog [THEN wf_subcls1]) (* establish  wf ((subcls1 G)\<inverse>) *)
                     apply (simp add: c_hupd_hp_invariant)
                     apply (rule progression_one_step)
                     apply (rotate_tac 1, drule sym) (* reverse equation (a, None) = new_Addr (fst s) *)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/Comp/LemmasComp.thy
--- a/src/HOL/MicroJava/Comp/LemmasComp.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/Comp/LemmasComp.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -185,18 +185,18 @@
 
 
 lemma comp_class_rec: 
-  "wf ((subcls1 G)^-1) \<Longrightarrow> 
+  "wf ((subcls1 G)\<inverse>) \<Longrightarrow> 
   class_rec (comp G) C t f =
   class_rec G C t (\<lambda> C' fs' ms' r'. f C' fs' (map (compMethod G C') ms') r')"
   apply (rule_tac a = C in  wf_induct)
    apply assumption
-  apply (subgoal_tac "wf ((subcls1 (comp G))^-1)")
+  apply (subgoal_tac "wf ((subcls1 (comp G))\<inverse>)")
    apply (subgoal_tac "(class G x = None) \<or> (\<exists> D fs ms. (class G x = Some (D, fs, ms)))")
     apply (erule disjE)
 
      (* case class G x = None *)
      apply (simp (no_asm_simp) add: class_rec_def comp_subcls1 
-                                    wfrec [where R="(subcls1 G)^-1", simplified])
+                                    wfrec [where R="(subcls1 G)\<inverse>", simplified])
      apply (simp add: comp_class_None)
 
     (* case \<exists> D fs ms. (class G x = Some (D, fs, ms)) *)
@@ -220,11 +220,11 @@
   apply (simp add: comp_subcls1)
   done
 
-lemma comp_fields: "wf ((subcls1 G)^-1) \<Longrightarrow> 
+lemma comp_fields: "wf ((subcls1 G)\<inverse>) \<Longrightarrow> 
   fields (comp G,C) = fields (G,C)" 
   by (simp add: fields_def comp_class_rec)
 
-lemma comp_field: "wf ((subcls1 G)^-1) \<Longrightarrow> 
+lemma comp_field: "wf ((subcls1 G)\<inverse>) \<Longrightarrow> 
   field (comp G,C) = field (G,C)" 
   by (simp add: TypeRel.field_def comp_fields)
 
@@ -233,7 +233,7 @@
   \<forall>fs ms. R (f1 Object fs ms t1) (f2 Object fs ms t2);
    \<forall>C fs ms r1 r2. (R r1 r2) \<longrightarrow> (R (f1 C fs ms r1) (f2 C fs ms r2)) \<rbrakk>
   \<Longrightarrow> ((class G C) \<noteq> None) \<longrightarrow>  R (class_rec G C t1 f1) (class_rec G C t2 f2)"
-  apply (frule wf_subcls1) (* establish wf ((subcls1 G)^-1) *)
+  apply (frule wf_subcls1) (* establish wf ((subcls1 G)\<inverse>) *)
   apply (rule_tac a = C in wf_induct)
    apply assumption
   apply (intro strip)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Err.thy
--- a/src/HOL/MicroJava/DFA/Err.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Err.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -34,7 +34,7 @@
 "sup f == lift2(%x y. OK(x +_f y))"
 
 definition err :: "'a set \<Rightarrow> 'a err set" where
-"err A == insert Err {x . ? y:A. x = OK y}"
+"err A == insert Err {x . \<exists>y\<in>A. x = OK y}"
 
 definition esl :: "'a sl \<Rightarrow> 'a esl" where
 "esl == %(A,r,f). (A,r, %x y. OK(f x y))"
@@ -68,7 +68,7 @@
   by (simp add: lesub_def)
 
 lemma le_err_refl:
-  "!x. x <=_r x \<Longrightarrow> e <=_(Err.le r) e"
+  "\<forall>x. x <=_r x \<Longrightarrow> e <=_(Err.le r) e"
 apply (unfold lesub_def Err.le_def)
 apply (simp split: err.split)
 done 
@@ -110,18 +110,18 @@
   by (simp add: unfold_lesub_err le_def  split: err.split)
 
 lemma le_OK_conv [iff]:
-  "e <=_(le r) OK x  =  (? y. e = OK y & y <=_r x)"
+  "e <=_(le r) OK x  =  (\<exists>y. e = OK y & y <=_r x)"
   by (simp add: unfold_lesub_err le_def split: err.split)
 
 lemma OK_le_conv:
- "OK x <=_(le r) e  =  (e = Err | (? y. e = OK y & x <=_r y))"
+ "OK x <=_(le r) e  =  (e = Err | (\<exists>y. e = OK y & x <=_r y))"
   by (simp add: unfold_lesub_err le_def split: err.split)
 
 lemma top_Err [iff]: "top (le r) Err"
   by (simp add: top_def)
 
 lemma OK_less_conv [rule_format, iff]:
-  "OK x <_(le r) e = (e=Err | (? y. e = OK y & x <_r y))"
+  "OK x <_(le r) e = (e=Err | (\<exists>y. e = OK y & x <_r y))"
   by (simp add: lesssub_def lesub_def le_def split: err.split)
 
 lemma not_Err_less [rule_format, iff]:
@@ -152,24 +152,24 @@
 apply (unfold acc_def lesub_def le_def lesssub_def)
 apply (simp add: wf_eq_minimal split: err.split)
 apply clarify
-apply (case_tac "Err : Q")
+apply (case_tac "Err \<in> Q")
  apply blast
-apply (erule_tac x = "{a . OK a : Q}" in allE)
+apply (erule_tac x = "{a . OK a \<in> Q}" in allE)
 apply (case_tac "x")
  apply fast
 apply blast
 done 
 
-lemma Err_in_err [iff]: "Err : err A"
+lemma Err_in_err [iff]: "Err \<in> err A"
   by (simp add: err_def)
 
-lemma Ok_in_err [iff]: "(OK x : err A) = (x:A)"
+lemma Ok_in_err [iff]: "(OK x \<in> err A) = (x\<in>A)"
   by (auto simp add: err_def)
 
 subsection \<open>lift\<close>
 
 lemma lift_in_errI:
-  "\<lbrakk> e : err S; !x:S. e = OK x \<longrightarrow> f x : err S \<rbrakk> \<Longrightarrow> lift f e : err S"
+  "\<lbrakk> e \<in> err S; \<forall>x\<in>S. e = OK x \<longrightarrow> f x \<in> err S \<rbrakk> \<Longrightarrow> lift f e \<in> err S"
 apply (unfold lift_def)
 apply (simp split: err.split)
 apply blast
@@ -203,7 +203,7 @@
   by (simp add: plussub_def Err.sup_def Err.lift2_def)
 
 lemma Err_sup_eq_OK_conv [iff]:
-  "(Err.sup f ex ey = OK z) = (? x y. ex = OK x & ey = OK y & f x y = z)"
+  "(Err.sup f ex ey = OK z) = (\<exists>x y. ex = OK x & ey = OK y & f x y = z)"
 apply (unfold Err.sup_def lift2_def plussub_def)
 apply (rule iffI)
  apply (simp split: err.split_asm)
@@ -220,17 +220,17 @@
 subsection \<open>semilat (err A) (le r) f\<close>
 
 lemma semilat_le_err_Err_plus [simp]:
-  "\<lbrakk> x: err A; semilat(err A, le r, f) \<rbrakk> \<Longrightarrow> Err +_f x = Err"
+  "\<lbrakk> x \<in> err A; semilat(err A, le r, f) \<rbrakk> \<Longrightarrow> Err +_f x = Err"
   by (blast intro: Semilat.le_iff_plus_unchanged [OF Semilat.intro, THEN iffD1]
                    Semilat.le_iff_plus_unchanged2 [OF Semilat.intro, THEN iffD1])
 
 lemma semilat_le_err_plus_Err [simp]:
-  "\<lbrakk> x: err A; semilat(err A, le r, f) \<rbrakk> \<Longrightarrow> x +_f Err = Err"
+  "\<lbrakk> x \<in> err A; semilat(err A, le r, f) \<rbrakk> \<Longrightarrow> x +_f Err = Err"
   by (blast intro: Semilat.le_iff_plus_unchanged [OF Semilat.intro, THEN iffD1]
                    Semilat.le_iff_plus_unchanged2 [OF Semilat.intro, THEN iffD1])
 
 lemma semilat_le_err_OK1:
-  "\<lbrakk> x:A; y:A; semilat(err A, le r, f); OK x +_f OK y = OK z \<rbrakk> 
+  "\<lbrakk> x \<in> A; y \<in> A; semilat(err A, le r, f); OK x +_f OK y = OK z \<rbrakk> 
   \<Longrightarrow> x <=_r z"
 apply (rule OK_le_err_OK [THEN iffD1])
 apply (erule subst)
@@ -238,7 +238,7 @@
 done
 
 lemma semilat_le_err_OK2:
-  "\<lbrakk> x:A; y:A; semilat(err A, le r, f); OK x +_f OK y = OK z \<rbrakk> 
+  "\<lbrakk> x \<in> A; y \<in> A; semilat(err A, le r, f); OK x +_f OK y = OK z \<rbrakk> 
   \<Longrightarrow> y <=_r z"
 apply (rule OK_le_err_OK [THEN iffD1])
 apply (erule subst)
@@ -252,11 +252,11 @@
 done
 
 lemma OK_plus_OK_eq_Err_conv [simp]:
-  assumes "x:A" and "y:A" and "semilat(err A, le r, fe)"
-  shows "((OK x) +_fe (OK y) = Err) = (~(? z:A. x <=_r z & y <=_r z))"
+  assumes "x \<in> A" and "y \<in> A" and "semilat(err A, le r, fe)"
+  shows "((OK x) +_fe (OK y) = Err) = (\<not>(\<exists>z\<in>A. x <=_r z & y <=_r z))"
 proof -
   have plus_le_conv3: "\<And>A x y z f r. 
-    \<lbrakk> semilat (A,r,f); x +_f y <=_r z; x:A; y:A; z:A \<rbrakk> 
+    \<lbrakk> semilat (A,r,f); x +_f y <=_r z; x \<in> A; y \<in> A; z \<in> A \<rbrakk> 
     \<Longrightarrow> x <=_r z \<and> y <=_r z"
     by (rule Semilat.plus_le_conv [OF Semilat.intro, THEN iffD1])
   from assms show ?thesis
@@ -274,7 +274,7 @@
   apply (case_tac "(OK x) +_fe (OK y)")
    apply assumption
   apply (rename_tac z)
-  apply (subgoal_tac "OK z: err A")
+  apply (subgoal_tac "OK z \<in> err A")
   apply (drule eq_order_le)
     apply (erule Semilat.orderI [OF Semilat.intro])
    apply (blast dest: plus_le_conv3) 
@@ -287,12 +287,12 @@
 
 (* FIXME? *)
 lemma all_bex_swap_lemma [iff]:
-  "(!x. (? y:A. x = f y) \<longrightarrow> P x) = (!y:A. P(f y))"
+  "(\<forall>x. (\<exists>y\<in>A. x = f y) \<longrightarrow> P x) = (\<forall>y\<in>A. P(f y))"
   by blast
 
 lemma closed_err_Union_lift2I: 
-  "\<lbrakk> !A:AS. closed (err A) (lift2 f); AS ~= {}; 
-      !A:AS.!B:AS. A~=B \<longrightarrow> (!a:A.!b:B. a +_f b = Err) \<rbrakk> 
+  "\<lbrakk> \<forall>A\<in>AS. closed (err A) (lift2 f); AS \<noteq> {}; 
+      \<forall>A\<in>AS. \<forall>B\<in>AS. A\<noteq>B \<longrightarrow> (\<forall>a\<in>A. \<forall>b\<in>B. a +_f b = Err) \<rbrakk> 
   \<Longrightarrow> closed (err (\<Union>AS)) (lift2 f)"
 apply (unfold closed_def err_def)
 apply simp
@@ -307,8 +307,8 @@
   which may not hold 
 \<close>
 lemma err_semilat_UnionI:
-  "\<lbrakk> !A:AS. err_semilat(A, r, f); AS ~= {}; 
-      !A:AS.!B:AS. A~=B \<longrightarrow> (!a:A.!b:B. ~ a <=_r b & a +_f b = Err) \<rbrakk> 
+  "\<lbrakk> \<forall>A\<in>AS. err_semilat(A, r, f); AS \<noteq> {}; 
+      \<forall>A\<in>AS. \<forall>B\<in>AS. A\<noteq>B \<longrightarrow> (\<forall>a\<in>A. \<forall>b\<in>B. \<not> a <=_r b & a +_f b = Err) \<rbrakk> 
   \<Longrightarrow> err_semilat (\<Union>AS, r, f)"
 apply (unfold semilat_def sl_def)
 apply (simp add: closed_err_Union_lift2I)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Kildall.thy
--- a/src/HOL/MicroJava/DFA/Kildall.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Kildall.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -203,7 +203,7 @@
      q \<notin> w \<or> q = p \<rbrakk> 
   \<Longrightarrow> stable r step (merges f (step p (ss!p)) ss) q"
   apply (unfold stable_def)
-  apply (subgoal_tac "\<forall>s'. (q,s') \<in> set (step p (ss!p)) \<longrightarrow> s' : A")
+  apply (subgoal_tac "\<forall>s'. (q,s') \<in> set (step p (ss!p)) \<longrightarrow> s' \<in> A")
    prefer 2
    apply clarify
    apply (erule pres_typeD)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Listn.thy
--- a/src/HOL/MicroJava/DFA/Listn.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Listn.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -94,7 +94,7 @@
 done
 
 lemma le_list_refl:
-  "!x. x <=_r x \<Longrightarrow> xs <=[r] xs"
+  "\<forall>x. x <=_r x \<Longrightarrow> xs <=[r] xs"
 apply (unfold unfold_lesub_list)
 apply (simp add: Listn.le_def list_all2_conv_all_nth)
 done
@@ -154,23 +154,23 @@
   done
 
 lemma listI:
-  "\<lbrakk> length xs = n; set xs <= A \<rbrakk> \<Longrightarrow> xs : list n A"
+  "\<lbrakk> length xs = n; set xs <= A \<rbrakk> \<Longrightarrow> xs \<in> list n A"
 apply (unfold list_def)
 apply blast
 done
 
 lemma listE_length [simp]:
-   "xs : list n A \<Longrightarrow> length xs = n"
+   "xs \<in> list n A \<Longrightarrow> length xs = n"
 apply (unfold list_def)
 apply blast
 done 
 
 lemma less_lengthI:
-  "\<lbrakk> xs : list n A; p < n \<rbrakk> \<Longrightarrow> p < length xs"
+  "\<lbrakk> xs \<in> list n A; p < n \<rbrakk> \<Longrightarrow> p < length xs"
   by simp
 
 lemma listE_set [simp]:
-  "xs : list n A \<Longrightarrow> set xs <= A"
+  "xs \<in> list n A \<Longrightarrow> set xs <= A"
 apply (unfold list_def)
 apply blast
 done 
@@ -182,19 +182,19 @@
 done 
 
 lemma in_list_Suc_iff: 
-  "(xs : list (Suc n) A) = (\<exists>y\<in> A. \<exists>ys\<in> list n A. xs = y#ys)"
+  "(xs \<in> list (Suc n) A) = (\<exists>y\<in> A. \<exists>ys\<in> list n A. xs = y#ys)"
 apply (unfold list_def)
 apply (case_tac "xs")
 apply auto
 done 
 
 lemma Cons_in_list_Suc [iff]:
-  "(x#xs : list (Suc n) A) = (x\<in> A & xs : list n A)"
+  "(x#xs \<in> list (Suc n) A) = (x\<in> A & xs \<in> list n A)"
 apply (simp add: in_list_Suc_iff)
 done 
 
 lemma list_not_empty:
-  "\<exists>a. a\<in> A \<Longrightarrow> \<exists>xs. xs : list n A"
+  "\<exists>a. a\<in> A \<Longrightarrow> \<exists>xs. xs \<in> list n A"
 apply (induct "n")
  apply simp
 apply (simp add: in_list_Suc_iff)
@@ -203,14 +203,14 @@
 
 
 lemma nth_in [rule_format, simp]:
-  "!i n. length xs = n \<longrightarrow> set xs <= A \<longrightarrow> i < n \<longrightarrow> (xs!i) : A"
+  "\<forall>i n. length xs = n \<longrightarrow> set xs <= A \<longrightarrow> i < n \<longrightarrow> (xs!i) \<in> A"
 apply (induct "xs")
  apply simp
 apply (simp add: nth_Cons split: nat.split)
 done
 
 lemma listE_nth_in:
-  "\<lbrakk> xs : list n A; i < n \<rbrakk> \<Longrightarrow> (xs!i) : A"
+  "\<lbrakk> xs \<in> list n A; i < n \<rbrakk> \<Longrightarrow> (xs!i) \<in> A"
   by auto
 
 
@@ -245,7 +245,7 @@
 
 
 lemma listt_update_in_list [simp, intro!]:
-  "\<lbrakk> xs : list n A; x\<in> A \<rbrakk> \<Longrightarrow> xs[i := x] : list n A"
+  "\<lbrakk> xs \<in> list n A; x\<in> A \<rbrakk> \<Longrightarrow> xs[i := x] \<in> list n A"
 apply (unfold list_def)
 apply simp
 done 
@@ -261,7 +261,7 @@
   by (simp add: plussub_def map2_def split: list.split)
 
 lemma length_plus_list [rule_format, simp]:
-  "!ys. length(xs +[f] ys) = min(length xs) (length ys)"
+  "\<forall>ys. length(xs +[f] ys) = min(length xs) (length ys)"
 apply (induct xs)
  apply simp
 apply clarify
@@ -269,7 +269,7 @@
 done
 
 lemma nth_plus_list [rule_format, simp]:
-  "!xs ys i. length xs = n \<longrightarrow> length ys = n \<longrightarrow> i<n \<longrightarrow> 
+  "\<forall>xs ys i. length xs = n \<longrightarrow> length ys = n \<longrightarrow> i<n \<longrightarrow> 
   (xs +[f] ys)!i = (xs!i) +_f (ys!i)"
 apply (induct n)
  apply simp
@@ -295,7 +295,7 @@
 done
 
 lemma (in Semilat) plus_list_lub [rule_format]:
-shows "!xs ys zs. set xs <= A \<longrightarrow> set ys <= A \<longrightarrow> set zs <= A 
+shows "\<forall>xs ys zs. set xs <= A \<longrightarrow> set ys <= A \<longrightarrow> set zs <= A 
   \<longrightarrow> size xs = n & size ys = n \<longrightarrow> 
   xs <=[r] zs & ys <=[r] zs \<longrightarrow> xs +[f] ys <=[r] zs"
 apply (unfold unfold_lesub_list)
@@ -304,7 +304,7 @@
 
 lemma (in Semilat) list_update_incr [rule_format]:
  "x\<in> A \<Longrightarrow> set xs <= A \<longrightarrow> 
-  (!i. i<size xs \<longrightarrow> xs <=[r] xs[i := x +_f xs!i])"
+  (\<forall>i. i<size xs \<longrightarrow> xs <=[r] xs[i := x +_f xs!i])"
 apply (unfold unfold_lesub_list)
 apply (simp add: Listn.le_def list_all2_conv_all_nth)
 apply (induct xs)
@@ -342,7 +342,7 @@
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
-apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
+apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
@@ -394,7 +394,7 @@
  by(simp add: Listn_sl_aux split_tupled_all)
 
 lemma coalesce_in_err_list [rule_format]:
-  "!xes. xes : list n (err A) \<longrightarrow> coalesce xes : err(list n A)"
+  "\<forall>xes. xes \<in> list n (err A) \<longrightarrow> coalesce xes \<in> err(list n A)"
 apply (induct n)
  apply simp
 apply clarify
@@ -409,8 +409,8 @@
 
 lemma coalesce_eq_OK1_D [rule_format]:
   "semilat(err A, Err.le r, lift2 f) \<Longrightarrow> 
-  !xs. xs : list n A \<longrightarrow> (!ys. ys : list n A \<longrightarrow> 
-  (!zs. coalesce (xs +[f] ys) = OK zs \<longrightarrow> xs <=[r] zs))"
+  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow> 
+  (\<forall>zs. coalesce (xs +[f] ys) = OK zs \<longrightarrow> xs <=[r] zs))"
 apply (induct n)
   apply simp
 apply clarify
@@ -422,8 +422,8 @@
 
 lemma coalesce_eq_OK2_D [rule_format]:
   "semilat(err A, Err.le r, lift2 f) \<Longrightarrow> 
-  !xs. xs : list n A \<longrightarrow> (!ys. ys : list n A \<longrightarrow> 
-  (!zs. coalesce (xs +[f] ys) = OK zs \<longrightarrow> ys <=[r] zs))"
+  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow> 
+  (\<forall>zs. coalesce (xs +[f] ys) = OK zs \<longrightarrow> ys <=[r] zs))"
 apply (induct n)
  apply simp
 apply clarify
@@ -447,9 +447,9 @@
 
 lemma coalesce_eq_OK_ub_D [rule_format]:
   "semilat(err A, Err.le r, lift2 f) \<Longrightarrow> 
-  !xs. xs : list n A \<longrightarrow> (!ys. ys : list n A \<longrightarrow> 
-  (!zs us. coalesce (xs +[f] ys) = OK zs & xs <=[r] us & ys <=[r] us 
-           & us : list n A \<longrightarrow> zs <=[r] us))"
+  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow> 
+  (\<forall>zs us. coalesce (xs +[f] ys) = OK zs \<and> xs <=[r] us \<and> ys <=[r] us 
+           \<and> us \<in> list n A \<longrightarrow> zs <=[r] us))"
 apply (induct n)
  apply simp
 apply clarify
@@ -470,9 +470,9 @@
 
 lemma coalesce_eq_Err_D [rule_format]:
   "\<lbrakk> semilat(err A, Err.le r, lift2 f) \<rbrakk> 
-  \<Longrightarrow> !xs. xs\<in> list n A \<longrightarrow> (!ys. ys\<in> list n A \<longrightarrow> 
+  \<Longrightarrow> \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow> 
       coalesce (xs +[f] ys) = Err \<longrightarrow> 
-      ~(\<exists>zs\<in> list n A. xs <=[r] zs & ys <=[r] zs))"
+      \<not>(\<exists>zs\<in> list n A. xs <=[r] zs \<and> ys <=[r] zs))"
 apply (induct n)
  apply simp
 apply clarify
@@ -483,15 +483,15 @@
 done 
 
 lemma closed_err_lift2_conv:
-  "closed (err A) (lift2 f) = (\<forall>x\<in> A. \<forall>y\<in> A. x +_f y : err A)"
+  "closed (err A) (lift2 f) = (\<forall>x\<in> A. \<forall>y\<in> A. x +_f y \<in> err A)"
 apply (unfold closed_def)
 apply (simp add: err_def)
 done 
 
 lemma closed_map2_list [rule_format]:
   "closed (err A) (lift2 f) \<Longrightarrow> 
-  \<forall>xs. xs : list n A \<longrightarrow> (\<forall>ys. ys : list n A \<longrightarrow> 
-  map2 f xs ys : list n (err A))"
+  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow> 
+  map2 f xs ys \<in> list n (err A))"
 apply (unfold map2_def)
 apply (induct n)
  apply simp
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Opt.thy
--- a/src/HOL/MicroJava/DFA/Opt.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Opt.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -15,7 +15,7 @@
                                                   | Some x \<Rightarrow> x <=_r y)"
 
 definition opt :: "'a set \<Rightarrow> 'a option set" where
-"opt A == insert None {x . ? y:A. x = Some y}"
+"opt A == insert None {x. \<exists>y\<in>A. x = Some y}"
 
 definition sup :: "'a ebinop \<Rightarrow> 'a option ebinop" where
 "sup f o1 o2 ==  
@@ -63,7 +63,7 @@
 done 
 
 lemma Some_le [iff]:
-  "(Some x <=_(le r) ox) = (? y. ox = Some y & x <=_r y)"
+  "(Some x <=_(le r) ox) = (\<exists>y. ox = Some y \<and> x <=_r y)"
 apply (unfold lesub_def le_def)
 apply (simp split: option.split)
 done 
@@ -89,11 +89,11 @@
 
 
 lemma None_in_opt [iff]:
-  "None : opt A"
+  "None \<in> opt A"
 by (simp add: opt_def)
 
 lemma Some_in_opt [iff]:
-  "(Some x : opt A) = (x:A)"
+  "(Some x \<in> opt A) = (x\<in>A)"
 apply (unfold opt_def)
 apply auto
 done 
@@ -132,34 +132,34 @@
   have "closed ?A ?f"
   proof (unfold closed_def, intro strip)
     fix x y    
-    assume x: "x : ?A" 
-    assume y: "y : ?A" 
+    assume x: "x \<in> ?A" 
+    assume y: "y \<in> ?A" 
 
     { fix a b
       assume ab: "x = OK a" "y = OK b"
       
       with x 
-      have a: "\<And>c. a = Some c \<Longrightarrow> c : A"
+      have a: "\<And>c. a = Some c \<Longrightarrow> c \<in> A"
         by (clarsimp simp add: opt_def)
 
       from ab y
-      have b: "\<And>d. b = Some d \<Longrightarrow> d : A"
+      have b: "\<And>d. b = Some d \<Longrightarrow> d \<in> A"
         by (clarsimp simp add: opt_def)
       
       { fix c d assume "a = Some c" "b = Some d"
         with ab x y
-        have "c:A & d:A"
+        have "c \<in> A \<and> d \<in> A"
           by (simp add: err_def opt_def Bex_def)
         with clo
-        have "f c d : err A"
+        have "f c d \<in> err A"
           by (simp add: closed_def plussub_def err_def lift2_def)
         moreover
         fix z assume "f c d = OK z"
         ultimately
-        have "z : A" by simp
+        have "z \<in> A" by simp
       } note f_closed = this    
 
-      have "sup f a b : ?A"
+      have "sup f a b \<in> ?A"
       proof (cases a)
         case None
         thus ?thesis
@@ -171,7 +171,7 @@
       qed
     }
 
-    thus "x +_?f y : ?A"
+    thus "x +_?f y \<in> ?A"
       by (simp add: plussub_def lift2_def split: err.split)
   qed
     
@@ -209,7 +209,7 @@
   have "\<forall>x\<in>?A. \<forall>y\<in>?A. \<forall>z\<in>?A. x <=_?r z \<and> y <=_?r z \<longrightarrow> x +_?f y <=_?r z"
   proof (intro strip, elim conjE)
     fix x y z
-    assume xyz: "x : ?A" "y : ?A" "z : ?A"
+    assume xyz: "x \<in> ?A" "y \<in> ?A" "z \<in> ?A"
     assume xz: "x <=_?r z"
     assume yz: "y <=_?r z"
 
@@ -220,7 +220,7 @@
         assume some: "a = Some d" "b = Some e" "c = Some g"
         
         with ok xyz
-        obtain "OK d:err A" "OK e:err A" "OK g:err A"
+        obtain "OK d \<in> err A" "OK e \<in> err A" "OK g \<in> err A"
           by simp
         with lub
         have "\<lbrakk> (OK d) <=_(Err.le r) (OK g); (OK e) <=_(Err.le r) (OK g) \<rbrakk>
@@ -272,8 +272,8 @@
 apply (unfold acc_def lesub_def le_def lesssub_def)
 apply (simp add: wf_eq_minimal split: option.split)
 apply clarify
-apply (case_tac "? a. Some a : Q")
- apply (erule_tac x = "{a . Some a : Q}" in allE)
+apply (case_tac "\<exists>a. Some a \<in> Q")
+ apply (erule_tac x = "{a. Some a \<in> Q}" in allE)
  apply blast
 apply (case_tac "x")
  apply blast
@@ -281,8 +281,8 @@
 done 
 
 lemma option_map_in_optionI:
-  "\<lbrakk> ox : opt S; !x:S. ox = Some x \<longrightarrow> f x : S \<rbrakk> 
-  \<Longrightarrow> map_option f ox : opt S"
+  "\<lbrakk> ox \<in> opt S; \<forall>x\<in>S. ox = Some x \<longrightarrow> f x \<in> S \<rbrakk> 
+  \<Longrightarrow> map_option f ox \<in> opt S"
 apply (unfold map_option_case)
 apply (simp split: option.split)
 apply blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Product.thy
--- a/src/HOL/MicroJava/DFA/Product.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Product.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -69,12 +69,12 @@
 
 
 lemma plus_eq_Err_conv [simp]:
-  assumes "x:A" and "y:A"
+  assumes "x \<in> A" and "y \<in> A"
     and "semilat(err A, Err.le r, lift2 f)"
-  shows "(x +_f y = Err) = (~(? z:A. x <=_r z & y <=_r z))"
+  shows "(x +_f y = Err) = (\<not>(\<exists>z\<in>A. x <=_r z & y <=_r z))"
 proof -
   have plus_le_conv2:
-    "\<And>r f z. \<lbrakk> z : err A; semilat (err A, r, f); OK x : err A; OK y : err A;
+    "\<And>r f z. \<lbrakk> z \<in> err A; semilat (err A, r, f); OK x \<in> err A; OK y \<in> err A;
                  OK x +_f OK y <=_r z\<rbrakk> \<Longrightarrow> OK x <=_r z \<and> OK y <=_r z"
     by (rule Semilat.plus_le_conv [OF Semilat.intro, THEN iffD1])
   from assms show ?thesis
@@ -92,7 +92,7 @@
   apply (case_tac "x +_f y")
    apply assumption
   apply (rename_tac "z")
-  apply (subgoal_tac "OK z: err A")
+  apply (subgoal_tac "OK z \<in> err A")
   apply (frule plus_le_conv2)
        apply assumption
       apply simp
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Semilat.thy
--- a/src/HOL/MicroJava/DFA/Semilat.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Semilat.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -238,7 +238,7 @@
 
 
 lemma is_lub_bigger1 [iff]:  
-  "is_lub (r^* ) x y y = ((x,y)\<in>r^* )"
+  "is_lub (r\<^sup>*) x y y = ((x,y)\<in>r\<^sup>*)"
 (*<*)
 apply (unfold is_lub_def is_ub_def)
 apply blast
@@ -246,7 +246,7 @@
 (*>*)
 
 lemma is_lub_bigger2 [iff]:
-  "is_lub (r^* ) x y x = ((y,x)\<in>r^* )"
+  "is_lub (r\<^sup>*) x y x = ((y,x)\<in>r\<^sup>*)"
 (*<*)
 apply (unfold is_lub_def is_ub_def)
 apply blast 
@@ -254,12 +254,12 @@
 (*>*)
 
 lemma extend_lub:
-  "\<lbrakk> single_valued r; is_lub (r^* ) x y u; (x',x) \<in> r \<rbrakk> 
-  \<Longrightarrow> EX v. is_lub (r^* ) x' y v"
+  "\<lbrakk> single_valued r; is_lub (r\<^sup>*) x y u; (x',x) \<in> r \<rbrakk> 
+  \<Longrightarrow> \<exists>v. is_lub (r\<^sup>*) x' y v"
 (*<*)
 apply (unfold is_lub_def is_ub_def)
-apply (case_tac "(y,x) \<in> r^*")
- apply (case_tac "(y,x') \<in> r^*")
+apply (case_tac "(y,x) \<in> r\<^sup>*")
+ apply (case_tac "(y,x') \<in> r\<^sup>*")
   apply blast
  apply (blast elim: converse_rtranclE dest: single_valuedD)
 apply (rule exI)
@@ -271,8 +271,8 @@
 (*>*)
 
 lemma single_valued_has_lubs [rule_format]:
-  "\<lbrakk> single_valued r; (x,u) \<in> r^* \<rbrakk> \<Longrightarrow> (\<forall>y. (y,u) \<in> r^* \<longrightarrow> 
-  (EX z. is_lub (r^* ) x y z))"
+  "\<lbrakk>single_valued r; (x,u) \<in> r\<^sup>*\<rbrakk> \<Longrightarrow> (\<forall>y. (y,u) \<in> r\<^sup>* \<longrightarrow>
+  (\<exists>z. is_lub (r\<^sup>*) x y z))"
 (*<*)
 apply (erule converse_rtrancl_induct)
  apply clarify
@@ -284,7 +284,7 @@
 (*>*)
 
 lemma some_lub_conv:
-  "\<lbrakk> acyclic r; is_lub (r^* ) x y u \<rbrakk> \<Longrightarrow> some_lub (r^* ) x y = u"
+  "\<lbrakk>acyclic r; is_lub (r\<^sup>*) x y u\<rbrakk> \<Longrightarrow> some_lub (r\<^sup>*) x y = u"
 (*<*)
 apply (unfold some_lub_def is_lub_def)
 apply (rule someI2)
@@ -294,8 +294,8 @@
 (*>*)
 
 lemma is_lub_some_lub:
-  "\<lbrakk> single_valued r; acyclic r; (x,u)\<in>r^*; (y,u)\<in>r^* \<rbrakk> 
-  \<Longrightarrow> is_lub (r^* ) x y (some_lub (r^* ) x y)"
+  "\<lbrakk>single_valued r; acyclic r; (x,u)\<in>r\<^sup>*; (y,u)\<in>r\<^sup>*\<rbrakk> 
+  \<Longrightarrow> is_lub (r\<^sup>*) x y (some_lub (r\<^sup>*) x y)"
   (*<*) by (fastforce dest: single_valued_has_lubs simp add: some_lub_conv) (*>*)
 
 subsection\<open>An executable lub-finder\<close>
@@ -331,7 +331,7 @@
 (*<*)
 apply(unfold exec_lub_def)
 apply(rule_tac P = "\<lambda>z. (y,z) \<in> r\<^sup>* \<and> (z,u) \<in> r\<^sup>*" and
-               r = "(r \<inter> {(a,b). (y,a) \<in> r\<^sup>* \<and> (b,u) \<in> r\<^sup>*})^-1" in while_rule)
+               r = "(r \<inter> {(a,b). (y,a) \<in> r\<^sup>* \<and> (b,u) \<in> r\<^sup>*})\<inverse>" in while_rule)
     apply(blast dest: is_lubD is_ubD)
    apply(erule conjE)
    apply(erule_tac z = u in converse_rtranclE)
@@ -363,8 +363,8 @@
 (*>*)
 
 lemma is_lub_exec_lub:
-  "\<lbrakk> single_valued r; acyclic r; (x,u):r^*; (y,u):r^*; \<forall>x y. (x,y) \<in> r \<longrightarrow> f x = y \<rbrakk>
-  \<Longrightarrow> is_lub (r^* ) x y (exec_lub r f x y)"
+  "\<lbrakk> single_valued r; acyclic r; (x,u)\<in>r\<^sup>*; (y,u)\<in>r\<^sup>*; \<forall>x y. (x,y) \<in> r \<longrightarrow> f x = y \<rbrakk>
+  \<Longrightarrow> is_lub (r\<^sup>*) x y (exec_lub r f x y)"
   (*<*) by (fastforce dest: single_valued_has_lubs simp add: exec_lub_conv) (*>*)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/SemilatAlg.thy
--- a/src/HOL/MicroJava/DFA/SemilatAlg.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/SemilatAlg.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -18,7 +18,7 @@
 | "(x#xs) ++_f y = xs ++_f (x +_f y)"
 
 definition bounded :: "'s step_type \<Rightarrow> nat \<Rightarrow> bool" where
-"bounded step n == !p<n. !s. !(q,t):set(step p s). q<n"  
+"bounded step n == \<forall>p<n. \<forall>s. \<forall>(q,t)\<in>set(step p s). q<n"  
 
 definition pres_type :: "'s step_type \<Rightarrow> nat \<Rightarrow> 's set \<Rightarrow> bool" where
 "pres_type step n A == \<forall>s\<in>A. \<forall>p<n. \<forall>(q,s')\<in>set (step p s). s' \<in> A"
@@ -36,7 +36,7 @@
   by (unfold mono_def, blast)
 
 lemma boundedD: 
-  "\<lbrakk> bounded step n; p < n; (q,t) : set (step p xs) \<rbrakk> \<Longrightarrow> q < n" 
+  "\<lbrakk> bounded step n; p < n; (q,t) \<in> set (step p xs) \<rbrakk> \<Longrightarrow> q < n" 
   by (unfold bounded_def, blast)
 
 lemma lesubstep_type_refl [simp, intro]:
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/DFA/Typing_Framework.thy
--- a/src/HOL/MicroJava/DFA/Typing_Framework.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/DFA/Typing_Framework.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -15,7 +15,7 @@
 type_synonym 's step_type = "nat \<Rightarrow> 's \<Rightarrow> (nat \<times> 's) list"
 
 definition stable :: "'s ord \<Rightarrow> 's step_type \<Rightarrow> 's list \<Rightarrow> nat \<Rightarrow> bool" where
-"stable r step ss p == !(q,s'):set(step p (ss!p)). s' <=_r ss!q"
+"stable r step ss p == \<forall>(q,s')\<in>set(step p (ss!p)). s' <=_r ss!q"
 
 definition stables :: "'s ord \<Rightarrow> 's step_type \<Rightarrow> 's list \<Rightarrow> bool" where
 "stables r step ss == !p<size ss. stable r step ss p"
@@ -27,8 +27,8 @@
 
 definition is_bcv :: "'s ord \<Rightarrow> 's \<Rightarrow> 's step_type 
            \<Rightarrow> nat \<Rightarrow> 's set \<Rightarrow> ('s list \<Rightarrow> 's list) \<Rightarrow> bool" where
-"is_bcv r T step n A bcv == !ss : list n A.
-   (!p<n. (bcv ss)!p ~= T) =
-   (? ts: list n A. ss <=[r] ts & wt_step r T step ts)"
+"is_bcv r T step n A bcv == \<forall>ss \<in> list n A.
+   (\<forall>p<n. (bcv ss)!p ~= T) =
+   (\<exists>ts \<in> list n A. ss <=[r] ts & wt_step r T step ts)"
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/J/Example.thy
--- a/src/HOL/MicroJava/J/Example.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/J/Example.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -173,7 +173,7 @@
 apply (simp (no_asm))
 done
 
-lemma not_Object_subcls [elim!]: "(Object, C) \<in> (subcls1 tprg)^+ ==> R"
+lemma not_Object_subcls [elim!]: "(Object, C) \<in> (subcls1 tprg)\<^sup>+ ==> R"
 apply (auto dest!: tranclD subcls1D)
 done
 
@@ -184,7 +184,7 @@
 apply auto
 done
 
-lemma not_Base_subcls_Ext [elim!]: "(Base, Ext) \<in> (subcls1 tprg)^+  ==> R"
+lemma not_Base_subcls_Ext [elim!]: "(Base, Ext) \<in> (subcls1 tprg)\<^sup>+  ==> R"
 apply (auto dest!: tranclD subcls1D)
 done
 
@@ -194,7 +194,7 @@
 apply (auto split: if_split_asm simp add: map_of_Cons)
 done
 
-lemma not_class_subcls_class [elim!]: "(C, C) \<in> (subcls1 tprg)^+ ==> R"
+lemma not_class_subcls_class [elim!]: "(C, C) \<in> (subcls1 tprg)\<^sup>+ ==> R"
 apply (auto dest!: tranclD subcls1D)
 apply (frule class_tprgD)
 apply (auto dest!:)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/J/JBasis.thy
--- a/src/HOL/MicroJava/J/JBasis.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/J/JBasis.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -21,17 +21,17 @@
   "unique == distinct \<circ> map fst"
 
 
-lemma fst_in_set_lemma: "(x, y) : set xys ==> x : fst ` set xys"
+lemma fst_in_set_lemma: "(x, y) \<in> set xys \<Longrightarrow> x \<in> fst ` set xys"
   by (induct xys) auto
 
 lemma unique_Nil [simp]: "unique []"
   by (simp add: unique_def)
 
-lemma unique_Cons [simp]: "unique ((x,y)#l) = (unique l & (!y. (x,y) ~: set l))"
+lemma unique_Cons [simp]: "unique ((x,y)#l) = (unique l & (\<forall>y. (x,y) \<notin> set l))"
   by (auto simp: unique_def dest: fst_in_set_lemma)
 
-lemma unique_append: "unique l' ==> unique l ==>
-    (!(x,y):set l. !(x',y'):set l'. x' ~= x) ==> unique (l @ l')"
+lemma unique_append: "unique l' \<Longrightarrow> unique l \<Longrightarrow>
+    (\<forall>(x,y) \<in> set l. \<forall>(x',y') \<in> set l'. x' \<noteq> x) \<Longrightarrow> unique (l @ l')"
   by (induct l) (auto dest: fst_in_set_lemma)
 
 lemma unique_map_inj: "unique l ==> inj f ==> unique (map (%(k,x). (f k, g k x)) l)"
@@ -40,7 +40,7 @@
 
 subsection "More about Maps"
 
-lemma map_of_SomeI: "unique l ==> (k, x) : set l ==> map_of l k = Some x"
+lemma map_of_SomeI: "unique l \<Longrightarrow> (k, x) \<in> set l \<Longrightarrow> map_of l k = Some x"
   by (induct l) auto
 
 lemma Ball_set_table: "(\<forall>(x,y)\<in>set l. P x y) ==> (\<forall>x. \<forall>y. map_of l x = Some y --> P x y)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/J/TypeRel.thy
--- a/src/HOL/MicroJava/J/TypeRel.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/J/TypeRel.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -20,7 +20,7 @@
 
 abbreviation
   subcls  :: "'c prog => cname \<Rightarrow> cname => bool" ("_ \<turnstile> _ \<preceq>C _"  [71,71,71] 70)
-  where "G \<turnstile> C \<preceq>C D \<equiv> (C, D) \<in> (subcls1 G)^*"
+  where "G \<turnstile> C \<preceq>C D \<equiv> (C, D) \<in> (subcls1 G)\<^sup>*"
 
 lemma subcls1D: 
   "G\<turnstile>C\<prec>C1D \<Longrightarrow> C \<noteq> Object \<and> (\<exists>fs ms. class G C = Some (D,fs,ms))"
@@ -40,7 +40,7 @@
 apply  auto
 done
 
-lemma subcls_is_class: "(C, D) \<in> (subcls1 G)^+  ==> is_class G C"
+lemma subcls_is_class: "(C, D) \<in> (subcls1 G)\<^sup>+  \<Longrightarrow> is_class G C"
 apply (unfold is_class_def)
 apply(erule trancl_trans_induct)
 apply (auto dest!: subcls1D)
@@ -56,21 +56,21 @@
 
 definition class_rec :: "'c prog \<Rightarrow> cname \<Rightarrow> 'a \<Rightarrow>
     (cname \<Rightarrow> fdecl list \<Rightarrow> 'c mdecl list \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> 'a" where
-  "class_rec G == wfrec ((subcls1 G)^-1)
+  "class_rec G == wfrec ((subcls1 G)\<inverse>)
     (\<lambda>r C t f. case class G C of
          None \<Rightarrow> undefined
        | Some (D,fs,ms) \<Rightarrow> 
            f C fs ms (if C = Object then t else r D t f))"
 
 lemma class_rec_lemma:
-  assumes wf: "wf ((subcls1 G)^-1)"
+  assumes wf: "wf ((subcls1 G)\<inverse>)"
     and cls: "class G C = Some (D, fs, ms)"
   shows "class_rec G C t f = f C fs ms (if C=Object then t else class_rec G D t f)"
   by (subst wfrec_def_adm[OF class_rec_def])
      (auto simp: assms adm_wf_def fun_eq_iff subcls1I split: option.split)
 
 definition
-  "wf_class G = wf ((subcls1 G)^-1)"
+  "wf_class G = wf ((subcls1 G)\<inverse>)"
 
 
 
@@ -89,7 +89,7 @@
   subcls1 
   .
 
