(* Author: Alexander Bentkamp, Universität des Saarlandes *)

section \<open>CP-Rank and Matrix Rank\<close>

theory DL_Rank_CP_Rank
imports Tensor_Rank Jordan_Normal_Form.DL_Rank Tensor_Matricization
  Jordan_Normal_Form.DL_Submatrix Jordan_Normal_Form.Missing_VectorSpace
begin

abbreviation "mrank A == vec_space.rank (dim_row A) A"

no_notation "normal_rel"  (infixl "\<lhd>" 60)

lemma lookup_order1_prod:
assumes "\<And>B. B\<in>set Bs \<Longrightarrow> Tensor.order B = 1"
assumes "is \<lhd> dims (prod_list Bs)"
shows "lookup (prod_list Bs) is = prod_list (map (\<lambda>(i,B). lookup B [i]) (zip is Bs))"
using assms proof (induction Bs arbitrary:"is")
  case Nil
  then show ?case unfolding "prod_list.Nil" unfolding zip.simps tensor_one_def
    by (metis (no_types, lifting) dims_tensor_from_lookup length_greater_0_conv length_map prod_list.Nil
    lookup_tensor_from_lookup tensor_one_def tensor_one_from_lookup)
next
  case (Cons B Bs "is'")
  then obtain i "is" where "is' = i # is"
    by (metis append_is_Nil_conv dims_tensor_prod length_0_conv list.set_intros(1) prod_list.Cons valid_index.simps zero_neq_one)
  have "Tensor.order B = 1" using Cons by auto
  then have valid1:"[i] \<lhd> dims B"
    using \<open>is' \<lhd> dims (prod_list (B # Bs))\<close>[unfolded prod_list.Cons dims_tensor_prod \<open>is' = i # is\<close>]
    by (metis One_nat_def Suc_length_conv hd_append2 length_0_conv list.sel(1) list.simps(3) valid_index.Nil valid_index.simps)
  have valid2:"is \<lhd> dims (prod_list Bs)"
    using \<open>is' \<lhd> dims (prod_list (B # Bs))\<close>[unfolded prod_list.Cons dims_tensor_prod \<open>is' = i # is\<close>] \<open>Tensor.order B = 1\<close>
    by (metis One_nat_def Suc_length_conv append_eq_Cons_conv length_0_conv list.sel(3) list.simps(3) self_append_conv2 valid_indexE)
  show ?case unfolding \<open>is' = i # is\<close> List.zip_Cons_Cons List.list.map(2) prod_list.Cons
    lookup_tensor_prod[OF valid1 valid2, simplified] by (simp add: Cons.IH Cons.prems(1) valid2)
qed