-definition subcls' where "subcls' G = (subcls1p G)^**"
+definition subcls' where "subcls' G = (subcls1p G)\<^sup>*\<^sup>*"
 
 code_pred
   (modes: i \<Rightarrow> i \<Rightarrow> i \<Rightarrow> bool, i \<Rightarrow> i \<Rightarrow> o \<Rightarrow> bool)
@@ -98,7 +98,7 @@
   .
 
 lemma subcls_conv_subcls' [code_unfold]:
-  "(subcls1 G)^* = {(C, D). subcls' G C D}"
+  "(subcls1 G)\<^sup>* = {(C, D). subcls' G C D}"
 by(simp add: subcls'_def subcls1_def rtrancl_def)
 
 lemma class_rec_code [code]:
@@ -126,8 +126,8 @@
   "wf_class G \<longleftrightarrow> (\<forall>(C, rest) \<in> set G. C \<noteq> Object \<longrightarrow> \<not> G \<turnstile> fst (the (class G C)) \<preceq>C C)"
 proof
   assume "wf_class G"
-  hence wf: "wf (((subcls1 G)^+)^-1)" unfolding wf_class_def by(rule wf_converse_trancl)
-  hence acyc: "acyclic ((subcls1 G)^+)" by(auto dest: wf_acyclic)
+  hence wf: "wf (((subcls1 G)\<^sup>+)\<inverse>)" unfolding wf_class_def by(rule wf_converse_trancl)
+  hence acyc: "acyclic ((subcls1 G)\<^sup>+)" by(auto dest: wf_acyclic)
   show "\<forall>(C, rest) \<in> set G. C \<noteq> Object \<longrightarrow> \<not> G \<turnstile> fst (the (class G C)) \<preceq>C C"
   proof(safe)
     fix C D fs ms
@@ -138,9 +138,9 @@
       where "class": "class G C = Some (D', fs', ms')"
       unfolding class_def by(auto dest!: weak_map_of_SomeI)
     hence "G \<turnstile> C \<prec>C1 D'" using \<open>C \<noteq> Object\<close> ..
-    hence *: "(C, D') \<in> (subcls1 G)^+" ..
+    hence *: "(C, D') \<in> (subcls1 G)\<^sup>+" ..
     also from * acyc have "C \<noteq> D'" by(auto simp add: acyclic_def)
-    with subcls "class" have "(D', C) \<in> (subcls1 G)^+" by(auto dest: rtranclD)
+    with subcls "class" have "(D', C) \<in> (subcls1 G)\<^sup>+" by(auto dest: rtranclD)
     finally show False using acyc by(auto simp add: acyclic_def)
   qed
 next
@@ -189,7 +189,7 @@
 definition field :: "'c prog \<times> cname => (vname \<rightharpoonup> cname \<times> ty)"
   where [code]: "field == map_of o (map (\<lambda>((fn,fd),ft). (fn,(fd,ft)))) o fields"
 
-lemma method_rec_lemma: "[|class G C = Some (D,fs,ms); wf ((subcls1 G)^-1)|] ==>
+lemma method_rec_lemma: "[|class G C = Some (D,fs,ms); wf ((subcls1 G)\<inverse>)|] ==>
   method (G,C) = (if C = Object then empty else method (G,D)) ++  
   map_of (map (\<lambda>(s,m). (s,(C,m))) ms)"
 apply (unfold method_def)
@@ -198,7 +198,7 @@
 apply auto
 done
 
-lemma fields_rec_lemma: "[|class G C = Some (D,fs,ms); wf ((subcls1 G)^-1)|] ==>
+lemma fields_rec_lemma: "[|class G C = Some (D,fs,ms); wf ((subcls1 G)\<inverse>)|] ==>
  fields (G,C) = 
   map (\<lambda>(fn,ft). ((fn,C),ft)) fs @ (if C = Object then [] else fields (G,D))"
 apply (unfold fields_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/J/WellForm.thy
--- a/src/HOL/MicroJava/J/WellForm.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/J/WellForm.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -134,7 +134,7 @@
   apply (auto intro!: map_of_SomeI)
   done
 
-lemma subcls1_wfD: "[|G\<turnstile>C\<prec>C1D; ws_prog G|] ==> D \<noteq> C \<and> (D, C) \<notin> (subcls1 G)^+"
+lemma subcls1_wfD: "[|G\<turnstile>C\<prec>C1D; ws_prog G|] ==> D \<noteq> C \<and> (D, C) \<notin> (subcls1 G)\<^sup>+"
 apply( frule trancl.r_into_trancl [where r="subcls1 G"])
 apply( drule subcls1D)
 apply(clarify)
@@ -149,13 +149,13 @@
 apply (auto split: option.split_asm)
 done
 
-lemma subcls_asym: "[|ws_prog G; (C, D) \<in> (subcls1 G)^+|] ==> (D, C) \<notin> (subcls1 G)^+"
+lemma subcls_asym: "[|ws_prog G; (C, D) \<in> (subcls1 G)\<^sup>+|] ==> (D, C) \<notin> (subcls1 G)\<^sup>+"
 apply(erule trancl.cases)
 apply(fast dest!: subcls1_wfD )
 apply(fast dest!: subcls1_wfD intro: trancl_trans)
 done
 
-lemma subcls_irrefl: "[|ws_prog G; (C, D) \<in> (subcls1 G)^+|] ==> C \<noteq> D"
+lemma subcls_irrefl: "[|ws_prog G; (C, D) \<in> (subcls1 G)\<^sup>+|] ==> C \<noteq> D"
 apply (erule trancl_trans_induct)
 apply  (auto dest: subcls1_wfD subcls_asym)
 done
@@ -165,7 +165,7 @@
 apply (fast dest: subcls_irrefl)
 done
 
-lemma wf_subcls1: "ws_prog G ==> wf ((subcls1 G)^-1)"
+lemma wf_subcls1: "ws_prog G ==> wf ((subcls1 G)\<inverse>)"
 apply (rule finite_acyclic_wf)
 apply ( subst finite_converse)
 apply ( rule finite_subcls1)
@@ -174,7 +174,7 @@
 done
 
 lemma subcls_induct_struct: 
-"[|ws_prog G; !!C. \<forall>D. (C, D) \<in> (subcls1 G)^+ --> P D ==> P C|] ==> P C"
+"[|ws_prog G; !!C. \<forall>D. (C, D) \<in> (subcls1 G)\<^sup>+ --> P D ==> P C|] ==> P C"
 (is "?A \<Longrightarrow> PROP ?P \<Longrightarrow> _")
 proof -
   assume p: "PROP ?P"
@@ -189,7 +189,7 @@
 qed
 
 lemma subcls_induct: 
-"[|wf_prog wf_mb G; !!C. \<forall>D. (C, D) \<in> (subcls1 G)^+ --> P D ==> P C|] ==> P C"
+"[|wf_prog wf_mb G; !!C. \<forall>D. (C, D) \<in> (subcls1 G)\<^sup>+ --> P D ==> P C|] ==> P C"
 (is "?A \<Longrightarrow> PROP ?P \<Longrightarrow> _")
 by (fact subcls_induct_struct [OF wf_prog_ws_prog])
 
@@ -367,7 +367,7 @@
 done
 
 lemma fields_mono_lemma [rule_format (no_asm)]: 
-  "[|ws_prog G; (C', C) \<in> (subcls1 G)^*|] ==>  
+  "[|ws_prog G; (C', C) \<in> (subcls1 G)\<^sup>*|] ==>  
   x \<in> set (fields (G,C)) --> x \<in> set (fields (G,C'))"
 apply(erule converse_rtrancl_induct)
 apply( safe dest!: subcls1D)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/MicroJava/JVM/JVMExec.thy
--- a/src/HOL/MicroJava/JVM/JVMExec.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/MicroJava/JVM/JVMExec.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -25,7 +25,7 @@
 
 definition exec_all :: "[jvm_prog,jvm_state,jvm_state] => bool"
               ("_ \<turnstile> _ \<midarrow>jvm\<rightarrow> _" [61,61,61]60) where
-  "G \<turnstile> s \<midarrow>jvm\<rightarrow> t == (s,t) \<in> {(s,t). exec(G,s) = Some t}^*"
+  "G \<turnstile> s \<midarrow>jvm\<rightarrow> t == (s,t) \<in> {(s,t). exec(G,s) = Some t}\<^sup>*"
 
 
 text \<open>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/NanoJava/Equivalence.thy
--- a/src/HOL/NanoJava/Equivalence.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/NanoJava/Equivalence.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -173,7 +173,7 @@
 
 lemma MGF_Loop: "\<forall>Z. A \<turnstile> {(=) Z} c {\<lambda>t. \<exists>n. Z -c-n\<rightarrow> t} \<Longrightarrow> 
   A \<turnstile> {(=) Z} While (x) c {\<lambda>t. \<exists>n. Z -While (x) c-n\<rightarrow> t}"
-apply (rule_tac P' = "\<lambda>Z s. (Z,s) \<in> ({(s,t). \<exists>n. s<x> \<noteq> Null \<and> s -c-n\<rightarrow> t})^*"
+apply (rule_tac P' = "\<lambda>Z s. (Z,s) \<in> ({(s,t). \<exists>n. s<x> \<noteq> Null \<and> s -c-n\<rightarrow> t})\<^sup>*"
        in hoare_ehoare.Conseq)
 apply  (rule allI)
 apply  (rule hoare_ehoare.Loop)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/NanoJava/TypeRel.thy
--- a/src/HOL/NanoJava/TypeRel.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/NanoJava/TypeRel.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -19,7 +19,7 @@
   where "C \<prec>C1 D == (C,D) \<in> subcls1"
 abbreviation
   subcls_syntax  :: "[cname, cname] => bool" ("_ \<preceq>C _"  [71,71] 70)
-  where "C \<preceq>C D == (C,D) \<in> subcls1^*"
+  where "C \<preceq>C D \<equiv> (C,D) \<in> subcls1\<^sup>*"
 
 
 subsection "Declarations and properties not used in the meta theory"
@@ -59,20 +59,20 @@
 
 definition ws_prog :: "bool" where
  "ws_prog \<equiv> \<forall>(C,c)\<in>set Prog. C\<noteq>Object \<longrightarrow> 
-                              is_class (super c) \<and> (super c,C)\<notin>subcls1^+"
+                              is_class (super c) \<and> (super c,C)\<notin>subcls1\<^sup>+"
 
 lemma ws_progD: "\<lbrakk>class C = Some c; C\<noteq>Object; ws_prog\<rbrakk> \<Longrightarrow>  
-  is_class (super c) \<and> (super c,C)\<notin>subcls1^+"
+  is_class (super c) \<and> (super c,C)\<notin>subcls1\<^sup>+"
 apply (unfold ws_prog_def class_def)
 apply (drule_tac map_of_SomeD)
 apply auto
 done
 
-lemma subcls1_irrefl_lemma1: "ws_prog \<Longrightarrow> subcls1^-1 \<inter> subcls1^+ = {}"
+lemma subcls1_irrefl_lemma1: "ws_prog \<Longrightarrow> subcls1\<inverse> \<inter> subcls1\<^sup>+ = {}"
 by (fast dest: subcls1D ws_progD)
 
 (* irrefl_tranclI in Transitive_Closure.thy is more general *)
-lemma irrefl_tranclI': "r^-1 Int r^+ = {} ==> !x. (x, x) ~: r^+"
+lemma irrefl_tranclI': "r\<inverse> \<inter> r\<^sup>+ = {} \<Longrightarrow> \<forall>x. (x, x) \<notin> r\<^sup>+"
 by(blast elim: tranclE dest: trancl_into_rtrancl)
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nitpick_Examples/Core_Nits.thy
--- a/src/HOL/Nitpick_Examples/Core_Nits.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nitpick_Examples/Core_Nits.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -55,7 +55,7 @@
 nitpick [card = 1, expect = genuine]
 oops
 
-lemma "{(a::'a\<times>'a, b::'b)}^-1 = {(b, a)}"
+lemma "{(a::'a\<times>'a, b::'b)}\<inverse> = {(b, a)}"
 nitpick [card = 1-12, expect = none]
 by auto
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nitpick_Examples/Mini_Nits.thy
--- a/src/HOL/Nitpick_Examples/Mini_Nits.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nitpick_Examples/Mini_Nits.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -90,7 +90,7 @@
 ML \<open>genuine 2 @{prop "fst (a, b) = b"}\<close>
 ML \<open>genuine 2 @{prop "fst (a, b) \<noteq> b"}\<close>
 ML \<open>genuine 2 @{prop "f ((x, z), y) = (x, z)"}\<close>
-ML \<open>none 2 @{prop "(ALL x. f x = fst x) \<longrightarrow> f ((x, z), y) = (x, z)"}\<close>
+ML \<open>none 2 @{prop "(\<forall>x. f x = fst x) \<longrightarrow> f ((x, z), y) = (x, z)"}\<close>
 ML \<open>none 4 @{prop "snd (a, b) = b"}\<close>
 ML \<open>none 1 @{prop "snd (a, b) = a"}\<close>
 ML \<open>genuine 2 @{prop "snd (a, b) = a"}\<close>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nitpick_Examples/Refute_Nits.thy
--- a/src/HOL/Nitpick_Examples/Refute_Nits.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nitpick_Examples/Refute_Nits.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -245,15 +245,15 @@
 text \<open>``The transitive closure of an arbitrary relation is non-empty.''\<close>
 
 definition "trans" :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> bool" where
-"trans P \<equiv> (ALL x y z. P x y \<longrightarrow> P y z \<longrightarrow> P x z)"
+"trans P \<equiv> (\<forall>x y z. P x y \<longrightarrow> P y z \<longrightarrow> P x z)"
 
 definition
 "subset" :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> ('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> bool" where
-"subset P Q \<equiv> (ALL x y. P x y \<longrightarrow> Q x y)"
+"subset P Q \<equiv> (\<forall>x y. P x y \<longrightarrow> Q x y)"
 
 definition
 "trans_closure" :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> ('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> bool" where
-"trans_closure P Q \<equiv> (subset Q P) \<and> (trans P) \<and> (ALL R. subset Q R \<longrightarrow> trans R \<longrightarrow> subset P R)"
+"trans_closure P Q \<equiv> (subset Q P) \<and> (trans P) \<and> (\<forall>R. subset Q R \<longrightarrow> trans R \<longrightarrow> subset P R)"
 
 lemma "trans_closure T P \<longrightarrow> (\<exists>x y. T x y)"
 nitpick [expect = genuine]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nominal/Examples/Class1.thy
--- a/src/HOL/Nominal/Examples/Class1.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nominal/Examples/Class1.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -5165,7 +5165,7 @@
 abbreviation
  a_star_redu :: "trm \<Rightarrow> trm \<Rightarrow> bool" ("_ \<longrightarrow>\<^sub>a* _" [100,100] 100)
 where
-  "M \<longrightarrow>\<^sub>a* M' \<equiv> (a_redu)^** M M'"
+  "M \<longrightarrow>\<^sub>a* M' \<equiv> (a_redu)\<^sup>*\<^sup>* M M'"
 
 lemma a_starI:
   assumes a: "M \<longrightarrow>\<^sub>a M'"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nonstandard_Analysis/HyperDef.thy
--- a/src/HOL/Nonstandard_Analysis/HyperDef.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nonstandard_Analysis/HyperDef.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -138,7 +138,7 @@
 lemma lemma_starrel_refl [simp]: "x \<in> starrel `` {x}"
   by (simp add: starrel_def)
 
-lemma starrel_in_hypreal [simp]: "starrel``{x}:star"
+lemma starrel_in_hypreal [simp]: "starrel``{x}\<in>star"
   by (simp add: star_def starrel_def quotient_def, blast)
 
 declare Abs_star_inject [simp] Abs_star_inverse [simp]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nonstandard_Analysis/NSCA.thy
--- a/src/HOL/Nonstandard_Analysis/NSCA.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nonstandard_Analysis/NSCA.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -57,13 +57,13 @@
 by (auto simp add: Standard_def image_def) (metis inj_star_of inv_f_f)
 
 lemma SComplex_hcomplex_of_complex_image: 
-      "[| \<exists>x. x: P; P \<le> SComplex |] ==> \<exists>Q. P = hcomplex_of_complex ` Q"
+      "\<lbrakk>\<exists>x. x \<in> P; P \<le> SComplex\<rbrakk> \<Longrightarrow> \<exists>Q. P = hcomplex_of_complex ` Q"
 apply (simp add: Standard_def, blast)
 done
 
 lemma SComplex_SReal_dense:
-     "[| x \<in> SComplex; y \<in> SComplex; hcmod x < hcmod y  
-      |] ==> \<exists>r \<in> Reals. hcmod x< r \<and> r < hcmod y"
+     "\<lbrakk>x \<in> SComplex; y \<in> SComplex; hcmod x < hcmod y  
+      \<rbrakk> \<Longrightarrow> \<exists>r \<in> Reals. hcmod x< r \<and> r < hcmod y"
 apply (auto intro: SReal_dense simp add: SReal_hcmod_SComplex)
 done
 
@@ -78,7 +78,7 @@
 by (simp add: HFinite_def)
 
 lemma HFinite_bounded_hcmod:
-  "[|x \<in> HFinite; y \<le> hcmod x; 0 \<le> y |] ==> y: HFinite"
+  "\<lbrakk>x \<in> HFinite; y \<le> hcmod x; 0 \<le> y\<rbrakk> \<Longrightarrow> y \<in> HFinite"
 by (auto intro: HFinite_bounded simp add: HFinite_hcmod_iff)
 
 
@@ -343,14 +343,14 @@
 by (simp add: HComplex_def)
 
 (* Here we go - easy proof now!! *)
-lemma stc_part_Ex: "x:HFinite ==> \<exists>t \<in> SComplex. x \<approx> t"
+lemma stc_part_Ex: "x \<in> HFinite \<Longrightarrow> \<exists>t \<in> SComplex. x \<approx> t"
 apply (simp add: hcomplex_HFinite_iff hcomplex_approx_iff)
 apply (rule_tac x="HComplex (st (hRe x)) (st (hIm x))" in bexI)
 apply (simp add: st_approx_self [THEN approx_sym])
 apply (simp add: Standard_HComplex st_SReal [unfolded Reals_eq_Standard])
 done
 
-lemma stc_part_Ex1: "x\<in>HFinite \<Longrightarrow> \<exists>!t. t \<in> SComplex \<and> x \<approx> t"
+lemma stc_part_Ex1: "x \<in> HFinite \<Longrightarrow> \<exists>!t. t \<in> SComplex \<and> x \<approx> t"
 apply (drule stc_part_Ex, safe)
 apply (drule_tac [2] approx_sym, drule_tac [2] approx_sym, drule_tac [2] approx_sym)
 apply (auto intro!: approx_unique_complex)
@@ -362,7 +362,7 @@
 
 subsection\<open>Theorems About Monads\<close>
 
-lemma monad_zero_hcmod_iff: "(x \<in> monad 0) = (hcmod x:monad 0)"
+lemma monad_zero_hcmod_iff: "(x \<in> monad 0) = (hcmod x \<in> monad 0)"
 by (simp add: Infinitesimal_monad_zero_iff [symmetric] Infinitesimal_hcmod_iff)
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Nonstandard_Analysis/Star.thy
--- a/src/HOL/Nonstandard_Analysis/Star.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Nonstandard_Analysis/Star.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -231,7 +231,7 @@
   by transfer (rule refl)
 
 text \<open>General lemma/theorem needed for proofs in elementary topology of the reals.\<close>
-lemma starfun_mem_starset: "\<And>x. ( *f* f) x : *s* A \<Longrightarrow> x \<in> *s* {x. f x \<in> A}"
+lemma starfun_mem_starset: "\<And>x. ( *f* f) x \<in> *s* A \<Longrightarrow> x \<in> *s* {x. f x \<in> A}"
   by transfer simp
 
 text \<open>Alternative definition for \<open>hrabs\<close> with \<open>rabs\<close> function applied
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Predicate_Compile.thy
--- a/src/HOL/Predicate_Compile.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Predicate_Compile.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -32,10 +32,10 @@
 \<close>
 
 definition contains :: "'a set => 'a => bool"
-where "contains A x \<longleftrightarrow> x : A"
+where "contains A x \<longleftrightarrow> x \<in> A"
 
 definition contains_pred :: "'a set => 'a => unit Predicate.pred"
-where "contains_pred A x = (if x : A then Predicate.single () else bot)"
+where "contains_pred A x = (if x \<in> A then Predicate.single () else bot)"
 
 lemma pred_of_setE:
   assumes "Predicate.eval (pred_of_set A) x"
@@ -52,7 +52,7 @@
 by(simp add: contains_def)
 
 lemma containsE: assumes "contains A x"
-  obtains A' x' where "A = A'" "x = x'" "x : A"
+  obtains A' x' where "A = A'" "x = x'" "x \<in> A"
 using assms by(simp add: contains_def)
 
 lemma contains_predI: "contains A x ==> Predicate.eval (contains_pred A x) ()"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Predicate_Compile_Examples/Hotel_Example.thy
--- a/src/HOL/Predicate_Compile_Examples/Hotel_Example.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Predicate_Compile_Examples/Hotel_Example.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -66,10 +66,10 @@
 primrec hotel :: "event list \<Rightarrow> bool"
 where
   "hotel []  = True"
-| "hotel (e # s) = (hotel s & (case e of
+| "hotel (e # s) = (hotel s \<and> (case e of
   Check_in g r (k,k') \<Rightarrow> k = currk s r \<and> k' \<notin> issued s |
-  Enter g r (k,k') \<Rightarrow> (k,k') : cards s g & (roomk s r : {k, k'}) |
-  Exit g r \<Rightarrow> g : isin s r))"
+  Enter g r (k,k') \<Rightarrow> (k,k') \<in> cards s g \<and> (roomk s r \<in> {k, k'}) |
+  Exit g r \<Rightarrow> g \<in> isin s r))"
 
 definition no_Check_in :: "event list \<Rightarrow> room \<Rightarrow> bool" where(*>*)
 [code del]: "no_Check_in s r \<equiv> \<not>(\<exists>g c. Check_in g r c \<in> set s)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Predicate_Compile_Examples/Hotel_Example_Prolog.thy
--- a/src/HOL/Predicate_Compile_Examples/Hotel_Example_Prolog.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Predicate_Compile_Examples/Hotel_Example_Prolog.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -59,11 +59,11 @@
 
 declare List.member_rec[code_pred_def]
 
-lemma [code_pred_def]: "no_Check_in s r = (~ (EX g c. List.member s (Check_in g r c)))"
+lemma [code_pred_def]: "no_Check_in s r = (\<not> (\<exists>g c. List.member s (Check_in g r c)))"
 unfolding no_Check_in_def member_def by auto
 
 lemma [code_pred_def]: "feels_safe s r =
-(EX s\<^sub>1 s\<^sub>2 s\<^sub>3 g c c'.
+(\<exists>s\<^sub>1 s\<^sub>2 s\<^sub>3 g c c'.
     s =
     s\<^sub>3 @
     [Enter g r c] @ s\<^sub>2 @ [Check_in g r c'] @ s\<^sub>1 &
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Presburger.thy
--- a/src/HOL/Presburger.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Presburger.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -194,12 +194,12 @@
     hence "P 0" using P Pmod by simp
     moreover have "P 0 = P(0 - (-1)*d)" using modd by blast
     ultimately have "P d" by simp
-    moreover have "d : {1..d}" using dpos by simp
+    moreover have "d \<in> {1..d}" using dpos by simp
     ultimately show ?RHS ..
   next
     assume not0: "x mod d \<noteq> 0"
     have "P(x mod d)" using dpos P Pmod by simp
-    moreover have "x mod d : {1..d}"
+    moreover have "x mod d \<in> {1..d}"
     proof -
       from dpos have "0 \<le> x mod d" by(rule pos_mod_sign)
       moreover from dpos have "x mod d < d" by(rule pos_mod_bound)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Prolog/Test.thy
--- a/src/HOL/Prolog/Test.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Prolog/Test.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -52,9 +52,9 @@
 where
         append:  "\<And>x xs ys zs. append  []    xs  xs    ..
                   append (x#xs) ys (x#zs) :- append xs ys zs" and
-        reverse: "\<And>L1 L2. reverse L1 L2 :- (!rev_aux.
-                  (!L.          rev_aux  []    L  L )..
-                  (!X L1 L2 L3. rev_aux (X#L1) L2 L3 :- rev_aux L1 L2 (X#L3))
+        reverse: "\<And>L1 L2. reverse L1 L2 :- (\<forall>rev_aux.
+                  (\<forall>L.          rev_aux  []    L  L )..
+                  (\<forall>X L1 L2 L3. rev_aux (X#L1) L2 L3 :- rev_aux L1 L2 (X#L3))
                   => rev_aux L1 L2 [])" and
 
         mappred: "\<And>x xs y ys P. mappred P  []     []    ..
@@ -70,7 +70,7 @@
 
 (* actual definitions of empty and add is hidden -> yields abstract data type *)
 
-        bag_appl: "\<And>A B X Y. bag_appl A B X Y:- (? S1 S2 S3 S4 S5.
+        bag_appl: "\<And>A B X Y. bag_appl A B X Y:- (\<exists>S1 S2 S3 S4 S5.
                                 empty    S1    &
                                 add A    S1 S2 &
                                 add B    S2 S3 &
@@ -92,7 +92,7 @@
   apply (prolog prog_Test)
   done
 
-schematic_goal "!y. append [a,b] y (?L y)"
+schematic_goal "\<forall>y. append [a,b] y (?L y)"
   apply (prolog prog_Test)
   done
 
@@ -117,7 +117,7 @@
   back
   done
 
-schematic_goal "mappred (%x y. ? z. age z y) ?x [23,24]"
+schematic_goal "mappred (\<lambda>x y. \<exists>z. age z y) ?x [23,24]"
   apply (prolog prog_Test)
   done
 
@@ -159,11 +159,11 @@
   back
   done
 
-lemma "? x y. age x y"
+lemma "\<exists>x y. age x y"
   apply (prolog prog_Test)
   done
 
-lemma "!x y. append [] x x"
+lemma "\<forall>x y. append [] x x"
   apply (prolog prog_Test)
   done
 
@@ -181,18 +181,18 @@
   done
 (*reset trace_DEPTH_FIRST;*)
 
-schematic_goal "(!x. age x 25 :- age x 23) => age ?x 25 & age ?y 25"
+schematic_goal "(\<forall>x. age x 25 :- age x 23) => age ?x 25 & age ?y 25"
   apply (prolog prog_Test)
   back
   back
   back
   done
 
-lemma "!x. ? y. eq x y"
+lemma "\<forall>x. \<exists>y. eq x y"
   apply (prolog prog_Test)
   done
 
-schematic_goal "? P. P & eq P ?x"
+schematic_goal "\<exists>P. P \<and> eq P ?x"
   apply (prolog prog_Test)
 (*
   back
@@ -206,20 +206,20 @@
 *)
   done
 
-lemma "? P. eq P (True & True) & P"
+lemma "\<exists>P. eq P (True & True) \<and> P"
   apply (prolog prog_Test)
   done
 
-lemma "? P. eq P (|) & P k True"
+lemma "\<exists>P. eq P (\<or>) \<and> P k True"
   apply (prolog prog_Test)
   done
 
-lemma "? P. eq P (Q => True) & P"
+lemma "\<exists>P. eq P (Q => True) \<and> P"
   apply (prolog prog_Test)
   done
 
 (* P flexible: *)
-lemma "(!P k l. P k l :- eq P Q) => Q a b"
+lemma "(\<forall>P k l. P k l :- eq P Q) => Q a b"
   apply (prolog prog_Test)
   done
 (*
@@ -228,11 +228,11 @@
 *)
 
 (* implication and disjunction in atom: *)
-lemma "? Q. (!p q. R(q :- p) => R(Q p q)) & Q (t | s) (s | t)"
+lemma "\<exists>Q. (\<forall>p q. R(q :- p) => R(Q p q)) \<and> Q (t | s) (s | t)"
   by fast
 
 (* disjunction in atom: *)
-lemma "(!P. g P :- (P => b | a)) => g(a | b)"
+lemma "(\<forall>P. g P :- (P => b \<or> a)) => g(a \<or> b)"
   apply (tactic "step_tac (put_claset HOL_cs @{context}) 1")
   apply (tactic "step_tac (put_claset HOL_cs @{context}) 1")
   apply (tactic "step_tac (put_claset HOL_cs @{context}) 1")
@@ -247,21 +247,21 @@
   by fast
 *)
 
-schematic_goal "!Emp Stk.(
+schematic_goal "\<forall>Emp Stk.(
                        empty    (Emp::'b) .. 
-         (!(X::nat) S. add    X (S::'b)         (Stk X S)) .. 
-         (!(X::nat) S. remove X ((Stk X S)::'b) S))
+         (\<forall>(X::nat) S. add    X (S::'b)         (Stk X S)) .. 
+         (\<forall>(X::nat) S. remove X ((Stk X S)::'b) S))
  => bag_appl 23 24 ?X ?Y"
   oops
 
-schematic_goal "!Qu. ( 
-          (!L.            empty    (Qu L L)) .. 
-          (!(X::nat) L K. add    X (Qu L (X#K)) (Qu L K)) ..
-          (!(X::nat) L K. remove X (Qu (X#L) K) (Qu L K)))
+schematic_goal "\<forall>Qu. ( 
+          (\<forall>L.            empty    (Qu L L)) .. 
+          (\<forall>(X::nat) L K. add    X (Qu L (X#K)) (Qu L K)) ..
+          (\<forall>(X::nat) L K. remove X (Qu (X#L) K) (Qu L K)))
  => bag_appl 23 24 ?X ?Y"
   oops
 
-lemma "D & (!y. E) :- (!x. True & True) :- True => D"
+lemma "D \<and> (\<forall>y. E) :- (\<forall>x. True \<and> True) :- True => D"
   apply (prolog prog_Test)
   done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Prolog/Type.thy
--- a/src/HOL/Prolog/Type.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Prolog/Type.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -13,14 +13,14 @@
 axiomatization
   bool    :: ty and
   nat     :: ty and
-  arrow   :: "ty => ty => ty"       (infixr "->" 20) and
-  typeof  :: "[tm, ty] => bool" and
+  arrow   :: "ty \<Rightarrow> ty \<Rightarrow> ty"       (infixr "->" 20) and
+  typeof  :: "[tm, ty] \<Rightarrow> bool" and
   anyterm :: tm
 where common_typeof:   "
-typeof (app M N) B       :- typeof M (A -> B) & typeof N A..
+typeof (app M N) B       :- typeof M (A -> B) \<and> typeof N A..
 
-typeof (cond C L R) A :- typeof C bool & typeof L A & typeof R A..
-typeof (fix F)   A       :- (!x. typeof x A => typeof (F  x) A)..
+typeof (cond C L R) A :- typeof C bool \<and> typeof L A \<and> typeof R A..
+typeof (fix F)   A       :- (\<forall>x. typeof x A => typeof (F  x) A)..
 
 typeof true  bool..
 typeof false bool..
@@ -35,7 +35,7 @@
 typeof (M * N) nat :- typeof M nat & typeof N nat"
 
 axiomatization where good_typeof:     "
-typeof (abs Bo) (A -> B) :- (!x. typeof x A => typeof (Bo x) B)"
+typeof (abs Bo) (A -> B) :- (\<forall>x. typeof x A => typeof (Bo x) B)"
 
 axiomatization where bad1_typeof:     "
 typeof (abs Bo) (A -> B) :- (typeof varterm A => typeof (Bo varterm) B)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Proofs/Lambda/Commutation.thy
--- a/src/HOL/Proofs/Lambda/Commutation.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Proofs/Lambda/Commutation.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -30,11 +30,11 @@
 definition
   Church_Rosser :: "('a => 'a => bool) => bool" where
   "Church_Rosser R =
-    (\<forall>x y. (sup R (R^--1))^** x y --> (\<exists>z. R^** x z \<and> R^** y z))"
+    (\<forall>x y. (sup R (R\<inverse>\<inverse>))\<^sup>*\<^sup>* x y \<longrightarrow> (\<exists>z. R\<^sup>*\<^sup>* x z \<and> R\<^sup>*\<^sup>* y z))"
 
 abbreviation
   confluent :: "('a => 'a => bool) => bool" where
-  "confluent R == diamond (R^**)"
+  "confluent R == diamond (R\<^sup>*\<^sup>*)"
 
 
 subsection \<open>Basic lemmas\<close>
@@ -53,13 +53,13 @@
   done
 
 lemma square_reflcl:
-    "[| square R S T (R^==); S \<le> T |] ==> square (R^==) S T (R^==)"
+    "[| square R S T (R\<^sup>=\<^sup>=); S \<le> T |] ==> square (R\<^sup>=\<^sup>=) S T (R\<^sup>=\<^sup>=)"
   apply (unfold square_def)
   apply (blast dest: predicate2D)
   done
 
 lemma square_rtrancl:
-    "square R S S T ==> square (R^**) S S (T^**)"
+    "square R S S T ==> square (R\<^sup>*\<^sup>*) S S (T\<^sup>*\<^sup>*)"
   apply (unfold square_def)
   apply (intro strip)
   apply (erule rtranclp_induct)
@@ -68,7 +68,7 @@
   done
 
 lemma square_rtrancl_reflcl_commute:
-    "square R S (S^**) (R^==) ==> commute (R^**) (S^**)"
+    "square R S (S\<^sup>*\<^sup>*) (R\<^sup>=\<^sup>=) ==> commute (R\<^sup>*\<^sup>*) (S\<^sup>*\<^sup>*)"
   apply (unfold commute_def)
   apply (fastforce dest: square_reflcl square_sym [THEN square_rtrancl])
   done
@@ -81,7 +81,7 @@
   apply (blast intro: square_sym)
   done
 
-lemma commute_rtrancl: "commute R S ==> commute (R^**) (S^**)"
+lemma commute_rtrancl: "commute R S ==> commute (R\<^sup>*\<^sup>*) (S\<^sup>*\<^sup>*)"
   apply (unfold commute_def)
   apply (blast intro: square_rtrancl square_sym)
   done
@@ -107,19 +107,19 @@
   done
 
 lemma square_reflcl_confluent:
-    "square R R (R^==) (R^==) ==> confluent R"
+    "square R R (R\<^sup>=\<^sup>=) (R\<^sup>=\<^sup>=) ==> confluent R"
   apply (unfold diamond_def)
   apply (fast intro: square_rtrancl_reflcl_commute elim: square_subset)
   done
 
 lemma confluent_Un:
-    "[| confluent R; confluent S; commute (R^**) (S^**) |] ==> confluent (sup R S)"
+    "[| confluent R; confluent S; commute (R\<^sup>*\<^sup>*) (S\<^sup>*\<^sup>*) |] ==> confluent (sup R S)"
   apply (rule rtranclp_sup_rtranclp [THEN subst])
   apply (blast dest: diamond_Un intro: diamond_confluent)
   done
 
 lemma diamond_to_confluence:
-    "[| diamond R; T \<le> R; R \<le> T^** |] ==> confluent T"
+    "[| diamond R; T \<le> R; R \<le> T\<^sup>*\<^sup>* |] ==> confluent T"
   apply (force intro: diamond_confluent
     dest: rtranclp_subset [symmetric])
   done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Proofs/Lambda/Eta.thy
--- a/src/HOL/Proofs/Lambda/Eta.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Proofs/Lambda/Eta.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -27,11 +27,11 @@
 
 abbreviation
   eta_reds :: "[dB, dB] => bool"   (infixl "\<rightarrow>\<^sub>\<eta>\<^sup>*" 50) where
-  "s \<rightarrow>\<^sub>\<eta>\<^sup>* t == eta^** s t"
+  "s \<rightarrow>\<^sub>\<eta>\<^sup>* t == eta\<^sup>*\<^sup>* s t"
 
 abbreviation
   eta_red0 :: "[dB, dB] => bool"   (infixl "\<rightarrow>\<^sub>\<eta>\<^sup>=" 50) where
-  "s \<rightarrow>\<^sub>\<eta>\<^sup>= t == eta^== s t"
+  "s \<rightarrow>\<^sub>\<eta>\<^sup>= t == eta\<^sup>=\<^sup>= s t"
 
 inductive_cases eta_cases [elim!]:
   "Abs s \<rightarrow>\<^sub>\<eta> z"
@@ -79,7 +79,7 @@
 
 subsection \<open>Confluence of \<open>eta\<close>\<close>
 
-lemma square_eta: "square eta eta (eta^==) (eta^==)"
+lemma square_eta: "square eta eta (eta\<^sup>=\<^sup>=) (eta\<^sup>=\<^sup>=)"
   apply (unfold square_def id_def)
   apply (rule impI [THEN allI [THEN allI]])
   apply (erule eta.induct)
@@ -148,7 +148,7 @@
   shows "u[s/i] \<rightarrow>\<^sub>\<eta>\<^sup>* u[t/i]" using eta
   by induct (iprover intro: rtrancl_eta_subst rtranclp_trans)+
 
-lemma square_beta_eta: "square beta eta (eta^**) (beta^==)"
+lemma square_beta_eta: "square beta eta (eta\<^sup>*\<^sup>*) (beta\<^sup>=\<^sup>=)"
   apply (unfold square_def)
   apply (rule impI [THEN allI [THEN allI]])
   apply (erule beta.induct)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Proofs/Lambda/InductTermi.thy
--- a/src/HOL/Proofs/Lambda/InductTermi.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Proofs/Lambda/InductTermi.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -84,7 +84,7 @@
    apply (erule mp)
    apply clarify
    apply (drule_tac r=beta in conversepI)
-   apply (drule_tac r="beta^--1" in ex_step1I, assumption)
+   apply (drule_tac r="beta\<inverse>\<inverse>" in ex_step1I, assumption)
    apply clarify
    apply (rename_tac us)
    apply (erule_tac x = "Var n \<degree>\<degree> us" in allE)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Proofs/Lambda/Lambda.thy
--- a/src/HOL/Proofs/Lambda/Lambda.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Proofs/Lambda/Lambda.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -65,7 +65,7 @@
 
 abbreviation
   beta_reds :: "[dB, dB] => bool"  (infixl "\<rightarrow>\<^sub>\<beta>\<^sup>*" 50) where
-  "s \<rightarrow>\<^sub>\<beta>\<^sup>* t == beta^** s t"
+  "s \<rightarrow>\<^sub>\<beta>\<^sup>* t == beta\<^sup>*\<^sup>* s t"
 
 inductive_cases beta_cases [elim!]:
   "Var i \<rightarrow>\<^sub>\<beta> t"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Proofs/Lambda/ListOrder.thy
--- a/src/HOL/Proofs/Lambda/ListOrder.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Proofs/Lambda/ListOrder.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -24,12 +24,12 @@
       us @ z' # vs)"
 
 
-lemma step1_converse [simp]: "step1 (r^--1) = (step1 r)^--1"
+lemma step1_converse [simp]: "step1 (r\<inverse>\<inverse>) = (step1 r)\<inverse>\<inverse>"
   apply (unfold step1_def)
   apply (blast intro!: order_antisym)
   done
 
-lemma in_step1_converse [iff]: "(step1 (r^--1) x y) = ((step1 r)^--1 x y)"
+lemma in_step1_converse [iff]: "(step1 (r\<inverse>\<inverse>) x y) = ((step1 r)\<inverse>\<inverse> x y)"
   apply auto
   done
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Proofs/Lambda/ParRed.thy
--- a/src/HOL/Proofs/Lambda/ParRed.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Proofs/Lambda/ParRed.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -30,7 +30,7 @@
 
 subsection \<open>Inclusions\<close>
 
-text \<open>\<open>beta \<subseteq> par_beta \<subseteq> beta^*\<close> \medskip\<close>
+text \<open>\<open>beta \<subseteq> par_beta \<subseteq> beta\<^sup>*\<close> \medskip\<close>
 
 lemma par_beta_varL [simp]:
     "(Var n => t) = (t = Var n)"
@@ -45,7 +45,7 @@
      apply (blast intro!: par_beta_refl)+
   done
 
-lemma par_beta_subset_beta: "par_beta <= beta^**"
+lemma par_beta_subset_beta: "par_beta \<le> beta\<^sup>*\<^sup>*"
   apply (rule predicate2I)
   apply (erule par_beta.induct)
      apply blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Quickcheck_Examples/Hotel_Example.thy
--- a/src/HOL/Quickcheck_Examples/Hotel_Example.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Quickcheck_Examples/Hotel_Example.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -70,8 +70,8 @@
   "hotel []  = True"
 | "hotel (e # s) = (hotel s & (case e of
   Check_in g r (k,k') \<Rightarrow> k = currk s r \<and> k' \<notin> issued s |
-  Enter g r (k,k') \<Rightarrow> (k,k') : cards s g & (roomk s r : {k, k'}) |
-  Exit g r \<Rightarrow> g : isin s r))"
+  Enter g r (k,k') \<Rightarrow> (k,k') \<in> cards s g & (roomk s r \<in> {k, k'}) |
+  Exit g r \<Rightarrow> g \<in> isin s r))"
 
 definition no_Check_in :: "event list \<Rightarrow> room \<Rightarrow> bool" where(*>*)
 [code del]: "no_Check_in s r \<equiv> \<not>(\<exists>g c. Check_in g r c \<in> set s)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Quickcheck_Examples/Quickcheck_Examples.thy
--- a/src/HOL/Quickcheck_Examples/Quickcheck_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Quickcheck_Examples/Quickcheck_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -303,7 +303,7 @@
 