lemma matricize_cprank_max1:
fixes A::"'a::field tensor"
assumes "cprank_max1 A"
shows "mrank (matricize I A) \<le> 1"
proof -
  obtain Bs a where "\<And>B. B \<in> set Bs \<Longrightarrow> Tensor.order B = 1" "a \<cdot> prod_list Bs = A"
    using cprank_max1_prod_listE assms by metis
  define row_factor
    where "row_factor ris = a * prod_list (map (\<lambda>(i,B). lookup B [i]) (zip ris (nths Bs I)))"
    for ris
  define col_factor
    where "col_factor cis = prod_list (map (\<lambda>(i,B). lookup B [i]) (zip cis (nths Bs (-I))))"
    for cis
  have "\<And>is. is \<lhd> dims A \<Longrightarrow> lookup A is = row_factor (nths is I) * col_factor (nths is (-I))"
  proof -
    fix "is" assume "is \<lhd> dims A"
    then have "lookup A is = a * (prod_list (map (\<lambda>(i,B). lookup B [i]) (zip is Bs)))"
      using lookup_order1_prod[OF \<open>\<And>B. B \<in> set Bs \<Longrightarrow> Tensor.order B = 1\<close>] lookup_smult
      using \<open>a \<cdot> prod_list Bs = A\<close> dims_smult by fastforce
    also have "... = a * (prod_list (map (\<lambda>(i,B). lookup B [i]) (nths (zip is Bs) I))) *
                         (prod_list (map (\<lambda>(i,B). lookup B [i]) (nths (zip is Bs) (-I))))"
      using prod_list_complementary_nthss by auto
    also have "... = row_factor (nths is I) * col_factor (nths is (-I))"
      using nths_zip row_factor_def col_factor_def by metis
    finally show "lookup A is = row_factor (nths is I) * col_factor (nths is (-I))" .
  qed
  define row_factor'
    where "row_factor' r = row_factor (digit_encode (nths (Tensor.dims A) I) r)" for r
  define col_factor'
    where "col_factor' c = col_factor (digit_encode (nths (Tensor.dims A) (-I)) c)" for c
  have "\<And>r c. r<dim_row (matricize I A) \<Longrightarrow> c<dim_col (matricize I A) \<Longrightarrow> matricize I A $$ (r,c) = row_factor' r * col_factor' c"
  proof -
    fix r c assume "r<dim_row (matricize I A)" "c<dim_col (matricize I A)"
    then have "matricize I A $$ (r,c) = Tensor.lookup A (weave I
      (digit_encode (nths (Tensor.dims A) I) r)
      (digit_encode (nths (Tensor.dims A) (-I)) c)
    )" unfolding dims_matricize unfolding matricize_def by simp
    also have "... = row_factor' r * col_factor' c"
      using  \<open>\<And>is. is \<lhd> dims A \<Longrightarrow> lookup A is = row_factor (nths is I) * col_factor (nths is (- I))\<close>
      valid_index_weave[OF
      digit_encode_valid_index[OF \<open>r < dim_row (matricize I A)\<close>[unfolded dims_matricize]]
      digit_encode_valid_index[OF \<open>c < dim_col (matricize I A)\<close>[unfolded dims_matricize]]]
      valid_index_weave(2) valid_index_weave(3) row_factor'_def col_factor'_def by metis
    finally show "matricize I A $$ (r,c) = row_factor' r * col_factor' c" .
  qed
  then show ?thesis using vec_space.rank_le_1_product_entries[of "matricize I A"] by blast
qed

lemma matrix_rank_le_cprank_max:
fixes A :: "('a::field) tensor"
assumes "cprank_max r A"
shows "mrank (matricize I A) \<le> r"
using assms
proof (induction rule:cprank_max.induct)
  fix ds :: "nat list"
  have "matricize I (tensor0 ds) = 0\<^sub>m (dim_row (matricize I (tensor0 ds))) (dim_col (matricize I (tensor0 ds)))"
    using matricize_0 by auto
  then show "mrank (matricize I (tensor0 ds)) \<le> 0"
    using eq_imp_le vec_space.rank_0I by metis
next
  fix A B::"'a tensor" and j::nat
  assume "dims A = dims B"
  assume "cprank_max1 A"
  assume "mrank (matricize I B) \<le> j"
  have "mrank (matricize I A) \<le> 1" using \<open>cprank_max1 A\<close> matricize_cprank_max1 by auto
  have "mrank (matricize I (A + B)) \<le> mrank (matricize I A) + mrank (matricize I B)"
    using matricize_add vec_space.rank_subadditive dims_matricize
    carrier_matI index_add_mat(2) \<open>dims A = dims B\<close> by metis
  then show "mrank (matricize I (A + B)) \<le> Suc j"
    using \<open>mrank (matricize I A) \<le> 1\<close> \<open>mrank (matricize I B) \<le> j\<close> by linarith
qed

lemma matrix_rank_le_cp_rank:
fixes A :: "('a::field) tensor"
shows "mrank (matricize I A) \<le> cprank A"
using matrix_rank_le_cprank_max using cprank_max_cprank by auto

end


(*  Title:      ZF/Constructible/Relative.thy
    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
*)

section \<open>Relativization and Absoluteness\<close>

theory Relative imports Main begin

subsection\<open>Relativized versions of standard set-theoretic concepts\<close>

definition
  empty :: "[i=>o,i] => o" where
    "empty(M,z) == \<forall>x[M]. x \<notin> z"

definition
  subset :: "[i=>o,i,i] => o" where
    "subset(M,A,B) == \<forall>x[M]. x\<in>A \<longrightarrow> x \<in> B"

definition
  upair :: "[i=>o,i,i,i] => o" where
    "upair(M,a,b,z) == a \<in> z & b \<in> z & (\<forall>x[M]. x\<in>z \<longrightarrow> x = a | x = b)"

definition
  pair :: "[i=>o,i,i,i] => o" where
    "pair(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) &
                     (\<exists>y[M]. upair(M,a,b,y) & upair(M,x,y,z))"

definition
  union :: "[i=>o,i,i,i] => o" where
    "union(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a | x \<in> b"

definition
  is_cons :: "[i=>o,i,i,i] => o" where
    "is_cons(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & union(M,x,b,z)"

definition
  successor :: "[i=>o,i,i] => o" where
    "successor(M,a,z) == is_cons(M,a,a,z)"

definition
  number1 :: "[i=>o,i] => o" where
    "number1(M,a) == \<exists>x[M]. empty(M,x) & successor(M,x,a)"

definition
  number2 :: "[i=>o,i] => o" where
    "number2(M,a) == \<exists>x[M]. number1(M,x) & successor(M,x,a)"

definition
  number3 :: "[i=>o,i] => o" where
    "number3(M,a) == \<exists>x[M]. number2(M,x) & successor(M,x,a)"

definition
  powerset :: "[i=>o,i,i] => o" where
    "powerset(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> subset(M,x,A)"

definition
  is_Collect :: "[i=>o,i,i=>o,i] => o" where
    "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> A & P(x)"

definition
  is_Replace :: "[i=>o,i,[i,i]=>o,i] => o" where
    "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,u))"

definition
  inter :: "[i=>o,i,i,i] => o" where
    "inter(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a & x \<in> b"

definition
  setdiff :: "[i=>o,i,i,i] => o" where
    "setdiff(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a & x \<notin> b"

definition
  big_union :: "[i=>o,i,i] => o" where
    "big_union(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y\<in>A & x \<in> y)"

definition
  big_inter :: "[i=>o,i,i] => o" where
    "big_inter(M,A,z) ==
             (A=0 \<longrightarrow> z=0) &
             (A\<noteq>0 \<longrightarrow> (\<forall>x[M]. x \<in> z \<longleftrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow> x \<in> y)))"

definition
  cartprod :: "[i=>o,i,i,i] => o" where
    "cartprod(M,A,B,z) ==
        \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))"

definition
  is_sum :: "[i=>o,i,i,i] => o" where
    "is_sum(M,A,B,Z) ==
       \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M].
       number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
       cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"

definition
  is_Inl :: "[i=>o,i,i] => o" where
    "is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z)"

definition
  is_Inr :: "[i=>o,i,i] => o" where
    "is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z)"

definition
  is_converse :: "[i=>o,i,i] => o" where
    "is_converse(M,r,z) ==
        \<forall>x[M]. x \<in> z \<longleftrightarrow>
             (\<exists>w[M]. w\<in>r & (\<exists>u[M]. \<exists>v[M]. pair(M,u,v,w) & pair(M,v,u,x)))"

definition
  pre_image :: "[i=>o,i,i,i] => o" where
    "pre_image(M,r,A,z) ==
        \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))"

definition
  is_domain :: "[i=>o,i,i] => o" where
    "is_domain(M,r,z) ==
        \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w)))"

definition
  image :: "[i=>o,i,i,i] => o" where
    "image(M,r,A,z) ==
        \<forall>y[M]. y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w)))"

definition
  is_range :: "[i=>o,i,i] => o" where
    \<comment>\<open>the cleaner
      @{term "\<exists>r'[M]. is_converse(M,r,r') & is_domain(M,r',z)"}
      unfortunately needs an instance of separation in order to prove
        @{term "M(converse(r))"}.\<close>
    "is_range(M,r,z) ==
        \<forall>y[M]. y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w)))"