 (* FIXME: some dramatic performance decrease after changing the code equation of the ntrancl *)
 lemma
-  "(x, z) : rtrancl (R Un S) ==> \<exists> y. (x, y) : rtrancl R & (y, z) : rtrancl S"
+  "(x, z) \<in> rtrancl (R Un S) \<Longrightarrow> \<exists>y. (x, y) \<in> rtrancl R \<and> (y, z) \<in> rtrancl S"
 (*quickcheck[exhaustive, expect = counterexample]*)
 oops
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Quickcheck_Examples/Quickcheck_Narrowing_Examples.thy
--- a/src/HOL/Quickcheck_Examples/Quickcheck_Narrowing_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Quickcheck_Examples/Quickcheck_Narrowing_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -41,34 +41,34 @@
 oops
 
 lemma
-  "x > 2 --> (\<exists>y :: nat. x < y & y <= 2)"
+  "x > 2 \<longrightarrow> (\<exists>y :: nat. x < y \<and> y \<le> 2)"
 quickcheck[tester = narrowing, finite_types = false, size = 10]
 oops
 
 lemma
-  "\<forall> x. \<exists> y :: nat. x > 3 --> (y < x & y > 3)"
+  "\<forall>x. \<exists>y :: nat. x > 3 \<longrightarrow> (y < x \<and> y > 3)"
 quickcheck[tester = narrowing, finite_types = false, size = 7]
 oops
 
 text \<open>A false conjecture derived from an partial copy-n-paste of @{thm not_distinct_decomp}\<close>
 lemma
-  "~ distinct ws ==> EX xs ys zs y. ws = xs @ [y] @ ys @ [y]"
+  "\<not> distinct ws \<Longrightarrow> \<exists>xs ys zs y. ws = xs @ [y] @ ys @ [y]"
 quickcheck[tester = narrowing, finite_types = false, default_type = nat, expect = counterexample]
 oops
 
 text \<open>A false conjecture derived from theorems @{thm split_list_first} and @{thm split_list_last}\<close>  
 lemma
-  "x : set xs ==> EX ys zs. xs = ys @ x # zs & x ~: set zs & x ~: set ys"
+  "x \<in> set xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> set zs \<and> x \<notin> set ys"
 quickcheck[tester = narrowing, finite_types = false, default_type = nat, expect = counterexample]
 oops
 
 text \<open>A false conjecture derived from @{thm map_eq_Cons_conv} with a typo\<close>
 lemma
-  "(map f xs = y # ys) = (EX z zs. xs = z' # zs & f z = y & map f zs = ys)"
+  "(map f xs = y # ys) = (\<exists>z zs. xs = z' # zs & f z = y \<and> map f zs = ys)"
 quickcheck[tester = narrowing, finite_types = false, default_type = nat, expect = counterexample]
 oops
 
-lemma "a # xs = ys @ [a] ==> EX zs. xs = zs @ [a] & ys = a#zs"
+lemma "a # xs = ys @ [a] \<Longrightarrow> \<exists>zs. xs = zs @ [a] \<and> ys = a#zs"
 quickcheck[narrowing, expect = counterexample]
 quickcheck[exhaustive, random, expect = no_counterexample]
 oops
@@ -216,7 +216,7 @@
 by (induct t) auto
 
 lemma is_ord_mkt:
-  "is_ord (MKT n l r h) = ((ALL n': set (set_of' l). n' < n) & (ALL n': set (set_of' r). n < n') & is_ord l & is_ord r)"
+  "is_ord (MKT n l r h) = ((\<forall>n' \<in> set (set_of' l). n' < n) \<and> (\<forall>n' \<in> set (set_of' r). n < n') \<and> is_ord l \<and> is_ord r)"
 by (simp add: set_of')
 
 declare is_ord.simps(1)[code] is_ord_mkt[code]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SET_Protocol/Cardholder_Registration.thy
--- a/src/HOL/SET_Protocol/Cardholder_Registration.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SET_Protocol/Cardholder_Registration.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -21,7 +21,7 @@
 
 subsection\<open>Predicate Formalizing the Encryption Association between Keys\<close>
 
-primrec KeyCryptKey :: "[key, key, event list] => bool"
+primrec KeyCryptKey :: "[key, key, event list] \<Rightarrow> bool"
 where
   KeyCryptKey_Nil:
     "KeyCryptKey DK K [] = False"
@@ -35,18 +35,18 @@
     "KeyCryptKey DK K (ev # evs) =
      (KeyCryptKey DK K evs |
       (case ev of
-        Says A B Z =>
-         ((\<exists>N X Y. A \<noteq> Spy &
-                 DK \<in> symKeys &
+        Says A B Z \<Rightarrow>
+         ((\<exists>N X Y. A \<noteq> Spy \<and>
+                 DK \<in> symKeys \<and>
                  Z = \<lbrace>Crypt DK \<lbrace>Agent A, Nonce N, Key K, X\<rbrace>, Y\<rbrace>) |
           (\<exists>C. DK = priEK C))
-      | Gets A' X => False
-      | Notes A' X => False))"
+      | Gets A' X \<Rightarrow> False
+      | Notes A' X \<Rightarrow> False))"
 
 
 subsection\<open>Predicate formalizing the association between keys and nonces\<close>
 
-primrec KeyCryptNonce :: "[key, key, event list] => bool"
+primrec KeyCryptNonce :: "[key, key, event list] \<Rightarrow> bool"
 where
   KeyCryptNonce_Nil:
     "KeyCryptNonce EK K [] = False"
@@ -63,25 +63,25 @@
   "KeyCryptNonce DK N (ev # evs) =
    (KeyCryptNonce DK N evs |
     (case ev of
-      Says A B Z =>
-       A \<noteq> Spy &
-       ((\<exists>X Y. DK \<in> symKeys &
+      Says A B Z \<Rightarrow>
+       A \<noteq> Spy \<and>
+       ((\<exists>X Y. DK \<in> symKeys \<and>
                Z = (EXHcrypt DK X \<lbrace>Agent A, Nonce N\<rbrace> Y)) |
-        (\<exists>X Y. DK \<in> symKeys &
+        (\<exists>X Y. DK \<in> symKeys \<and>
                Z = \<lbrace>Crypt DK \<lbrace>Agent A, Nonce N, X\<rbrace>, Y\<rbrace>) |
         (\<exists>K i X Y.
-          K \<in> symKeys &
-          Z = Crypt K \<lbrace>sign (priSK (CA i)) \<lbrace>Agent B, Nonce N, X\<rbrace>, Y\<rbrace> &
+          K \<in> symKeys \<and>
+          Z = Crypt K \<lbrace>sign (priSK (CA i)) \<lbrace>Agent B, Nonce N, X\<rbrace>, Y\<rbrace> \<and>
           (DK=K | KeyCryptKey DK K evs)) |
         (\<exists>K C NC3 Y.
-          K \<in> symKeys &
+          K \<in> symKeys \<and>
           Z = Crypt K
                 \<lbrace>sign (priSK C) \<lbrace>Agent B, Nonce NC3, Agent C, Nonce N\<rbrace>,
-                  Y\<rbrace> &
+                  Y\<rbrace> \<and>
           (DK=K | KeyCryptKey DK K evs)) |
         (\<exists>C. DK = priEK C))
-    | Gets A' X => False
-    | Notes A' X => False))"
+    | Gets A' X \<Rightarrow> False
+    | Notes A' X \<Rightarrow> False))"
 
 
 subsection\<open>Formal protocol definition\<close>
@@ -329,7 +329,7 @@
      "[| Gets A \<lbrace> X, cert C EKi onlyEnc (priSK RCA),
                       cert C SKi onlySig (priSK RCA)\<rbrace> \<in> set evs;
          evs \<in> set_cr |]
-      ==> EKi = pubEK C & SKi = pubSK C"
+      ==> EKi = pubEK C \<and> SKi = pubSK C"
 by (blast dest: certificate_valid_pubEK certificate_valid_pubSK)
 
 text\<open>Nobody can have used non-existent keys!\<close>
@@ -350,13 +350,13 @@
 
 lemma gen_new_keys_not_used:
      "[|Key K \<notin> used evs; K \<in> symKeys; evs \<in> set_cr |]
-      ==> Key K \<notin> used evs --> K \<in> symKeys -->
-          K \<notin> keysFor (parts (Key`KK Un knows Spy evs))"
+      ==> Key K \<notin> used evs \<longrightarrow> K \<in> symKeys \<longrightarrow>
+          K \<notin> keysFor (parts (Key`KK \<union> knows Spy evs))"
 by (auto simp add: new_keys_not_used)
 
 lemma gen_new_keys_not_analzd:
      "[|Key K \<notin> used evs; K \<in> symKeys; evs \<in> set_cr |]
-      ==> K \<notin> keysFor (analz (Key`KK Un knows Spy evs))"
+      ==> K \<notin> keysFor (analz (Key`KK \<union> knows Spy evs))"
 by (blast intro: keysFor_mono [THEN [2] rev_subsetD]
           dest: gen_new_keys_not_used)
 
@@ -459,14 +459,14 @@
 for other keys aren't needed.\<close>
 
 lemma parts_image_priEK:
-     "[|Key (priEK C) \<in> parts (Key`KK Un (knows Spy evs));
+     "[|Key (priEK C) \<in> parts (Key`KK \<union> (knows Spy evs));
         evs \<in> set_cr|] ==> priEK C \<in> KK | C \<in> bad"
 by auto
 
 text\<open>trivial proof because (priEK C) never appears even in (parts evs)\<close>
 lemma analz_image_priEK:
      "evs \<in> set_cr ==>
-          (Key (priEK C) \<in> analz (Key`KK Un (knows Spy evs))) =
+          (Key (priEK C) \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (priEK C \<in> KK | C \<in> bad)"
 by (blast dest!: parts_image_priEK intro: analz_mono [THEN [2] rev_subsetD])
 
@@ -478,7 +478,7 @@
 text\<open>A fresh DK cannot be associated with any other
   (with respect to a given trace).\<close>
 lemma DK_fresh_not_KeyCryptKey:
-     "[| Key DK \<notin> used evs; evs \<in> set_cr |] ==> ~ KeyCryptKey DK K evs"
+     "[| Key DK \<notin> used evs; evs \<in> set_cr |] ==> \<not> KeyCryptKey DK K evs"
 apply (erule rev_mp)
 apply (erule set_cr.induct)
 apply (simp_all (no_asm_simp))
@@ -489,7 +489,7 @@
   DK isn't a private encryption key may be an artifact of the particular
   definition of KeyCryptKey.\<close>
 lemma K_fresh_not_KeyCryptKey:
-     "[|\<forall>C. DK \<noteq> priEK C; Key K \<notin> used evs|] ==> ~ KeyCryptKey DK K evs"
+     "[|\<forall>C. DK \<noteq> priEK C; Key K \<notin> used evs|] ==> \<not> KeyCryptKey DK K evs"
 apply (induct evs)
 apply (auto simp add: parts_insert2 split: event.split)
 done
@@ -499,17 +499,17 @@
   be known to the Spy, by @{term Spy_see_private_Key}\<close>
 lemma cardSK_neq_priEK:
      "[|Key cardSK \<notin> analz (knows Spy evs);
-        Key cardSK : parts (knows Spy evs);
+        Key cardSK \<in> parts (knows Spy evs);
         evs \<in> set_cr|] ==> cardSK \<noteq> priEK C"
 by blast
 
 lemma not_KeyCryptKey_cardSK [rule_format (no_asm)]:
      "[|cardSK \<notin> symKeys;  \<forall>C. cardSK \<noteq> priEK C;  evs \<in> set_cr|] ==>
-      Key cardSK \<notin> analz (knows Spy evs) --> ~ KeyCryptKey cardSK K evs"
+      Key cardSK \<notin> analz (knows Spy evs) \<longrightarrow> \<not> KeyCryptKey cardSK K evs"
 by (erule set_cr.induct, analz_mono_contra, auto)
 
 text\<open>Lemma for message 5: pubSK C is never used to encrypt Keys.\<close>
-lemma pubSK_not_KeyCryptKey [simp]: "~ KeyCryptKey (pubSK C) K evs"
+lemma pubSK_not_KeyCryptKey [simp]: "\<not> KeyCryptKey (pubSK C) K evs"
 apply (induct_tac "evs")
 apply (auto simp add: parts_insert2 split: event.split)
 done
@@ -523,14 +523,14 @@
           \<in> set evs;
         cardSK \<notin> symKeys;  evs \<in> set_cr|]
       ==> Key cardSK \<in> analz (knows Spy evs) |
-          (\<forall>K. ~ KeyCryptKey cardSK K evs)"
+          (\<forall>K. \<not> KeyCryptKey cardSK K evs)"
 by (blast dest: not_KeyCryptKey_cardSK intro: cardSK_neq_priEK)
 
 text\<open>As usual: we express the property as a logical equivalence\<close>
 lemma Key_analz_image_Key_lemma:
-     "P --> (Key K \<in> analz (Key`KK Un H)) --> (K \<in> KK | Key K \<in> analz H)
+     "P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) \<longrightarrow> (K \<in> KK | Key K \<in> analz H)
       ==>
-      P --> (Key K \<in> analz (Key`KK Un H)) = (K \<in> KK | Key K \<in> analz H)"
+      P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) = (K \<in> KK | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 method_setup valid_certificate_tac = \<open>
@@ -545,8 +545,8 @@
   the quantifier and allows the simprule's condition to itself be simplified.\<close>
 lemma symKey_compromise [rule_format (no_asm)]:
      "evs \<in> set_cr ==>
-      (\<forall>SK KK. SK \<in> symKeys \<longrightarrow> (\<forall>K \<in> KK. ~ KeyCryptKey K SK evs)   -->
-               (Key SK \<in> analz (Key`KK Un (knows Spy evs))) =
+      (\<forall>SK KK. SK \<in> symKeys \<longrightarrow> (\<forall>K \<in> KK. \<not> KeyCryptKey K SK evs)   \<longrightarrow>
+               (Key SK \<in> analz (Key`KK \<union> (knows Spy evs))) =
                (SK \<in> KK | Key SK \<in> analz (knows Spy evs)))"
 apply (erule set_cr.induct)
 apply (rule_tac [!] allI) +
@@ -572,9 +572,9 @@
   wrong!!\<close>
 lemma symKey_secrecy [rule_format]:
      "[|CA i \<notin> bad;  K \<in> symKeys;  evs \<in> set_cr|]
-      ==> \<forall>X c. Says (Cardholder c) (CA i) X \<in> set evs -->
-                Key K \<in> parts{X} -->
-                Cardholder c \<notin> bad -->
+      ==> \<forall>X c. Says (Cardholder c) (CA i) X \<in> set evs \<longrightarrow>
+                Key K \<in> parts{X} \<longrightarrow>
+                Cardholder c \<notin> bad \<longrightarrow>
                 Key K \<notin> analz (knows Spy evs)"
 apply (erule set_cr.induct)
 apply (frule_tac [8] Gets_certificate_valid) \<comment> \<open>for message 5\<close>
@@ -629,7 +629,7 @@
 
 lemma Hash_imp_parts [rule_format]:
      "evs \<in> set_cr
-      ==> Hash\<lbrace>X, Nonce N\<rbrace> \<in> parts (knows Spy evs) -->
+      ==> Hash\<lbrace>X, Nonce N\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
           Nonce N \<in> parts (knows Spy evs)"
 apply (erule set_cr.induct, force)
 apply (simp_all (no_asm_simp))
@@ -638,8 +638,8 @@
 
 lemma Hash_imp_parts2 [rule_format]:
      "evs \<in> set_cr
-      ==> Hash\<lbrace>X, Nonce M, Y, Nonce N\<rbrace> \<in> parts (knows Spy evs) -->
-          Nonce M \<in> parts (knows Spy evs) & Nonce N \<in> parts (knows Spy evs)"
+      ==> Hash\<lbrace>X, Nonce M, Y, Nonce N\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
+          Nonce M \<in> parts (knows Spy evs) \<and> Nonce N \<in> parts (knows Spy evs)"
 apply (erule set_cr.induct, force)
 apply (simp_all (no_asm_simp))
 apply (blast intro: parts_mono [THEN [2] rev_subsetD])
@@ -654,7 +654,7 @@
   (with respect to a given trace).\<close>
 lemma DK_fresh_not_KeyCryptNonce:
      "[| DK \<in> symKeys; Key DK \<notin> used evs; evs \<in> set_cr |]
-      ==> ~ KeyCryptNonce DK K evs"
+      ==> \<not> KeyCryptNonce DK K evs"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_cr.induct)
@@ -667,7 +667,7 @@
 text\<open>A fresh N cannot be associated with any other
       (with respect to a given trace).\<close>
 lemma N_fresh_not_KeyCryptNonce:
-     "\<forall>C. DK \<noteq> priEK C ==> Nonce N \<notin> used evs --> ~ KeyCryptNonce DK N evs"
+     "\<forall>C. DK \<noteq> priEK C ==> Nonce N \<notin> used evs \<longrightarrow> \<not> KeyCryptNonce DK N evs"
 apply (induct_tac "evs")
 apply (rename_tac [2] a evs')
 apply (case_tac [2] "a")
@@ -676,7 +676,7 @@
 
 lemma not_KeyCryptNonce_cardSK [rule_format (no_asm)]:
      "[|cardSK \<notin> symKeys;  \<forall>C. cardSK \<noteq> priEK C;  evs \<in> set_cr|] ==>
-      Key cardSK \<notin> analz (knows Spy evs) --> ~ KeyCryptNonce cardSK N evs"
+      Key cardSK \<notin> analz (knows Spy evs) \<longrightarrow> \<not> KeyCryptNonce cardSK N evs"
 apply (erule set_cr.induct, analz_mono_contra, simp_all)
 apply (blast dest: not_KeyCryptKey_cardSK)  \<comment> \<open>6\<close>
 done
@@ -686,7 +686,7 @@
   or else cardSK hasn't been used to encrypt K.\<close>
 
 text\<open>Lemma for message 5: pubSK C is never used to encrypt Nonces.\<close>
-lemma pubSK_not_KeyCryptNonce [simp]: "~ KeyCryptNonce (pubSK C) N evs"
+lemma pubSK_not_KeyCryptNonce [simp]: "\<not> KeyCryptNonce (pubSK C) N evs"
 apply (induct_tac "evs")
 apply (auto simp add: parts_insert2 split: event.split)
 done
@@ -698,16 +698,16 @@
           \<in> set evs;
         cardSK \<notin> symKeys;  evs \<in> set_cr|]
       ==> Key cardSK \<in> analz (knows Spy evs) |
-          ((\<forall>K. ~ KeyCryptKey cardSK K evs) &
-           (\<forall>N. ~ KeyCryptNonce cardSK N evs))"
+          ((\<forall>K. \<not> KeyCryptKey cardSK K evs) \<and>
+           (\<forall>N. \<not> KeyCryptNonce cardSK N evs))"
 by (blast dest: not_KeyCryptKey_cardSK not_KeyCryptNonce_cardSK
           intro: cardSK_neq_priEK)
 
 
 text\<open>As usual: we express the property as a logical equivalence\<close>
 lemma Nonce_analz_image_Key_lemma:
-     "P --> (Nonce N \<in> analz (Key`KK Un H)) --> (Nonce N \<in> analz H)
-      ==> P --> (Nonce N \<in> analz (Key`KK Un H)) = (Nonce N \<in> analz H)"
+     "P \<longrightarrow> (Nonce N \<in> analz (Key`KK \<union> H)) \<longrightarrow> (Nonce N \<in> analz H)
+      ==> P \<longrightarrow> (Nonce N \<in> analz (Key`KK \<union> H)) = (Nonce N \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 
@@ -715,8 +715,8 @@
   the quantifier and allows the simprule's condition to itself be simplified.\<close>
 lemma Nonce_compromise [rule_format (no_asm)]:
      "evs \<in> set_cr ==>
-      (\<forall>N KK. (\<forall>K \<in> KK. ~ KeyCryptNonce K N evs)   -->
-               (Nonce N \<in> analz (Key`KK Un (knows Spy evs))) =
+      (\<forall>N KK. (\<forall>K \<in> KK. \<not> KeyCryptNonce K N evs)   \<longrightarrow>
+               (Nonce N \<in> analz (Key`KK \<union> (knows Spy evs))) =
                (Nonce N \<in> analz (knows Spy evs)))"
 apply (erule set_cr.induct)
 apply (rule_tac [!] allI)+
@@ -766,9 +766,9 @@
      "[|U = Crypt KC3 \<lbrace>Agent C, Nonce N, Key KC2, X\<rbrace>;
         U \<in> parts (knows Spy evs);
         evs \<in> set_cr|]
-  ==> Nonce N \<notin> analz (knows Spy evs) -->
-      (\<exists>k i W. Says (Cardholder k) (CA i) \<lbrace>U,W\<rbrace> \<in> set evs & 
-               Cardholder k \<notin> bad & CA i \<notin> bad)"
+  ==> Nonce N \<notin> analz (knows Spy evs) \<longrightarrow>
+      (\<exists>k i W. Says (Cardholder k) (CA i) \<lbrace>U,W\<rbrace> \<in> set evs \<and> 
+               Cardholder k \<notin> bad \<and> CA i \<notin> bad)"
 apply (erule_tac P = "U \<in> H" for H in rev_mp)
 apply (erule set_cr.induct)
 apply (valid_certificate_tac [8])  \<comment> \<open>for message 5\<close>
@@ -791,9 +791,9 @@
 text\<open>Inductive version\<close>
 lemma CardSecret_secrecy_lemma [rule_format]:
      "[|CA i \<notin> bad;  evs \<in> set_cr|]
-      ==> Key K \<notin> analz (knows Spy evs) -->
+      ==> Key K \<notin> analz (knows Spy evs) \<longrightarrow>
           Crypt (pubEK (CA i)) \<lbrace>Key K, Pan p, Nonce CardSecret\<rbrace>
-             \<in> parts (knows Spy evs) -->
+             \<in> parts (knows Spy evs) \<longrightarrow>
           Nonce CardSecret \<notin> analz (knows Spy evs)"
 apply (erule set_cr.induct, analz_mono_contra)
 apply (valid_certificate_tac [8]) \<comment> \<open>for message 5\<close>
@@ -854,12 +854,12 @@
 text\<open>Inductive version\<close>
 lemma NonceCCA_secrecy_lemma [rule_format]:
      "[|CA i \<notin> bad;  evs \<in> set_cr|]
-      ==> Key K \<notin> analz (knows Spy evs) -->
+      ==> Key K \<notin> analz (knows Spy evs) \<longrightarrow>
           Crypt K
             \<lbrace>sign (priSK (CA i))
                    \<lbrace>Agent C, Nonce N, Agent(CA i), Nonce NonceCCA\<rbrace>,
               X, Y\<rbrace>
-             \<in> parts (knows Spy evs) -->
+             \<in> parts (knows Spy evs) \<longrightarrow>
           Nonce NonceCCA \<notin> analz (knows Spy evs)"
 apply (erule set_cr.induct, analz_mono_contra)
 apply (valid_certificate_tac [8]) \<comment> \<open>for message 5\<close>
@@ -921,14 +921,14 @@
 by auto
 
 lemma analz_image_pan_lemma:
-     "(Pan P \<in> analz (Key`nE Un H)) --> (Pan P \<in> analz H)  ==>
-      (Pan P \<in> analz (Key`nE Un H)) =   (Pan P \<in> analz H)"
+     "(Pan P \<in> analz (Key`nE \<union> H)) \<longrightarrow> (Pan P \<in> analz H)  ==>
+      (Pan P \<in> analz (Key`nE \<union> H)) =   (Pan P \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 lemma analz_image_pan [rule_format]:
      "evs \<in> set_cr ==>
-       \<forall>KK. KK <= - invKey ` pubEK ` range CA -->
-            (Pan P \<in> analz (Key`KK Un (knows Spy evs))) =
+       \<forall>KK. KK \<subseteq> - invKey ` pubEK ` range CA \<longrightarrow>
+            (Pan P \<in> analz (Key`KK \<union> (knows Spy evs))) =
             (Pan P \<in> analz (knows Spy evs))"
 apply (erule set_cr.induct)
 apply (rule_tac [!] allI impI)+
@@ -957,11 +957,11 @@
   this theorem with @{term analz_image_pan}, requiring a single induction but
   a much more difficult proof.\<close>
 lemma pan_confidentiality:
-     "[| Pan (pan C) \<in> analz(knows Spy evs); C \<noteq>Spy; evs :set_cr|]
+     "[| Pan (pan C) \<in> analz(knows Spy evs); C \<noteq>Spy; evs \<in> set_cr|]
     ==> \<exists>i X K HN.
         Says C (CA i) \<lbrace>X, Crypt (pubEK (CA i)) \<lbrace>Key K, Pan (pan C), HN\<rbrace> \<rbrace>
            \<in> set evs
-      & (CA i) \<in> bad"
+      \<and> (CA i) \<in> bad"
 apply (erule rev_mp)
 apply (erule set_cr.induct)
 apply (valid_certificate_tac [8]) \<comment> \<open>for message 5\<close>
@@ -1006,7 +1006,7 @@
             certC (pan C') cardSK X' onlySig (priSK (CA i)),
             cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>)
           \<in> set evs;
-        evs \<in> set_cr |] ==> C=C' & NC3=NC3' & X=X' & KC2=KC2' & Y=Y'"
+        evs \<in> set_cr |] ==> C=C' \<and> NC3=NC3' \<and> X=X' \<and> KC2=KC2' \<and> Y=Y'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_cr.induct)
@@ -1022,7 +1022,7 @@
           \<in> set evs;
         Says C B' \<lbrace>Crypt KC1 X', Crypt EK' \<lbrace>Key KC1, Y'\<rbrace>\<rbrace>
           \<in> set evs;
-        C \<notin> bad;  evs \<in> set_cr|] ==> B'=B & Y'=Y"
+        C \<notin> bad;  evs \<in> set_cr|] ==> B'=B \<and> Y'=Y"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_cr.induct, auto)
@@ -1032,7 +1032,7 @@
 lemma unique_KC2:
      "[|Says C B \<lbrace>Crypt K \<lbrace>Agent C, nn, Key KC2, X\<rbrace>, Y\<rbrace> \<in> set evs;
         Says C B' \<lbrace>Crypt K' \<lbrace>Agent C, nn', Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs;
-        C \<notin> bad;  evs \<in> set_cr|] ==> B'=B & X'=X"
+        C \<notin> bad;  evs \<in> set_cr|] ==> B'=B \<and> X'=X"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_cr.induct, auto)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SET_Protocol/Event_SET.thy
--- a/src/HOL/SET_Protocol/Event_SET.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SET_Protocol/Event_SET.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -34,11 +34,11 @@
 subsection\<open>Agents' Knowledge\<close>
 
 consts  (*Initial states of agents -- parameter of the construction*)
-  initState :: "agent => msg set"
+  initState :: "agent \<Rightarrow> msg set"
 
 (* Message reception does not extend spy's knowledge because of
    reception invariant enforced by Reception rule in protocol definition*)
-primrec knows :: "[agent, event list] => msg set"
+primrec knows :: "[agent, event list] \<Rightarrow> msg set"
 where
   knows_Nil:
     "knows A [] = initState A"
@@ -46,23 +46,23 @@
     "knows A (ev # evs) =
        (if A = Spy then
         (case ev of
-           Says A' B X => insert X (knows Spy evs)
-         | Gets A' X => knows Spy evs
-         | Notes A' X  =>
+           Says A' B X \<Rightarrow> insert X (knows Spy evs)
+         | Gets A' X \<Rightarrow> knows Spy evs
+         | Notes A' X  \<Rightarrow>
              if A' \<in> bad then insert X (knows Spy evs) else knows Spy evs)
         else
         (case ev of
-           Says A' B X =>
+           Says A' B X \<Rightarrow>
              if A'=A then insert X (knows A evs) else knows A evs
-         | Gets A' X    =>
+         | Gets A' X    \<Rightarrow>
              if A'=A then insert X (knows A evs) else knows A evs
-         | Notes A' X    =>
+         | Notes A' X    \<Rightarrow>
              if A'=A then insert X (knows A evs) else knows A evs))"
 
 
 subsection\<open>Used Messages\<close>
 
-primrec used :: "event list => msg set"
+primrec used :: "event list \<Rightarrow> msg set"
 where
   (*Set of items that might be visible to somebody:
     complement of the set of fresh items.
@@ -70,9 +70,9 @@
   used_Nil:  "used []         = (UN B. parts (initState B))"
 | used_Cons: "used (ev # evs) =
                  (case ev of
-                    Says A B X => parts {X} Un (used evs)
-                  | Gets A X   => used evs
-                  | Notes A X  => parts {X} Un (used evs))"
+                    Says A B X \<Rightarrow> parts {X} \<union> (used evs)
+                  | Gets A X   \<Rightarrow> used evs
+                  | Notes A X  \<Rightarrow> parts {X} \<union> (used evs))"
 
 
 
@@ -80,7 +80,7 @@
 be re-loaded. Addsimps [knows_Cons, used_Nil, *)
 
 (** Simplifying   parts (insert X (knows Spy evs))
-      = parts {X} Un parts (knows Spy evs) -- since general case loops*)
+      = parts {X} \<union> parts (knows Spy evs) -- since general case loops*)
 
 lemmas parts_insert_knows_A = parts_insert [of _ "knows A evs"] for A evs
 
@@ -92,33 +92,33 @@
       on whether @{term "A=Spy"} and whether @{term "A\<in>bad"}\<close>
 lemma knows_Spy_Notes [simp]:
      "knows Spy (Notes A X # evs) =
-          (if A:bad then insert X (knows Spy evs) else knows Spy evs)"
+          (if A\<in>bad then insert X (knows Spy evs) else knows Spy evs)"
 apply auto
 done
 
 lemma knows_Spy_Gets [simp]: "knows Spy (Gets A X # evs) = knows Spy evs"
 by auto
 
-lemma initState_subset_knows: "initState A <= knows A evs"
+lemma initState_subset_knows: "initState A \<subseteq> knows A evs"
 apply (induct_tac "evs")
 apply (auto split: event.split) 
 done
 
 lemma knows_Spy_subset_knows_Spy_Says:
-     "knows Spy evs <= knows Spy (Says A B X # evs)"
+     "knows Spy evs \<subseteq> knows Spy (Says A B X # evs)"
 by auto
 
 lemma knows_Spy_subset_knows_Spy_Notes:
-     "knows Spy evs <= knows Spy (Notes A X # evs)"
+     "knows Spy evs \<subseteq> knows Spy (Notes A X # evs)"
 by auto
 
 lemma knows_Spy_subset_knows_Spy_Gets:
-     "knows Spy evs <= knows Spy (Gets A X # evs)"
+     "knows Spy evs \<subseteq> knows Spy (Gets A X # evs)"
 by auto
 
 (*Spy sees what is sent on the traffic*)
 lemma Says_imp_knows_Spy [rule_format]:
-     "Says A B X \<in> set evs --> X \<in> knows Spy evs"
+     "Says A B X \<in> set evs \<longrightarrow> X \<in> knows Spy evs"
 apply (induct_tac "evs")
 apply (auto split: event.split) 
 done
@@ -132,24 +132,24 @@
 
 subsection\<open>The Function @{term used}\<close>
 
-lemma parts_knows_Spy_subset_used: "parts (knows Spy evs) <= used evs"
+lemma parts_knows_Spy_subset_used: "parts (knows Spy evs) \<subseteq> used evs"
 apply (induct_tac "evs")
 apply (auto simp add: parts_insert_knows_A split: event.split) 
 done
 
 lemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]
 
-lemma initState_subset_used: "parts (initState B) <= used evs"
+lemma initState_subset_used: "parts (initState B) \<subseteq> used evs"
 apply (induct_tac "evs")
 apply (auto split: event.split) 
 done
 
 lemmas initState_into_used = initState_subset_used [THEN subsetD]
 
-lemma used_Says [simp]: "used (Says A B X # evs) = parts{X} Un used evs"
+lemma used_Says [simp]: "used (Says A B X # evs) = parts{X} \<union> used evs"
 by auto
 
-lemma used_Notes [simp]: "used (Notes A X # evs) = parts{X} Un used evs"
+lemma used_Notes [simp]: "used (Notes A X # evs) = parts{X} \<union> used evs"
 by auto
 
 lemma used_Gets [simp]: "used (Gets A X # evs) = used evs"
@@ -157,7 +157,7 @@
 
 
 lemma Notes_imp_parts_subset_used [rule_format]:
-     "Notes A X \<in> set evs --> parts {X} <= used evs"
+     "Notes A X \<in> set evs \<longrightarrow> parts {X} \<subseteq> used evs"
 apply (induct_tac "evs")
 apply (rename_tac [2] a evs')
 apply (induct_tac [2] "a", auto)
@@ -168,7 +168,7 @@
         used_Nil [simp del] used_Cons [simp del]
 
 
-text\<open>For proving theorems of the form @{term "X \<notin> analz (knows Spy evs) --> P"}
+text\<open>For proving theorems of the form @{term "X \<notin> analz (knows Spy evs) \<longrightarrow> P"}
   New events added by induction to "evs" are discarded.  Provided 
   this information isn't needed, the proof will be much shorter, since
   it will omit complicated reasoning about @{term analz}.\<close>
@@ -190,6 +190,6 @@
 
 method_setup analz_mono_contra = \<open>
     Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt)))\<close>
-    "for proving theorems of the form X \<notin> analz (knows Spy evs) --> P"
+    "for proving theorems of the form X \<notin> analz (knows Spy evs) \<longrightarrow> P"
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SET_Protocol/Merchant_Registration.thy
--- a/src/HOL/SET_Protocol/Merchant_Registration.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SET_Protocol/Merchant_Registration.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -182,14 +182,14 @@
      "[| Gets A \<lbrace> X, cert (CA i) EKi onlyEnc (priSK RCA),
                       cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs;
          evs \<in> set_mr |]
-      ==> EKi = pubEK (CA i) & SKi = pubSK (CA i)"
+      ==> EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)"
 by (blast dest: certificate_valid_pubEK certificate_valid_pubSK)
 
 
 text\<open>Nobody can have used non-existent keys!\<close>
 lemma new_keys_not_used [rule_format,simp]:
      "evs \<in> set_mr
-      ==> Key K \<notin> used evs --> K \<in> symKeys -->
+      ==> Key K \<notin> used evs \<longrightarrow> K \<in> symKeys \<longrightarrow>
           K \<notin> keysFor (parts (knows Spy evs))"
 apply (erule set_mr.induct, simp_all)
 apply (force dest!: usedI keysFor_parts_insert)  \<comment> \<open>Fake\<close>
@@ -203,13 +203,13 @@
 
 lemma gen_new_keys_not_used [rule_format]:
      "evs \<in> set_mr
-      ==> Key K \<notin> used evs --> K \<in> symKeys -->
-          K \<notin> keysFor (parts (Key`KK Un knows Spy evs))"
+      ==> Key K \<notin> used evs \<longrightarrow> K \<in> symKeys \<longrightarrow>
+          K \<notin> keysFor (parts (Key`KK \<union> knows Spy evs))"
 by auto
 
 lemma gen_new_keys_not_analzd:
      "[|Key K \<notin> used evs; K \<in> symKeys; evs \<in> set_mr |]
-      ==> K \<notin> keysFor (analz (Key`KK Un knows Spy evs))"
+      ==> K \<notin> keysFor (analz (Key`KK \<union> knows Spy evs))"
 by (blast intro: keysFor_mono [THEN [2] rev_subsetD]
           dest: gen_new_keys_not_used)
 
@@ -236,14 +236,14 @@
 for other keys aren't needed.\<close>
 
 lemma parts_image_priEK:
-     "[|Key (priEK (CA i)) \<in> parts (Key`KK Un (knows Spy evs));
+     "[|Key (priEK (CA i)) \<in> parts (Key`KK \<union> (knows Spy evs));
         evs \<in> set_mr|] ==> priEK (CA i) \<in> KK | CA i \<in> bad"
 by auto
 
 text\<open>trivial proof because (priEK (CA i)) never appears even in (parts evs)\<close>
 lemma analz_image_priEK:
      "evs \<in> set_mr ==>
-          (Key (priEK (CA i)) \<in> analz (Key`KK Un (knows Spy evs))) =
+          (Key (priEK (CA i)) \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (priEK (CA i) \<in> KK | CA i \<in> bad)"
 by (blast dest!: parts_image_priEK intro: analz_mono [THEN [2] rev_subsetD])
 
@@ -266,22 +266,22 @@
                  Y\<rbrace> \<in> set evs;
         evs \<in> set_mr|]
   ==> (Key merSK \<in> analz (knows Spy evs) | merSK \<notin> range(\<lambda>C. priEK C))
-   &  (Key merEK \<in> analz (knows Spy evs) | merEK \<notin> range(\<lambda>C. priEK C))"
+   \<and>  (Key merEK \<in> analz (knows Spy evs) | merEK \<notin> range(\<lambda>C. priEK C))"
 apply (unfold sign_def)
 apply (blast dest: merK_neq_priEK)
 done
 
 
 lemma Key_analz_image_Key_lemma:
-     "P --> (Key K \<in> analz (Key`KK Un H)) --> (K\<in>KK | Key K \<in> analz H)
+     "P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) \<longrightarrow> (K\<in>KK | Key K \<in> analz H)
       ==>
-      P --> (Key K \<in> analz (Key`KK Un H)) = (K\<in>KK | Key K \<in> analz H)"
+      P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) = (K\<in>KK | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 lemma symKey_compromise:
      "evs \<in> set_mr ==>
-      (\<forall>SK KK. SK \<in> symKeys \<longrightarrow> (\<forall>K \<in> KK. K \<notin> range(\<lambda>C. priEK C)) -->
-               (Key SK \<in> analz (Key`KK Un (knows Spy evs))) =
+      (\<forall>SK KK. SK \<in> symKeys \<longrightarrow> (\<forall>K \<in> KK. K \<notin> range(\<lambda>C. priEK C)) \<longrightarrow>
+               (Key SK \<in> analz (Key`KK \<union> (knows Spy evs))) =
                (SK \<in> KK | Key SK \<in> analz (knows Spy evs)))"
 apply (erule set_mr.induct)
 apply (safe del: impI intro!: Key_analz_image_Key_lemma [THEN impI])
@@ -299,9 +299,9 @@
 
 lemma symKey_secrecy [rule_format]:
      "[|CA i \<notin> bad; K \<in> symKeys;  evs \<in> set_mr|]
-      ==> \<forall>X m. Says (Merchant m) (CA i) X \<in> set evs -->
-                Key K \<in> parts{X} -->
-                Merchant m \<notin> bad -->
+      ==> \<forall>X m. Says (Merchant m) (CA i) X \<in> set evs \<longrightarrow>
+                Key K \<in> parts{X} \<longrightarrow>
+                Merchant m \<notin> bad \<longrightarrow>
                 Key K \<notin> analz (knows Spy evs)"
 apply (erule set_mr.induct)
 apply (drule_tac [7] msg4_priEK_disj)
@@ -326,7 +326,7 @@
                     cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs;
     evs \<in> set_mr |]
   ==> Notes (CA i) (Key merSK) \<in> set evs
-   &  Notes (CA i) (Key merEK) \<in> set evs"
+   \<and>  Notes (CA i) (Key merEK) \<in> set evs"
 apply (erule rev_mp)
 apply (erule set_mr.induct)
 apply (simp_all (no_asm_simp))
@@ -343,7 +343,7 @@
                     cert  M'      merSK    onlySig (priSK (CA i)),
                     cert  M'      merEK'    onlyEnc (priSK (CA i)),
                     cert (CA i) (pubSK(CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs;
-    evs \<in> set_mr |] ==> M=M' & NM2=NM2' & merEK=merEK'"
+    evs \<in> set_mr |] ==> M=M' \<and> NM2=NM2' \<and> merEK=merEK'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_mr.induct)
@@ -363,7 +363,7 @@
                      cert  M'      merEK    onlyEnc (priSK (CA i)),
                      cert (CA i) (pubSK(CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs;
     evs \<in> set_mr |] 
-  ==> M=M' & NM2=NM2' & merSK=merSK'"
+  ==> M=M' \<and> NM2=NM2' \<and> merSK=merSK'"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_mr.induct)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SET_Protocol/Message_SET.thy
--- a/src/HOL/SET_Protocol/Message_SET.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SET_Protocol/Message_SET.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -27,7 +27,7 @@
 by blast
 
 text\<open>Effective with the assumption @{term "KK \<subseteq> - (range(invKey o pubK))"}\<close>
-lemma disjoint_image_iff: "(A <= - (f`I)) = (\<forall>i\<in>I. f i \<notin> A)"
+lemma disjoint_image_iff: "(A \<subseteq> - (f`I)) = (\<forall>i\<in>I. f i \<notin> A)"
 by blast
 
 
@@ -36,11 +36,11 @@
 
 consts
   all_symmetric :: bool        \<comment> \<open>true if all keys are symmetric\<close>
-  invKey        :: "key=>key"  \<comment> \<open>inverse of a symmetric key\<close>
+  invKey        :: "key\<Rightarrow>key"  \<comment> \<open>inverse of a symmetric key\<close>
 
 specification (invKey)
   invKey [simp]: "invKey (invKey K) = K"
-  invKey_symmetric: "all_symmetric --> invKey = id"
+  invKey_symmetric: "all_symmetric \<longrightarrow> invKey = id"
     by (rule exI [of _ id], auto)
 
 
@@ -69,13 +69,13 @@
 
 (*Concrete syntax: messages appear as \<open>\<lbrace>A,B,NA\<rbrace>\<close>, etc...*)
 syntax
-  "_MTuple"      :: "['a, args] => 'a * 'b"       ("(2\<lbrace>_,/ _\<rbrace>)")
+  "_MTuple"      :: "['a, args] \<Rightarrow> 'a * 'b"       ("(2\<lbrace>_,/ _\<rbrace>)")
 translations
   "\<lbrace>x, y, z\<rbrace>"   == "\<lbrace>x, \<lbrace>y, z\<rbrace>\<rbrace>"
   "\<lbrace>x, y\<rbrace>"      == "CONST MPair x y"
 
 
-definition nat_of_agent :: "agent => nat" where
+definition nat_of_agent :: "agent \<Rightarrow> nat" where
    "nat_of_agent == case_agent (curry prod_encode 0)
                                (curry prod_encode 1)
                                (curry prod_encode 2)
@@ -90,13 +90,13 @@
 
 definition
   (*Keys useful to decrypt elements of a message set*)
-  keysFor :: "msg set => key set"
+  keysFor :: "msg set \<Rightarrow> key set"
   where "keysFor H = invKey ` {K. \<exists>X. Crypt K X \<in> H}"
 
 subsubsection\<open>Inductive definition of all "parts" of a message.\<close>
 
 inductive_set
-  parts :: "msg set => msg set"
+  parts :: "msg set \<Rightarrow> msg set"
   for H :: "msg set"
   where
     Inj [intro]:               "X \<in> H ==> X \<in> parts H"
@@ -106,7 +106,7 @@
 
 
 (*Monotonicity*)
-lemma parts_mono: "G<=H ==> parts(G) <= parts(H)"
+lemma parts_mono: "G\<subseteq>H ==> parts(G) \<subseteq> parts(H)"
 apply auto
 apply (erule parts.induct)
 apply (auto dest: Fst Snd Body)
@@ -363,7 +363,7 @@
 
 
 (*In any message, there is an upper bound N on its greatest nonce.*)
-lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n --> Nonce n \<notin> parts {msg}"
+lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Nonce n \<notin> parts {msg}"
 apply (induct_tac "msg")
 apply (simp_all (no_asm_simp) add: exI parts_insert2)
 (*MPair case: blast_tac works out the necessary sum itself!*)
@@ -375,7 +375,7 @@
 done
 
 (* Ditto, for numbers.*)
-lemma msg_Number_supply: "\<exists>N. \<forall>n. N<=n --> Number n \<notin> parts {msg}"
+lemma msg_Number_supply: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Number n \<notin> parts {msg}"
 apply (induct_tac "msg")
 apply (simp_all (no_asm_simp) add: exI parts_insert2)
 prefer 2 apply (blast elim!: add_leE)
@@ -397,11 +397,11 @@
   | Fst:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> X \<in> analz H"
   | Snd:     "\<lbrace>X,Y\<rbrace> \<in> analz H ==> Y \<in> analz H"
   | Decrypt [dest]:
-             "[|Crypt K X \<in> analz H; Key(invKey K): analz H|] ==> X \<in> analz H"
+             "[|Crypt K X \<in> analz H; Key(invKey K) \<in> analz H|] ==> X \<in> analz H"
 