definition
  is_field :: "[i=>o,i,i] => o" where
    "is_field(M,r,z) ==
        \<exists>dr[M]. \<exists>rr[M]. is_domain(M,r,dr) & is_range(M,r,rr) &
                        union(M,dr,rr,z)"

definition
  is_relation :: "[i=>o,i] => o" where
    "is_relation(M,r) ==
        (\<forall>z[M]. z\<in>r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))"

definition
  is_function :: "[i=>o,i] => o" where
    "is_function(M,r) ==
        \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
           pair(M,x,y,p) \<longrightarrow> pair(M,x,y',p') \<longrightarrow> p\<in>r \<longrightarrow> p'\<in>r \<longrightarrow> y=y'"

definition
  fun_apply :: "[i=>o,i,i,i] => o" where
    "fun_apply(M,f,x,y) ==
        (\<exists>xs[M]. \<exists>fxs[M].
         upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))"

definition
  typed_function :: "[i=>o,i,i,i] => o" where
    "typed_function(M,A,B,r) ==
        is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
        (\<forall>u[M]. u\<in>r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) \<longrightarrow> y\<in>B))"

definition
  is_funspace :: "[i=>o,i,i,i] => o" where
    "is_funspace(M,A,B,F) ==
        \<forall>f[M]. f \<in> F \<longleftrightarrow> typed_function(M,A,B,f)"

definition
  composition :: "[i=>o,i,i,i] => o" where
    "composition(M,r,s,t) ==
        \<forall>p[M]. p \<in> t \<longleftrightarrow>
               (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
                pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) &
                xy \<in> s & yz \<in> r)"

definition
  injection :: "[i=>o,i,i,i] => o" where
    "injection(M,A,B,f) ==
        typed_function(M,A,B,f) &
        (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M].
          pair(M,x,y,p) \<longrightarrow> pair(M,x',y,p') \<longrightarrow> p\<in>f \<longrightarrow> p'\<in>f \<longrightarrow> x=x')"

definition
  surjection :: "[i=>o,i,i,i] => o" where
    "surjection(M,A,B,f) ==
        typed_function(M,A,B,f) &
        (\<forall>y[M]. y\<in>B \<longrightarrow> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))"

definition
  bijection :: "[i=>o,i,i,i] => o" where
    "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)"

definition
  restriction :: "[i=>o,i,i,i] => o" where
    "restriction(M,r,A,z) ==
        \<forall>x[M]. x \<in> z \<longleftrightarrow> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))"

definition
  transitive_set :: "[i=>o,i] => o" where
    "transitive_set(M,a) == \<forall>x[M]. x\<in>a \<longrightarrow> subset(M,x,a)"

definition
  ordinal :: "[i=>o,i] => o" where
     \<comment>\<open>an ordinal is a transitive set of transitive sets\<close>
    "ordinal(M,a) == transitive_set(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> transitive_set(M,x))"

definition
  limit_ordinal :: "[i=>o,i] => o" where
    \<comment>\<open>a limit ordinal is a non-empty, successor-closed ordinal\<close>
    "limit_ordinal(M,a) ==
        ordinal(M,a) & ~ empty(M,a) &
        (\<forall>x[M]. x\<in>a \<longrightarrow> (\<exists>y[M]. y\<in>a & successor(M,x,y)))"

definition
  successor_ordinal :: "[i=>o,i] => o" where
    \<comment>\<open>a successor ordinal is any ordinal that is neither empty nor limit\<close>
    "successor_ordinal(M,a) ==
        ordinal(M,a) & ~ empty(M,a) & ~ limit_ordinal(M,a)"

definition
  finite_ordinal :: "[i=>o,i] => o" where
    \<comment>\<open>an ordinal is finite if neither it nor any of its elements are limit\<close>
    "finite_ordinal(M,a) ==
        ordinal(M,a) & ~ limit_ordinal(M,a) &
        (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))"

definition
  omega :: "[i=>o,i] => o" where
    \<comment>\<open>omega is a limit ordinal none of whose elements are limit\<close>
    "omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))"

definition
  is_quasinat :: "[i=>o,i] => o" where
    "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))"