 
 (*Monotonicity; Lemma 1 of Lowe's paper*)
-lemma analz_mono: "G<=H ==> analz(G) <= analz(H)"
+lemma analz_mono: "G\<subseteq>H ==> analz(G) \<subseteq> analz(H)"
 apply auto
 apply (erule analz.induct)
 apply (auto dest: Fst Snd)
@@ -584,7 +584,7 @@
 by (erule analz_trans, blast)
 
 (*Cut can be proved easily by induction on
-   "Y: analz (insert X H) ==> X: analz H --> Y: analz H"
+   "Y: analz (insert X H) ==> X: analz H \<longrightarrow> Y: analz H"
 *)
 
 (*This rewrite rule helps in the simplification of messages that involve
@@ -639,7 +639,7 @@
     Numbers can be guessed, but Nonces cannot be.\<close>
 
 inductive_set
-  synth :: "msg set => msg set"
+  synth :: "msg set \<Rightarrow> msg set"
   for H :: "msg set"
   where
     Inj    [intro]:   "X \<in> H ==> X \<in> synth H"
@@ -650,7 +650,7 @@
   | Crypt  [intro]:   "[|X \<in> synth H;  Key(K) \<in> H|] ==> Crypt K X \<in> synth H"
 
 (*Monotonicity*)
-lemma synth_mono: "G<=H ==> synth(G) <= synth(H)"
+lemma synth_mono: "G\<subseteq>H ==> synth(G) \<subseteq> synth(H)"
 apply auto
 apply (erule synth.induct)
 apply (auto dest: Fst Snd Body)
@@ -760,7 +760,7 @@
 done
 
 lemma Fake_parts_insert_in_Un:
-     "[|Z \<in> parts (insert X H);  X: synth (analz H)|] 
+     "[|Z \<in> parts (insert X H);  X \<in> synth (analz H)|] 
       ==> Z \<in>  synth (analz H) \<union> parts H"
 by (blast dest: Fake_parts_insert [THEN subsetD, dest])
 
@@ -776,7 +776,7 @@
 done
 
 lemma analz_conj_parts [simp]:
-     "(X \<in> analz H & X \<in> parts H) = (X \<in> analz H)"
+     "(X \<in> analz H \<and> X \<in> parts H) = (X \<in> analz H)"
 by (blast intro: analz_subset_parts [THEN subsetD])
 
 lemma analz_disj_parts [simp]:
@@ -787,7 +787,7 @@
   redundant cases*)
 lemma MPair_synth_analz [iff]:
      "(\<lbrace>X,Y\<rbrace> \<in> synth (analz H)) =
-      (X \<in> synth (analz H) & Y \<in> synth (analz H))"
+      (X \<in> synth (analz H) \<and> Y \<in> synth (analz H))"
 by blast
 
 lemma Crypt_synth_analz:
@@ -889,7 +889,7 @@
 lemma Hash_notin_image_Key [simp] :"Hash X \<notin> Key ` A"
 by auto
 
-lemma synth_analz_mono: "G<=H ==> synth (analz(G)) <= synth (analz(H))"
+lemma synth_analz_mono: "G\<subseteq>H ==> synth (analz(G)) \<subseteq> synth (analz(H))"
 by (simp add: synth_mono analz_mono)
 
 lemma Fake_analz_eq [simp]:
@@ -903,12 +903,12 @@
 
 text\<open>Two generalizations of \<open>analz_insert_eq\<close>\<close>
 lemma gen_analz_insert_eq [rule_format]:
-     "X \<in> analz H ==> ALL G. H \<subseteq> G --> analz (insert X G) = analz G"
+     "X \<in> analz H ==> \<forall>G. H \<subseteq> G \<longrightarrow> analz (insert X G) = analz G"
 by (blast intro: analz_cut analz_insertI analz_mono [THEN [2] rev_subsetD])
 
 lemma synth_analz_insert_eq [rule_format]:
      "X \<in> synth (analz H)
-      ==> ALL G. H \<subseteq> G --> (Key K \<in> analz (insert X G)) = (Key K \<in> analz G)"
+      \<Longrightarrow> \<forall>G. H \<subseteq> G \<longrightarrow> (Key K \<in> analz (insert X G)) = (Key K \<in> analz G)"
 apply (erule synth.induct)
 apply (simp_all add: gen_analz_insert_eq subset_trans [OF _ subset_insertI])
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SET_Protocol/Public_SET.thy
--- a/src/HOL/SET_Protocol/Public_SET.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SET_Protocol/Public_SET.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -20,7 +20,7 @@
 text\<open>The SET specs mention two signature keys for CAs - we only have one\<close>
 
 consts
-  publicKey :: "[bool, agent] => key"
+  publicKey :: "[bool, agent] \<Rightarrow> key"
     \<comment> \<open>the boolean is TRUE if a signing key\<close>
 
 abbreviation "pubEK == publicKey False"
@@ -35,7 +35,7 @@
 
 specification (publicKey)
   injective_publicKey:
-    "publicKey b A = publicKey c A' ==> b=c & A=A'"
+    "publicKey b A = publicKey c A' \<Longrightarrow> b=c \<and> A=A'"
 (*<*)
    apply (rule exI [of _ "%b A. 2 * nat_of_agent A + (if b then 1 else 0)"]) 
    apply (auto simp add: inj_on_def inj_nat_of_agent [THEN inj_eq] split: agent.split) 
@@ -72,8 +72,8 @@
 (*<*)
   initState_CA:
     "initState (CA i)  =
-       (if i=0 then Key ` ({priEK RCA, priSK RCA} Un
-                            pubEK ` (range CA) Un pubSK ` (range CA))
+       (if i=0 then Key ` ({priEK RCA, priSK RCA} \<union>
+                            pubEK ` (range CA) \<union> pubSK ` (range CA))
         else {Key (priEK (CA i)), Key (priSK (CA i)),
               Key (pubEK (CA i)), Key (pubSK (CA i)),
               Key (pubEK RCA), Key (pubSK RCA)})"
@@ -97,16 +97,16 @@
         Key (pubEK RCA), Key (pubSK RCA)}"
 (*>*)
 | initState_Spy:
-    "initState Spy = Key ` (invKey ` pubEK ` bad Un
-                            invKey ` pubSK ` bad Un
-                            range pubEK Un range pubSK)"
+    "initState Spy = Key ` (invKey ` pubEK ` bad \<union>
+                            invKey ` pubSK ` bad \<union>
+                            range pubEK \<union> range pubSK)"
 
 end
 
 
 text\<open>Injective mapping from agents to PANs: an agent can have only one card\<close>
 
-consts  pan :: "agent => nat"
+consts  pan :: "agent \<Rightarrow> nat"
 
 specification (pan)
   inj_pan: "inj pan"
@@ -120,24 +120,24 @@
 declare inj_pan [THEN inj_eq, iff]
 
 consts
-  XOR :: "nat*nat => nat"  \<comment> \<open>no properties are assumed of exclusive-or\<close>
+  XOR :: "nat*nat \<Rightarrow> nat"  \<comment> \<open>no properties are assumed of exclusive-or\<close>
 
 
 subsection\<open>Signature Primitives\<close>
 
 definition
  (* Signature = Message + signed Digest *)
-  sign :: "[key, msg]=>msg"
+  sign :: "[key, msg]\<Rightarrow>msg"
   where "sign K X = \<lbrace>X, Crypt K (Hash X) \<rbrace>"
 
 definition
  (* Signature Only = signed Digest Only *)
-  signOnly :: "[key, msg]=>msg"
+  signOnly :: "[key, msg]\<Rightarrow>msg"
   where "signOnly K X = Crypt K (Hash X)"
 
 definition
  (* Signature for Certificates = Message + signed Message *)
-  signCert :: "[key, msg]=>msg"
+  signCert :: "[key, msg]\<Rightarrow>msg"
   where "signCert K X = \<lbrace>X, Crypt K X \<rbrace>"
 
 definition
@@ -148,7 +148,7 @@
     Should prove if signK=priSK RCA and C=CA i,
                   then Ka=pubEK i or pubSK i depending on T  ??
  *)
-  cert :: "[agent, key, msg, key] => msg"
+  cert :: "[agent, key, msg, key] \<Rightarrow> msg"
   where "cert A Ka T signK = signCert signK \<lbrace>Agent A, Key Ka, T\<rbrace>"
 
 definition
@@ -156,7 +156,7 @@
     Contains a PAN, the certified key Ka, the PANSecret PS,
     a number specifying the target use for Ka, the signing key signK.
  *)
-  certC :: "[nat, key, nat, msg, key] => msg"
+  certC :: "[nat, key, nat, msg, key] \<Rightarrow> msg"
   where "certC PAN Ka PS T signK =
     signCert signK \<lbrace>Hash \<lbrace>Nonce PS, Pan PAN\<rbrace>, Key Ka, T\<rbrace>"
 
@@ -169,19 +169,19 @@
 
 subsection\<open>Encryption Primitives\<close>
 
-definition EXcrypt :: "[key,key,msg,msg] => msg" where
+definition EXcrypt :: "[key,key,msg,msg] \<Rightarrow> msg" where
   \<comment> \<open>Extra Encryption\<close>
     (*K: the symmetric key   EK: the public encryption key*)
     "EXcrypt K EK M m =
        \<lbrace>Crypt K \<lbrace>M, Hash m\<rbrace>, Crypt EK \<lbrace>Key K, m\<rbrace>\<rbrace>"
 
-definition EXHcrypt :: "[key,key,msg,msg] => msg" where
+definition EXHcrypt :: "[key,key,msg,msg] \<Rightarrow> msg" where
   \<comment> \<open>Extra Encryption with Hashing\<close>
     (*K: the symmetric key   EK: the public encryption key*)
     "EXHcrypt K EK M m =
        \<lbrace>Crypt K \<lbrace>M, Hash m\<rbrace>, Crypt EK \<lbrace>Key K, m, Hash M\<rbrace>\<rbrace>"
 
-definition Enc :: "[key,key,key,msg] => msg" where
+definition Enc :: "[key,key,key,msg] \<Rightarrow> msg" where
   \<comment> \<open>Simple Encapsulation with SIGNATURE\<close>
     (*SK: the sender's signing key
       K: the symmetric key
@@ -189,7 +189,7 @@
     "Enc SK K EK M =
        \<lbrace>Crypt K (sign SK M), Crypt EK (Key K)\<rbrace>"
 
-definition EncB :: "[key,key,key,msg,msg] => msg" where
+definition EncB :: "[key,key,key,msg,msg] \<Rightarrow> msg" where
   \<comment> \<open>Encapsulation with Baggage.  Keys as above, and baggage b.\<close>
     "EncB SK K EK M b =
        \<lbrace>Enc SK K EK \<lbrace>M, Hash b\<rbrace>, b\<rbrace>"
@@ -198,11 +198,11 @@
 subsection\<open>Basic Properties of pubEK, pubSK, priEK and priSK\<close>
 
 lemma publicKey_eq_iff [iff]:
-     "(publicKey b A = publicKey b' A') = (b=b' & A=A')"
+     "(publicKey b A = publicKey b' A') = (b=b' \<and> A=A')"
 by (blast dest: injective_publicKey)
 
 lemma privateKey_eq_iff [iff]:
-     "(invKey (publicKey b A) = invKey (publicKey b' A')) = (b=b' & A=A')"
+     "(invKey (publicKey b A) = invKey (publicKey b' A')) = (b=b' \<and> A=A')"
 by auto
 
 lemma not_symKeys_publicKey [iff]: "publicKey b A \<notin> symKeys"
@@ -211,28 +211,28 @@
 lemma not_symKeys_privateKey [iff]: "invKey (publicKey b A) \<notin> symKeys"
 by (simp add: symKeys_def)
 
-lemma symKeys_invKey_eq [simp]: "K \<in> symKeys ==> invKey K = K"
+lemma symKeys_invKey_eq [simp]: "K \<in> symKeys \<Longrightarrow> invKey K = K"
 by (simp add: symKeys_def)
 
 lemma symKeys_invKey_iff [simp]: "(invKey K \<in> symKeys) = (K \<in> symKeys)"
 by (unfold symKeys_def, auto)
 
 text\<open>Can be slow (or even loop) as a simprule\<close>
-lemma symKeys_neq_imp_neq: "(K \<in> symKeys) \<noteq> (K' \<in> symKeys) ==> K \<noteq> K'"
+lemma symKeys_neq_imp_neq: "(K \<in> symKeys) \<noteq> (K' \<in> symKeys) \<Longrightarrow> K \<noteq> K'"
 by blast
 
 text\<open>These alternatives to \<open>symKeys_neq_imp_neq\<close> don't seem any better
 in practice.\<close>
-lemma publicKey_neq_symKey: "K \<in> symKeys ==> publicKey b A \<noteq> K"
+lemma publicKey_neq_symKey: "K \<in> symKeys \<Longrightarrow> publicKey b A \<noteq> K"
 by blast
 
-lemma symKey_neq_publicKey: "K \<in> symKeys ==> K \<noteq> publicKey b A"
+lemma symKey_neq_publicKey: "K \<in> symKeys \<Longrightarrow> K \<noteq> publicKey b A"
 by blast
 
-lemma privateKey_neq_symKey: "K \<in> symKeys ==> invKey (publicKey b A) \<noteq> K"
+lemma privateKey_neq_symKey: "K \<in> symKeys \<Longrightarrow> invKey (publicKey b A) \<noteq> K"
 by blast
 
-lemma symKey_neq_privateKey: "K \<in> symKeys ==> K \<noteq> invKey (publicKey b A)"
+lemma symKey_neq_privateKey: "K \<in> symKeys \<Longrightarrow> K \<noteq> invKey (publicKey b A)"
 by blast
 
 lemma analz_symKeys_Decrypt:
@@ -248,11 +248,11 @@
 
 text\<open>holds because invKey is injective\<close>
 lemma publicKey_image_eq [iff]:
-     "(publicKey b A \<in> publicKey c ` AS) = (b=c & A\<in>AS)"
+     "(publicKey b A \<in> publicKey c ` AS) = (b=c \<and> A\<in>AS)"
 by auto
 
 lemma privateKey_image_eq [iff]:
-     "(invKey (publicKey b A) \<in> invKey ` publicKey c ` AS) = (b=c & A\<in>AS)"
+     "(invKey (publicKey b A) \<in> invKey ` publicKey c ` AS) = (b=c \<and> A\<in>AS)"
 by auto
 
 lemma privateKey_notin_image_publicKey [iff]:
@@ -308,7 +308,7 @@
 
 text\<open>Spy sees private keys of bad agents! [and obviously public keys too]\<close>
 lemma knows_Spy_bad_privateKey [intro!]:
-     "A \<in> bad ==> Key (invKey (publicKey b A)) \<in> knows Spy evs"
+     "A \<in> bad \<Longrightarrow> Key (invKey (publicKey b A)) \<in> knows Spy evs"
 by (rule initState_subset_knows [THEN subsetD], simp)
 
 
@@ -321,7 +321,7 @@
 by (simp add: used_Nil)
 
 text\<open>In any trace, there is an upper bound N on the greatest nonce in use.\<close>
-lemma Nonce_supply_lemma: "\<exists>N. \<forall>n. N<=n --> Nonce n \<notin> used evs"
+lemma Nonce_supply_lemma: "\<exists>N. \<forall>n. N\<le>n \<longrightarrow> Nonce n \<notin> used evs"
 apply (induct_tac "evs")
 apply (rule_tac x = 0 in exI)
 apply (simp_all add: used_Cons split: event.split, safe)
@@ -331,7 +331,7 @@
 lemma Nonce_supply1: "\<exists>N. Nonce N \<notin> used evs"
 by (rule Nonce_supply_lemma [THEN exE], blast)
 
-lemma Nonce_supply: "Nonce (@ N. Nonce N \<notin> used evs) \<notin> used evs"
+lemma Nonce_supply: "Nonce (SOME N. Nonce N \<notin> used evs) \<notin> used evs"
 apply (rule Nonce_supply_lemma [THEN exE])
 apply (rule someI, fast)
 done
@@ -369,11 +369,11 @@
 
 subsection\<open>Specialized Rewriting for Theorems About @{term analz} and Image\<close>
 
-lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} Un H"
+lemma insert_Key_singleton: "insert (Key K) H = Key ` {K} \<union> H"
 by blast
 
 lemma insert_Key_image:
-     "insert (Key K) (Key`KK Un C) = Key ` (insert K KK) Un C"
+     "insert (Key K) (Key`KK \<union> C) = Key ` (insert K KK) \<union> C"
 by blast
 
 text\<open>Needed for \<open>DK_fresh_not_KeyCryptKey\<close>\<close>
@@ -398,16 +398,16 @@
 
 text\<open>A set is expanded only if a relation is applied to it\<close>
 lemma def_abbrev_simp_relation:
-     "A = B ==> (A \<in> X) = (B \<in> X) &  
-                 (u = A) = (u = B) &  
+     "A = B \<Longrightarrow> (A \<in> X) = (B \<in> X) \<and>  
+                 (u = A) = (u = B) \<and>  
                  (A = u) = (B = u)"
 by auto
 
 text\<open>A set is expanded only if one of the given functions is applied to it\<close>
 lemma def_abbrev_simp_function:
      "A = B  
-      ==> parts (insert A X) = parts (insert B X) &  
-          analz (insert A X) = analz (insert B X) &  
+      \<Longrightarrow> parts (insert A X) = parts (insert B X) \<and>  
+          analz (insert A X) = analz (insert B X) \<and>  
           keysFor (insert A X) = keysFor (insert B X)"
 by auto
 
@@ -516,7 +516,7 @@
 by auto
 
 lemma fresh_notin_analz_knows_Spy:
-     "Key K \<notin> used evs ==> Key K \<notin> analz (knows Spy evs)"
+     "Key K \<notin> used evs \<Longrightarrow> Key K \<notin> analz (knows Spy evs)"
 by (auto dest: analz_into_parts)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SET_Protocol/Purchase.thy
--- a/src/HOL/SET_Protocol/Purchase.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SET_Protocol/Purchase.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -53,11 +53,11 @@
 
 consts
 
-    CardSecret :: "nat => nat"
+    CardSecret :: "nat \<Rightarrow> nat"
      \<comment> \<open>Maps Cardholders to CardSecrets.
          A CardSecret of 0 means no cerificate, must use unsigned format.\<close>
 
-    PANSecret :: "nat => nat"
+    PANSecret :: "nat \<Rightarrow> nat"
      \<comment> \<open>Maps Cardholders to PANSecrets.\<close>
 
 inductive_set
@@ -192,7 +192,7 @@
        HOD = Hash\<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>;
        OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD,
                   Nonce Chall_M\<rbrace>;
-       CardSecret k \<noteq> 0 -->
+       CardSecret k \<noteq> 0 \<longrightarrow>
          P_I = \<lbrace>sign (priSK C) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>;
        Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq;
        Says M C (sign (priSK M) \<lbrace>Number LID_M, Number XID,
@@ -427,7 +427,7 @@
 
 text\<open>rewriting rule for priEK's\<close>
 lemma parts_image_priEK:
-     "[|Key (priEK C) \<in> parts (Key`KK Un (knows Spy evs));
+     "[|Key (priEK C) \<in> parts (Key`KK \<union> (knows Spy evs));
         evs \<in> set_pur|] ==> priEK C \<in> KK | C \<in> bad"
 by auto
 
@@ -435,7 +435,7 @@
   @{term "parts evs"}.\<close>
 lemma analz_image_priEK:
      "evs \<in> set_pur ==>
-          (Key (priEK C) \<in> analz (Key`KK Un (knows Spy evs))) =
+          (Key (priEK C) \<in> analz (Key`KK \<union> (knows Spy evs))) =
           (priEK C \<in> KK | C \<in> bad)"
 by (blast dest!: parts_image_priEK intro: analz_mono [THEN [2] rev_subsetD])
 
@@ -492,7 +492,7 @@
 text\<open>Nobody can have used non-existent keys!\<close>
 lemma new_keys_not_used [rule_format,simp]:
      "evs \<in> set_pur
-      ==> Key K \<notin> used evs --> K \<in> symKeys -->
+      ==> Key K \<notin> used evs \<longrightarrow> K \<in> symKeys \<longrightarrow>
           K \<notin> keysFor (parts (knows Spy evs))"
 apply (erule set_pur.induct)
 apply (valid_certificate_tac [8]) \<comment> \<open>PReqS\<close>
@@ -522,13 +522,13 @@
 
 lemma gen_new_keys_not_used:
      "[|Key K \<notin> used evs; K \<in> symKeys; evs \<in> set_pur |]
-      ==> Key K \<notin> used evs --> K \<in> symKeys -->
-          K \<notin> keysFor (parts (Key`KK Un knows Spy evs))"
+      ==> Key K \<notin> used evs \<longrightarrow> K \<in> symKeys \<longrightarrow>
+          K \<notin> keysFor (parts (Key`KK \<union> knows Spy evs))"
 by auto
 
 lemma gen_new_keys_not_analzd:
      "[|Key K \<notin> used evs; K \<in> symKeys; evs \<in> set_pur |]
-      ==> K \<notin> keysFor (analz (Key`KK Un knows Spy evs))"
+      ==> K \<notin> keysFor (analz (Key`KK \<union> knows Spy evs))"
 by (blast intro: keysFor_mono [THEN subsetD] dest: gen_new_keys_not_used)
 
 lemma analz_Key_image_insert_eq:
@@ -541,9 +541,9 @@
 subsection\<open>Secrecy of Symmetric Keys\<close>
 
 lemma Key_analz_image_Key_lemma:
-     "P --> (Key K \<in> analz (Key`KK Un H)) --> (K\<in>KK | Key K \<in> analz H)
+     "P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) \<longrightarrow> (K\<in>KK | Key K \<in> analz H)
       ==>
-      P --> (Key K \<in> analz (Key`KK Un H)) = (K\<in>KK | Key K \<in> analz H)"
+      P \<longrightarrow> (Key K \<in> analz (Key`KK \<union> H)) = (K\<in>KK | Key K \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 
@@ -575,15 +575,15 @@
 
 text\<open>As usual: we express the property as a logical equivalence\<close>
 lemma Nonce_analz_image_Key_lemma:
-     "P --> (Nonce N \<in> analz (Key`KK Un H)) --> (Nonce N \<in> analz H)
-      ==> P --> (Nonce N \<in> analz (Key`KK Un H)) = (Nonce N \<in> analz H)"
+     "P \<longrightarrow> (Nonce N \<in> analz (Key`KK \<union> H)) \<longrightarrow> (Nonce N \<in> analz H)
+      ==> P \<longrightarrow> (Nonce N \<in> analz (Key`KK \<union> H)) = (Nonce N \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 text\<open>The \<open>(no_asm)\<close> attribute is essential, since it retains
   the quantifier and allows the simprule's condition to itself be simplified.\<close>
 lemma Nonce_compromise [rule_format (no_asm)]:
      "evs \<in> set_pur ==>
-      (\<forall>N KK. (\<forall>K \<in> KK. K \<notin> range(\<lambda>C. priEK C))   -->
+      (\<forall>N KK. (\<forall>K \<in> KK. K \<notin> range(\<lambda>C. priEK C))   \<longrightarrow>
               (Nonce N \<in> analz (Key`KK \<union> (knows Spy evs))) =
               (Nonce N \<in> analz (knows Spy evs)))"
 apply (erule set_pur.induct)
@@ -639,16 +639,16 @@
 subsection\<open>Confidentiality of PAN\<close>
 
 lemma analz_image_pan_lemma:
-     "(Pan P \<in> analz (Key`nE Un H)) --> (Pan P \<in> analz H)  ==>
-      (Pan P \<in> analz (Key`nE Un H)) =   (Pan P \<in> analz H)"
+     "(Pan P \<in> analz (Key`nE \<union> H)) \<longrightarrow> (Pan P \<in> analz H)  ==>
+      (Pan P \<in> analz (Key`nE \<union> H)) =   (Pan P \<in> analz H)"
 by (blast intro: analz_mono [THEN [2] rev_subsetD])
 
 text\<open>The \<open>(no_asm)\<close> attribute is essential, since it retains
   the quantifier and allows the simprule's condition to itself be simplified.\<close>
 lemma analz_image_pan [rule_format (no_asm)]:
      "evs \<in> set_pur ==>
-       \<forall>KK. (\<forall>K \<in> KK. K \<notin> range(\<lambda>C. priEK C)) -->
-            (Pan P \<in> analz (Key`KK Un (knows Spy evs))) =
+       \<forall>KK. (\<forall>K \<in> KK. K \<notin> range(\<lambda>C. priEK C)) \<longrightarrow>
+            (Pan P \<in> analz (Key`KK \<union> (knows Spy evs))) =
             (Pan P \<in> analz (knows Spy evs))"
 apply (erule set_pur.induct)
 apply (rule_tac [!] allI impI)+
@@ -680,7 +680,7 @@
          CardSecret k = 0;  evs \<in> set_pur|]
     ==> \<exists>P M KC1 K X Y.
      Says C M \<lbrace>EXHcrypt KC1 (pubEK P) X (Pan (pan C)), Y\<rbrace>
-          \<in> set evs  &
+          \<in> set evs  \<and>
      P \<in> bad"
 apply (erule rev_mp)
 apply (erule set_pur.induct)
@@ -705,7 +705,7 @@
   ==> \<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign.
       Says C M \<lbrace>\<lbrace>PIDualSign_1, 
                    EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, 
-       OIDualSign\<rbrace> \<in> set evs  &  P \<in> bad"
+       OIDualSign\<rbrace> \<in> set evs  \<and>  P \<in> bad"
 apply (erule rev_mp)
 apply (erule set_pur.induct)
 apply (frule_tac [9] AuthReq_msg_in_analz_spies) \<comment> \<open>AReq\<close>
@@ -742,7 +742,7 @@
          Crypt (priSK M) (Hash MsgPInitRes) \<in> parts (knows Spy evs);
          evs \<in> set_pur; M \<notin> bad |]
       ==> \<exists>j trans.
-            P = PG j &
+            P = PG j \<and>
             Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs"
 apply clarify
 apply (erule rev_mp)
@@ -757,8 +757,8 @@
                               cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evs;
          evs \<in> set_pur;  M \<notin> bad|]
       ==> \<exists>j trans.
-            P = PG j &
-            Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs &
+            P = PG j \<and>
+            Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs \<and>
             EKj = pubEK P"
 by (rule refl [THEN goodM_gives_correct_PG, THEN exE], auto)
 
@@ -769,8 +769,8 @@
      Crypt (priSK M) (Hash MsgPInitRes) \<in> parts (knows Spy evs);
      evs \<in> set_pur;  M \<notin> bad|]
   ==> \<exists>j trans.
-         Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs &
-         P = PG j &
+         Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs \<and>
+         P = PG j \<and>
          EKj = pubEK P"
 apply clarify
 apply (erule rev_mp)
@@ -788,8 +788,8 @@
                         cert P EKj onlyEnc (priSK RCA)\<rbrace>)
            \<in> set evs;  M \<notin> bad;  evs \<in> set_pur|]
       ==> \<exists>j trans.
-           Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs &
-           P = PG j &
+           Notes M \<lbrace>Number LID_M, Agent P, trans\<rbrace> \<in> set evs \<and>
+           P = PG j \<and>
            EKj = pubEK (PG j)"
 apply (frule Says_certificate_valid)
 apply (auto simp add: sign_def)
@@ -805,8 +805,8 @@
            \<in> parts (knows Spy evs);
          evs \<in> set_pur;  M \<notin> bad|]
       ==> \<exists>j trans KM OIData HPIData.
-            Notes M \<lbrace>Number LID_M, Agent (PG j), trans\<rbrace> \<in> set evs &
-            Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evs &
+            Notes M \<lbrace>Number LID_M, Agent (PG j), trans\<rbrace> \<in> set evs \<and>
+            Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evs \<and>
             Says M (PG j) (EncB (priSK M) KM (pubEK (PG j)) AuthReqData P_I)
               \<in> set evs"
 apply clarify
@@ -833,7 +833,7 @@
         Gets (PG j)
            (EncB (priSK M) KM (pubEK (PG j))
                     \<lbrace>Number LID_M, Number XID, HOIData, HOD\<rbrace>
-                    P_I) \<in> set evs &
+                    P_I) \<in> set evs \<and>
         Says (PG j) M
              (EncB (priSK (PG j)) KP (pubEK M)
               \<lbrace>Number LID_M, Number XID, Number PurchAmt\<rbrace>
@@ -857,7 +857,7 @@
          PIHead = \<lbrace>Number LID_M, Trans_details\<rbrace>;
          evs \<in> set_pur;  C = Cardholder k;  M \<notin> bad|]
   ==> \<exists>trans j.
-               Notes M \<lbrace>Number LID_M, Agent (PG j), trans \<rbrace> \<in> set evs &
+               Notes M \<lbrace>Number LID_M, Agent (PG j), trans \<rbrace> \<in> set evs \<and>
                EKj = pubEK (PG j)"
 apply clarify
 apply (erule rev_mp)
@@ -874,7 +874,7 @@
         Notes C \<lbrace>Number LID_M, Agent M, Agent C, Number OD,
              Number PA\<rbrace> \<in> set evs;
         evs \<in> set_pur|]
-      ==> M = Merchant i & Trans = \<lbrace>Agent M, Agent C, Number OD, Number PA\<rbrace>"
+      ==> M = Merchant i \<and> Trans = \<lbrace>Agent M, Agent C, Number OD, Number PA\<rbrace>"
 apply (erule rev_mp)
 apply (erule rev_mp)
 apply (erule set_pur.induct, simp_all)
@@ -935,11 +935,11 @@
          evs \<in> set_pur;  M \<notin> bad|]
   ==> \<exists>j KP.
         Notes M \<lbrace>Number LID_M, Agent (PG j), Trans \<rbrace>
-          \<in> set evs &
+          \<in> set evs \<and>
         Gets M (EncB (priSK (PG j)) KP (pubEK M)
                 \<lbrace>Number LID_M, Number XID, Number PurchAmt\<rbrace>
                 authCode)
-          \<in> set evs &
+          \<in> set evs \<and>
         Says M C (sign (priSK M) MsgPRes) \<in> set evs"
 apply clarify
 apply (erule rev_mp)
@@ -965,10 +965,10 @@
                    Number PurchAmt\<rbrace> \<in> set evs;
          evs \<in> set_pur;  M \<notin> bad|]
   ==> \<exists>P KP trans.
-        Notes M \<lbrace>Number LID_M,Agent P, trans\<rbrace> \<in> set evs &
+        Notes M \<lbrace>Number LID_M,Agent P, trans\<rbrace> \<in> set evs \<and>
         Gets M (EncB (priSK P) KP (pubEK M)
                 \<lbrace>Number LID_M, Number XID, Number PurchAmt\<rbrace>
-                authCode)  \<in>  set evs &
+                authCode)  \<in>  set evs \<and>
         Says M C (sign (priSK M) MsgPRes) \<in> set evs"
 apply (rule C_verifies_PRes_lemma [THEN exE])
 apply (auto simp add: sign_def)
@@ -1034,7 +1034,7 @@
      Notes M \<lbrace>Number LID_M, Agent P, extras\<rbrace> \<in> set evs;
      M = Merchant i;  C = Cardholder k;  C \<notin> bad;  evs \<in> set_pur|]
   ==> \<exists>PIData PICrypt.
-        HPIData = Hash PIData &
+        HPIData = Hash PIData \<and>
         Says C M \<lbrace>\<lbrace>sign (priSK C) MsgDualSign, PICrypt\<rbrace>, OIData, Hash PIData\<rbrace>
           \<in> set evs"
 apply clarify
@@ -1061,9 +1061,9 @@
          Crypt (priSK C) (Hash MsgDualSign) \<in> parts (knows Spy evs);
          evs \<in> set_pur;  C \<notin> bad;  M \<notin> bad|]
     ==> \<exists>OIData OrderDesc K j trans.
-          HOD = Hash\<lbrace>Number OrderDesc, Number PurchAmt\<rbrace> &
-          HOIData = Hash OIData &
-          Notes M \<lbrace>Number LID_M, Agent (PG j), trans\<rbrace> \<in> set evs &
+          HOD = Hash\<lbrace>Number OrderDesc, Number PurchAmt\<rbrace> \<and>
+          HOIData = Hash OIData \<and>
+          Notes M \<lbrace>Number LID_M, Agent (PG j), trans\<rbrace> \<in> set evs \<and>
           Says C M \<lbrace>\<lbrace>sign (priSK C) MsgDualSign,
                      EXcrypt K (pubEK (PG j))
                                 \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace>,
@@ -1081,7 +1081,7 @@
          PIHead = \<lbrace>Number LID_M, Number XID, W\<rbrace>;
          C = Cardholder k;  evs \<in> set_pur;  M \<notin> bad|]
   ==> \<exists> trans j.
-         Notes M \<lbrace>Number LID_M, Agent (PG j), trans\<rbrace> \<in> set evs &
+         Notes M \<lbrace>Number LID_M, Agent (PG j), trans\<rbrace> \<in> set evs \<and>
          EKj = pubEK (PG j)"
 apply clarify
 apply (erule rev_mp)
@@ -1094,7 +1094,7 @@
          sign (priSK M) \<lbrace>AuthReqData, Hash P_I\<rbrace> \<in> parts (knows Spy evs);
          evs \<in> set_pur;  M \<notin> bad|]
    ==> \<exists>j trans KM.
-           Notes M \<lbrace>Number LID_M, Agent (PG j), trans \<rbrace> \<in> set evs &
+           Notes M \<lbrace>Number LID_M, Agent (PG j), trans \<rbrace> \<in> set evs \<and>
              Says M (PG j)
                (EncB (priSK M) KM (pubEK (PG j)) AuthReqData P_I)
               \<in> set evs"
@@ -1151,14 +1151,14 @@
                     TransStain\<rbrace>;
          evs \<in> set_pur;  C \<notin> bad;  M \<notin> bad|]
   ==> \<exists>OIData OrderDesc KM' trans j' KC' KC'' P_I' P_I''.
-           HOD = Hash\<lbrace>Number OrderDesc, Number PurchAmt\<rbrace> &
-           HOIData = Hash OIData &
-           Notes M \<lbrace>Number LID_M, Agent (PG j'), trans\<rbrace> \<in> set evs &
-           Says C M \<lbrace>P_I', OIData, Hash PIData\<rbrace> \<in> set evs &
+           HOD = Hash\<lbrace>Number OrderDesc, Number PurchAmt\<rbrace> \<and>
+           HOIData = Hash OIData \<and>
+           Notes M \<lbrace>Number LID_M, Agent (PG j'), trans\<rbrace> \<in> set evs \<and>
+           Says C M \<lbrace>P_I', OIData, Hash PIData\<rbrace> \<in> set evs \<and>
            Says M (PG j') (EncB (priSK M) KM' (pubEK (PG j'))
-                           AuthReqData P_I'')  \<in>  set evs &
+                           AuthReqData P_I'')  \<in>  set evs \<and>
            P_I' = \<lbrace>PI_sign,
-             EXcrypt KC' (pubEK (PG j')) \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace> &
+             EXcrypt KC' (pubEK (PG j')) \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace> \<and>
            P_I'' = \<lbrace>PI_sign,
              EXcrypt KC'' (pubEK (PG j)) \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace>"
 apply clarify
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/SMT_Examples/SMT_Examples.thy
--- a/src/HOL/SMT_Examples/SMT_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/SMT_Examples/SMT_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -242,7 +242,7 @@
 lemma
   assumes "(\<forall>x y. P x y = x)"
   and "(\<forall>x. \<exists>y. P x y) = (\<forall>x. P x c)"
-  shows "(EX y. P x y) = P x c"
+  shows "(\<exists>y. P x y) = P x c"
   using assms by smt
 
 lemma
@@ -345,8 +345,8 @@
 lemma "\<forall>x y::int. (2 * x + 1) \<noteq> (2 * y)" by smt
 lemma "\<forall>x y::int. x + y > 2 \<or> x + y = 2 \<or> x + y < 2" by smt
 lemma "\<forall>x::int. if x > 0 then x + 1 > 0 else 1 > x" by smt
-lemma "if (ALL x::int. x < 0 \<or> x > 0) then False else True" by smt
-lemma "(if (ALL x::int. x < 0 \<or> x > 0) then -1 else 3) > (0::int)" by smt
+lemma "if (\<forall>x::int. x < 0 \<or> x > 0) then False else True" by smt
+lemma "(if (\<forall>x::int. x < 0 \<or> x > 0) then -1 else 3) > (0::int)" by smt
 lemma "~ (\<exists>x y z::int. 4 * x + -6 * y = (1::int))" by smt
 lemma "\<exists>x::int. \<forall>x y. 0 < x \<and> 0 < y \<longrightarrow> (0::int) < x + y" by smt
 lemma "\<exists>u::int. \<forall>(x::int) y::real. 0 < x \<and> 0 < y \<longrightarrow> -1 < x" by smt
@@ -437,7 +437,7 @@
 lemma True using let_rsp by smt
 lemma "le = (\<le>) \<Longrightarrow> le (3::int) 42" by smt
 lemma "map (\<lambda>i::int. i + 1) [0, 1] = [1, 2]" by (smt list.map)
-lemma "(ALL x. P x) \<or> ~ All P" by smt
+lemma "(\<forall>x. P x) \<or> \<not> All P" by smt
 
 fun dec_10 :: "int \<Rightarrow> int" where
   "dec_10 n = (if n < 10 then n else dec_10 (n - 10))"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Set.thy
--- a/src/HOL/Set.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Set.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1780,7 +1780,7 @@
   for f :: "'a::order \<Rightarrow> 'b::order"
   \<comment> \<open>Courtesy of Stephan Merz\<close>
   apply clarify
-  apply (erule_tac P = "\<lambda>x. x : S" in LeastI2_order)
+  apply (erule_tac P = "\<lambda>x. x \<in> S" in LeastI2_order)
    apply fast
   apply (rule LeastI2_order)
     apply (auto elim: monoD intro!: order_antisym)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Set_Interval.thy
--- a/src/HOL/Set_Interval.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Set_Interval.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -86,7 +86,7 @@
 
 subsection \<open>Various equivalences\<close>
 
-lemma (in ord) lessThan_iff [iff]: "(i: lessThan k) = (i<k)"
+lemma (in ord) lessThan_iff [iff]: "(i \<in> lessThan k) = (i<k)"
 by (simp add: lessThan_def)
 
 lemma Compl_lessThan [simp]:
@@ -97,7 +97,7 @@
 lemma single_Diff_lessThan [simp]: "!!k:: 'a::order. {k} - lessThan k = {k}"
 by auto
 
-lemma (in ord) greaterThan_iff [iff]: "(i: greaterThan k) = (k<i)"
+lemma (in ord) greaterThan_iff [iff]: "(i \<in> greaterThan k) = (k<i)"
 by (simp add: greaterThan_def)
 
 lemma Compl_greaterThan [simp]:
@@ -109,14 +109,14 @@
 apply (rule double_complement)
 done
 
-lemma (in ord) atLeast_iff [iff]: "(i: atLeast k) = (k<=i)"
+lemma (in ord) atLeast_iff [iff]: "(i \<in> atLeast k) = (k<=i)"
 by (simp add: atLeast_def)
 
 lemma Compl_atLeast [simp]:
     "!!k:: 'a::linorder. -atLeast k = lessThan k"
   by (auto simp add: lessThan_def atLeast_def)
 