definition
  is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o" where
    "is_nat_case(M, a, is_b, k, z) ==
       (empty(M,k) \<longrightarrow> z=a) &
       (\<forall>m[M]. successor(M,m,k) \<longrightarrow> is_b(m,z)) &
       (is_quasinat(M,k) | empty(M,z))"

definition
  relation1 :: "[i=>o, [i,i]=>o, i=>i] => o" where
    "relation1(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. is_f(x,y) \<longleftrightarrow> y = f(x)"

definition
  Relation1 :: "[i=>o, i, [i,i]=>o, i=>i] => o" where
    \<comment>\<open>as above, but typed\<close>
    "Relation1(M,A,is_f,f) ==
        \<forall>x[M]. \<forall>y[M]. x\<in>A \<longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)"

definition
  relation2 :: "[i=>o, [i,i,i]=>o, [i,i]=>i] => o" where
    "relation2(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. is_f(x,y,z) \<longleftrightarrow> z = f(x,y)"

definition
  Relation2 :: "[i=>o, i, i, [i,i,i]=>o, [i,i]=>i] => o" where
    "Relation2(M,A,B,is_f,f) ==
        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. x\<in>A \<longrightarrow> y\<in>B \<longrightarrow> is_f(x,y,z) \<longleftrightarrow> z = f(x,y)"

definition
  relation3 :: "[i=>o, [i,i,i,i]=>o, [i,i,i]=>i] => o" where
    "relation3(M,is_f,f) ==
       \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. is_f(x,y,z,u) \<longleftrightarrow> u = f(x,y,z)"

definition
  Relation3 :: "[i=>o, i, i, i, [i,i,i,i]=>o, [i,i,i]=>i] => o" where
    "Relation3(M,A,B,C,is_f,f) ==
       \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M].
         x\<in>A \<longrightarrow> y\<in>B \<longrightarrow> z\<in>C \<longrightarrow> is_f(x,y,z,u) \<longleftrightarrow> u = f(x,y,z)"

definition
  relation4 :: "[i=>o, [i,i,i,i,i]=>o, [i,i,i,i]=>i] => o" where
    "relation4(M,is_f,f) ==
       \<forall>u[M]. \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>a[M]. is_f(u,x,y,z,a) \<longleftrightarrow> a = f(u,x,y,z)"

text\<open>Useful when absoluteness reasoning has replaced the predicates by terms\<close>
lemma triv_Relation1:
     "Relation1(M, A, \<lambda>x y. y = f(x), f)"
by (simp add: Relation1_def)

lemma triv_Relation2:
     "Relation2(M, A, B, \<lambda>x y a. a = f(x,y), f)"
by (simp add: Relation2_def)

subsection \<open>The relativized ZF axioms\<close>

definition
  extensionality :: "(i=>o) => o" where
    "extensionality(M) ==
        \<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x \<longleftrightarrow> z \<in> y) \<longrightarrow> x=y"

definition
  separation :: "[i=>o, i=>o] => o" where
    \<comment>\<open>The formula \<open>P\<close> should only involve parameters
        belonging to \<open>M\<close> and all its quantifiers must be relativized
        to \<open>M\<close>.  We do not have separation as a scheme; every instance
        that we need must be assumed (and later proved) separately.\<close>
    "separation(M,P) ==
        \<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z & P(x)"

definition
  upair_ax :: "(i=>o) => o" where
    "upair_ax(M) == \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M,x,y,z)"

definition
  Union_ax :: "(i=>o) => o" where
    "Union_ax(M) == \<forall>x[M]. \<exists>z[M]. big_union(M,x,z)"

definition
  power_ax :: "(i=>o) => o" where
    "power_ax(M) == \<forall>x[M]. \<exists>z[M]. powerset(M,x,z)"

definition
  univalent :: "[i=>o, i, [i,i]=>o] => o" where
    "univalent(M,A,P) ==
        \<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. \<forall>z[M]. P(x,y) & P(x,z) \<longrightarrow> y=z)"