-lemma (in ord) atMost_iff [iff]: "(i: atMost k) = (i<=k)"
+lemma (in ord) atMost_iff [iff]: "(i \<in> atMost k) = (i<=k)"
 by (simp add: atMost_def)
 
 lemma atMost_Int_atLeast: "!!n:: 'a::order. atMost n Int atLeast n = {n}"
@@ -1084,8 +1084,7 @@
 by (simp add: atLeastAtMost_def)
 
 text \<open>A bounded set of natural numbers is finite.\<close>
-lemma bounded_nat_set_is_finite:
-  "(ALL i:N. i < (n::nat)) ==> finite N"
+lemma bounded_nat_set_is_finite: "(\<forall>i\<in>N. i < (n::nat)) \<Longrightarrow> finite N"
 apply (rule finite_subset)
  apply (rule_tac [2] finite_lessThan, auto)
 done
@@ -1153,11 +1152,11 @@
 lemma UN_le_eq_Un0:
   "(\<Union>i\<le>n::nat. M i) = (\<Union>i\<in>{1..n}. M i) \<union> M 0" (is "?A = ?B")
 proof
-  show "?A <= ?B"
+  show "?A \<subseteq> ?B"
   proof
-    fix x assume "x : ?A"
-    then obtain i where i: "i\<le>n" "x : M i" by auto
-    show "x : ?B"
+    fix x assume "x \<in> ?A"
+    then obtain i where i: "i\<le>n" "x \<in> M i" by auto
+    show "x \<in> ?B"
     proof(cases i)
       case 0 with i show ?thesis by simp
     next
@@ -1165,18 +1164,18 @@
     qed
   qed
 next
-  show "?B <= ?A" by fastforce
+  show "?B \<subseteq> ?A" by fastforce
 qed
 
 lemma UN_le_add_shift:
   "(\<Union>i\<le>n::nat. M(i+k)) = (\<Union>i\<in>{k..n+k}. M i)" (is "?A = ?B")
 proof
-  show "?A <= ?B" by fastforce
+  show "?A \<subseteq> ?B" by fastforce
 next
-  show "?B <= ?A"
+  show "?B \<subseteq> ?A"
   proof
-    fix x assume "x : ?B"
-    then obtain i where i: "i : {k..n+k}" "x : M(i)" by auto
+    fix x assume "x \<in> ?B"
+    then obtain i where i: "i \<in> {k..n+k}" "x \<in> M(i)" by auto
     hence "i-k\<le>n \<and> x \<in> M((i-k)+k)" by auto
     thus "x \<in> ?A" by blast
   qed
@@ -1731,7 +1730,7 @@
 
 text\<open>This congruence rule should be used for sums over intervals as
 the standard theorem @{text[source]sum.cong} does not work well
-with the simplifier who adds the unsimplified premise @{term"x:B"} to
+with the simplifier who adds the unsimplified premise @{term"x\<in>B"} to
 the context.\<close>
 
 lemmas sum_ivl_cong = sum.ivl_cong
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/TLA/Memory/Memory.thy
--- a/src/HOL/TLA/Memory/Memory.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/TLA/Memory/Memory.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -197,7 +197,7 @@
 
 lemma ReadInner_enabled: "\<And>p. basevars (rtrner ch ! p, rs!p) \<Longrightarrow>
       \<turnstile> Calling ch p \<and> (arg<ch!p> = #(read l)) \<longrightarrow> Enabled (ReadInner ch mm rs p l)"
-  apply (case_tac "l : MemLoc")
+  apply (case_tac "l \<in> MemLoc")
   apply (force simp: ReadInner_def GoodRead_def BadRead_def RdRequest_def
     intro!: exI elim!: base_enabled [temp_use])+
   done
@@ -205,7 +205,7 @@
 lemma WriteInner_enabled: "\<And>p. basevars (mm!l, rtrner ch ! p, rs!p) \<Longrightarrow>
       \<turnstile> Calling ch p \<and> (arg<ch!p> = #(write l v))
          \<longrightarrow> Enabled (WriteInner ch mm rs p l v)"
-  apply (case_tac "l:MemLoc & v:MemVal")
+  apply (case_tac "l \<in> MemLoc \<and> v \<in> MemVal")
   apply (force simp: WriteInner_def GoodWrite_def BadWrite_def WrRequest_def
     intro!: exI elim!: base_enabled [temp_use])+
   done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/TLA/Memory/MemoryImplementation.thy
--- a/src/HOL/TLA/Memory/MemoryImplementation.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/TLA/Memory/MemoryImplementation.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -33,15 +33,15 @@
 definition
   (* auxiliary predicates *)
   MVOKBARF      :: "Vals \<Rightarrow> bool"
-  where "MVOKBARF v \<longleftrightarrow> (v : MemVal) | (v = OK) | (v = BadArg) | (v = RPCFailure)"
+  where "MVOKBARF v \<longleftrightarrow> (v \<in> MemVal) \<or> (v = OK) \<or> (v = BadArg) \<or> (v = RPCFailure)"
 
 definition
   MVOKBA        :: "Vals \<Rightarrow> bool"
-  where "MVOKBA v \<longleftrightarrow> (v : MemVal) | (v = OK) | (v = BadArg)"
+  where "MVOKBA v \<longleftrightarrow> (v \<in> MemVal) \<or> (v = OK) \<or> (v = BadArg)"
 
 definition
   MVNROKBA      :: "Vals \<Rightarrow> bool"
-  where "MVNROKBA v \<longleftrightarrow> (v : MemVal) | (v = NotAResult) | (v = OK) | (v = BadArg)"
+  where "MVNROKBA v \<longleftrightarrow> (v \<in> MemVal) \<or> (v = NotAResult) \<or> (v = OK) \<or> (v = BadArg)"
 
 definition
   (* tuples of state functions changed by the various components *)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/TLA/Memory/MemoryParameters.thy
--- a/src/HOL/TLA/Memory/MemoryParameters.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/TLA/Memory/MemoryParameters.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -29,7 +29,7 @@
   (* basic assumptions about the above constants and predicates *)
   BadArgNoMemVal:    "BadArg \<notin> MemVal" and
   MemFailNoMemVal:   "MemFailure \<notin> MemVal" and
-  InitValMemVal:     "InitVal : MemVal" and
+  InitValMemVal:     "InitVal \<in> MemVal" and
   NotAResultNotVal:  "NotAResult \<notin> MemVal" and
   NotAResultNotOK:   "NotAResult \<noteq> OK" and
   NotAResultNotBA:   "NotAResult \<noteq> BadArg" and
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/TPTP/TPTP_Parser/tptp_reconstruct_library.ML
--- a/src/HOL/TPTP/TPTP_Parser/tptp_reconstruct_library.ML	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/TPTP/TPTP_Parser/tptp_reconstruct_library.ML	Thu Feb 15 13:04:36 2018 +0100
@@ -264,13 +264,13 @@
     | try_dest_All t = t
 
   val _ = @{assert}
-    ((@{term "! x. (! y. P) = True"}
+    ((@{term "\<forall>x. (\<forall>y. P) = True"}
       |> try_dest_All
       |> Term.strip_abs_vars)
      = [("x", @{typ "'a"})])
 
   val _ = @{assert}
-    ((@{prop "! x. (! y. P) = True"}
+    ((@{prop "\<forall>x. (\<forall>y. P) = True"}
       |> try_dest_All
       |> Term.strip_abs_vars)
      = [("x", @{typ "'a"})])
@@ -306,7 +306,7 @@
          Free ("x", @{typ "'a"})))
   in
     @{assert}
-      ((@{term "! x. All ((=) x)"}
+      ((@{term "\<forall>x. All ((=) x)"}
         |> strip_top_All_vars)
        = answer)
   end
@@ -642,7 +642,7 @@
      val simpset =
        empty_simpset ctxt
        |> Simplifier.add_simp
-           @{lemma "! x. P x & Q x \<equiv> (! x. P x) & (! x. Q x)"
+           @{lemma "\<forall>x. P x \<and> Q x \<equiv> (\<forall>x. P x) \<and> (\<forall>x. Q x)"
               by (rule eq_reflection, auto)}
    in
      CHANGED (asm_full_simp_tac simpset i)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/TPTP/TPTP_Proof_Reconstruction.thy
--- a/src/HOL/TPTP/TPTP_Proof_Reconstruction.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/TPTP/TPTP_Proof_Reconstruction.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -346,8 +346,8 @@
   "(((A :: bool) = B) = True) == (((A \<longrightarrow> B) = True) & ((B \<longrightarrow> A) = True))"
   "((A :: bool) = B) = False == (((~A) | B) = False) | (((~B) | A) = False)"
 
-  "((F = G) = True) == (! x. (F x = G x)) = True"
-  "((F = G) = False) == (! x. (F x = G x)) = False"
+  "((F = G) = True) == (\<forall>x. (F x = G x)) = True"
+  "((F = G) = False) == (\<forall>x. (F x = G x)) = False"
 
   "(A | B) = True == (A = True) | (B = True)"
   "(A & B) = False == (A = False) | (B = False)"
@@ -403,7 +403,7 @@
   "((A \<or> B) = (C \<or> D)) = False \<Longrightarrow> (B = C) = False \<or> (A = D) = False"
 by auto
 
-lemma extuni_func [rule_format]: "(F = G) = False \<Longrightarrow> (! X. (F X = G X)) = False" by auto
+lemma extuni_func [rule_format]: "(F = G) = False \<Longrightarrow> (\<forall>X. (F X = G X)) = False" by auto
 
 
 subsection "Emulation: tactics"
@@ -482,18 +482,18 @@
 subsection "Skolemisation"
 
 lemma skolemise [rule_format]:
-  "\<forall> P. (~ (! x. P x)) \<longrightarrow> ~ (P (SOME x. ~ P x))"
+  "\<forall> P. (\<not> (\<forall>x. P x)) \<longrightarrow> \<not> (P (SOME x. ~ P x))"
 proof -
-  have "\<And> P. (~ (! x. P x)) \<Longrightarrow> ~ (P (SOME x. ~ P x))"
+  have "\<And> P. (\<not> (\<forall>x. P x)) \<Longrightarrow> \<not> (P (SOME x. ~ P x))"
   proof -
     fix P
-    assume ption: "~ (! x. P x)"
-    hence a: "? x. ~ P x" by force
+    assume ption: "\<not> (\<forall>x. P x)"
+    hence a: "\<exists>x. \<not> P x" by force
 
-    have hilbert : "\<And> P. (? x. P x) \<Longrightarrow> (P (SOME x. P x))"
+    have hilbert : "\<And>P. (\<exists>x. P x) \<Longrightarrow> (P (SOME x. P x))"
     proof -
       fix P
-      assume "(? x. P x)"
+      assume "(\<exists>x. P x)"
       thus "(P (SOME x. P x))"
         apply auto
         apply (rule someI)
@@ -501,9 +501,9 @@
         done
     qed
 
-    from a show "~ P (SOME x. ~ P x)"
+    from a show "\<not> P (SOME x. \<not> P x)"
     proof -
-      assume "? x. ~ P x"
+      assume "\<exists>x. \<not> P x"
       hence "\<not> P (SOME x. \<not> P x)" by (rule hilbert)
       thus ?thesis .
     qed
@@ -512,13 +512,13 @@
 qed
 
 lemma polar_skolemise [rule_format]:
-  "\<forall> P. (! x. P x) = False \<longrightarrow> (P (SOME x. ~ P x)) = False"
+  "\<forall>P. (\<forall>x. P x) = False \<longrightarrow> (P (SOME x. \<not> P x)) = False"
 proof -
-  have "\<And> P. (! x. P x) = False \<Longrightarrow> (P (SOME x. ~ P x)) = False"
+  have "\<And>P. (\<forall>x. P x) = False \<Longrightarrow> (P (SOME x. \<not> P x)) = False"
   proof -
     fix P
-    assume ption: "(! x. P x) = False"
-    hence "\<not> (\<forall> x. P x)" by force
+    assume ption: "(\<forall>x. P x) = False"
+    hence "\<not> (\<forall>x. P x)" by force
     hence "\<not> All P" by force
     hence "\<not> (P (SOME x. \<not> P x))" by (rule skolemise)
     thus "(P (SOME x. \<not> P x)) = False" by force
@@ -527,12 +527,12 @@
 qed
 
 lemma leo2_skolemise [rule_format]:
-  "\<forall> P sk. (! x. P x) = False \<longrightarrow> (sk = (SOME x. ~ P x)) \<longrightarrow> (P sk) = False"
+  "\<forall>P sk. (\<forall>x. P x) = False \<longrightarrow> (sk = (SOME x. \<not> P x)) \<longrightarrow> (P sk) = False"
 by (clarify, rule polar_skolemise)
 
 lemma lift_forall [rule_format]:
-  "!! x. (! x. A x) = True ==> (A x) = True"
-  "!! x. (? x. A x) = False ==> (A x) = False"
+  "\<And>x. (\<forall>x. A x) = True \<Longrightarrow> (A x) = True"
+  "\<And>x. (\<exists>x. A x) = False \<Longrightarrow> (A x) = False"
 by auto
 lemma lift_exists [rule_format]:
   "\<lbrakk>(All P) = False; sk = (SOME x. \<not> P x)\<rbrakk> \<Longrightarrow> P sk = False"
@@ -975,7 +975,7 @@
    let
      val simpset =
        empty_simpset ctxt (*NOTE for some reason, Bind exception gets raised if ctxt's simpset isn't emptied*)
-       |> Simplifier.add_simp @{lemma "Ex P == (~ (! x. ~ P x))" by auto}
+       |> Simplifier.add_simp @{lemma "Ex P == (\<not> (\<forall>x. \<not> P x))" by auto}
    in
      CHANGED (asm_full_simp_tac simpset i)
    end
@@ -1541,7 +1541,7 @@
 subsubsection "Finite types"
 (*lift quantification from a singleton literal to a singleton clause*)
 lemma forall_pos_lift:
-"\<lbrakk>(! X. P X) = True; ! X. (P X = True) \<Longrightarrow> R\<rbrakk> \<Longrightarrow> R" by auto
+"\<lbrakk>(\<forall>X. P X) = True; \<forall>X. (P X = True) \<Longrightarrow> R\<rbrakk> \<Longrightarrow> R" by auto
 
 (*predicate over the type of the leading quantified variable*)
 
@@ -1750,10 +1750,10 @@
 \<close>
 
 lemma drop_redundant_literal_qtfr:
-  "(! X. P) = True \<Longrightarrow> P = True"
-  "(? X. P) = True \<Longrightarrow> P = True"
-  "(! X. P) = False \<Longrightarrow> P = False"
-  "(? X. P) = False \<Longrightarrow> P = False"
+  "(\<forall>X. P) = True \<Longrightarrow> P = True"
+  "(\<exists>X. P) = True \<Longrightarrow> P = True"
+  "(\<forall>X. P) = False \<Longrightarrow> P = False"
+  "(\<exists>X. P) = False \<Longrightarrow> P = False"
 by auto
 
 ML \<open>
@@ -1952,11 +1952,11 @@
 subsection "Handling split 'preprocessing'"
 
 lemma split_tranfs:
-  "! x. P x & Q x \<equiv> (! x. P x) & (! x. Q x)"
-  "~ (~ A) \<equiv> A"
-  "? x. A \<equiv> A"
-  "(A & B) & C \<equiv> A & B & C"
-  "A = B \<equiv> (A --> B) & (B --> A)"
+  "\<forall>x. P x \<and> Q x \<equiv> (\<forall>x. P x) \<and> (\<forall>x. Q x)"
+  "\<not> (\<not> A) \<equiv> A"
+  "\<exists>x. A \<equiv> A"
+  "(A \<and> B) \<and> C \<equiv> A \<and> B \<and> C"
+  "A = B \<equiv> (A \<longrightarrow> B) \<and> (B \<longrightarrow> A)"
 by (rule eq_reflection, auto)+
 
 (*Same idiom as ex_expander_tac*)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Transitive_Closure.thy
--- a/src/HOL/Transitive_Closure.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Transitive_Closure.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -243,7 +243,7 @@
 
 lemmas rtrancl_converseI = rtranclp_converseI [to_set]
 
-lemma rtrancl_converse: "(r^-1)\<^sup>* = (r\<^sup>*)^-1"
+lemma rtrancl_converse: "(r\<inverse>)\<^sup>* = (r\<^sup>*)\<inverse>"
   by (fast dest!: rtrancl_converseD intro!: rtrancl_converseI)
 
 lemma sym_rtrancl: "sym r \<Longrightarrow> sym (r\<^sup>*)"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Comp/Alloc.thy
--- a/src/HOL/UNITY/Comp/Alloc.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Comp/Alloc.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -79,7 +79,7 @@
 definition
   \<comment> \<open>spec (4)\<close>
   client_bounded :: "'a clientState_d program set"
-  where "client_bounded = UNIV guarantees  Always {s. ALL elt : set (ask s). elt \<le> NbT}"
+  where "client_bounded = UNIV guarantees  Always {s. \<forall>elt \<in> set (ask s). elt \<le> NbT}"
 
 definition
   \<comment> \<open>spec (5)\<close>
@@ -132,8 +132,8 @@
          (INT i : lessThan Nclients. Increasing (sub i o allocAsk) Int
                                      Increasing (sub i o allocRel))
          Int
-         Always {s. ALL i<Nclients.
-                     ALL elt : set ((sub i o allocAsk) s). elt \<le> NbT}
+         Always {s. \<forall>i<Nclients.
+                     \<forall>elt \<in> set ((sub i o allocAsk) s). elt \<le> NbT}
          Int
          (INT i : lessThan Nclients.
           INT h. {s. h \<le> (sub i o allocGiv)s & h pfixGe (sub i o allocAsk)s}
@@ -242,13 +242,13 @@
                                  systemState.dummy = allocState_d.dummy al|))"
 
 axiomatization Alloc :: "'a allocState_d program"
-  where Alloc: "Alloc : alloc_spec"
+  where Alloc: "Alloc \<in> alloc_spec"
 
 axiomatization Client :: "'a clientState_d program"
-  where Client: "Client : client_spec"
+  where Client: "Client \<in> client_spec"
 
 axiomatization Network :: "'a systemState program"
-  where Network: "Network : network_spec"
+  where Network: "Network \<in> network_spec"
 
 definition System  :: "'a systemState program"
   where "System = rename sysOfAlloc Alloc \<squnion> Network \<squnion>
@@ -735,22 +735,22 @@
 \<close>
 
 text\<open>Lifting \<open>Client_Increasing\<close> to @{term systemState}\<close>
-lemma rename_Client_Increasing: "i : I
-      ==> rename sysOfClient (plam x: I. rename client_map Client) :
+lemma rename_Client_Increasing: "i \<in> I
+      ==> rename sysOfClient (plam x: I. rename client_map Client) \<in>
             UNIV  guarantees
             Increasing (ask o sub i o client) Int
             Increasing (rel o sub i o client)"
   by rename_client_map
 
-lemma preserves_sub_fst_lift_map: "[| F : preserves w; i ~= j |]
-      ==> F : preserves (sub i o fst o lift_map j o funPair v w)"
+lemma preserves_sub_fst_lift_map: "[| F \<in> preserves w; i \<noteq> j |]
+      ==> F \<in> preserves (sub i o fst o lift_map j o funPair v w)"
   apply (auto simp add: lift_map_def split_def linorder_neq_iff o_def)
   apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD])
   apply (auto simp add: o_def)
   done
 
 lemma client_preserves_giv_oo_client_map: "[| i < Nclients; j < Nclients |]
-      ==> Client : preserves (giv o sub i o fst o lift_map j o client_map)"
+      ==> Client \<in> preserves (giv o sub i o fst o lift_map j o client_map)"
   apply (cases "i=j")
   apply (simp, simp add: o_def non_dummy_def)
   apply (drule Client_preserves_dummy [THEN preserves_sub_fst_lift_map])
@@ -784,7 +784,7 @@
   rename_sysOfAlloc_ok_Network [THEN ok_sym]
 
 lemma System_Increasing: "i < Nclients
-      ==> System : Increasing (ask o sub i o client) Int
+      ==> System \<in> Increasing (ask o sub i o client) Int
                    Increasing (rel o sub i o client)"
   apply (rule component_guaranteesD [OF rename_Client_Increasing Client_component_System])
   apply auto
@@ -803,7 +803,7 @@
                 allocGiv_o_inv_sysOfAlloc_eq']
 
 lemma System_Increasing_allocGiv:
-     "i < Nclients ==> System : Increasing (sub i o allocGiv)"
+     "i < Nclients \<Longrightarrow> System \<in> Increasing (sub i o allocGiv)"
   apply (unfold System_def)
   apply (simp add: o_def)
   apply (rule rename_Alloc_Increasing [THEN guarantees_Join_I1, THEN guaranteesD])
@@ -822,19 +822,19 @@
     and allows it to be combined using \<open>Always_Int_rule\<close> below.\<close>
 
 lemma System_Follows_rel:
-  "i < Nclients ==> System : ((sub i o allocRel) Fols (rel o sub i o client))"
+  "i < Nclients ==> System \<in> ((sub i o allocRel) Fols (rel o sub i o client))"
   apply (auto intro!: Network_Rel [THEN component_guaranteesD])
   apply (simp add: ok_commute [of Network])
   done
 
 lemma System_Follows_ask:
-  "i < Nclients ==> System : ((sub i o allocAsk) Fols (ask o sub i o client))"
+  "i < Nclients ==> System \<in> ((sub i o allocAsk) Fols (ask o sub i o client))"
   apply (auto intro!: Network_Ask [THEN component_guaranteesD])
   apply (simp add: ok_commute [of Network])
   done
 
 lemma System_Follows_allocGiv:
-  "i < Nclients ==> System : (giv o sub i o client) Fols (sub i o allocGiv)"
+  "i < Nclients ==> System \<in> (giv o sub i o client) Fols (sub i o allocGiv)"
   apply (auto intro!: Network_Giv [THEN component_guaranteesD]
     rename_Alloc_Increasing [THEN component_guaranteesD])
   apply (simp_all add: o_def non_dummy_def ok_commute [of Network])
@@ -842,21 +842,21 @@
   done
 
 
-lemma Always_giv_le_allocGiv: "System : Always (INT i: lessThan Nclients.
+lemma Always_giv_le_allocGiv: "System \<in> Always (INT i: lessThan Nclients.
                        {s. (giv o sub i o client) s \<le> (sub i o allocGiv) s})"
   apply auto
   apply (erule System_Follows_allocGiv [THEN Follows_Bounded])
   done
 
 
-lemma Always_allocAsk_le_ask: "System : Always (INT i: lessThan Nclients.
+lemma Always_allocAsk_le_ask: "System \<in> Always (INT i: lessThan Nclients.
                        {s. (sub i o allocAsk) s \<le> (ask o sub i o client) s})"
   apply auto
   apply (erule System_Follows_ask [THEN Follows_Bounded])
   done
 
 
-lemma Always_allocRel_le_rel: "System : Always (INT i: lessThan Nclients.
+lemma Always_allocRel_le_rel: "System \<in> Always (INT i: lessThan Nclients.
                        {s. (sub i o allocRel) s \<le> (rel o sub i o client) s})"
   by (auto intro!: Follows_Bounded System_Follows_rel)
 
@@ -875,7 +875,7 @@
 
 text\<open>safety (1), step 3\<close>
 lemma System_sum_bounded:
-    "System : Always {s. (\<Sum>i \<in> lessThan Nclients. (tokens o sub i o allocGiv) s)
+    "System \<in> Always {s. (\<Sum>i \<in> lessThan Nclients. (tokens o sub i o allocGiv) s)
             \<le> NbT + (\<Sum>i \<in> lessThan Nclients. (tokens o sub i o allocRel) s)}"
   apply (simp add: o_apply)
   apply (insert Alloc_Safety [THEN rename_guarantees_sysOfAlloc_I])
@@ -886,14 +886,14 @@
 
 text\<open>Follows reasoning\<close>
 
-lemma Always_tokens_giv_le_allocGiv: "System : Always (INT i: lessThan Nclients.
+lemma Always_tokens_giv_le_allocGiv: "System \<in> Always (INT i: lessThan Nclients.
                           {s. (tokens o giv o sub i o client) s
                            \<le> (tokens o sub i o allocGiv) s})"
   apply (rule Always_giv_le_allocGiv [THEN Always_weaken])
   apply (auto intro: tokens_mono_prefix simp add: o_apply)
   done
 
-lemma Always_tokens_allocRel_le_rel: "System : Always (INT i: lessThan Nclients.
+lemma Always_tokens_allocRel_le_rel: "System \<in> Always (INT i: lessThan Nclients.
                           {s. (tokens o sub i o allocRel) s
                            \<le> (tokens o rel o sub i o client) s})"
   apply (rule Always_allocRel_le_rel [THEN Always_weaken])
@@ -901,7 +901,7 @@
   done
 
 text\<open>safety (1), step 4 (final result!)\<close>
-theorem System_safety: "System : system_safety"
+theorem System_safety: "System \<in> system_safety"
   apply (unfold system_safety_def)
   apply (tactic \<open>resolve_tac @{context} [Always_Int_rule [@{thm System_sum_bounded},
     @{thm Always_tokens_giv_le_allocGiv}, @{thm Always_tokens_allocRel_le_rel}] RS
@@ -924,27 +924,27 @@
 lemmas System_Increasing_allocAsk =  System_Follows_ask [THEN Follows_Increasing1]
 
 text\<open>progress (2), step 3: lifting \<open>Client_Bounded\<close> to systemState\<close>
-lemma rename_Client_Bounded: "i : I
-    ==> rename sysOfClient (plam x: I. rename client_map Client) :
+lemma rename_Client_Bounded: "i \<in> I
+    ==> rename sysOfClient (plam x: I. rename client_map Client) \<in>
           UNIV  guarantees
-          Always {s. ALL elt : set ((ask o sub i o client) s). elt \<le> NbT}"
+          Always {s. \<forall>elt \<in> set ((ask o sub i o client) s). elt \<le> NbT}"
   by rename_client_map
 
 
 lemma System_Bounded_ask: "i < Nclients
-      ==> System : Always
-                    {s. ALL elt : set ((ask o sub i o client) s). elt \<le> NbT}"
+      ==> System \<in> Always
+                    {s. \<forall>elt \<in> set ((ask o sub i o client) s). elt \<le> NbT}"
   apply (rule component_guaranteesD [OF rename_Client_Bounded Client_component_System])
   apply auto
   done
 
-lemma Collect_all_imp_eq: "{x. ALL y. P y --> Q x y} = (INT y: {y. P y}. {x. Q x y})"
+lemma Collect_all_imp_eq: "{x. \<forall>y. P y \<longrightarrow> Q x y} = (INT y: {y. P y}. {x. Q x y})"
   apply blast
   done
 
 text\<open>progress (2), step 4\<close>
-lemma System_Bounded_allocAsk: "System : Always {s. ALL i<Nclients.
-                          ALL elt : set ((sub i o allocAsk) s). elt \<le> NbT}"
+lemma System_Bounded_allocAsk: "System \<in> Always {s. ALL i<Nclients.
+                          \<forall>elt \<in> set ((sub i o allocAsk) s). elt \<le> NbT}"
   apply (auto simp add: Collect_all_imp_eq)
   apply (tactic \<open>resolve_tac @{context} [Always_Int_rule [@{thm Always_allocAsk_le_ask},
     @{thm System_Bounded_ask}] RS @{thm Always_weaken}] 1\<close>)
@@ -958,9 +958,9 @@
 lemmas System_Increasing_giv =  System_Follows_allocGiv [THEN Follows_Increasing1]
 
 
-lemma rename_Client_Progress: "i: I
+lemma rename_Client_Progress: "i \<in> I
    ==> rename sysOfClient (plam x: I. rename client_map Client)
-        : Increasing (giv o sub i o client)
+        \<in> Increasing (giv o sub i o client)
           guarantees
           (INT h. {s. h \<le> (giv o sub i o client) s &
                             h pfixGe (ask o sub i o client) s}
@@ -972,7 +972,7 @@
 
 text\<open>progress (2), step 7\<close>
 lemma System_Client_Progress:
-  "System : (INT i : (lessThan Nclients).
+  "System \<in> (INT i : (lessThan Nclients).
             INT h. {s. h \<le> (giv o sub i o client) s &
                        h pfixGe (ask o sub i o client) s}
                 LeadsTo {s. tokens h \<le> (tokens o rel o sub i o client) s})"
@@ -998,7 +998,7 @@
 
 
 lemma System_lemma3: "i < Nclients
-      ==> System : {s. h \<le> (sub i o allocGiv) s &
+      ==> System \<in> {s. h \<le> (sub i o allocGiv) s &
                        h pfixGe (sub i o allocAsk) s}
                    LeadsTo
                    {s. h \<le> (giv o sub i o client) s &
@@ -1013,7 +1013,7 @@
 
 text\<open>progress (2), step 8: Client i's "release" action is visible system-wide\<close>
 lemma System_Alloc_Client_Progress: "i < Nclients
-      ==> System : {s. h \<le> (sub i o allocGiv) s &
+      ==> System \<in> {s. h \<le> (sub i o allocGiv) s &
                        h pfixGe (sub i o allocAsk) s}
                    LeadsTo {s. tokens h \<le> (tokens o sub i o allocRel) s}"
   apply (rule LeadsTo_Trans)
@@ -1033,7 +1033,7 @@
 
 text\<open>progress (2), step 9\<close>
 lemma System_Alloc_Progress:
- "System : (INT i : (lessThan Nclients).
+ "System \<in> (INT i : (lessThan Nclients).
             INT h. {s. h \<le> (sub i o allocAsk) s}
                    LeadsTo {s. h pfixLe (sub i o allocGiv) s})"
   apply (simp only: o_apply sub_def)
@@ -1048,7 +1048,7 @@
   done
 
 text\<open>progress (2), step 10 (final result!)\<close>
-lemma System_Progress: "System : system_progress"
+lemma System_Progress: "System \<in> system_progress"
   apply (unfold system_progress_def)
   apply (cut_tac System_Alloc_Progress)
   apply auto
@@ -1058,7 +1058,7 @@
   done
 
 
-theorem System_correct: "System : system_spec"
+theorem System_correct: "System \<in> system_spec"
   apply (unfold system_spec_def)
   apply (blast intro: System_safety System_Progress)
   done
@@ -1083,7 +1083,7 @@
   done
 
 text\<open>Could go to Extend.ML\<close>
-lemma bij_fst_inv_inv_eq: "bij f ==> fst (inv (%(x, u). inv f x) z) = f z"
+lemma bij_fst_inv_inv_eq: "bij f \<Longrightarrow> fst (inv (%(x, u). inv f x) z) = f z"
   apply (rule fst_inv_equalityI)
    apply (rule_tac f = "%z. (f z, h z)" for h in surjI)
    apply (simp add: bij_is_inj inv_f_f)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Comp/AllocBase.thy
--- a/src/HOL/UNITY/Comp/AllocBase.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Comp/AllocBase.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -76,7 +76,7 @@
 by (simp add: bag_of_nths_Un_Int [symmetric])
 
 lemma bag_of_nths_UN_disjoint [rule_format]:
-     "[| finite I; ALL i:I. ALL j:I. i~=j --> A i Int A j = {} |]  
+     "[| finite I; \<forall>i\<in>I. \<forall>j\<in>I. i\<noteq>j \<longrightarrow> A i Int A j = {} |]  
       ==> bag_of (nths l (UNION I A)) =   
           (\<Sum>i\<in>I. bag_of (nths l (A i)))"
 apply (auto simp add: bag_of_nths)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Comp/Handshake.thy
--- a/src/HOL/UNITY/Comp/Handshake.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Comp/Handshake.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -47,7 +47,7 @@
         invFG_def [THEN def_set_simp, simp]
 
 
-lemma invFG: "(F \<squnion> G) : Always invFG"
+lemma invFG: "(F \<squnion> G) \<in> Always invFG"
 apply (rule AlwaysI)
 apply force
 apply (rule constrains_imp_Constrains [THEN StableI])
@@ -56,21 +56,21 @@
 apply (unfold G_def, safety) 
 done
 
-lemma lemma2_1: "(F \<squnion> G) : ({s. NF s = k} - {s. BB s}) LeadsTo  
+lemma lemma2_1: "(F \<squnion> G) \<in> ({s. NF s = k} - {s. BB s}) LeadsTo  
                               ({s. NF s = k} Int {s. BB s})"
 apply (rule stable_Join_ensures1[THEN leadsTo_Basis, THEN leadsTo_imp_LeadsTo])
  apply (unfold F_def, safety) 
 apply (unfold G_def, ensures_tac "cmdG") 
 done
 
-lemma lemma2_2: "(F \<squnion> G) : ({s. NF s = k} Int {s. BB s}) LeadsTo 
+lemma lemma2_2: "(F \<squnion> G) \<in> ({s. NF s = k} Int {s. BB s}) LeadsTo 
                               {s. k < NF s}"
 apply (rule stable_Join_ensures2[THEN leadsTo_Basis, THEN leadsTo_imp_LeadsTo])
  apply (unfold F_def, ensures_tac "cmdF") 
 apply (unfold G_def, safety) 
 done
 
-lemma progress: "(F \<squnion> G) : UNIV LeadsTo {s. m < NF s}"
+lemma progress: "(F \<squnion> G) \<in> UNIV LeadsTo {s. m < NF s}"
 apply (rule LeadsTo_weaken_R)
 apply (rule_tac f = "NF" and l = "Suc m" and B = "{}" 
        in GreaterThan_bounded_induct)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Comp/Priority.thy
--- a/src/HOL/UNITY/Comp/Priority.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Comp/Priority.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -84,13 +84,13 @@
 by (simp add: Component_def, safety, auto)
 
 text\<open>property 4\<close>
-lemma Component_waits_priority: "Component i: {s. ((i,j):s) = b} Int (- Highest i) co {s. ((i,j):s)=b}"
+lemma Component_waits_priority: "Component i \<in> {s. ((i,j) \<in> s) = b} \<inter> (- Highest i) co {s. ((i,j) \<in> s)=b}"
 by (simp add: Component_def, safety)
 
 text\<open>property 5: charpentier and Chandy mistakenly express it as
  'transient Highest i'. Consider the case where i has neighbors\<close>
 lemma Component_yields_priority: 
- "Component i: {s. neighbors i s \<noteq> {}} Int Highest i  
+ "Component i \<in> {s. neighbors i s \<noteq> {}} Int Highest i  
                ensures - Highest i"
 apply (simp add: Component_def)
 apply (ensures_tac "act i", blast+) 
@@ -107,7 +107,7 @@
 by (simp add: Component_def, safety, fast)
 
 text\<open>property 7: local axiom\<close>
-lemma locality: "Component i \<in> stable {s. \<forall>j k. j\<noteq>i & k\<noteq>i--> ((j,k):s) = b j k}"
+lemma locality: "Component i \<in> stable {s. \<forall>j k. j\<noteq>i & k\<noteq>i--> ((j,k) \<in> s) = b j k}"
 by (simp add: Component_def, safety)
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Comp/PriorityAux.thy
--- a/src/HOL/UNITY/Comp/PriorityAux.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Comp/PriorityAux.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -12,33 +12,33 @@
 typedecl vertex
   
 definition symcl :: "(vertex*vertex)set=>(vertex*vertex)set" where
-  "symcl r == r \<union> (r^-1)"
+  "symcl r == r \<union> (r\<inverse>)"
     \<comment> \<open>symmetric closure: removes the orientation of a relation\<close>
 
 definition neighbors :: "[vertex, (vertex*vertex)set]=>vertex set" where
-  "neighbors i r == ((r \<union> r^-1)``{i}) - {i}"
+  "neighbors i r == ((r \<union> r\<inverse>)``{i}) - {i}"
     \<comment> \<open>Neighbors of a vertex i\<close>
 
 definition R :: "[vertex, (vertex*vertex)set]=>vertex set" where
   "R i r == r``{i}"
 
 definition A :: "[vertex, (vertex*vertex)set]=>vertex set" where
-  "A i r == (r^-1)``{i}"
+  "A i r == (r\<inverse>)``{i}"
 
 definition reach :: "[vertex, (vertex*vertex)set]=> vertex set" where
-  "reach i r == (r^+)``{i}"
+  "reach i r == (r\<^sup>+)``{i}"
     \<comment> \<open>reachable and above vertices: the original notation was R* and A*\<close>
 
 definition above :: "[vertex, (vertex*vertex)set]=> vertex set" where
-  "above i r == ((r^-1)^+)``{i}"  
+  "above i r == ((r\<inverse>)\<^sup>+)``{i}"  
 
 definition reverse :: "[vertex, (vertex*vertex) set]=>(vertex*vertex)set" where
-  "reverse i r == (r - {(x,y). x=i | y=i} \<inter> r) \<union> ({(x,y). x=i|y=i} \<inter> r)^-1"
+  "reverse i r == (r - {(x,y). x=i | y=i} \<inter> r) \<union> ({(x,y). x=i|y=i} \<inter> r)\<inverse>"
 
 definition derive1 :: "[vertex, (vertex*vertex)set, (vertex*vertex)set]=>bool" where
     \<comment> \<open>The original definition\<close>
   "derive1 i r q == symcl r = symcl q &
-                    (\<forall>k k'. k\<noteq>i & k'\<noteq>i -->((k,k'):r) = ((k,k'):q)) &
+                    (\<forall>k k'. k\<noteq>i & k'\<noteq>i -->((k,k') \<in> r) = ((k,k') \<in> q)) \<and>
                     A i r = {} & R i q = {}"
 
 definition derive :: "[vertex, (vertex*vertex)set, (vertex*vertex)set]=>bool" where
@@ -68,13 +68,13 @@
 (* The equalities (above i r = {}) = (A i r = {}) 
    and (reach i r = {}) = (R i r) rely on the following theorem  *)
 
-lemma image0_trancl_iff_image0_r: "((r^+)``{i} = {}) = (r``{i} = {})"
+lemma image0_trancl_iff_image0_r: "((r\<^sup>+)``{i} = {}) = (r``{i} = {})"
 apply auto
 apply (erule trancl_induct, auto)
 done
 
 (* Another form usefull in some situation *)
-lemma image0_r_iff_image0_trancl: "(r``{i}={}) = (ALL x. ((i,x):r^+) = False)"
+lemma image0_r_iff_image0_trancl: "(r``{i}={}) = (\<forall>x. ((i,x) \<in> r\<^sup>+) = False)"
 apply auto
 apply (drule image0_trancl_iff_image0_r [THEN ssubst], auto)
 done
@@ -117,7 +117,7 @@
 
 (* Lemma 2 *)
 lemma maximal_converse_image0: 
-     "(z, i):r^+ ==> (\<forall>y. (y, z):r --> (y,i) \<notin> r^+) = ((r^-1)``{z}={})"
+     "(z, i) \<in> r\<^sup>+ \<Longrightarrow> (\<forall>y. (y, z) \<in> r \<longrightarrow> (y,i) \<notin> r\<^sup>+) = ((r\<inverse>)``{z}={})"
 apply auto
 apply (frule_tac r = r in trancl_into_trancl2, auto)
 done
@@ -125,7 +125,7 @@
 lemma above_lemma_a: 
      "acyclic r ==> A i r\<noteq>{}-->(\<exists>j \<in> above i r. A j r = {})"
 apply (simp add: acyclic_eq_wf wf_eq_minimal) 
-apply (drule_tac x = " ((r^-1) ^+) ``{i}" in spec)
+apply (drule_tac x = " ((r\<inverse>)\<^sup>+) ``{i}" in spec)
 apply auto
 apply (simp add: maximal_converse_image0 trancl_converse)
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Comp/TimerArray.thy
--- a/src/HOL/UNITY/Comp/TimerArray.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Comp/TimerArray.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -24,14 +24,14 @@
 declare count_def [simp] decr_def [simp]
 
 (*Demonstrates induction, but not used in the following proof*)
-lemma Timer_leadsTo_zero: "Timer : UNIV leadsTo {s. count s = 0}"
+lemma Timer_leadsTo_zero: "Timer \<in> UNIV leadsTo {s. count s = 0}"
 apply (rule_tac f = count in lessThan_induct, simp)
 apply (case_tac "m")
  apply (force intro!: subset_imp_leadsTo)
 apply (unfold Timer_def, ensures_tac "decr")
 done
 
-lemma Timer_preserves_snd [iff]: "Timer : preserves snd"
+lemma Timer_preserves_snd [iff]: "Timer \<in> preserves snd"
 apply (rule preservesI)
 apply (unfold Timer_def, safety)
 done
@@ -41,8 +41,8 @@
 
 lemma TimerArray_leadsTo_zero:
      "finite I  
-      ==> (plam i: I. Timer) : UNIV leadsTo {(s,uu). ALL i:I. s i = 0}"
-apply (erule_tac A'1 = "%i. lift_set i ({0} \<times> UNIV)" 
+      \<Longrightarrow> (plam i: I. Timer) \<in> UNIV leadsTo {(s,uu). \<forall>i\<in>I. s i = 0}"
+apply (erule_tac A'1 = "\<lambda>i. lift_set i ({0} \<times> UNIV)" 
        in finite_stable_completion [THEN leadsTo_weaken])
 apply auto
 (*Safety property, already reduced to the single Timer case*)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Constrains.thy
--- a/src/HOL/UNITY/Constrains.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Constrains.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -19,7 +19,7 @@
          (*Initial trace is empty*)
     Init:  "s \<in> init ==> (s,[]) \<in> traces init acts"
 
-  | Acts:  "[| act: acts;  (s,evs) \<in> traces init acts;  (s,s'): act |]
+  | Acts:  "[| act \<in> acts;  (s,evs) \<in> traces init acts;  (s,s') \<in> act |]
             ==> (s', s#evs) \<in> traces init acts"
 
 
@@ -29,7 +29,7 @@
   where
     Init:  "s \<in> Init F ==> s \<in> reachable F"
 
-  | Acts:  "[| act: Acts F;  s \<in> reachable F;  (s,s'): act |]
+  | Acts:  "[| act \<in> Acts F;  s \<in> reachable F;  (s,s') \<in> act |]
             ==> s' \<in> reachable F"
 
 definition Constrains :: "['a set, 'a set] => 'a program set" (infixl "Co" 60) where
@@ -106,7 +106,7 @@
 done
 
 lemma ConstrainsI: 
-    "(!!act s s'. [| act: Acts F;  (s,s') \<in> act;  s \<in> A |] ==> s': A')  
+    "(!!act s s'. [| act \<in> Acts F;  (s,s') \<in> act;  s \<in> A |] ==> s' \<in> A')  
      ==> F \<in> A Co A'"
 apply (rule constrains_imp_Constrains)
 apply (blast intro: constrainsI)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/ELT.thy
--- a/src/HOL/UNITY/ELT.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/ELT.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -31,11 +31,11 @@
   for CC :: "'a set set" and F :: "'a program"
  where
 
-   Basis:  "[| F : A ensures B;  A-B : (insert {} CC) |] ==> (A,B) : elt CC F"
+   Basis:  "[| F \<in> A ensures B;  A-B \<in> (insert {} CC) |] ==> (A,B) \<in> elt CC F"
 
- | Trans:  "[| (A,B) : elt CC F;  (B,C) : elt CC F |] ==> (A,C) : elt CC F"
+ | Trans:  "[| (A,B) \<in> elt CC F;  (B,C) \<in> elt CC F |] ==> (A,C) \<in> elt CC F"
 
- | Union:  "ALL A: S. (A,B) : elt CC F ==> (Union S, B) : elt CC F"
+ | Union:  "\<forall>A\<in>S. (A,B) \<in> elt CC F ==> (Union S, B) \<in> elt CC F"
 
 
 definition  
@@ -47,13 +47,13 @@
   (*visible version of the LEADS-TO relation*)
   leadsETo :: "['a set, 'a set set, 'a set] => 'a program set"
                                         ("(3_/ leadsTo[_]/ _)" [80,0,80] 80)
-  where "leadsETo A CC B = {F. (A,B) : elt CC F}"
+  where "leadsETo A CC B = {F. (A,B) \<in> elt CC F}"
 
 definition
   LeadsETo :: "['a set, 'a set set, 'a set] => 'a program set"
                                         ("(3_/ LeadsTo[_]/ _)" [80,0,80] 80)
   where "LeadsETo A CC B =
-      {F. F : (reachable F Int A) leadsTo[(%C. reachable F Int C) ` CC] B}"
+      {F. F \<in> (reachable F Int A) leadsTo[(%C. reachable F Int C) ` CC] B}"
 
 
 (*** givenBy ***)
@@ -61,35 +61,35 @@
 lemma givenBy_id [simp]: "givenBy id = UNIV"
 by (unfold givenBy_def, auto)
 
-lemma givenBy_eq_all: "(givenBy v) = {A. ALL x:A. ALL y. v x = v y --> y: A}"
+lemma givenBy_eq_all: "(givenBy v) = {A. \<forall>x\<in>A. \<forall>y. v x = v y \<longrightarrow> y \<in> A}"
 apply (unfold givenBy_def, safe)
 apply (rule_tac [2] x = "v ` _" in image_eqI, auto)
 done
 
-lemma givenByI: "(!!x y. [| x:A;  v x = v y |] ==> y: A) ==> A: givenBy v"
+lemma givenByI: "(\<And>x y. [| x \<in> A;  v x = v y |] ==> y \<in> A) ==> A \<in> givenBy v"
 by (subst givenBy_eq_all, blast)
 
-lemma givenByD: "[| A: givenBy v;  x:A;  v x = v y |] ==> y: A"
+lemma givenByD: "[| A \<in> givenBy v;  x \<in> A;  v x = v y |] ==> y \<in> A"
 by (unfold givenBy_def, auto)
 
-lemma empty_mem_givenBy [iff]: "{} : givenBy v"
+lemma empty_mem_givenBy [iff]: "{} \<in> givenBy v"
 by (blast intro!: givenByI)
 
-lemma givenBy_imp_eq_Collect: "A: givenBy v ==> EX P. A = {s. P(v s)}"
-apply (rule_tac x = "%n. EX s. v s = n & s : A" in exI)
+lemma givenBy_imp_eq_Collect: "A \<in> givenBy v ==> \<exists>P. A = {s. P(v s)}"
+apply (rule_tac x = "\<lambda>n. \<exists>s. v s = n \<and> s \<in> A" in exI)
 apply (simp (no_asm_use) add: givenBy_eq_all)
 apply blast
 done
 
-lemma Collect_mem_givenBy: "{s. P(v s)} : givenBy v"
+lemma Collect_mem_givenBy: "{s. P(v s)} \<in> givenBy v"
 by (unfold givenBy_def, best)
 
-lemma givenBy_eq_Collect: "givenBy v = {A. EX P. A = {s. P(v s)}}"
+lemma givenBy_eq_Collect: "givenBy v = {A. \<exists>P. A = {s. P(v s)}}"
 by (blast intro: Collect_mem_givenBy givenBy_imp_eq_Collect)
 
 (*preserving v preserves properties given by v*)
 lemma preserves_givenBy_imp_stable:
-     "[| F : preserves v;  D : givenBy v |] ==> F : stable D"
+     "[| F \<in> preserves v;  D \<in> givenBy v |] ==> F \<in> stable D"
 by (force simp add: preserves_subset_stable [THEN subsetD] givenBy_eq_Collect)
 
 lemma givenBy_o_subset: "givenBy (w o v) <= givenBy v"
@@ -98,7 +98,7 @@
 done
 
 lemma givenBy_DiffI:
-     "[| A : givenBy v;  B : givenBy v |] ==> A-B : givenBy v"
+     "[| A \<in> givenBy v;  B \<in> givenBy v |] ==> A-B \<in> givenBy v"
 apply (simp (no_asm_use) add: givenBy_eq_Collect)
 apply safe
 apply (rule_tac x = "%z. R z & ~ Q z" for R Q in exI)
@@ -110,13 +110,13 @@
 (** Standard leadsTo rules **)
 
 lemma leadsETo_Basis [intro]: 
-     "[| F: A ensures B;  A-B: insert {} CC |] ==> F : A leadsTo[CC] B"
+     "[| F \<in> A ensures B;  A-B \<in> insert {} CC |] ==> F \<in> A leadsTo[CC] B"
 apply (unfold leadsETo_def)
 apply (blast intro: elt.Basis)
 done
 
 lemma leadsETo_Trans: 
-     "[| F : A leadsTo[CC] B;  F : B leadsTo[CC] C |] ==> F : A leadsTo[CC] C"
+     "[| F \<in> A leadsTo[CC] B;  F \<in> B leadsTo[CC] C |] ==> F \<in> A leadsTo[CC] C"
 apply (unfold leadsETo_def)
 apply (blast intro: elt.Trans)
 done
@@ -124,33 +124,33 @@
 
 (*Useful with cancellation, disjunction*)
 lemma leadsETo_Un_duplicate:
-     "F : A leadsTo[CC] (A' Un A') ==> F : A leadsTo[CC] A'"
+     "F \<in> A leadsTo[CC] (A' \<union> A') \<Longrightarrow> F \<in> A leadsTo[CC] A'"
 by (simp add: Un_ac)
 
 lemma leadsETo_Un_duplicate2:
-     "F : A leadsTo[CC] (A' Un C Un C) ==> F : A leadsTo[CC] (A' Un C)"
+     "F \<in> A leadsTo[CC] (A' \<union> C \<union> C) ==> F \<in> A leadsTo[CC] (A' Un C)"
 by (simp add: Un_ac)
 
 (*The Union introduction rule as we should have liked to state it*)
 lemma leadsETo_Union:
-    "(!!A. A : S ==> F : A leadsTo[CC] B) ==> F : (\<Union>S) leadsTo[CC] B"
+    "(\<And>A. A \<in> S \<Longrightarrow> F \<in> A leadsTo[CC] B) \<Longrightarrow> F \<in> (\<Union>S) leadsTo[CC] B"
 apply (unfold leadsETo_def)
 apply (blast intro: elt.Union)
 done
 
 lemma leadsETo_UN:
-    "(!!i. i : I ==> F : (A i) leadsTo[CC] B)  
-     ==> F : (UN i:I. A i) leadsTo[CC] B"
+    "(\<And>i. i \<in> I \<Longrightarrow> F \<in> (A i) leadsTo[CC] B)  
+     ==> F \<in> (UN i:I. A i) leadsTo[CC] B"
 apply (blast intro: leadsETo_Union)
 done
 
 (*The INDUCTION rule as we should have liked to state it*)
 lemma leadsETo_induct:
-  "[| F : za leadsTo[CC] zb;   
-      !!A B. [| F : A ensures B;  A-B : insert {} CC |] ==> P A B;  
-      !!A B C. [| F : A leadsTo[CC] B; P A B; F : B leadsTo[CC] C; P B C |]  
+  "[| F \<in> za leadsTo[CC] zb;   
+      !!A B. [| F \<in> A ensures B;  A-B \<in> insert {} CC |] ==> P A B;  
+      !!A B C. [| F \<in> A leadsTo[CC] B; P A B; F \<in> B leadsTo[CC] C; P B C |]  
                ==> P A C;  
-      !!B S. ALL A:S. F : A leadsTo[CC] B & P A B ==> P (\<Union>S) B  
+      !!B S. \<forall>A\<in>S. F \<in> A leadsTo[CC] B & P A B ==> P (\<Union>S) B  
    |] ==> P za zb"
 apply (unfold leadsETo_def)
 apply (drule CollectD) 
@@ -169,13 +169,13 @@
 done
 
 lemma leadsETo_Trans_Un:
-     "[| F : A leadsTo[CC] B;  F : B leadsTo[DD] C |]  
-      ==> F : A leadsTo[CC Un DD] C"
+     "[| F \<in> A leadsTo[CC] B;  F \<in> B leadsTo[DD] C |]  
+      ==> F \<in> A leadsTo[CC Un DD] C"
 by (blast intro: leadsETo_mono [THEN subsetD] leadsETo_Trans)
 
 lemma leadsETo_Union_Int:
- "(!!A. A : S ==> F : (A Int C) leadsTo[CC] B) 
-  ==> F : (\<Union>S Int C) leadsTo[CC] B"
+ "(!!A. A \<in> S ==> F \<in> (A Int C) leadsTo[CC] B) 
+  ==> F \<in> (\<Union>S Int C) leadsTo[CC] B"
 apply (unfold leadsETo_def)
 apply (simp only: Int_Union_Union)
 apply (blast intro: elt.Union)
@@ -183,16 +183,16 @@
 
 (*Binary union introduction rule*)
 lemma leadsETo_Un:
-     "[| F : A leadsTo[CC] C; F : B leadsTo[CC] C |] 
-      ==> F : (A Un B) leadsTo[CC] C"
+     "[| F \<in> A leadsTo[CC] C; F \<in> B leadsTo[CC] C |] 
+      ==> F \<in> (A Un B) leadsTo[CC] C"
   using leadsETo_Union [of "{A, B}" F CC C] by auto
 
 lemma single_leadsETo_I:
-     "(!!x. x : A ==> F : {x} leadsTo[CC] B) ==> F : A leadsTo[CC] B"
+     "(\<And>x. x \<in> A ==> F \<in> {x} leadsTo[CC] B) \<Longrightarrow> F \<in> A leadsTo[CC] B"
 by (subst UN_singleton [symmetric], rule leadsETo_UN, blast)
 
 
-lemma subset_imp_leadsETo: "A<=B ==> F : A leadsTo[CC] B"
+lemma subset_imp_leadsETo: "A<=B \<Longrightarrow> F \<in> A leadsTo[CC] B"
 by (simp add: subset_imp_ensures [THEN leadsETo_Basis] 
               Diff_eq_empty_iff [THEN iffD2])
 
@@ -203,73 +203,73 @@
 (** Weakening laws **)
 
 lemma leadsETo_weaken_R:
-     "[| F : A leadsTo[CC] A';  A'<=B' |] ==> F : A leadsTo[CC] B'"
+     "[| F \<in> A leadsTo[CC] A';  A'<=B' |] ==> F \<in> A leadsTo[CC] B'"
 by (blast intro: subset_imp_leadsETo leadsETo_Trans)
 
 lemma leadsETo_weaken_L:
-     "[| F : A leadsTo[CC] A'; B<=A |] ==> F : B leadsTo[CC] A'"
+     "[| F \<in> A leadsTo[CC] A'; B<=A |] ==> F \<in> B leadsTo[CC] A'"
 by (blast intro: leadsETo_Trans subset_imp_leadsETo)
 
 (*Distributes over binary unions*)
 lemma leadsETo_Un_distrib:
-     "F : (A Un B) leadsTo[CC] C  =   
-      (F : A leadsTo[CC] C & F : B leadsTo[CC] C)"
+     "F \<in> (A Un B) leadsTo[CC] C  =   
+      (F \<in> A leadsTo[CC] C \<and> F \<in> B leadsTo[CC] C)"
 by (blast intro: leadsETo_Un leadsETo_weaken_L)
 
 lemma leadsETo_UN_distrib:
-     "F : (UN i:I. A i) leadsTo[CC] B  =   
-      (ALL i : I. F : (A i) leadsTo[CC] B)"
+     "F \<in> (UN i:I. A i) leadsTo[CC] B  =   
+      (\<forall>i\<in>I. F \<in> (A i) leadsTo[CC] B)"
 by (blast intro: leadsETo_UN leadsETo_weaken_L)
 
 lemma leadsETo_Union_distrib:
-     "F : (\<Union>S) leadsTo[CC] B  =  (ALL A : S. F : A leadsTo[CC] B)"
+     "F \<in> (\<Union>S) leadsTo[CC] B  =  (\<forall>A\<in>S. F \<in> A leadsTo[CC] B)"
 by (blast intro: leadsETo_Union leadsETo_weaken_L)
 
 lemma leadsETo_weaken:
-     "[| F : A leadsTo[CC'] A'; B<=A; A'<=B';  CC' <= CC |]  
-      ==> F : B leadsTo[CC] B'"
+     "[| F \<in> A leadsTo[CC'] A'; B<=A; A'<=B';  CC' <= CC |]  
+      ==> F \<in> B leadsTo[CC] B'"
 apply (drule leadsETo_mono [THEN subsetD], assumption)
 apply (blast del: subsetCE 
              intro: leadsETo_weaken_R leadsETo_weaken_L leadsETo_Trans)
 done
 
 lemma leadsETo_givenBy:
-     "[| F : A leadsTo[CC] A';  CC <= givenBy v |]  
-      ==> F : A leadsTo[givenBy v] A'"
+     "[| F \<in> A leadsTo[CC] A';  CC <= givenBy v |]  
+      ==> F \<in> A leadsTo[givenBy v] A'"
 by (blast intro: leadsETo_weaken)
 
 
 (*Set difference*)
 lemma leadsETo_Diff:
-     "[| F : (A-B) leadsTo[CC] C; F : B leadsTo[CC] C |]  
-      ==> F : A leadsTo[CC] C"
+     "[| F \<in> (A-B) leadsTo[CC] C; F \<in> B leadsTo[CC] C |]  
+      ==> F \<in> A leadsTo[CC] C"
 by (blast intro: leadsETo_Un leadsETo_weaken)
 
 
 (*Binary union version*)
 lemma leadsETo_Un_Un:
-     "[| F : A leadsTo[CC] A';  F : B leadsTo[CC] B' |]  
-      ==> F : (A Un B) leadsTo[CC] (A' Un B')"
+     "[| F \<in> A leadsTo[CC] A';  F \<in> B leadsTo[CC] B' |]  
+      ==> F \<in> (A Un B) leadsTo[CC] (A' Un B')"
 by (blast intro: leadsETo_Un leadsETo_weaken_R)
 
 
 (** The cancellation law **)
 
 lemma leadsETo_cancel2:
-     "[| F : A leadsTo[CC] (A' Un B); F : B leadsTo[CC] B' |]  
-      ==> F : A leadsTo[CC] (A' Un B')"
+     "[| F \<in> A leadsTo[CC] (A' Un B); F \<in> B leadsTo[CC] B' |]  
+      ==> F \<in> A leadsTo[CC] (A' Un B')"
 by (blast intro: leadsETo_Un_Un subset_imp_leadsETo leadsETo_Trans)
 
 lemma leadsETo_cancel1:
-     "[| F : A leadsTo[CC] (B Un A'); F : B leadsTo[CC] B' |]  
-    ==> F : A leadsTo[CC] (B' Un A')"
+     "[| F \<in> A leadsTo[CC] (B Un A'); F \<in> B leadsTo[CC] B' |]  
+    ==> F \<in> A leadsTo[CC] (B' Un A')"
 apply (simp add: Un_commute)
 apply (blast intro!: leadsETo_cancel2)
 done
 
 lemma leadsETo_cancel_Diff1:
-     "[| F : A leadsTo[CC] (B Un A'); F : (B-A') leadsTo[CC] B' |]  
-    ==> F : A leadsTo[CC] (B' Un A')"
+     "[| F \<in> A leadsTo[CC] (B Un A'); F \<in> (B-A') leadsTo[CC] B' |]  
+    ==> F \<in> A leadsTo[CC] (B' Un A')"
 apply (rule leadsETo_cancel1)
  prefer 2 apply assumption
 apply simp_all
@@ -280,8 +280,8 @@
 
 (*Special case of PSP: Misra's "stable conjunction"*)
 lemma e_psp_stable: 
-   "[| F : A leadsTo[CC] A';  F : stable B;  ALL C:CC. C Int B : CC |]  
-    ==> F : (A Int B) leadsTo[CC] (A' Int B)"
+   "[| F \<in> A leadsTo[CC] A';  F \<in> stable B;  \<forall>C\<in>CC. C Int B \<in> CC |]  
+    ==> F \<in> (A Int B) leadsTo[CC] (A' Int B)"
 apply (unfold stable_def)
 apply (erule leadsETo_induct)
 prefer 3 apply (blast intro: leadsETo_Union_Int)
@@ -294,14 +294,14 @@
 done
 
 lemma e_psp_stable2:
-     "[| F : A leadsTo[CC] A'; F : stable B;  ALL C:CC. C Int B : CC |]  
-      ==> F : (B Int A) leadsTo[CC] (B Int A')"
+     "[| F \<in> A leadsTo[CC] A'; F \<in> stable B;  \<forall>C\<in>CC. C Int B \<in> CC |]  
+      ==> F \<in> (B Int A) leadsTo[CC] (B Int A')"
 by (simp (no_asm_simp) add: e_psp_stable Int_ac)
 
 lemma e_psp:
-     "[| F : A leadsTo[CC] A'; F : B co B';   
-         ALL C:CC. C Int B Int B' : CC |]  
-      ==> F : (A Int B') leadsTo[CC] ((A' Int B) Un (B' - B))"
+     "[| F \<in> A leadsTo[CC] A'; F \<in> B co B';   
+         \<forall>C\<in>CC. C Int B Int B' \<in> CC |]  
+      ==> F \<in> (A Int B') leadsTo[CC] ((A' Int B) Un (B' - B))"
 apply (erule leadsETo_induct)
 prefer 3 apply (blast intro: leadsETo_Union_Int)
 (*Transitivity case has a delicate argument involving "cancellation"*)
@@ -318,9 +318,9 @@
 done
 
 lemma e_psp2:
-     "[| F : A leadsTo[CC] A'; F : B co B';   
-         ALL C:CC. C Int B Int B' : CC |]  
-      ==> F : (B' Int A) leadsTo[CC] ((B Int A') Un (B' - B))"
+     "[| F \<in> A leadsTo[CC] A'; F \<in> B co B';   
+         \<forall>C\<in>CC. C Int B Int B' \<in> CC |]  
+      ==> F \<in> (B' Int A) leadsTo[CC] ((B Int A') Un (B' - B))"
 by (simp add: e_psp Int_ac)
 
 
@@ -328,9 +328,9 @@
 
 (*??IS THIS NEEDED?? or is it just an example of what's provable??*)
 lemma gen_leadsETo_imp_Join_leadsETo:
-     "[| F: (A leadsTo[givenBy v] B);  G : preserves v;   
-         F\<squnion>G : stable C |]  
-      ==> F\<squnion>G : ((C Int A) leadsTo[(%D. C Int D) ` givenBy v] B)"
+     "[| F \<in> (A leadsTo[givenBy v] B);  G \<in> preserves v;   
+         F\<squnion>G \<in> stable C |]  
+      ==> F\<squnion>G \<in> ((C Int A) leadsTo[(%D. C Int D) ` givenBy v] B)"
 apply (erule leadsETo_induct)
   prefer 3
   apply (subst Int_Union) 
@@ -371,7 +371,7 @@
 
 lemma LeadsETo_eq_leadsETo: 
      "A LeadsTo[CC] B =  
-        {F. F : (reachable F Int A) leadsTo[(%C. reachable F Int C) ` CC]  
+        {F. F \<in> (reachable F Int A) leadsTo[(%C. reachable F Int C) ` CC]  
         (reachable F Int B)}"
 apply (unfold LeadsETo_def)
 apply (blast dest: e_psp_stable2 intro: leadsETo_weaken)
@@ -380,38 +380,38 @@
 (*** Introduction rules: Basis, Trans, Union ***)
 
 lemma LeadsETo_Trans:
-     "[| F : A LeadsTo[CC] B;  F : B LeadsTo[CC] C |]  
-      ==> F : A LeadsTo[CC] C"
+     "[| F \<in> A LeadsTo[CC] B;  F \<in> B LeadsTo[CC] C |]  
+      ==> F \<in> A LeadsTo[CC] C"
 apply (simp add: LeadsETo_eq_leadsETo)
 apply (blast intro: leadsETo_Trans)
 done
 
 lemma LeadsETo_Union:
-     "(!!A. A : S ==> F : A LeadsTo[CC] B) ==> F : (\<Union>S) LeadsTo[CC] B"
+     "(\<And>A. A \<in> S \<Longrightarrow> F \<in> A LeadsTo[CC] B) \<Longrightarrow> F \<in> (\<Union>S) LeadsTo[CC] B"
 apply (simp add: LeadsETo_def)
 apply (subst Int_Union)
 apply (blast intro: leadsETo_UN)
 done
 
 lemma LeadsETo_UN:
-     "(!!i. i : I ==> F : (A i) LeadsTo[CC] B)  
-      ==> F : (UN i:I. A i) LeadsTo[CC] B"
+     "(\<And>i. i \<in> I \<Longrightarrow> F \<in> (A i) LeadsTo[CC] B)  
+      \<Longrightarrow> F \<in> (UN i:I. A i) LeadsTo[CC] B"
 apply (blast intro: LeadsETo_Union)
 done
 
 (*Binary union introduction rule*)
 lemma LeadsETo_Un:
-     "[| F : A LeadsTo[CC] C; F : B LeadsTo[CC] C |]  
-      ==> F : (A Un B) LeadsTo[CC] C"
+     "[| F \<in> A LeadsTo[CC] C; F \<in> B LeadsTo[CC] C |]  
+      ==> F \<in> (A Un B) LeadsTo[CC] C"
   using LeadsETo_Union [of "{A, B}" F CC C] by auto
 
 (*Lets us look at the starting state*)
 lemma single_LeadsETo_I:
-     "(!!s. s : A ==> F : {s} LeadsTo[CC] B) ==> F : A LeadsTo[CC] B"
+     "(\<And>s. s \<in> A ==> F \<in> {s} LeadsTo[CC] B) \<Longrightarrow> F \<in> A LeadsTo[CC] B"
 by (subst UN_singleton [symmetric], rule LeadsETo_UN, blast)
 
 lemma subset_imp_LeadsETo:
-     "A <= B ==> F : A LeadsTo[CC] B"
+     "A <= B \<Longrightarrow> F \<in> A LeadsTo[CC] B"
 apply (simp (no_asm) add: LeadsETo_def)
 apply (blast intro: subset_imp_leadsETo)
 done
@@ -419,21 +419,21 @@
 lemmas empty_LeadsETo = empty_subsetI [THEN subset_imp_LeadsETo]
 
 lemma LeadsETo_weaken_R:
-     "[| F : A LeadsTo[CC] A';  A' <= B' |] ==> F : A LeadsTo[CC] B'"
+     "[| F \<in> A LeadsTo[CC] A';  A' <= B' |] ==> F \<in> A LeadsTo[CC] B'"
 apply (simp add: LeadsETo_def)
 apply (blast intro: leadsETo_weaken_R)
 done
 
 lemma LeadsETo_weaken_L:
-     "[| F : A LeadsTo[CC] A';  B <= A |] ==> F : B LeadsTo[CC] A'"
+     "[| F \<in> A LeadsTo[CC] A';  B <= A |] ==> F \<in> B LeadsTo[CC] A'"
 apply (simp add: LeadsETo_def)
 apply (blast intro: leadsETo_weaken_L)
 done
 
 lemma LeadsETo_weaken:
-     "[| F : A LeadsTo[CC'] A';    
+     "[| F \<in> A LeadsTo[CC'] A';    
          B <= A;  A' <= B';  CC' <= CC |]  
-      ==> F : B LeadsTo[CC] B'"
+      ==> F \<in> B LeadsTo[CC] B'"
 apply (simp (no_asm_use) add: LeadsETo_def)
 apply (blast intro: leadsETo_weaken)
 done
@@ -445,12 +445,12 @@
 
 (*Postcondition can be strengthened to (reachable F Int B) *)
 lemma reachable_ensures:
-     "F : A ensures B ==> F : (reachable F Int A) ensures B"
+     "F \<in> A ensures B \<Longrightarrow> F \<in> (reachable F Int A) ensures B"
 apply (rule stable_ensures_Int [THEN ensures_weaken_R], auto)
 done
 
 lemma lel_lemma:
-     "F : A leadsTo B ==> F : (reachable F Int A) leadsTo[Pow(reachable F)] B"
+     "F \<in> A leadsTo B \<Longrightarrow> F \<in> (reachable F Int A) leadsTo[Pow(reachable F)] B"
 apply (erule leadsTo_induct)
   apply (blast intro: reachable_ensures)
  apply (blast dest: e_psp_stable2 intro: leadsETo_Trans leadsETo_weaken_L)
@@ -483,13 +483,13 @@
 by (simp add: givenBy_eq_Collect, best)
 
 lemma extend_set_givenBy_I:
-     "D : givenBy v ==> extend_set h D : givenBy (v o f)"
+     "D \<in> givenBy v ==> extend_set h D \<in> givenBy (v o f)"
 apply (simp (no_asm_use) add: givenBy_eq_all, blast)
 done
 
 lemma leadsETo_imp_extend_leadsETo:
-     "F : A leadsTo[CC] B  
-      ==> extend h F : (extend_set h A) leadsTo[extend_set h ` CC]  
+     "F \<in> A leadsTo[CC] B  
+      ==> extend h F \<in> (extend_set h A) leadsTo[extend_set h ` CC]  
                        (extend_set h B)"
 apply (erule leadsETo_induct)
   apply (force intro: subset_imp_ensures 
@@ -502,11 +502,11 @@
 (*This version's stronger in the "ensures" precondition
   BUT there's no ensures_weaken_L*)
 lemma Join_project_ensures_strong:
-     "[| project h C G ~: transient (project_set h C Int (A-B)) |  
+     "[| project h C G \<notin> transient (project_set h C Int (A-B)) |  
            project_set h C Int (A - B) = {};   
-         extend h F\<squnion>G : stable C;   
-         F\<squnion>project h C G : (project_set h C Int A) ensures B |]  
-      ==> extend h F\<squnion>G : (C Int extend_set h A) ensures (extend_set h B)"
+         extend h F\<squnion>G \<in> stable C;   
+         F\<squnion>project h C G \<in> (project_set h C Int A) ensures B |]  
+      ==> extend h F\<squnion>G \<in> (C Int extend_set h A) ensures (extend_set h B)"
 apply (subst Int_extend_set_lemma [symmetric])
 apply (rule Join_project_ensures)
 apply (auto simp add: Int_Diff)
@@ -595,22 +595,22 @@
 
 (*Lemma for the Trans case*)
 lemma pli_lemma:
-     "[| extend h F\<squnion>G : stable C;     
+     "[| extend h F\<squnion>G \<in> stable C;     
          F\<squnion>project h C G     
-           : project_set h C Int project_set h A leadsTo project_set h B |]  
+           \<in> project_set h C Int project_set h A leadsTo project_set h B |]  
       ==> F\<squnion>project h C G     
-            : project_set h C Int project_set h A leadsTo     
+            \<in> project_set h C Int project_set h A leadsTo     
               project_set h C Int project_set h B"
 apply (rule psp_stable2 [THEN leadsTo_weaken_L])
 apply (auto simp add: project_stable_project_set extend_stable_project_set)
 done
 
 lemma project_leadsETo_I_lemma:
-     "[| extend h F\<squnion>G : stable C;   
-         extend h F\<squnion>G :  
+     "[| extend h F\<squnion>G \<in> stable C;   
+         extend h F\<squnion>G \<in>  
            (C Int A) leadsTo[(%D. C Int D)`givenBy f]  B |]   
   ==> F\<squnion>project h C G   
-    : (project_set h C Int project_set h (C Int A)) leadsTo (project_set h B)"
+    \<in> (project_set h C Int project_set h (C Int A)) leadsTo (project_set h B)"
 apply (erule leadsETo_induct)
   prefer 3
   apply (simp only: Int_UN_distrib project_set_Union)
@@ -622,22 +622,22 @@
 done
 
 lemma project_leadsETo_I:
-     "extend h F\<squnion>G : (extend_set h A) leadsTo[givenBy f] (extend_set h B)
-      ==> F\<squnion>project h UNIV G : A leadsTo B"
+     "extend h F\<squnion>G \<in> (extend_set h A) leadsTo[givenBy f] (extend_set h B)
+      \<Longrightarrow> F\<squnion>project h UNIV G \<in> A leadsTo B"
 apply (rule project_leadsETo_I_lemma [THEN leadsTo_weaken], auto)
 done
 
 lemma project_LeadsETo_I:
-     "extend h F\<squnion>G : (extend_set h A) LeadsTo[givenBy f] (extend_set h B) 
-      ==> F\<squnion>project h (reachable (extend h F\<squnion>G)) G   
-           : A LeadsTo B"
+     "extend h F\<squnion>G \<in> (extend_set h A) LeadsTo[givenBy f] (extend_set h B) 
+      \<Longrightarrow> F\<squnion>project h (reachable (extend h F\<squnion>G)) G   
+           \<in> A LeadsTo B"
 apply (simp (no_asm_use) add: LeadsTo_def LeadsETo_def)
 apply (rule project_leadsETo_I_lemma [THEN leadsTo_weaken])
 apply (auto simp add: project_set_reachable_extend_eq [symmetric])
 done
 
 lemma projecting_leadsTo: 
-     "projecting (%G. UNIV) h F  
+     "projecting (\<lambda>G. UNIV) h F  
                  (extend_set h A leadsTo[givenBy f] extend_set h B)  
                  (A leadsTo B)"
 apply (unfold projecting_def)
@@ -645,7 +645,7 @@
 done
 
 lemma projecting_LeadsTo: 
-     "projecting (%G. reachable (extend h F\<squnion>G)) h F  
+     "projecting (\<lambda>G. reachable (extend h F\<squnion>G)) h F  
                  (extend_set h A LeadsTo[givenBy f] extend_set h B)  
                  (A LeadsTo B)"
 apply (unfold projecting_def)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Extend.thy
--- a/src/HOL/UNITY/Extend.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Extend.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -49,7 +49,7 @@
   where "project h C F =
        mk_program (project_set h (Init F),
                    project_act h ` Restrict C ` Acts F,
-                   {act. Restrict (project_set h C) act :
+                   {act. Restrict (project_set h C) act \<in>
                          project_act h ` Restrict C ` AllowedActs F})"
 
 locale Extend =
@@ -70,7 +70,7 @@
 subsection\<open>Restrict\<close>
 (*MOVE to Relation.thy?*)
 
-lemma Restrict_iff [iff]: "((x,y): Restrict A r) = ((x,y): r & x \<in> A)"
+lemma Restrict_iff [iff]: "((x,y) \<in> Restrict A r) = ((x,y) \<in> r & x \<in> A)"
 by (unfold Restrict_def, blast)
 
 lemma Restrict_UNIV [simp]: "Restrict UNIV = id"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/FP.thy
--- a/src/HOL/UNITY/FP.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/FP.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -10,21 +10,21 @@
 theory FP imports UNITY begin
 
 definition FP_Orig :: "'a program => 'a set" where
-    "FP_Orig F == \<Union>{A. ALL B. F : stable (A Int B)}"
+    "FP_Orig F == \<Union>{A. \<forall>B. F \<in> stable (A \<inter> B)}"
 
 definition FP :: "'a program => 'a set" where
-    "FP F == {s. F : stable {s}}"
+    "FP F == {s. F \<in> stable {s}}"
 
-lemma stable_FP_Orig_Int: "F : stable (FP_Orig F Int B)"
+lemma stable_FP_Orig_Int: "F \<in> stable (FP_Orig F Int B)"
 apply (simp only: FP_Orig_def stable_def Int_Union2)
 apply (blast intro: constrains_UN)
 done
 
 lemma FP_Orig_weakest:
-    "(!!B. F : stable (A Int B)) ==> A <= FP_Orig F"
+    "(\<And>B. F \<in> stable (A \<inter> B)) \<Longrightarrow> A <= FP_Orig F"
 by (simp add: FP_Orig_def stable_def, blast)
 
-lemma stable_FP_Int: "F : stable (FP F Int B)"
+lemma stable_FP_Int: "F \<in> stable (FP F \<inter> B)"
 apply (subgoal_tac "FP F Int B = (UN x:B. FP F Int {x}) ")
 prefer 2 apply blast
 apply (simp (no_asm_simp) add: Int_insert_right)
@@ -42,7 +42,7 @@
 done
 
 lemma FP_weakest:
-    "(!!B. F : stable (A Int B)) ==> A <= FP F"
+    "(\<And>B. F \<in> stable (A Int B)) \<Longrightarrow> A <= FP F"
 by (simp add: FP_equivalence FP_Orig_weakest)
 
 lemma Compl_FP: 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Guar.thy
--- a/src/HOL/UNITY/Guar.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Guar.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -85,8 +85,8 @@
   done
 
 lemma ex2: 
-     "\<forall>GG. finite GG & GG \<inter> X \<noteq> {} --> OK GG (%G. G) -->(\<Squnion>G \<in> GG. G):X 
-      ==> ex_prop X"
+     "\<forall>GG. finite GG & GG \<inter> X \<noteq> {} \<longrightarrow> OK GG (\<lambda>G. G) \<longrightarrow> (\<Squnion>G \<in> GG. G) \<in> X 
+      \<Longrightarrow> ex_prop X"
 apply (unfold ex_prop_def, clarify)
 apply (drule_tac x = "{F,G}" in spec)
 apply (auto dest: ok_sym simp add: OK_iff_ok)
@@ -140,7 +140,7 @@
 (*Chandy & Sanders take this as a definition*)
 lemma uv_prop_finite:
      "uv_prop X = 
-      (\<forall>GG. finite GG & GG \<subseteq> X & OK GG (%G. G) --> (\<Squnion>G \<in> GG. G): X)"
+      (\<forall>GG. finite GG \<and> GG \<subseteq> X \<and> OK GG (\<lambda>G. G) \<longrightarrow> (\<Squnion>G \<in> GG. G) \<in> X)"
 by (blast intro: uv1 uv2)
 
 subsection\<open>Guarantees\<close>
@@ -403,8 +403,8 @@
 by (simp add: wg_equiv)
 
 lemma wg_finite: 
-    "\<forall>FF. finite FF & FF \<inter> X \<noteq> {} --> OK FF (%F. F)  
-          --> (\<forall>F\<in>FF. ((\<Squnion>F \<in> FF. F): wg F X) = ((\<Squnion>F \<in> FF. F):X))"
+    "\<forall>FF. finite FF \<and> FF \<inter> X \<noteq> {} \<longrightarrow> OK FF (\<lambda>F. F)
+          \<longrightarrow> (\<forall>F\<in>FF. ((\<Squnion>F \<in> FF. F) \<in> wg F X) = ((\<Squnion>F \<in> FF. F) \<in> X))"
 apply clarify
 apply (subgoal_tac "F component_of (\<Squnion>F \<in> FF. F) ")
 apply (drule_tac X = X in component_of_wg, simp)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/ListOrder.thy
--- a/src/HOL/UNITY/ListOrder.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/ListOrder.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -20,18 +20,18 @@
   genPrefix :: "('a * 'a)set => ('a list * 'a list)set"
   for r :: "('a * 'a)set"
  where
-   Nil:     "([],[]) : genPrefix(r)"
+   Nil:     "([],[]) \<in> genPrefix(r)"
 
- | prepend: "[| (xs,ys) : genPrefix(r);  (x,y) : r |] ==>
-             (x#xs, y#ys) : genPrefix(r)"
+ | prepend: "[| (xs,ys) \<in> genPrefix(r);  (x,y) \<in> r |] ==>
+             (x#xs, y#ys) \<in> genPrefix(r)"
 
- | append:  "(xs,ys) : genPrefix(r) ==> (xs, ys@zs) : genPrefix(r)"
+ | append:  "(xs,ys) \<in> genPrefix(r) ==> (xs, ys@zs) \<in> genPrefix(r)"
 
 instantiation list :: (type) ord 
 begin
 
 definition
-  prefix_def:        "xs <= zs \<longleftrightarrow>  (xs, zs) : genPrefix Id"
+  prefix_def:        "xs <= zs \<longleftrightarrow>  (xs, zs) \<in> genPrefix Id"
 
 definition
   strict_prefix_def: "xs < zs  \<longleftrightarrow>  xs \<le> zs \<and> \<not> zs \<le> (xs :: 'a list)"
@@ -50,37 +50,37 @@
 
 abbreviation
   pfixLe :: "[nat list, nat list] => bool"  (infixl "pfixLe" 50)  where
-  "xs pfixLe ys == (xs,ys) : genPrefix Le"
+  "xs pfixLe ys == (xs,ys) \<in> genPrefix Le"
 
 abbreviation
   pfixGe :: "[nat list, nat list] => bool"  (infixl "pfixGe" 50)  where
-  "xs pfixGe ys == (xs,ys) : genPrefix Ge"
+  "xs pfixGe ys == (xs,ys) \<in> genPrefix Ge"
 
 
 subsection\<open>preliminary lemmas\<close>
 
-lemma Nil_genPrefix [iff]: "([], xs) : genPrefix r"
+lemma Nil_genPrefix [iff]: "([], xs) \<in> genPrefix r"
 by (cut_tac genPrefix.Nil [THEN genPrefix.append], auto)
 
-lemma genPrefix_length_le: "(xs,ys) : genPrefix r ==> length xs <= length ys"
+lemma genPrefix_length_le: "(xs,ys) \<in> genPrefix r \<Longrightarrow> length xs <= length ys"
 by (erule genPrefix.induct, auto)
 
 lemma cdlemma:
-     "[| (xs', ys'): genPrefix r |]  
-      ==> (ALL x xs. xs' = x#xs --> (EX y ys. ys' = y#ys & (x,y) : r & (xs, ys) : genPrefix r))"
+     "[| (xs', ys') \<in> genPrefix r |]  
+      ==> (\<forall>x xs. xs' = x#xs \<longrightarrow> (\<exists>y ys. ys' = y#ys & (x,y) \<in> r & (xs, ys) \<in> genPrefix r))"
 apply (erule genPrefix.induct, blast, blast)
 apply (force intro: genPrefix.append)
 done
 
 (*As usual converting it to an elimination rule is tiresome*)
 lemma cons_genPrefixE [elim!]: 
-     "[| (x#xs, zs): genPrefix r;   
-         !!y ys. [| zs = y#ys;  (x,y) : r;  (xs, ys) : genPrefix r |] ==> P  
+     "[| (x#xs, zs) \<in> genPrefix r;   
+         !!y ys. [| zs = y#ys;  (x,y) \<in> r;  (xs, ys) \<in> genPrefix r |] ==> P  
       |] ==> P"
 by (drule cdlemma, simp, blast)
 
 lemma Cons_genPrefix_Cons [iff]:
-     "((x#xs,y#ys) : genPrefix r) = ((x,y) : r & (xs,ys) : genPrefix r)"
+     "((x#xs,y#ys) \<in> genPrefix r) = ((x,y) \<in> r \<and> (xs,ys) \<in> genPrefix r)"
 by (blast intro: genPrefix.prepend)
 
 
@@ -93,7 +93,7 @@
 apply (blast intro: genPrefix.Nil)
 done
 
-lemma genPrefix_refl [simp]: "refl r ==> (l,l) : genPrefix r"
+lemma genPrefix_refl [simp]: "refl r \<Longrightarrow> (l,l) \<in> genPrefix r"
 by (erule refl_onD [OF refl_genPrefix UNIV_I])
 
 lemma genPrefix_mono: "r<=s ==> genPrefix r <= genPrefix s"
@@ -107,13 +107,13 @@
 
 (*A lemma for proving genPrefix_trans_O*)
 lemma append_genPrefix:
-     "(xs @ ys, zs) : genPrefix r \<Longrightarrow> (xs, zs) : genPrefix r"
+     "(xs @ ys, zs) \<in> genPrefix r \<Longrightarrow> (xs, zs) \<in> genPrefix r"
   by (induct xs arbitrary: zs) auto
 
 (*Lemma proving transitivity and more*)
 lemma genPrefix_trans_O:
-  assumes "(x, y) : genPrefix r"
-  shows "\<And>z. (y, z) : genPrefix s \<Longrightarrow> (x, z) : genPrefix (r O s)"
+  assumes "(x, y) \<in> genPrefix r"
+  shows "\<And>z. (y, z) \<in> genPrefix s \<Longrightarrow> (x, z) \<in> genPrefix (r O s)"
   apply (atomize (full))
   using assms
   apply induct
@@ -123,22 +123,22 @@
   done
 
 lemma genPrefix_trans:
-  "(x, y) : genPrefix r \<Longrightarrow> (y, z) : genPrefix r \<Longrightarrow> trans r
-    \<Longrightarrow> (x, z) : genPrefix r"
+  "(x, y) \<in> genPrefix r \<Longrightarrow> (y, z) \<in> genPrefix r \<Longrightarrow> trans r
+    \<Longrightarrow> (x, z) \<in> genPrefix r"
   apply (rule trans_O_subset [THEN genPrefix_mono, THEN subsetD])
    apply assumption
   apply (blast intro: genPrefix_trans_O)
   done
 
 lemma prefix_genPrefix_trans:
-  "[| x<=y;  (y,z) : genPrefix r |] ==> (x, z) : genPrefix r"
+  "[| x<=y;  (y,z) \<in> genPrefix r |] ==> (x, z) \<in> genPrefix r"
 apply (unfold prefix_def)
 apply (drule genPrefix_trans_O, assumption)
 apply simp
 done
 
 lemma genPrefix_prefix_trans:
-  "[| (x,y) : genPrefix r;  y<=z |] ==> (x,z) : genPrefix r"
+  "[| (x,y) \<in> genPrefix r;  y<=z |] ==> (x,z) \<in> genPrefix r"
 apply (unfold prefix_def)
 apply (drule genPrefix_trans_O, assumption)
 apply simp
@@ -151,9 +151,9 @@
 (** Antisymmetry **)
 
 lemma genPrefix_antisym:
-  assumes 1: "(xs, ys) : genPrefix r"
+  assumes 1: "(xs, ys) \<in> genPrefix r"
     and 2: "antisym r"
-    and 3: "(ys, xs) : genPrefix r"
+    and 3: "(ys, xs) \<in> genPrefix r"
   shows "xs = ys"
   using 1 3
 proof induct
@@ -178,29 +178,29 @@
 
 subsection\<open>recursion equations\<close>
 
-lemma genPrefix_Nil [simp]: "((xs, []) : genPrefix r) = (xs = [])"
+lemma genPrefix_Nil [simp]: "((xs, []) \<in> genPrefix r) = (xs = [])"
   by (induct xs) auto
 
 lemma same_genPrefix_genPrefix [simp]: 
-    "refl r ==> ((xs@ys, xs@zs) : genPrefix r) = ((ys,zs) : genPrefix r)"
+    "refl r \<Longrightarrow> ((xs@ys, xs@zs) \<in> genPrefix r) = ((ys,zs) \<in> genPrefix r)"
   by (induct xs) (simp_all add: refl_on_def)
 
 lemma genPrefix_Cons:
-     "((xs, y#ys) : genPrefix r) =  
-      (xs=[] | (EX z zs. xs=z#zs & (z,y) : r & (zs,ys) : genPrefix r))"
+     "((xs, y#ys) \<in> genPrefix r) =  
+      (xs=[] | (\<exists>z zs. xs=z#zs & (z,y) \<in> r & (zs,ys) \<in> genPrefix r))"
   by (cases xs) auto
 
 lemma genPrefix_take_append:
-     "[| refl r;  (xs,ys) : genPrefix r |]  
-      ==>  (xs@zs, take (length xs) ys @ zs) : genPrefix r"
+     "[| refl r;  (xs,ys) \<in> genPrefix r |]  
+      ==>  (xs@zs, take (length xs) ys @ zs) \<in> genPrefix r"
 apply (erule genPrefix.induct)
 apply (frule_tac [3] genPrefix_length_le)
 apply (simp_all (no_asm_simp) add: diff_is_0_eq [THEN iffD2])
 done
 
 lemma genPrefix_append_both:
-     "[| refl r;  (xs,ys) : genPrefix r;  length xs = length ys |]  
-      ==>  (xs@zs, ys @ zs) : genPrefix r"
+     "[| refl r;  (xs,ys) \<in> genPrefix r;  length xs = length ys |]  
+      ==>  (xs@zs, ys @ zs) \<in> genPrefix r"
 apply (drule genPrefix_take_append, assumption)
 apply simp
 done
@@ -211,8 +211,8 @@
 by auto
 
 lemma aolemma:
-     "[| (xs,ys) : genPrefix r;  refl r |]  
-      ==> length xs < length ys --> (xs @ [ys ! length xs], ys) : genPrefix r"
+     "[| (xs,ys) \<in> genPrefix r;  refl r |]  
+      ==> length xs < length ys \<longrightarrow> (xs @ [ys ! length xs], ys) \<in> genPrefix r"
 apply (erule genPrefix.induct)
   apply blast
  apply simp
@@ -226,15 +226,15 @@
 done
 
 lemma append_one_genPrefix:
-     "[| (xs,ys) : genPrefix r;  length xs < length ys;  refl r |]  
-      ==> (xs @ [ys ! length xs], ys) : genPrefix r"
+     "[| (xs,ys) \<in> genPrefix r;  length xs < length ys;  refl r |]  
+      ==> (xs @ [ys ! length xs], ys) \<in> genPrefix r"
 by (blast intro: aolemma [THEN mp])
 
 
 (** Proving the equivalence with Charpentier's definition **)
 
 lemma genPrefix_imp_nth:
-    "i < length xs \<Longrightarrow> (xs, ys) : genPrefix r \<Longrightarrow> (xs ! i, ys ! i) : r"
+    "i < length xs \<Longrightarrow> (xs, ys) \<in> genPrefix r \<Longrightarrow> (xs ! i, ys ! i) \<in> r"
   apply (induct xs arbitrary: i ys)
    apply auto
   apply (case_tac i)
@@ -243,8 +243,8 @@
 
 lemma nth_imp_genPrefix:
   "length xs <= length ys \<Longrightarrow>
-     (\<forall>i. i < length xs --> (xs ! i, ys ! i) : r) \<Longrightarrow>
-     (xs, ys) : genPrefix r"
+     (\<forall>i. i < length xs \<longrightarrow> (xs ! i, ys ! i) \<in> r) \<Longrightarrow>
+     (xs, ys) \<in> genPrefix r"
   apply (induct xs arbitrary: ys)
    apply (simp_all add: less_Suc_eq_0_disj all_conj_distrib)
   apply (case_tac ys)
@@ -252,8 +252,8 @@
   done
 
 lemma genPrefix_iff_nth:
-     "((xs,ys) : genPrefix r) =  
-      (length xs <= length ys & (ALL i. i < length xs --> (xs!i, ys!i) : r))"
+     "((xs,ys) \<in> genPrefix r) =  
+      (length xs <= length ys & (\<forall>i. i < length xs \<longrightarrow> (xs!i, ys!i) \<in> r))"
 apply (blast intro: genPrefix_length_le genPrefix_imp_nth nth_imp_genPrefix)
 done
 
@@ -315,7 +315,7 @@
 done
 
 lemma prefix_Cons: 
-   "(xs <= y#ys) = (xs=[] | (? zs. xs=y#zs & zs <= ys))"
+   "(xs <= y#ys) = (xs=[] | (\<exists>zs. xs=y#zs \<and> zs <= ys))"
 by (simp add: prefix_def genPrefix_Cons)
 
 lemma append_one_prefix: 
@@ -343,7 +343,7 @@
 by (blast intro: monoI prefix_length_le)
 
 (*Equivalence to the definition used in Lex/Prefix.thy*)
-lemma prefix_iff: "(xs <= zs) = (EX ys. zs = xs@ys)"
+lemma prefix_iff: "(xs <= zs) = (\<exists>ys. zs = xs@ys)"
 apply (unfold prefix_def)
 apply (auto simp add: genPrefix_iff_nth nth_append)
 apply (rule_tac x = "drop (length xs) zs" in exI)
@@ -363,7 +363,7 @@
 done
 
 lemma prefix_append_iff:
-     "(xs <= ys@zs) = (xs <= ys | (? us. xs = ys@us & us <= zs))"
+     "(xs <= ys@zs) = (xs <= ys | (\<exists>us. xs = ys@us & us <= zs))"
 apply (rule_tac xs = zs in rev_induct)
  apply force
 apply (simp del: append_assoc add: append_assoc [symmetric], force)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/PPROD.thy
--- a/src/HOL/UNITY/PPROD.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/PPROD.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -120,8 +120,8 @@
   something like \<open>lift_preserves_sub\<close> to rewrite the third.  However
   there's no obvious alternative for the third premise.\<close>
 lemma guarantees_PLam_I:
-    "[| lift i (F i): X guarantees Y;  i \<in> I;
-        OK I (%i. lift i (F i)) |]
+    "[| lift i (F i) \<in> X guarantees Y;  i \<in> I;
+        OK I (\<lambda>i. lift i (F i)) |]
      ==> (PLam I F) \<in> X guarantees Y"
 apply (unfold PLam_def)
 apply (simp add: guarantees_JN_I)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Simple/NSP_Bad.thy
--- a/src/HOL/UNITY/Simple/NSP_Bad.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Simple/NSP_Bad.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -258,7 +258,7 @@
      "[| A \<notin> bad;  B \<notin> bad |]
   ==> Nprg \<in> Always
               {s. Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set s &
-                  (ALL C. Says A C (Crypt (pubK C) (Nonce NB)) \<notin> set s)
+                  (\<forall>C. Says A C (Crypt (pubK C) (Nonce NB)) \<notin> set s)
                   --> Nonce NB \<notin> analz (spies s)}"
 apply ns_induct
 apply (simp_all (no_asm_simp) add: all_conj_distrib)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Simple/Reach.thy
--- a/src/HOL/UNITY/Simple/Reach.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Simple/Reach.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -24,7 +24,7 @@
   where "Rprg = mk_total_program ({%v. v=init}, \<Union>(u,v)\<in>edges. {asgt u v}, UNIV)"
 
 definition reach_invariant :: "state set"
-  where "reach_invariant = {s. (\<forall>v. s v --> (init, v) \<in> edges^*) & s init}"
+  where "reach_invariant = {s. (\<forall>v. s v --> (init, v) \<in> edges\<^sup>*) & s init}"
 
 definition fixedpoint :: "state set"
   where "fixedpoint = {s. \<forall>(u,v)\<in>edges. s u --> s v}"
@@ -68,7 +68,7 @@
 
 (*If it reaches a fixedpoint, it has found a solution*)
 lemma fixedpoint_invariant_correct: 
-     "fixedpoint \<inter> reach_invariant = { %v. (init, v) \<in> edges^* }"
+     "fixedpoint \<inter> reach_invariant = { %v. (init, v) \<in> edges\<^sup>* }"
 apply (unfold fixedpoint_def)
 apply (rule equalityI)
 apply (auto intro!: ext)
@@ -152,7 +152,7 @@
 apply (rule LeadsTo_Un_fixedpoint)
 done
 
-lemma LeadsTo_correct: "Rprg \<in> UNIV LeadsTo { %v. (init, v) \<in> edges^* }"
+lemma LeadsTo_correct: "Rprg \<in> UNIV LeadsTo { %v. (init, v) \<in> edges\<^sup>* }"
 apply (subst fixedpoint_invariant_correct [symmetric])
 apply (rule Always_LeadsTo_weaken [OF reach_invariant LeadsTo_fixedpoint], auto)
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Simple/Reachability.thy
--- a/src/HOL/UNITY/Simple/Reachability.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Simple/Reachability.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -296,7 +296,7 @@
 lemma Leadsto_reachability_AND_nmsg_0:
      "[| v \<in> V; w \<in> V |]  
       ==> F \<in> UNIV LeadsTo  
-             ((reachable v <==> {s. (root,v): REACHABLE}) \<inter> nmsg_eq 0 (v,w))"
+             ((reachable v <==> {s. (root,v) \<in> REACHABLE}) \<inter> nmsg_eq 0 (v,w))"
 apply (rule LeadsTo_Reachability [THEN LeadsTo_Trans], blast)
 apply (subgoal_tac
          "F \<in> (reachable v <==> {s. (root,v) \<in> REACHABLE}) \<inter> 
@@ -355,7 +355,7 @@
  apply simp
 apply (subgoal_tac 
         "({s. (s \<in> reachable v) = ((root,v) \<in> REACHABLE) }) = 
-         ({s. (s \<in> reachable v) = ( (root,v) \<in> REACHABLE) } Int
+         ({s. (s \<in> reachable v) = ( (root,v) \<in> REACHABLE) } \<inter>
               (- {} \<union> nmsg_eq 0 (v,w)))")
 apply blast+
 done
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/SubstAx.thy
--- a/src/HOL/UNITY/SubstAx.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/SubstAx.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -304,7 +304,7 @@
 lemma LeadsTo_wf_induct:
      "[| wf r;      
          \<forall>m. F \<in> (A \<inter> f-`{m}) LeadsTo                      
-                    ((A \<inter> f-`(r^-1 `` {m})) \<union> B) |]  
+                    ((A \<inter> f-`(r\<inverse> `` {m})) \<union> B) |]  
       ==> F \<in> A LeadsTo B"
 apply (simp add: LeadsTo_eq_leadsTo)
 apply (erule leadsTo_wf_induct)
@@ -315,7 +315,7 @@
 lemma Bounded_induct:
      "[| wf r;      
          \<forall>m \<in> I. F \<in> (A \<inter> f-`{m}) LeadsTo                    
-                      ((A \<inter> f-`(r^-1 `` {m})) \<union> B) |]  
+                      ((A \<inter> f-`(r\<inverse> `` {m})) \<union> B) |]  
       ==> F \<in> A LeadsTo ((A - (f-`I)) \<union> B)"
 apply (erule LeadsTo_wf_induct, safe)
 apply (case_tac "m \<in> I")
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Transformers.thy
--- a/src/HOL/UNITY/Transformers.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Transformers.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -22,7 +22,7 @@
 
 definition wp :: "[('a*'a) set, 'a set] => 'a set" where  
     \<comment> \<open>Dijkstra's weakest-precondition operator (for an individual command)\<close>
-    "wp act B == - (act^-1 `` (-B))"
+    "wp act B == - (act\<inverse> `` (-B))"
 
 definition awp :: "['a program, 'a set] => 'a set" where
     \<comment> \<open>Dijkstra's weakest-precondition operator (for a program)\<close>
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/UNITY.thy
--- a/src/HOL/UNITY/UNITY.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/UNITY.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -15,7 +15,7 @@
 definition
   "Program =
     {(init:: 'a set, acts :: ('a * 'a)set set,
-      allowed :: ('a * 'a)set set). Id \<in> acts & Id: allowed}"
+      allowed :: ('a * 'a)set set). Id \<in> acts & Id \<in> allowed}"
 
 typedef 'a program = "Program :: ('a set * ('a * 'a) set set * ('a * 'a) set set) set"
   morphisms Rep_Program Abs_Program
@@ -127,12 +127,12 @@
 subsubsection\<open>co\<close>
 
 lemma constrainsI: 
-    "(!!act s s'. [| act: Acts F;  (s,s') \<in> act;  s \<in> A |] ==> s': A')  
+    "(!!act s s'. [| act \<in> Acts F;  (s,s') \<in> act;  s \<in> A |] ==> s' \<in> A')  
      ==> F \<in> A co A'"
 by (simp add: constrains_def, blast)
 
 lemma constrainsD: 
-    "[| F \<in> A co A'; act: Acts F;  (s,s'): act;  s \<in> A |] ==> s': A'"
+    "[| F \<in> A co A'; act \<in> Acts F;  (s,s') \<in> act;  s \<in> A |] ==> s' \<in> A'"
 by (unfold constrains_def, blast)
 
 lemma constrains_empty [iff]: "F \<in> {} co B"
@@ -351,7 +351,7 @@
 lemma Image_less_than [simp]: "less_than `` {k} = greaterThan k"
 by blast
 
-lemma Image_inverse_less_than [simp]: "less_than^-1 `` {k} = lessThan k"
+lemma Image_inverse_less_than [simp]: "less_than\<inverse> `` {k} = lessThan k"
 by blast
 
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/Union.thy
--- a/src/HOL/UNITY/Union.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/Union.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -36,7 +36,7 @@
   (*Characterizes safety properties.  Used with specifying Allowed*)
 definition
   safety_prop :: "'a program set => bool"
-  where "safety_prop X \<longleftrightarrow> SKIP: X & (\<forall>G. Acts G \<subseteq> UNION X Acts --> G \<in> X)"
+  where "safety_prop X \<longleftrightarrow> SKIP \<in> X \<and> (\<forall>G. Acts G \<subseteq> UNION X Acts \<longrightarrow> G \<in> X)"
 
 syntax
   "_JOIN1" :: "[pttrns, 'b set] => 'b set"              ("(3\<Squnion>_./ _)" 10)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/UNITY/WFair.thy
--- a/src/HOL/UNITY/WFair.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/UNITY/WFair.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -91,12 +91,12 @@
 done
 
 lemma transientI: 
-    "[| act: Acts F;  act``A \<subseteq> -A |] ==> F \<in> transient A"
+    "[| act \<in> Acts F;  act``A \<subseteq> -A |] ==> F \<in> transient A"
 by (unfold transient_def, blast)
 
 lemma transientE: 
     "[| F \<in> transient A;   
-        !!act. [| act: Acts F;  act``A \<subseteq> -A |] ==> P |]  
+        \<And>act. [| act \<in> Acts F;  act``A \<subseteq> -A |] ==> P |]  
      ==> P"
 by (unfold transient_def, blast)
 
@@ -115,7 +115,7 @@
 done
 
 lemma totalize_transientI: 
-    "[| act: Acts F;  A \<subseteq> Domain act;  act``A \<subseteq> -A |] 
+    "[| act \<in> Acts F;  A \<subseteq> Domain act;  act``A \<subseteq> -A |] 
      ==> totalize F \<in> transient A"
 by (simp add: totalize_transient_iff, blast)
 
@@ -420,10 +420,10 @@
 lemma leadsTo_wf_induct_lemma:
      "[| wf r;      
          \<forall>m. F \<in> (A \<inter> f-`{m}) leadsTo                      
-                    ((A \<inter> f-`(r^-1 `` {m})) \<union> B) |]  
+                    ((A \<inter> f-`(r\<inverse> `` {m})) \<union> B) |]  
       ==> F \<in> (A \<inter> f-`{m}) leadsTo B"
 apply (erule_tac a = m in wf_induct)
-apply (subgoal_tac "F \<in> (A \<inter> (f -` (r^-1 `` {x}))) leadsTo B")
+apply (subgoal_tac "F \<in> (A \<inter> (f -` (r\<inverse> `` {x}))) leadsTo B")
  apply (blast intro: leadsTo_cancel1 leadsTo_Un_duplicate)
 apply (subst vimage_eq_UN)
 apply (simp only: UN_simps [symmetric])
@@ -435,7 +435,7 @@
 lemma leadsTo_wf_induct:
      "[| wf r;      
          \<forall>m. F \<in> (A \<inter> f-`{m}) leadsTo                      
-                    ((A \<inter> f-`(r^-1 `` {m})) \<union> B) |]  
+                    ((A \<inter> f-`(r\<inverse> `` {m})) \<union> B) |]  
       ==> F \<in> A leadsTo B"
 apply (rule_tac t = A in subst)
  defer 1
@@ -449,7 +449,7 @@
 lemma bounded_induct:
      "[| wf r;      
          \<forall>m \<in> I. F \<in> (A \<inter> f-`{m}) leadsTo                    
-                      ((A \<inter> f-`(r^-1 `` {m})) \<union> B) |]  
+                      ((A \<inter> f-`(r\<inverse> `` {m})) \<union> B) |]  
       ==> F \<in> A leadsTo ((A - (f-`I)) \<union> B)"
 apply (erule leadsTo_wf_induct, safe)
 apply (case_tac "m \<in> I")
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Word/Misc_Typedef.thy
--- a/src/HOL/Word/Misc_Typedef.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Word/Misc_Typedef.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -124,7 +124,7 @@
 
 lemmas td = td_thm
 
-lemma set_iff_norm: "w : A \<longleftrightarrow> w = norm w"
+lemma set_iff_norm: "w \<in> A \<longleftrightarrow> w = norm w"
   by (auto simp: set_Rep_Abs eq_norm' eq_norm [symmetric])
 
 lemma inverse_norm: "Abs n = w \<longleftrightarrow> Rep w = norm n"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ZF/Games.thy
--- a/src/HOL/ZF/Games.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ZF/Games.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -85,18 +85,18 @@
   apply (rule_tac x=r in exI, insert Elem_Opair_exists, blast) 
   done
 
-lemma is_option_of_subset_is_Elem_of: "is_option_of \<subseteq> (is_Elem_of^+)"
+lemma is_option_of_subset_is_Elem_of: "is_option_of \<subseteq> (is_Elem_of\<^sup>+)"
 proof -
   {
     fix opt
     fix g
     assume "(opt, g) \<in> is_option_of"
-    then have "\<exists> u v. (opt, u) \<in> (is_Elem_of^+) \<and> (u,v) \<in> (is_Elem_of^+) \<and> (v,g) \<in> (is_Elem_of^+)" 
+    then have "\<exists> u v. (opt, u) \<in> (is_Elem_of\<^sup>+) \<and> (u,v) \<in> (is_Elem_of\<^sup>+) \<and> (v,g) \<in> (is_Elem_of\<^sup>+)" 
       apply -
       apply (drule option2elem)
       apply (auto simp add: r_into_trancl' is_Elem_of_def)
       done
-    then have "(opt, g) \<in> (is_Elem_of^+)"
+    then have "(opt, g) \<in> (is_Elem_of\<^sup>+)"
       by (blast intro: trancl_into_rtrancl trancl_rtrancl_trancl)
   } 
   then show ?thesis by auto
@@ -104,7 +104,7 @@
 
 lemma wfzf_is_option_of: "wfzf is_option_of"
 proof - 
-  have "wfzf (is_Elem_of^+)" by (simp add: wfzf_trancl wfzf_is_Elem_of)
+  have "wfzf (is_Elem_of\<^sup>+)" by (simp add: wfzf_trancl wfzf_is_Elem_of)
   then show ?thesis 
     apply (rule wfzf_subset)
     apply (rule is_option_of_subset_is_Elem_of)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ZF/HOLZF.thy
--- a/src/HOL/ZF/HOLZF.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ZF/HOLZF.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -32,25 +32,25 @@
   "SucNat x == union x (Singleton x)"
 
 definition subset :: "ZF \<Rightarrow> ZF \<Rightarrow> bool" where
-  "subset A B == ! x. Elem x A \<longrightarrow> Elem x B"
+  "subset A B \<equiv> \<forall>x. Elem x A \<longrightarrow> Elem x B"
 
 axiomatization where
   Empty: "Not (Elem x Empty)" and
-  Ext: "(x = y) = (! z. Elem z x = Elem z y)" and
-  Sum: "Elem z (Sum x) = (? y. Elem z y & Elem y x)" and
+  Ext: "(x = y) = (\<forall>z. Elem z x = Elem z y)" and
+  Sum: "Elem z (Sum x) = (\<exists>y. Elem z y \<and> Elem y x)" and
   Power: "Elem y (Power x) = (subset y x)" and
-  Repl: "Elem b (Repl A f) = (? a. Elem a A & b = f a)" and
-  Regularity: "A \<noteq> Empty \<longrightarrow> (? x. Elem x A & (! y. Elem y x \<longrightarrow> Not (Elem y A)))" and
-  Infinity: "Elem Empty Inf & (! x. Elem x Inf \<longrightarrow> Elem (SucNat x) Inf)"
+  Repl: "Elem b (Repl A f) = (\<exists>a. Elem a A \<and> b = f a)" and
+  Regularity: "A \<noteq> Empty \<longrightarrow> (\<exists>x. Elem x A \<and> (\<forall>y. Elem y x \<longrightarrow> Not (Elem y A)))" and
+  Infinity: "Elem Empty Inf \<and> (\<forall>x. Elem x Inf \<longrightarrow> Elem (SucNat x) Inf)"
 
 definition Sep :: "ZF \<Rightarrow> (ZF \<Rightarrow> bool) \<Rightarrow> ZF" where
-  "Sep A p == (if (!x. Elem x A \<longrightarrow> Not (p x)) then Empty else 
+  "Sep A p == (if (\<forall>x. Elem x A \<longrightarrow> Not (p x)) then Empty else 
   (let z = (\<some> x. Elem x A & p x) in
-   let f = % x. (if p x then x else z) in Repl A f))" 
+   let f = \<lambda>x. (if p x then x else z) in Repl A f))" 
 
 thm Power[unfolded subset_def]
 
-theorem Sep: "Elem b (Sep A p) = (Elem b A & p b)"
+theorem Sep: "Elem b (Sep A p) = (Elem b A \<and> p b)"
   apply (auto simp add: Sep_def Empty)
   apply (auto simp add: Let_def Repl)
   apply (rule someI2, auto)+
@@ -59,7 +59,7 @@
 lemma subset_empty: "subset Empty A"
   by (simp add: subset_def Empty)
 
-theorem Upair: "Elem x (Upair a b) = (x = a | x = b)"
+theorem Upair: "Elem x (Upair a b) = (x = a \<or> x = b)"
   apply (auto simp add: Upair_def Repl)
   apply (rule exI[where x=Empty])
   apply (simp add: Power subset_empty)
@@ -103,14 +103,14 @@
 definition Replacement :: "ZF \<Rightarrow> (ZF \<Rightarrow> ZF option) \<Rightarrow> ZF" where
   "Replacement A f == Repl (Sep A (% a. f a \<noteq> None)) (the o f)"
 
-theorem Replacement: "Elem y (Replacement A f) = (? x. Elem x A & f x = Some y)"
+theorem Replacement: "Elem y (Replacement A f) = (\<exists>x. Elem x A \<and> f x = Some y)"
   by (auto simp add: Replacement_def Repl Sep) 
 
 definition Fst :: "ZF \<Rightarrow> ZF" where
-  "Fst q == SOME x. ? y. q = Opair x y"
+  "Fst q == SOME x. \<exists>y. q = Opair x y"
 
 definition Snd :: "ZF \<Rightarrow> ZF" where
-  "Snd q == SOME y. ? x. q = Opair x y"
+  "Snd q == SOME y. \<exists>x. q = Opair x y"
 
 theorem Fst: "Fst (Opair x y) = x"
   apply (simp add: Fst_def)
@@ -125,7 +125,7 @@
   done
 
 definition isOpair :: "ZF \<Rightarrow> bool" where
-  "isOpair q == ? x y. q = Opair x y"
+  "isOpair q == \<exists>x y. q = Opair x y"
 
 lemma isOpair: "isOpair (Opair x y) = True"
   by (auto simp add: isOpair_def)
@@ -136,7 +136,7 @@
 definition CartProd :: "ZF \<Rightarrow> ZF \<Rightarrow> ZF" where
   "CartProd A B == Sum(Repl A (% a. Repl B (% b. Opair a b)))"
 
-lemma CartProd: "Elem x (CartProd A B) = (? a b. Elem a A & Elem b B & x = (Opair a b))"
+lemma CartProd: "Elem x (CartProd A B) = (\<exists>a b. Elem a A \<and> Elem b B \<and> x = (Opair a b))"
   apply (auto simp add: CartProd_def Sum Repl)
   apply (rule_tac x="Repl B (Opair a)" in exI)
   apply (auto simp add: Repl)
@@ -166,7 +166,7 @@
 definition Range :: "ZF \<Rightarrow> ZF" where
   "Range f == Replacement f (% p. if isOpair p then Some (Snd p) else None)"
 
-theorem Domain: "Elem x (Domain f) = (? y. Elem (Opair x y) f)"
+theorem Domain: "Elem x (Domain f) = (\<exists>y. Elem (Opair x y) f)"
   apply (auto simp add: Domain_def Replacement)
   apply (rule_tac x="Snd xa" in exI)
   apply (simp add: FstSnd)
@@ -174,7 +174,7 @@
   apply (simp add: isOpair Fst)
   done
 
-theorem Range: "Elem y (Range f) = (? x. Elem (Opair x y) f)"
+theorem Range: "Elem y (Range f) = (\<exists>x. Elem (Opair x y) f)"
   apply (auto simp add: Range_def Replacement)
   apply (rule_tac x="Fst x" in exI)
   apply (simp add: FstSnd)
@@ -192,7 +192,7 @@
   "f \<acute> x == (THE y. Elem (Opair x y) f)"
 
 definition isFun :: "ZF \<Rightarrow> bool" where
-  "isFun f == (! x y1 y2. Elem (Opair x y1) f & Elem (Opair x y2) f \<longrightarrow> y1 = y2)"
+  "isFun f == (\<forall>x y1 y2. Elem (Opair x y1) f & Elem (Opair x y2) f \<longrightarrow> y1 = y2)"
 
 definition Lambda :: "ZF \<Rightarrow> (ZF \<Rightarrow> ZF) \<Rightarrow> ZF" where
   "Lambda A f == Repl A (% x. Opair x (f x))"
@@ -214,7 +214,7 @@
   apply (auto simp add: Fst isOpair_def)
   done
 
-lemma Lambda_ext: "(Lambda s f = Lambda t g) = (s = t & (! x. Elem x s \<longrightarrow> f x = g x))"
+lemma Lambda_ext: "(Lambda s f = Lambda t g) = (s = t \<and> (\<forall>x. Elem x s \<longrightarrow> f x = g x))"
 proof -
   have "Lambda s f = Lambda t g \<Longrightarrow> s = t"
     apply (subst domain_Lambda[where A = s and f = f, symmetric])
@@ -282,13 +282,13 @@
   apply (auto simp add: the_equality)
   done
 
-lemma fun_range_witness: "\<lbrakk>isFun f; Elem y (Range f)\<rbrakk> \<Longrightarrow> ? x. Elem x (Domain f) & f\<acute>x = y"
+lemma fun_range_witness: "\<lbrakk>isFun f; Elem y (Range f)\<rbrakk> \<Longrightarrow> \<exists>x. Elem x (Domain f) & f\<acute>x = y"
   apply (auto simp add: Range)
   apply (rule_tac x="x" in exI)
   apply (auto simp add: app_def the_equality isFun_def Domain)
   done
 
-lemma Elem_Fun_Lambda: "Elem F (Fun U V) \<Longrightarrow> ? f. F = Lambda U f"
+lemma Elem_Fun_Lambda: "Elem F (Fun U V) \<Longrightarrow> \<exists>f. F = Lambda U f"
   apply (rule exI[where x= "% x. (THE y. Elem (Opair x y) F)"])
   apply (simp add: Ext Lambda_def Repl Domain)
   apply (simp add: Ext[symmetric])
@@ -313,7 +313,7 @@
   apply (auto simp add: Fst Snd)
   done
  
-lemma Elem_Lambda_Fun: "Elem (Lambda A f) (Fun U V) = (A = U & (! x. Elem x A \<longrightarrow> Elem (f x) V))"
+lemma Elem_Lambda_Fun: "Elem (Lambda A f) (Fun U V) = (A = U \<and> (\<forall>x. Elem x A \<longrightarrow> Elem (f x) V))"
 proof -
   have "Elem (Lambda A f) (Fun U V) \<Longrightarrow> A = U"
     by (simp add: Fun_def Sep domain_Lambda)
@@ -359,8 +359,8 @@
           proof 
             assume not_empty: "?Z \<noteq> Empty" 
             note thereis_x = Regularity[where A="?Z", simplified not_empty, simplified]
-            then obtain x where x_def: "Elem x ?Z & (! y. Elem y x \<longrightarrow> Not (Elem y ?Z))" ..
-            then have x_induct:"! y. Elem y x \<longrightarrow> Elem y U \<longrightarrow> P y" by (simp add: Sep)
+            then obtain x where x_def: "Elem x ?Z \<and> (\<forall>y. Elem y x \<longrightarrow> Not (Elem y ?Z))" ..
+            then have x_induct:"\<forall>y. Elem y x \<longrightarrow> Elem y U \<longrightarrow> P y" by (simp add: Sep)
             have "Elem x U \<longrightarrow> P x" 
               by (rule impE[OF spec[OF P_induct, where x=x], OF x_induct], assumption)
             moreover have "Elem x U & Not(P x)"
@@ -377,14 +377,14 @@
 
 lemma cond2_wf_Elem:
   assumes 
-     special_P: "? U. ! x. Not(Elem x U) \<longrightarrow> (P x)"
+     special_P: "\<exists>U. \<forall>x. Not(Elem x U) \<longrightarrow> (P x)"
      and P_induct: "\<forall>x. (\<forall>y. Elem y x \<longrightarrow> P y) \<longrightarrow> P x"
   shows
      "P a"
 proof -
-  have "? U Q. P = (\<lambda> x. (Elem x U \<longrightarrow> Q x))"
+  have "\<exists>U Q. P = (\<lambda> x. (Elem x U \<longrightarrow> Q x))"
   proof -
-    from special_P obtain U where U:"! x. Not(Elem x U) \<longrightarrow> (P x)" ..
+    from special_P obtain U where U: "\<forall>x. Not(Elem x U) \<longrightarrow> (P x)" ..
     show ?thesis
       apply (rule_tac exI[where x=U])
       apply (rule exI[where x="P"])
@@ -392,7 +392,7 @@
       apply (auto simp add: U)
       done
   qed    
-  then obtain U where "? Q. P = (\<lambda> x. (Elem x U \<longrightarrow> Q x))" ..
+  then obtain U where "\<exists>Q. P = (\<lambda> x. (Elem x U \<longrightarrow> Q x))" ..
   then obtain Q where UQ: "P = (\<lambda> x. (Elem x U \<longrightarrow> Q x))" ..
   show ?thesis
     apply (auto simp add: UQ)
@@ -415,7 +415,7 @@
   done
 
 definition Nat :: ZF
- where  "Nat == Sep Inf (\<lambda> N. ? n. nat2Nat n = N)"
+ where  "Nat == Sep Inf (\<lambda>N. \<exists>n. nat2Nat n = N)"
 
 lemma Elem_nat2Nat_Nat[intro]: "Elem (nat2Nat n) Nat"
   by (auto simp add: Nat_def Sep)
@@ -427,11 +427,11 @@
   by (auto simp add: Nat_def Sep Infinity)
   
 lemma no_infinite_Elem_down_chain:
-  "Not (? f. isFun f & Domain f = Nat & (! N. Elem N Nat \<longrightarrow> Elem (f\<acute>(SucNat N)) (f\<acute>N)))"
+  "Not (\<exists>f. isFun f \<and> Domain f = Nat \<and> (\<forall>N. Elem N Nat \<longrightarrow> Elem (f\<acute>(SucNat N)) (f\<acute>N)))"
 proof -
   {
     fix f
-    assume f:"isFun f & Domain f = Nat & (! N. Elem N Nat \<longrightarrow> Elem (f\<acute>(SucNat N)) (f\<acute>N))"
+    assume f: "isFun f \<and> Domain f = Nat \<and> (\<forall>N. Elem N Nat \<longrightarrow> Elem (f\<acute>(SucNat N)) (f\<acute>N))"
     let ?r = "Range f"
     have "?r \<noteq> Empty"
       apply (auto simp add: Ext Empty)
@@ -439,14 +439,14 @@
       apply (rule fun_value_in_range)
       apply (auto simp add: f Elem_Empty_Nat)
       done
-    then have "? x. Elem x ?r & (! y. Elem y x \<longrightarrow> Not(Elem y ?r))"
+    then have "\<exists>x. Elem x ?r \<and> (\<forall>y. Elem y x \<longrightarrow> Not(Elem y ?r))"
       by (simp add: Regularity)
-    then obtain x where x: "Elem x ?r & (! y. Elem y x \<longrightarrow> Not(Elem y ?r))" ..
-    then have "? N. Elem N (Domain f) & f\<acute>N = x" 
+    then obtain x where x: "Elem x ?r \<and> (\<forall>y. Elem y x \<longrightarrow> Not(Elem y ?r))" ..
+    then have "\<exists>N. Elem N (Domain f) & f\<acute>N = x" 
       apply (rule_tac fun_range_witness)
       apply (simp_all add: f)
       done
-    then have "? N. Elem N Nat & f\<acute>N = x" 
+    then have "\<exists>N. Elem N Nat & f\<acute>N = x" 
       by (simp add: f)
     then obtain N where N: "Elem N Nat & f\<acute>N = x" ..
     from N have N': "Elem N Nat" by auto
@@ -475,9 +475,9 @@
     assume ba: "Elem b a"
     let ?Z = "Upair a b"
     have "?Z \<noteq> Empty" by (simp add: Upair_nonEmpty)
-    then have "? x. Elem x ?Z & (! y. Elem y x \<longrightarrow> Not(Elem y ?Z))"
+    then have "\<exists>x. Elem x ?Z \<and> (\<forall>y. Elem y x \<longrightarrow> Not(Elem y ?Z))"
       by (simp add: Regularity)
-    then obtain x where x:"Elem x ?Z & (! y. Elem y x \<longrightarrow> Not(Elem y ?Z))" ..
+    then obtain x where x:"Elem x ?Z \<and> (\<forall>y. Elem y x \<longrightarrow> Not(Elem y ?Z))" ..
     then have "x = a \<or> x = b" by (simp add: Upair)
     moreover have "x = a \<longrightarrow> Not (Elem b ?Z)"
       by (auto simp add: x ba)
@@ -501,7 +501,7 @@
   "NatInterval n 0 = Singleton (nat2Nat n)"
 | "NatInterval n (Suc m) = union (NatInterval n m) (Singleton (nat2Nat (n+m+1)))"
 
-lemma n_Elem_NatInterval[rule_format]: "! q. q <= m \<longrightarrow> Elem (nat2Nat (n+q)) (NatInterval n m)"
+lemma n_Elem_NatInterval[rule_format]: "\<forall>q. q \<le> m \<longrightarrow> Elem (nat2Nat (n+q)) (NatInterval n m)"
   apply (induct m)
   apply (auto simp add: Singleton union)
   apply (case_tac "q <= m")
@@ -514,13 +514,13 @@
   by (auto intro:   n_Elem_NatInterval[where q = 0, simplified] simp add: Empty Ext)
 
 lemma increasing_nat2Nat[rule_format]: "0 < n \<longrightarrow> Elem (nat2Nat (n - 1)) (nat2Nat n)"
-  apply (case_tac "? m. n = Suc m")
+  apply (case_tac "\<exists>m. n = Suc m")
   apply (auto simp add: SucNat_def union Singleton)
   apply (drule spec[where x="n - 1"])
   apply arith
   done
 
-lemma represent_NatInterval[rule_format]: "Elem x (NatInterval n m) \<longrightarrow> (? u. n \<le> u & u \<le> n+m & nat2Nat u = x)"
+lemma represent_NatInterval[rule_format]: "Elem x (NatInterval n m) \<longrightarrow> (\<exists>u. n \<le> u \<and> u \<le> n+m \<and> nat2Nat u = x)"
   apply (induct m)
   apply (auto simp add: Singleton union)
   apply (rule_tac x="Suc (n+m)" in exI)
@@ -535,12 +535,12 @@
     assume mg0: "0 < m"
     let ?Z = "NatInterval n m"
     have "?Z \<noteq> Empty" by (simp add: NatInterval_not_Empty)
-    then have "? x. (Elem x ?Z) & (! y. Elem y x \<longrightarrow> Not (Elem y ?Z))" 
+    then have "\<exists>x. (Elem x ?Z) \<and> (\<forall>y. Elem y x \<longrightarrow> Not (Elem y ?Z))" 
       by (auto simp add: Regularity)
-    then obtain x where x:"Elem x ?Z & (! y. Elem y x \<longrightarrow> Not (Elem y ?Z))" ..
-    then have "? u. n \<le> u & u \<le> n+m & nat2Nat u = x" 
+    then obtain x where x:"Elem x ?Z \<and> (\<forall>y. Elem y x \<longrightarrow> Not (Elem y ?Z))" ..
+    then have "\<exists>u. n \<le> u & u \<le> n+m & nat2Nat u = x" 
       by (simp add: represent_NatInterval)
-    then obtain u where u: "n \<le> u & u \<le> n+m & nat2Nat u = x" ..
+    then obtain u where u: "n \<le> u & u \<le> n+m \<and> nat2Nat u = x" ..
     have "n < u \<longrightarrow> False"
     proof 
       assume n_less_u: "n < u"
@@ -590,14 +590,14 @@
     apply (case_tac "x = y")
     apply auto
     apply (case_tac "x < y")
-    apply (case_tac "? m. y = x + m & 0 < m")
+    apply (case_tac "\<exists>m. y = x + m & 0 < m")
     apply (auto intro: lemma_nat2Nat)
     apply (case_tac "y < x")
-    apply (case_tac "? m. x = y + m & 0 < m")
+    apply (case_tac "\<exists>m. x = y + m & 0 < m")
     apply simp
     apply simp
     using th apply blast
-    apply (case_tac "? m. x = y + m")
+    apply (case_tac "\<exists>m. x = y + m")
     apply (auto intro: lemma_nat2Nat)
     apply (drule sym)
     using lemma_nat2Nat apply blast
@@ -625,7 +625,7 @@
 (*lemma Elem_induct: "(\<And>x. \<forall>y. Elem y x \<longrightarrow> P y \<Longrightarrow> P x) \<Longrightarrow> P a"
   by (erule wf_induct[OF wf_is_Elem_of, simplified is_Elem_of_def, simplified])*)
 
-lemma Elem_Opair_exists: "? z. Elem x z & Elem y z & Elem z (Opair x y)"
+lemma Elem_Opair_exists: "\<exists>z. Elem x z & Elem y z & Elem z (Opair x y)"
   apply (rule exI[where x="Upair x y"])
   by (simp add: Upair Opair_def)
 
@@ -682,13 +682,13 @@
   by (simp add: implode_def inj_explode)
 
 definition regular :: "(ZF * ZF) set \<Rightarrow> bool" where
-  "regular R == ! A. A \<noteq> Empty \<longrightarrow> (? x. Elem x A & (! y. (y, x) \<in> R \<longrightarrow> Not (Elem y A)))"
+  "regular R == \<forall>A. A \<noteq> Empty \<longrightarrow> (\<exists>x. Elem x A \<and> (\<forall>y. (y, x) \<in> R \<longrightarrow> Not (Elem y A)))"
 
 definition set_like :: "(ZF * ZF) set \<Rightarrow> bool" where
-  "set_like R == ! y. Ext R y \<in> range explode"
+  "set_like R == \<forall>y. Ext R y \<in> range explode"
 
 definition wfzf :: "(ZF * ZF) set \<Rightarrow> bool" where
-  "wfzf R == regular R & set_like R"
+  "wfzf R == regular R \<and> set_like R"
 
 lemma regular_Elem: "regular is_Elem_of"
   by (simp add: regular_def is_Elem_of_def Regularity)
@@ -702,7 +702,7 @@
 definition SeqSum :: "(nat \<Rightarrow> ZF) \<Rightarrow> ZF" where
   "SeqSum f == Sum (Repl Nat (f o Nat2nat))"
 
-lemma SeqSum: "Elem x (SeqSum f) = (? n. Elem x (f n))"
+lemma SeqSum: "Elem x (SeqSum f) = (\<exists>n. Elem x (f n))"
   apply (auto simp add: SeqSum_def Sum Repl)
   apply (rule_tac x = "f n" in exI)
   apply auto
@@ -732,7 +732,7 @@
 
 lemma Elem_Ext_ZF_hull:
   assumes set_like_R: "set_like R" 
-  shows "Elem x (Ext_ZF_hull R S) = (? n. Elem x (Ext_ZF_n R S n))"
+  shows "Elem x (Ext_ZF_hull R S) = (\<exists>n. Elem x (Ext_ZF_n R S n))"
   by (simp add: Ext_ZF_hull_def SeqSum)
   
 lemma Elem_Elem_Ext_ZF_hull:
@@ -742,7 +742,7 @@
   shows "Elem y (Ext_ZF_hull R S)"
 proof -
   from Elem_Ext_ZF_hull[OF set_like_R] x_hull 
-  have "? n. Elem x (Ext_ZF_n R S n)" by auto
+  have "\<exists>n. Elem x (Ext_ZF_n R S n)" by auto
   then obtain n where n:"Elem x (Ext_ZF_n R S n)" ..
   with y_R_x have "Elem y (Ext_ZF_n R S (Suc n))"
     apply (auto simp add: Repl Sum)
@@ -805,16 +805,16 @@
         done
       with x show "False" by auto
     qed
-    then have "! x. P x" by auto
+    then have "\<forall>x. P x" by auto
   }
-  then show "(\<forall>x. (\<forall>y. (y, x) \<in> R \<longrightarrow> P y) \<longrightarrow> P x) \<longrightarrow> (! x. P x)" by blast
+  then show "(\<forall>x. (\<forall>y. (y, x) \<in> R \<longrightarrow> P y) \<longrightarrow> P x) \<longrightarrow> (\<forall>x. P x)" by blast
 qed
 
 lemma wf_is_Elem_of: "wf is_Elem_of"
   by (auto simp add: wfzf_is_Elem_of wfzf_implies_wf)
 
 lemma in_Ext_RTrans_implies_Elem_Ext_ZF_hull:  
-  "set_like R \<Longrightarrow> x \<in> (Ext (R^+) s) \<Longrightarrow> Elem x (Ext_ZF_hull R s)"
+  "set_like R \<Longrightarrow> x \<in> (Ext (R\<^sup>+) s) \<Longrightarrow> Elem x (Ext_ZF_hull R s)"
   apply (simp add: Ext_def Elem_Ext_ZF_hull)
   apply (erule converse_trancl_induct[where r="R"])
   apply (rule exI[where x=0])
@@ -826,21 +826,21 @@
   apply (auto simp add: Elem_Ext_ZF)
   done
 
-lemma implodeable_Ext_trancl: "set_like R \<Longrightarrow> set_like (R^+)"
+lemma implodeable_Ext_trancl: "set_like R \<Longrightarrow> set_like (R\<^sup>+)"
   apply (subst set_like_def)
   apply (auto simp add: image_def)
-  apply (rule_tac x="Sep (Ext_ZF_hull R y) (\<lambda> z. z \<in> (Ext (R^+) y))" in exI)
+  apply (rule_tac x="Sep (Ext_ZF_hull R y) (\<lambda> z. z \<in> (Ext (R\<^sup>+) y))" in exI)
   apply (auto simp add: explode_def Sep set_eqI 
     in_Ext_RTrans_implies_Elem_Ext_ZF_hull)
   done
  
 lemma Elem_Ext_ZF_hull_implies_in_Ext_RTrans[rule_format]:
-  "set_like R \<Longrightarrow> ! x. Elem x (Ext_ZF_n R s n) \<longrightarrow> x \<in> (Ext (R^+) s)"
+  "set_like R \<Longrightarrow> \<forall>x. Elem x (Ext_ZF_n R s n) \<longrightarrow> x \<in> (Ext (R\<^sup>+) s)"
   apply (induct_tac n)
   apply (auto simp add: Elem_Ext_ZF Ext_def Sum Repl)
   done
 
-lemma "set_like R \<Longrightarrow> Ext_ZF (R^+) s = Ext_ZF_hull R s"
+lemma "set_like R \<Longrightarrow> Ext_ZF (R\<^sup>+) s = Ext_ZF_hull R s"
   apply (frule implodeable_Ext_trancl)
   apply (auto simp add: Ext)
   apply (erule in_Ext_RTrans_implies_Elem_Ext_ZF_hull)
@@ -856,7 +856,7 @@
   show "A \<noteq> Empty \<longrightarrow> (\<exists>x. Elem x A \<and> (\<forall>y. (y, x) \<in> R \<longrightarrow> \<not> Elem y A))"
   proof
     assume A: "A \<noteq> Empty"
-    then have "? x. x \<in> explode A" 
+    then have "\<exists>x. x \<in> explode A" 
       by (auto simp add: explode_def Ext Empty)
     then obtain x where x:"x \<in> explode A" ..   
     from iffD1[OF wf_eq_minimal wf, rule_format, where Q="explode A", OF x]
@@ -873,7 +873,7 @@
   apply (auto simp add: wfzf_def wf_implies_regular)
   done
 
-lemma wfzf_trancl: "wfzf R \<Longrightarrow> wfzf (R^+)"
+lemma wfzf_trancl: "wfzf R \<Longrightarrow> wfzf (R\<^sup>+)"
   by (auto simp add: wf_eq_wfzf[symmetric] implodeable_Ext_trancl wf_trancl)
 
 lemma Ext_subset_mono: "R \<subseteq> S \<Longrightarrow> Ext R y \<subseteq> Ext S y"
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ZF/LProd.thy
--- a/src/HOL/ZF/LProd.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ZF/LProd.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -86,9 +86,9 @@
   assumes wf_R: "wf R"
   shows "wf (lprod R)"
 proof -
-  have subset: "lprod (R^+) \<subseteq> inv_image (mult (R^+)) mset"
+  have subset: "lprod (R\<^sup>+) \<subseteq> inv_image (mult (R\<^sup>+)) mset"
     by (auto simp add: lprod_implies_mult trans_trancl)
-  note lprodtrancl = wf_subset[OF wf_inv_image[where r="mult (R^+)" and f="mset", 
+  note lprodtrancl = wf_subset[OF wf_inv_image[where r="mult (R\<^sup>+)" and f="mset", 
     OF wf_mult[OF wf_trancl[OF wf_R]]], OF subset]
   note lprod = wf_subset[OF lprodtrancl, where p="lprod R", OF lprod_subset, simplified]
   show ?thesis by (auto intro: lprod)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ZF/Zet.thy
--- a/src/HOL/ZF/Zet.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ZF/Zet.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -17,7 +17,7 @@
 definition zin :: "'a \<Rightarrow> 'a zet \<Rightarrow> bool" where
   "zin x A == x \<in> (Rep_zet A)"
 
-lemma zet_ext_eq: "(A = B) = (! x. zin x A = zin x B)"
+lemma zet_ext_eq: "(A = B) = (\<forall>x. zin x A = zin x B)"
   by (auto simp add: Rep_zet_inject[symmetric] zin_def)
 
 definition zimage :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a zet \<Rightarrow> 'b zet" where
@@ -32,7 +32,7 @@
   apply (auto simp add: explode_def Sep)
   done
 
-lemma image_zet_rep: "A \<in> zet \<Longrightarrow> ? z . g ` A = explode z"
+lemma image_zet_rep: "A \<in> zet \<Longrightarrow> \<exists>z . g ` A = explode z"
   apply (auto simp add: zet_def')
   apply (rule_tac x="Repl z (g o (inv_into A f))" in exI)
   apply (simp add: explode_Repl_eq)
@@ -44,7 +44,7 @@
   assumes Azet: "A \<in> zet"
   shows "g ` A \<in> zet"
 proof -
-  from Azet have "? (f :: _ \<Rightarrow> ZF). inj_on f A" 
+  from Azet have "\<exists>(f :: _ \<Rightarrow> ZF). inj_on f A" 
     by (auto simp add: zet_def')
   then obtain f where injf: "inj_on (f :: _ \<Rightarrow> ZF) A"  
     by auto
@@ -70,7 +70,7 @@
   apply (simp_all add: Rep_zet zet_image_mem)
   done
 
-lemma zimage_iff: "zin y (zimage f A) = (? x. zin x A & y = f x)"
+lemma zimage_iff: "zin y (zimage f A) = (\<exists>x. zin x A \<and> y = f x)"
   by (auto simp add: zin_def Rep_zimage_eq)
 
 definition zimplode :: "ZF zet \<Rightarrow> ZF" where
@@ -79,7 +79,7 @@
 definition zexplode :: "ZF \<Rightarrow> ZF zet" where
   "zexplode z == Abs_zet (explode z)"
 
-lemma Rep_zet_eq_explode: "? z. Rep_zet A = explode z"
+lemma Rep_zet_eq_explode: "\<exists>z. Rep_zet A = explode z"
   by (rule image_zet_rep[where g="\<lambda> x. x",OF Rep_zet, simplified])
 
 lemma zexplode_zimplode: "zexplode (zimplode A) = A"
@@ -117,7 +117,7 @@
   "zunion a b \<equiv> Abs_zet ((Rep_zet a) \<union> (Rep_zet b))"
 
 definition zsubset :: "'a zet \<Rightarrow> 'a zet \<Rightarrow> bool" where
-  "zsubset a b \<equiv> ! x. zin x a \<longrightarrow> zin x b"
+  "zsubset a b \<equiv> \<forall>x. zin x a \<longrightarrow> zin x b"
 
 lemma explode_union: "explode (union a b) = (explode a) \<union> (explode b)"
   apply (rule set_eqI)
@@ -126,13 +126,13 @@
 
 lemma Rep_zet_zunion: "Rep_zet (zunion a b) = (Rep_zet a) \<union> (Rep_zet b)"
 proof -
-  from Rep_zet[of a] have "? f z. inj_on f (Rep_zet a) \<and> f ` (Rep_zet a) = explode z"
+  from Rep_zet[of a] have "\<exists>f z. inj_on f (Rep_zet a) \<and> f ` (Rep_zet a) = explode z"
     by (auto simp add: zet_def')
   then obtain fa za where a:"inj_on fa (Rep_zet a) \<and> fa ` (Rep_zet a) = explode za"
     by blast
   from a have fa: "inj_on fa (Rep_zet a)" by blast
   from a have za: "fa ` (Rep_zet a) = explode za" by blast
-  from Rep_zet[of b] have "? f z. inj_on f (Rep_zet b) \<and> f ` (Rep_zet b) = explode z"
+  from Rep_zet[of b] have "\<exists>f z. inj_on f (Rep_zet b) \<and> f ` (Rep_zet b) = explode z"
     by (auto simp add: zet_def')
   then obtain fb zb where b:"inj_on fb (Rep_zet b) \<and> fb ` (Rep_zet b) = explode zb"
     by blast
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/Zorn.thy
--- a/src/HOL/Zorn.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/Zorn.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -669,7 +669,7 @@
     from that have Ris: "R \<in> Chains init_seg_of"
       using mono_Chains [OF I_init] by blast
     have subch: "chain\<^sub>\<subseteq> R"
-      using \<open>R : Chains I\<close> I_init by (auto simp: init_seg_of_def chain_subset_def Chains_def)
+      using \<open>R \<in> Chains I\<close> I_init by (auto simp: init_seg_of_def chain_subset_def Chains_def)
     have "\<forall>r\<in>R. Refl r" and "\<forall>r\<in>R. trans r" and "\<forall>r\<in>R. antisym r"
       and "\<forall>r\<in>R. Total r" and "\<forall>r\<in>R. wf (r - Id)"
       using Chains_wo [OF \<open>R \<in> Chains I\<close>] by (simp_all add: order_on_defs)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Birthday_Paradox.thy
--- a/src/HOL/ex/Birthday_Paradox.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Birthday_Paradox.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -36,10 +36,10 @@
   } note finite_delete = this
   from insert have hyps: "\<forall>y \<in> T. card ({g. g \<in> extensional_funcset S (T - {y}) \<and> inj_on g S}) = fact (card T - 1) div fact ((card T - 1) - card S)"(is "\<forall> _ \<in> T. _ = ?k") by auto
   from extensional_funcset_extend_domain_inj_on_eq[OF \<open>x \<notin> S\<close>]
-  have "card {f. f : extensional_funcset (insert x S) T & inj_on f (insert x S)} =
-    card ((%(y, g). g(x := y)) ` {(y, g). y : T & g : extensional_funcset S (T - {y}) & inj_on g S})"
+  have "card {f. f \<in> extensional_funcset (insert x S) T \<and> inj_on f (insert x S)} =
+    card ((\<lambda>(y, g). g(x := y)) ` {(y, g). y \<in> T \<and> g \<in> extensional_funcset S (T - {y}) \<and> inj_on g S})"
     by metis
-  also from extensional_funcset_extend_domain_inj_onI[OF \<open>x \<notin> S\<close>, of T] have "... =  card {(y, g). y : T & g : extensional_funcset S (T - {y}) & inj_on g S}"
+  also from extensional_funcset_extend_domain_inj_onI[OF \<open>x \<notin> S\<close>, of T] have "\<dots> =  card {(y, g). y \<in> T \<and> g \<in> extensional_funcset S (T - {y}) \<and> inj_on g S}"
     by (simp add: card_image)
   also have "card {(y, g). y \<in> T \<and> g \<in> extensional_funcset S (T - {y}) \<and> inj_on g S} =
     card {(y, g). y \<in> T \<and> g \<in> {f \<in> extensional_funcset S (T - {y}). inj_on f S}}" by auto
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Dedekind_Real.thy
--- a/src/HOL/ex/Dedekind_Real.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Dedekind_Real.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -1273,7 +1273,7 @@
 declare equiv_realrel_iff [simp]
 
 
-lemma realrel_in_real [simp]: "realrel``{(x,y)}: Real"
+lemma realrel_in_real [simp]: "realrel``{(x,y)} \<in> Real"
 by (simp add: Real_def realrel_def quotient_def, blast)
 
 declare Abs_Real_inject [simp]
@@ -1283,7 +1283,7 @@
 text\<open>Case analysis on the representation of a real number as an equivalence
       class of pairs of positive reals.\<close>
 lemma eq_Abs_Real [case_names Abs_Real, cases type: real]: 
-     "(!!x y. z = Abs_Real(realrel``{(x,y)}) ==> P) ==> P"
+     "(\<And>x y. z = Abs_Real(realrel``{(x,y)}) \<Longrightarrow> P) \<Longrightarrow> P"
 apply (rule Rep_Real [of z, unfolded Real_def, THEN quotientE])
 apply (drule arg_cong [where f=Abs_Real])
 apply (auto simp add: Rep_Real_inverse)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Executable_Relation.thy
--- a/src/HOL/ex/Executable_Relation.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Executable_Relation.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -34,11 +34,11 @@
 code_datatype Rel
 
 lemma [code]:
-  "member (x, y) (Rel X R) = ((x = y \<and> x : X) \<or> (x, y) : R)"
+  "member (x, y) (Rel X R) = ((x = y \<and> x \<in> X) \<or> (x, y) \<in> R)"
 by transfer auto
 
 lemma [code]:
-  "converse (Rel X R) = Rel X (R^-1)"
+  "converse (Rel X R) = Rel X (R\<inverse>)"
 by transfer auto
 
 lemma [code]:
@@ -46,11 +46,11 @@
 by transfer auto
 
 lemma [code]:
-   "relcomp (Rel X R) (Rel Y S) = Rel (X Int Y) (Set.filter (%(x, y). y : Y) R Un (Set.filter (%(x, y). x : X) S Un R O S))"
+   "relcomp (Rel X R) (Rel Y S) = Rel (X \<inter> Y) (Set.filter (\<lambda>(x, y). y \<in> Y) R \<union> (Set.filter (\<lambda>(x, y). x \<in> X) S \<union> R O S))"
 by transfer (auto simp add: Id_on_eqI relcomp.simps)
 
 lemma [code]:
-  "rtrancl (Rel X R) = Rel UNIV (R^+)"
+  "rtrancl (Rel X R) = Rel UNIV (R\<^sup>+)"
 apply transfer
 apply auto
 apply (metis Id_on_iff Un_commute UNIV_I rtrancl_Un_separatorE rtrancl_eq_or_trancl)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Groebner_Examples.thy
--- a/src/HOL/ex/Groebner_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Groebner_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -110,7 +110,7 @@
   using assms 
   by (algebra add: collinear_def split_def fst_conv snd_conv)
 
-lemma "EX (d::int). a*y - a*x = n*d \<Longrightarrow> EX u v. a*u + n*v = 1 \<Longrightarrow> EX e. y - x = n*e"
+lemma "\<exists>(d::int). a*y - a*x = n*d \<Longrightarrow> \<exists>u v. a*u + n*v = 1 \<Longrightarrow> \<exists>e. y - x = n*e"
   by algebra
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Intuitionistic.thy
--- a/src/HOL/ex/Intuitionistic.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Intuitionistic.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -86,12 +86,12 @@
 ***)
 
 (*Problem 1.1*)
-lemma "(ALL x. EX y. ALL z. p(x) & q(y) & r(z)) =
-       (ALL z. EX y. ALL x. p(x) & q(y) & r(z))"
+lemma "(\<forall>x. \<exists>y. \<forall>z. p(x) \<and> q(y) \<and> r(z)) =
+       (\<forall>z. \<exists>y. \<forall>x. p(x) \<and> q(y) \<and> r(z))"
   by (iprover del: allE elim 2: allE')
 
 (*Problem 3.1*)
-lemma "~ (EX x. ALL y. p y x = (~ p x x))"
+lemma "\<not> (\<exists>x. \<forall>y. p y x = (\<not> p x x))"
   by iprover
 
 
@@ -177,19 +177,19 @@
 
 (* The converse is classical in the following implications... *)
 
-lemma "(EX x. P(x)-->Q)  -->  (ALL x. P(x)) --> Q"
+lemma "(\<exists>x. P(x)\<longrightarrow>Q)  \<longrightarrow>  (\<forall>x. P(x)) \<longrightarrow> Q"
   by iprover
 
-lemma "((ALL x. P(x))-->Q) --> ~ (ALL x. P(x) & ~Q)"
+lemma "((\<forall>x. P(x))\<longrightarrow>Q) \<longrightarrow> \<not> (\<forall>x. P(x) \<and> \<not>Q)"
   by iprover
 
-lemma "((ALL x. ~P(x))-->Q)  -->  ~ (ALL x. ~ (P(x)|Q))"
+lemma "((\<forall>x. \<not>P(x))\<longrightarrow>Q)  \<longrightarrow>  \<not> (\<forall>x. \<not> (P(x)\<or>Q))"
   by iprover
 
-lemma "(ALL x. P(x)) | Q  -->  (ALL x. P(x) | Q)"
+lemma "(\<forall>x. P(x)) \<or> Q  \<longrightarrow>  (\<forall>x. P(x) \<or> Q)"
   by iprover 
 
-lemma "(EX x. P --> Q(x)) --> (P --> (EX x. Q(x)))"
+lemma "(\<exists>x. P \<longrightarrow> Q(x)) \<longrightarrow> (P \<longrightarrow> (\<exists>x. Q(x)))"
   by iprover
 
 
@@ -199,130 +199,130 @@
   Some will require quantifier duplication -- not currently available*)
 
 (* Problem ~~19 *)
-lemma "~~(EX x. ALL y z. (P(y)-->Q(z)) --> (P(x)-->Q(x)))"
+lemma "\<not>\<not>(\<exists>x. \<forall>y z. (P(y)\<longrightarrow>Q(z)) \<longrightarrow> (P(x)\<longrightarrow>Q(x)))"
   by iprover
 
 (* Problem 20 *)
-lemma "(ALL x y. EX z. ALL w. (P(x)&Q(y)-->R(z)&S(w)))
-    --> (EX x y. P(x) & Q(y)) --> (EX z. R(z))"
+lemma "(\<forall>x y. \<exists>z. \<forall>w. (P(x)\<and>Q(y)\<longrightarrow>R(z)\<and>S(w)))
+    \<longrightarrow> (\<exists>x y. P(x) \<and> Q(y)) \<longrightarrow> (\<exists>z. R(z))"
   by iprover
 
 (* Problem 21 *)
-lemma "(EX x. P-->Q(x)) & (EX x. Q(x)-->P) --> ~~(EX x. P=Q(x))"
+lemma "(\<exists>x. P\<longrightarrow>Q(x)) \<and> (\<exists>x. Q(x)\<longrightarrow>P) \<longrightarrow> \<not>\<not>(\<exists>x. P=Q(x))"
   by iprover
 
 (* Problem 22 *)
-lemma "(ALL x. P = Q(x))  -->  (P = (ALL x. Q(x)))"
+lemma "(\<forall>x. P = Q(x))  \<longrightarrow>  (P = (\<forall>x. Q(x)))"
   by iprover
 
 (* Problem ~~23 *)
-lemma "~~ ((ALL x. P | Q(x))  =  (P | (ALL x. Q(x))))"
+lemma "\<not>\<not> ((\<forall>x. P \<or> Q(x))  =  (P \<or> (\<forall>x. Q(x))))"
   by iprover
 
 (* Problem 25 *)
-lemma "(EX x. P(x)) &
-       (ALL x. L(x) --> ~ (M(x) & R(x))) &
-       (ALL x. P(x) --> (M(x) & L(x))) &
-       ((ALL x. P(x)-->Q(x)) | (EX x. P(x)&R(x)))
-   --> (EX x. Q(x)&P(x))"
+lemma "(\<exists>x. P(x)) \<and>
+       (\<forall>x. L(x) \<longrightarrow> \<not> (M(x) \<and> R(x))) \<and>
+       (\<forall>x. P(x) \<longrightarrow> (M(x) \<and> L(x))) \<and>
+       ((\<forall>x. P(x)\<longrightarrow>Q(x)) \<or> (\<exists>x. P(x)\<and>R(x)))
+   \<longrightarrow> (\<exists>x. Q(x)\<and>P(x))"
   by iprover
 
 (* Problem 27 *)
-lemma "(EX x. P(x) & ~Q(x)) &
-             (ALL x. P(x) --> R(x)) &
-             (ALL x. M(x) & L(x) --> P(x)) &
-             ((EX x. R(x) & ~ Q(x)) --> (ALL x. L(x) --> ~ R(x)))
-         --> (ALL x. M(x) --> ~L(x))"
+lemma "(\<exists>x. P(x) \<and> \<not>Q(x)) \<and>
+             (\<forall>x. P(x) \<longrightarrow> R(x)) \<and>
+             (\<forall>x. M(x) \<and> L(x) \<longrightarrow> P(x)) \<and>
+             ((\<exists>x. R(x) \<and> \<not> Q(x)) \<longrightarrow> (\<forall>x. L(x) \<longrightarrow> \<not> R(x)))
+         \<longrightarrow> (\<forall>x. M(x) \<longrightarrow> \<not>L(x))"
   by iprover
 
 (* Problem ~~28.  AMENDED *)
-lemma "(ALL x. P(x) --> (ALL x. Q(x))) &
-       (~~(ALL x. Q(x)|R(x)) --> (EX x. Q(x)&S(x))) &
-       (~~(EX x. S(x)) --> (ALL x. L(x) --> M(x)))
-   --> (ALL x. P(x) & L(x) --> M(x))"
+lemma "(\<forall>x. P(x) \<longrightarrow> (\<forall>x. Q(x))) \<and>
+       (\<not>\<not>(\<forall>x. Q(x)\<or>R(x)) \<longrightarrow> (\<exists>x. Q(x)&S(x))) \<and>
+       (\<not>\<not>(\<exists>x. S(x)) \<longrightarrow> (\<forall>x. L(x) \<longrightarrow> M(x)))
+   \<longrightarrow> (\<forall>x. P(x) \<and> L(x) \<longrightarrow> M(x))"
   by iprover
 
 (* Problem 29.  Essentially the same as Principia Mathematica *11.71 *)
-lemma "(((EX x. P(x)) & (EX y. Q(y))) -->
-   (((ALL x. (P(x) --> R(x))) & (ALL y. (Q(y) --> S(y)))) =
-    (ALL x y. ((P(x) & Q(y)) --> (R(x) & S(y))))))"
+lemma "(((\<exists>x. P(x)) \<and> (\<exists>y. Q(y))) \<longrightarrow>
+   (((\<forall>x. (P(x) \<longrightarrow> R(x))) \<and> (\<forall>y. (Q(y) \<longrightarrow> S(y)))) =
+    (\<forall>x y. ((P(x) \<and> Q(y)) \<longrightarrow> (R(x) \<and> S(y))))))"
   by iprover
 
 (* Problem ~~30 *)
-lemma "(ALL x. (P(x) | Q(x)) --> ~ R(x)) &
-       (ALL x. (Q(x) --> ~ S(x)) --> P(x) & R(x))
-   --> (ALL x. ~~S(x))"
+lemma "(\<forall>x. (P(x) \<or> Q(x)) \<longrightarrow> \<not> R(x)) \<and>
+       (\<forall>x. (Q(x) \<longrightarrow> \<not> S(x)) \<longrightarrow> P(x) \<and> R(x))
+   \<longrightarrow> (\<forall>x. \<not>\<not>S(x))"
   by iprover
 
 (* Problem 31 *)
-lemma "~(EX x. P(x) & (Q(x) | R(x))) & 
-        (EX x. L(x) & P(x)) &
-        (ALL x. ~ R(x) --> M(x))
-    --> (EX x. L(x) & M(x))"
+lemma "\<not>(\<exists>x. P(x) \<and> (Q(x) \<or> R(x))) \<and>
+        (\<exists>x. L(x) \<and> P(x)) \<and>
+        (\<forall>x. \<not> R(x) \<longrightarrow> M(x))
+    \<longrightarrow> (\<exists>x. L(x) \<and> M(x))"
   by iprover
 
 (* Problem 32 *)
-lemma "(ALL x. P(x) & (Q(x)|R(x))-->S(x)) &
-       (ALL x. S(x) & R(x) --> L(x)) &
-       (ALL x. M(x) --> R(x))
-   --> (ALL x. P(x) & M(x) --> L(x))"
+lemma "(\<forall>x. P(x) \<and> (Q(x)|R(x))\<longrightarrow>S(x)) \<and>
+       (\<forall>x. S(x) \<and> R(x) \<longrightarrow> L(x)) \<and>
+       (\<forall>x. M(x) \<longrightarrow> R(x))
+   \<longrightarrow> (\<forall>x. P(x) \<and> M(x) \<longrightarrow> L(x))"
   by iprover
 
 (* Problem ~~33 *)
-lemma "(ALL x. ~~(P(a) & (P(x)-->P(b))-->P(c)))  =
-       (ALL x. ~~((~P(a) | P(x) | P(c)) & (~P(a) | ~P(b) | P(c))))"
+lemma "(\<forall>x. \<not>\<not>(P(a) \<and> (P(x)\<longrightarrow>P(b))\<longrightarrow>P(c)))  =
+       (\<forall>x. \<not>\<not>((\<not>P(a) \<or> P(x) \<or> P(c)) \<and> (\<not>P(a) \<or> \<not>P(b) \<or> P(c))))"
   oops
 
 (* Problem 36 *)
 lemma
-     "(ALL x. EX y. J x y) &
-      (ALL x. EX y. G x y) &
-      (ALL x y. J x y | G x y --> (ALL z. J y z | G y z --> H x z))
-  --> (ALL x. EX y. H x y)"
+     "(\<forall>x. \<exists>y. J x y) \<and>
+      (\<forall>x. \<exists>y. G x y) \<and>
+      (\<forall>x y. J x y \<or> G x y \<longrightarrow> (\<forall>z. J y z \<or> G y z \<longrightarrow> H x z))
+  \<longrightarrow> (\<forall>x. \<exists>y. H x y)"
   by iprover
 
 (* Problem 39 *)
-lemma "~ (EX x. ALL y. F y x = (~F y y))"
+lemma "\<not> (\<exists>x. \<forall>y. F y x = (\<not>F y y))"
   by iprover
 
 (* Problem 40.  AMENDED *)
-lemma "(EX y. ALL x. F x y = F x x) -->
-             ~(ALL x. EX y. ALL z. F z y = (~ F z x))"
+lemma "(\<exists>y. \<forall>x. F x y = F x x) \<longrightarrow>
+             \<not>(\<forall>x. \<exists>y. \<forall>z. F z y = (\<not> F z x))"
   by iprover
 
 (* Problem 44 *)
-lemma "(ALL x. f(x) -->
-             (EX y. g(y) & h x y & (EX y. g(y) & ~ h x y)))  &
-             (EX x. j(x) & (ALL y. g(y) --> h x y))
-             --> (EX x. j(x) & ~f(x))"
+lemma "(\<forall>x. f(x) \<longrightarrow>
+             (\<exists>y. g(y) \<and> h x y \<and> (\<exists>y. g(y) \<and> ~ h x y)))  \<and>
+             (\<exists>x. j(x) \<and> (\<forall>y. g(y) \<longrightarrow> h x y))
+             \<longrightarrow> (\<exists>x. j(x) \<and> \<not>f(x))"
   by iprover
 
 (* Problem 48 *)
-lemma "(a=b | c=d) & (a=c | b=d) --> a=d | b=c"
+lemma "(a=b \<or> c=d) \<and> (a=c \<or> b=d) \<longrightarrow> a=d \<or> b=c"
   by iprover
 
 (* Problem 51 *)
-lemma "((EX z w. (ALL x y. (P x y = ((x = z) & (y = w))))) -->
-  (EX z. (ALL x. (EX w. ((ALL y. (P x y = (y = w))) = (x = z))))))"
+lemma "((\<exists>z w. (\<forall>x y. (P x y = ((x = z) \<and> (y = w))))) \<longrightarrow>
+  (\<exists>z. (\<forall>x. (\<exists>w. ((\<forall>y. (P x y = (y = w))) = (x = z))))))"
   by iprover
 
 (* Problem 52 *)
 (*Almost the same as 51. *)
-lemma "((EX z w. (ALL x y. (P x y = ((x = z) & (y = w))))) -->
-   (EX w. (ALL y. (EX z. ((ALL x. (P x y = (x = z))) = (y = w))))))"
+lemma "((\<exists>z w. (\<forall>x y. (P x y = ((x = z) \<and> (y = w))))) \<longrightarrow>
+   (\<exists>w. (\<forall>y. (\<exists>z. ((\<forall>x. (P x y = (x = z))) = (y = w))))))"
   by iprover
 
 (* Problem 56 *)
-lemma "(ALL x. (EX y. P(y) & x=f(y)) --> P(x)) = (ALL x. P(x) --> P(f(x)))"
+lemma "(\<forall>x. (\<exists>y. P(y) \<and> x=f(y)) \<longrightarrow> P(x)) = (\<forall>x. P(x) \<longrightarrow> P(f(x)))"
   by iprover
 
 (* Problem 57 *)
-lemma "P (f a b) (f b c) & P (f b c) (f a c) &
-     (ALL x y z. P x y & P y z --> P x z) --> P (f a b) (f a c)"
+lemma "P (f a b) (f b c) & P (f b c) (f a c) \<and>
+     (\<forall>x y z. P x y \<and> P y z \<longrightarrow> P x z) \<longrightarrow> P (f a b) (f a c)"
   by iprover
 
 (* Problem 60 *)
-lemma "ALL x. P x (f x) = (EX y. (ALL z. P z y --> P z (f x)) & P x y)"
+lemma "\<forall>x. P x (f x) = (\<exists>y. (\<forall>z. P z y \<longrightarrow> P z (f x)) \<and> P x y)"
   by iprover
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/LocaleTest2.thy
--- a/src/HOL/ex/LocaleTest2.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/LocaleTest2.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -43,7 +43,7 @@
   where "(x \<sqsubset> y) = (x \<sqsubseteq> y & x ~= y)"
 
 theorem abs_test:
-  "(\<sqsubset>) = (%x y. x \<sqsubset> y)"
+  "(\<sqsubset>) = (\<lambda>x y. x \<sqsubset> y)"
   by simp
 
 definition
@@ -57,8 +57,8 @@
 end
 
 locale dlat = dpo +
-  assumes ex_inf: "EX inf. dpo.is_inf le x y inf"
-    and ex_sup: "EX sup. dpo.is_sup le x y sup"
+  assumes ex_inf: "\<exists>inf. dpo.is_inf le x y inf"
+    and ex_sup: "\<exists>sup. dpo.is_sup le x y sup"
 
 begin
 
@@ -436,11 +436,11 @@
 proof
   fix x y
   from total have "is_inf x y (if x \<sqsubseteq> y then x else y)" by (auto simp: is_inf_def)
-  then show "EX inf. is_inf x y inf" by blast
+  then show "\<exists>inf. is_inf x y inf" by blast
 next
   fix x y
   from total have "is_sup x y (if x \<sqsubseteq> y then y else x)" by (auto simp: is_sup_def)
-  then show "EX sup. is_sup x y sup" by blast
+  then show "\<exists>sup. is_sup x y sup" by blast
 qed
 
 sublocale dlo < ddlat
@@ -644,7 +644,7 @@
 definition
   inv where "inv x = (THE y. x ** y = one & y ** x = one)"
 definition
-  unit where "unit x = (EX y. x ** y = one  & y ** x = one)"
+  unit where "unit x = (\<exists>y. x ** y = one  & y ** x = one)"
 
 lemma inv_unique:
   assumes eq: "y ** x = one" "x ** y' = one"
@@ -872,7 +872,7 @@
     then
     have inv: "f o Hilbert_Choice.inv f = id & Hilbert_Choice.inv f o f = id"
       by (simp add: bij_def surj_iff inj_iff)
-    show "EX g. f o g = id & g o f = id" by rule (rule inv)
+    show "\<exists>g. f \<circ> g = id \<and> g \<circ> f = id" by rule (rule inv)
   qed
 qed
 
@@ -896,7 +896,7 @@
 apply (insert unit_id)
 apply simp
 done
-  show "Dmonoid.inv (o) id f = inv (f :: unit => unit)"
+  show "Dmonoid.inv (o) id f = inv (f :: unit \<Rightarrow> unit)"
 apply (unfold Dmonoid.inv_def [OF Dmonoid])
 apply (insert unit_id)
 apply simp
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Refute_Examples.thy
--- a/src/HOL/ex/Refute_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Refute_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -247,13 +247,13 @@
 text \<open>"The transitive closure 'T' of an arbitrary relation 'P' is non-empty."\<close>
 
 definition "trans" :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> bool" where
-  "trans P == (ALL x y z. P x y \<longrightarrow> P y z \<longrightarrow> P x z)"
+  "trans P \<equiv> (\<forall>x y z. P x y \<longrightarrow> P y z \<longrightarrow> P x z)"
 
 definition "subset" :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> ('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> bool" where
-  "subset P Q == (ALL x y. P x y \<longrightarrow> Q x y)"
+  "subset P Q \<equiv> (\<forall>x y. P x y \<longrightarrow> Q x y)"
 
 definition "trans_closure" :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> ('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> bool" where
-  "trans_closure P Q == (subset Q P) & (trans P) & (ALL R. subset Q R \<longrightarrow> trans R \<longrightarrow> subset P R)"
+  "trans_closure P Q \<equiv> (subset Q P) \<and> (trans P) \<and> (\<forall>R. subset Q R \<longrightarrow> trans R \<longrightarrow> subset P R)"
 
 lemma "trans_closure T P \<longrightarrow> (\<exists>x y. T x y)"
 refute [expect = genuine]
@@ -372,15 +372,15 @@
 refute
 by simp
 
-lemma "x : {x. P x}"
+lemma "x \<in> {x. P x}"
 refute
 oops
 
-lemma "P (:)"
+lemma "P (\<in>)"
 refute
 oops
 
-lemma "P ((:) x)"
+lemma "P ((\<in>) x)"
 refute
 oops
 
@@ -388,11 +388,11 @@
 refute
 oops
 
-lemma "A Un B = A Int B"
+lemma "A \<union> B = A \<inter> B"
 refute
 oops
 
-lemma "(A Int B) Un C = (A Un C) Int B"
+lemma "(A \<inter> B) \<union> C = (A \<union> C) \<inter> B"
 refute
 oops
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/SAT_Examples.thy
--- a/src/HOL/ex/SAT_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/SAT_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -76,7 +76,7 @@
 
 text \<open>eta-Equivalence\<close>
 
-lemma "(ALL x. P x) | ~ All P"
+lemma "(\<forall>x. P x) \<or> \<not> All P"
 by sat
 
 declare [[sat_trace = false]]
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Set_Comprehension_Pointfree_Examples.thy
--- a/src/HOL/ex/Set_Comprehension_Pointfree_Examples.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Set_Comprehension_Pointfree_Examples.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -12,102 +12,102 @@
 declare [[simproc add: finite_Collect]]
 
 lemma
-  "finite (UNIV::'a set) ==> finite {p. EX x::'a. p = (x, x)}"
+  "finite (UNIV::'a set) \<Longrightarrow> finite {p. \<exists>x::'a. p = (x, x)}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite {f a b| a b. a : A \<and> b : B}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite {f a b| a b. a \<in> A \<and> b \<in> B}"
   by simp
   
 lemma
-  "finite B ==> finite A' ==> finite {f a b| a b. a : A \<and> a : A' \<and> b : B}"
+  "finite B \<Longrightarrow> finite A' \<Longrightarrow> finite {f a b| a b. a \<in> A \<and> a \<in> A' \<and> b \<in> B}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite {f a b| a b. a : A \<and> b : B \<and> b : B'}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite {f a b| a b. a \<in> A \<and> b \<in> B \<and> b \<in> B'}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite C ==> finite {f a b c| a b c. a : A \<and> b : B \<and> c : C}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite C \<Longrightarrow> finite {f a b c| a b c. a \<in> A \<and> b \<in> B \<and> c \<in> C}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite C ==> finite D ==>
-     finite {f a b c d| a b c d. a : A \<and> b : B \<and> c : C \<and> d : D}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite C \<Longrightarrow> finite D \<Longrightarrow>
+     finite {f a b c d| a b c d. a \<in> A \<and> b \<in> B \<and> c \<in> C \<and> d \<in> D}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite C ==> finite D ==> finite E ==>
-    finite {f a b c d e | a b c d e. a : A \<and> b : B \<and> c : C \<and> d : D \<and> e : E}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite C \<Longrightarrow> finite D \<Longrightarrow> finite E \<Longrightarrow>
+    finite {f a b c d e | a b c d e. a \<in> A \<and> b \<in> B \<and> c \<in> C \<and> d \<in> D \<and> e \<in> E}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite C ==> finite D ==> finite E \<Longrightarrow>
-    finite {f a d c b e | e b c d a. b : B \<and> a : A \<and> e : E' \<and> c : C \<and> d : D \<and> e : E \<and> b : B'}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite C \<Longrightarrow> finite D \<Longrightarrow> finite E \<Longrightarrow>
+    finite {f a d c b e | e b c d a. b \<in> B \<and> a \<in> A \<and> e \<in> E' \<and> c \<in> C \<and> d \<in> D \<and> e \<in> E \<and> b \<in> B'}"
   by simp
 
 lemma
   "\<lbrakk> finite A ; finite B ; finite C ; finite D \<rbrakk>
-  \<Longrightarrow> finite ({f a b c d| a b c d. a : A \<and> b : B \<and> c : C \<and> d : D})"
+  \<Longrightarrow> finite ({f a b c d| a b c d. a \<in> A \<and> b \<in> B \<and> c \<in> C \<and> d \<in> D})"
   by simp
 
 lemma
   "finite ((\<lambda>(a,b,c,d). f a b c d) ` (A \<times> B \<times> C \<times> D))
-  \<Longrightarrow> finite ({f a b c d| a b c d. a : A \<and> b : B \<and> c : C \<and> d : D})"
+  \<Longrightarrow> finite ({f a b c d| a b c d. a \<in> A \<and> b \<in> B \<and> c \<in> C \<and> d \<in> D})"
   by simp
 
 lemma
-  "finite S ==> finite {s'. EX s:S. s' = f a e s}"
+  "finite S \<Longrightarrow> finite {s'. \<exists>s\<in>S. s' = f a e s}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite {f a b| a b. a : A \<and> b : B \<and> a \<notin> Z}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite {f a b| a b. a \<in> A \<and> b \<in> B \<and> a \<notin> Z}"
   by simp
 
 lemma
-  "finite A ==> finite B ==> finite R ==> finite {f a b x y| a b x y. a : A \<and> b : B \<and> (x,y) \<in> R}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite R \<Longrightarrow> finite {f a b x y| a b x y. a \<in> A \<and> b \<in> B \<and> (x,y) \<in> R}"
 by simp
 
 lemma
-  "finite A ==> finite B ==> finite R ==> finite {f a b x y| a b x y. a : A \<and> (x,y) \<in> R \<and> b : B}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite R \<Longrightarrow> finite {f a b x y| a b x y. a \<in> A \<and> (x,y) \<in> R \<and> b \<in> B}"
 by simp
 
 lemma
-  "finite A ==> finite B ==> finite R ==> finite {f a (x, b) y| y b x a. a : A \<and> (x,y) \<in> R \<and> b : B}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite R \<Longrightarrow> finite {f a (x, b) y| y b x a. a \<in> A \<and> (x,y) \<in> R \<and> b \<in> B}"
 by simp
 
 lemma
-  "finite A ==> finite AA ==> finite B ==> finite {f a b| a b. (a : A \<or> a : AA) \<and> b : B \<and> a \<notin> Z}"
+  "finite A \<Longrightarrow> finite AA \<Longrightarrow> finite B \<Longrightarrow> finite {f a b| a b. (a \<in> A \<or> a \<in> AA) \<and> b \<in> B \<and> a \<notin> Z}"
 by simp
 
 lemma
-  "finite A1 ==> finite A2 ==> finite A3 ==> finite A4 ==> finite A5 ==> finite B ==>
-     finite {f a b c | a b c. ((a : A1 \<and> a : A2) \<or> (a : A3 \<and> (a : A4 \<or> a : A5))) \<and> b : B \<and> a \<notin> Z}"
+  "finite A1 \<Longrightarrow> finite A2 \<Longrightarrow> finite A3 \<Longrightarrow> finite A4 \<Longrightarrow> finite A5 \<Longrightarrow> finite B \<Longrightarrow>
+     finite {f a b c | a b c. ((a \<in> A1 \<and> a \<in> A2) \<or> (a \<in> A3 \<and> (a \<in> A4 \<or> a \<in> A5))) \<and> b \<in> B \<and> a \<notin> Z}"
 apply simp
 oops
 
-lemma "finite B ==> finite {c. EX x. x : B & c = a * x}"
+lemma "finite B \<Longrightarrow> finite {c. \<exists>x. x \<in> B \<and> c = a * x}"
 by simp
 
 lemma
-  "finite A ==> finite B ==> finite {f a * g b |a b. a : A & b : B}"
+  "finite A \<Longrightarrow> finite B \<Longrightarrow> finite {f a * g b |a b. a \<in> A \<and> b \<in> B}"
 by simp
 
 lemma
-  "finite S ==> inj (%(x, y). g x y) ==> finite {f x y| x y. g x y : S}"
+  "finite S \<Longrightarrow> inj (\<lambda>(x, y). g x y) \<Longrightarrow> finite {f x y| x y. g x y \<in> S}"
   by (auto intro: finite_vimageI)
 
 lemma
-  "finite A ==> finite S ==> inj (%(x, y). g x y) ==> finite {f x y z | x y z. g x y : S & z : A}"
+  "finite A \<Longrightarrow> finite S \<Longrightarrow> inj (\<lambda>(x, y). g x y) \<Longrightarrow> finite {f x y z | x y z. g x y \<in> S & z \<in> A}"
   by (auto intro: finite_vimageI)
 
 lemma
-  "finite S ==> finite A ==> inj (%(x, y). g x y) ==> inj (%(x, y). h x y)
-    ==> finite {f a b c d | a b c d. g a c : S & h b d : A}"
+  "finite S \<Longrightarrow> finite A \<Longrightarrow> inj (\<lambda>(x, y). g x y) \<Longrightarrow> inj (\<lambda>(x, y). h x y)
+    \<Longrightarrow> finite {f a b c d | a b c d. g a c \<in> S \<and> h b d \<in> A}"
   by (auto intro: finite_vimageI)
 
 lemma
-  assumes "finite S" shows "finite {(a,b,c,d). ([a, b], [c, d]) : S}"
+  assumes "finite S" shows "finite {(a,b,c,d). ([a, b], [c, d]) \<in> S}"
 using assms by (auto intro!: finite_vimageI simp add: inj_on_def)
   (* injectivity to be automated with further rules and automation *)
 
@@ -123,15 +123,15 @@
 
 definition union :: "nat set => nat set => nat set"
 where
-  "union A B = {x. x : A \<or> x : B}"
+  "union A B = {x. x \<in> A \<or> x \<in> B}"
 
-definition common_subsets :: "nat set => nat set => nat set set"
+definition common_subsets :: "nat set \<Rightarrow> nat set \<Rightarrow> nat set set"
 where
   "common_subsets S1 S2 = {S. S \<subseteq> S1 \<and> S \<subseteq> S2}"
 
 definition products :: "nat set => nat set => nat set"
 where
-  "products A B = {c. EX a b. a : A & b : B & c = a * b}"
+  "products A B = {c. \<exists>a b. a \<in> A \<and> b \<in> B \<and> c = a * b}"
 
 export_code products in Haskell
 
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Set_Theory.thy
--- a/src/HOL/ex/Set_Theory.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Set_Theory.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -129,12 +129,12 @@
   have "finite A" using \<open>card A \<ge> 2\<close> by(auto intro:ccontr)
   have 0: "R `` A <= A" using \<open>sym R\<close> \<open>Domain R <= A\<close>
     unfolding Domain_unfold sym_def by blast
-  have h: "ALL a:A. R `` {a} <= A" using 0 by blast
-  hence 1: "ALL a:A. finite(R `` {a})" using \<open>finite A\<close>
+  have h: "\<forall>a\<in>A. R `` {a} <= A" using 0 by blast
+  hence 1: "\<forall>a\<in>A. finite(R `` {a})" using \<open>finite A\<close>
     by(blast intro: finite_subset)
   have sub: "?N ` A <= {0..<?n}"
   proof -
-    have "ALL a:A. R `` {a} - {a} < A" using h by blast
+    have "\<forall>a\<in>A. R `` {a} - {a} < A" using h by blast
     thus ?thesis using psubset_card_mono[OF \<open>finite A\<close>] by auto
   qed
   show "~ inj_on ?N A" (is "~ ?I")
@@ -143,8 +143,8 @@
     hence "?n = card(?N ` A)" by(rule card_image[symmetric])
     with sub \<open>finite A\<close> have 2[simp]: "?N ` A = {0..<?n}"
       using subset_card_intvl_is_intvl[of _ 0] by(auto)
-    have "0 : ?N ` A" and "?n - 1 : ?N ` A"  using \<open>card A \<ge> 2\<close> by simp+
-    then obtain a b where ab: "a:A" "b:A" and Na: "?N a = 0" and Nb: "?N b = ?n - 1"
+    have "0 \<in> ?N ` A" and "?n - 1 \<in> ?N ` A"  using \<open>card A \<ge> 2\<close> by simp+
+    then obtain a b where ab: "a\<in>A" "b\<in>A" and Na: "?N a = 0" and Nb: "?N b = ?n - 1"
       by (auto simp del: 2)
     have "a \<noteq> b" using Na Nb \<open>card A \<ge> 2\<close> by auto
     have "R `` {a} - {a} = {}" by (metis 1 Na ab card_eq_0_iff finite_Diff)
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/Tarski.thy
--- a/src/HOL/ex/Tarski.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/Tarski.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -385,7 +385,7 @@
   by (simp add: isLub_def A_def r_def)
 
 lemma isLubI:
-  "\<lbrakk>L \<in> A; \<forall>y \<in> S. (y, L) \<in> r; (\<forall>z \<in> A. (\<forall>y \<in> S. (y, z):r) \<longrightarrow> (L, z) \<in> r)\<rbrakk> \<Longrightarrow> isLub S cl L"
+  "\<lbrakk>L \<in> A; \<forall>y \<in> S. (y, L) \<in> r; (\<forall>z \<in> A. (\<forall>y \<in> S. (y, z)\<in>r) \<longrightarrow> (L, z) \<in> r)\<rbrakk> \<Longrightarrow> isLub S cl L"
   by (simp add: isLub_def A_def r_def)
 
 end
diff -r e4e57da0583a -r 560fbd6bc047 src/HOL/ex/While_Combinator_Example.thy
--- a/src/HOL/ex/While_Combinator_Example.thy	Wed Feb 14 16:32:09 2018 +0100
+++ b/src/HOL/ex/While_Combinator_Example.thy	Thu Feb 15 13:04:36 2018 +0100
@@ -41,9 +41,9 @@
 theorem "P (lfp (\<lambda>N::int set. {0} \<union> {(n + 2) mod 6 | n. n \<in> N})) =
   P {0, 4, 2}"
 proof -
-  have seteq: "!!A B. (A = B) = ((!a : A. a:B) & (!b:B. b:A))"
+  have seteq: "\<And>A B. (A = B) = ((\<forall>a \<in> A. a\<in>B) \<and> (\<forall>b\<in>B. b\<in>A))"
     by blast
-  have aux: "!!f A B. {f n | n. A n \<or> B n} = {f n | n. A n} \<union> {f n | n. B n}"
+  have aux: "\<And>f A B. {f n | n. A n \<or> B n} = {f n | n. A n} \<union> {f n | n. B n}"
     apply blast
     done
   show ?thesis