definition
  replacement :: "[i=>o, [i,i]=>o] => o" where
    "replacement(M,P) ==
      \<forall>A[M]. univalent(M,A,P) \<longrightarrow>
      (\<exists>Y[M]. \<forall>b[M]. (\<exists>x[M]. x\<in>A & P(x,b)) \<longrightarrow> b \<in> Y)"

definition
  strong_replacement :: "[i=>o, [i,i]=>o] => o" where
    "strong_replacement(M,P) ==
      \<forall>A[M]. univalent(M,A,P) \<longrightarrow>
      (\<exists>Y[M]. \<forall>b[M]. b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,b)))"

definition
  foundation_ax :: "(i=>o) => o" where
    "foundation_ax(M) ==
        \<forall>x[M]. (\<exists>y[M]. y\<in>x) \<longrightarrow> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & z \<in> y))"

subsection\<open>A trivial consistency proof for $V_\omega$\<close>

text\<open>We prove that $V_\omega$
      (or \<open>univ\<close> in Isabelle) satisfies some ZF axioms.
     Kunen, Theorem IV 3.13, page 123.\<close>

lemma univ0_downwards_mem: "[| y \<in> x; x \<in> univ(0) |] ==> y \<in> univ(0)"
apply (insert Transset_univ [OF Transset_0])
apply (simp add: Transset_def, blast)
done

lemma univ0_Ball_abs [simp]:
     "A \<in> univ(0) ==> (\<forall>x\<in>A. x \<in> univ(0) \<longrightarrow> P(x)) \<longleftrightarrow> (\<forall>x\<in>A. P(x))"
by (blast intro: univ0_downwards_mem)

lemma univ0_Bex_abs [simp]:
     "A \<in> univ(0) ==> (\<exists>x\<in>A. x \<in> univ(0) & P(x)) \<longleftrightarrow> (\<exists>x\<in>A. P(x))"
by (blast intro: univ0_downwards_mem)

text\<open>Congruence rule for separation: can assume the variable is in \<open>M\<close>\<close>
lemma separation_cong [cong]:
     "(!!x. M(x) ==> P(x) \<longleftrightarrow> P'(x))
      ==> separation(M, %x. P(x)) \<longleftrightarrow> separation(M, %x. P'(x))"
by (simp add: separation_def)

lemma univalent_cong [cong]:
     "[| A=A'; !!x y. [| x\<in>A; M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y) |]
      ==> univalent(M, A, %x y. P(x,y)) \<longleftrightarrow> univalent(M, A', %x y. P'(x,y))"
by (simp add: univalent_def)

lemma univalent_triv [intro,simp]:
     "univalent(M, A, \<lambda>x y. y = f(x))"
by (simp add: univalent_def)

lemma univalent_conjI2 [intro,simp]:
     "univalent(M,A,Q) ==> univalent(M, A, \<lambda>x y. P(x,y) & Q(x,y))"
by (simp add: univalent_def, blast)

text\<open>Congruence rule for replacement\<close>
lemma strong_replacement_cong [cong]:
     "[| !!x y. [| M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y) |]
      ==> strong_replacement(M, %x y. P(x,y)) \<longleftrightarrow>
          strong_replacement(M, %x y. P'(x,y))"
by (simp add: strong_replacement_def)

text\<open>The extensionality axiom\<close>
lemma "extensionality(\<lambda>x. x \<in> univ(0))"
apply (simp add: extensionality_def)
apply (blast intro: univ0_downwards_mem)
done

text\<open>The separation axiom requires some lemmas\<close>
lemma Collect_in_Vfrom:
     "[| X \<in> Vfrom(A,j);  Transset(A) |] ==> Collect(X,P) \<in> Vfrom(A, succ(j))"
apply (drule Transset_Vfrom)
apply (rule subset_mem_Vfrom)
apply (unfold Transset_def, blast)
done

lemma Collect_in_VLimit:
     "[| X \<in> Vfrom(A,i);  Limit(i);  Transset(A) |]
      ==> Collect(X,P) \<in> Vfrom(A,i)"
apply (rule Limit_VfromE, assumption+)
apply (blast intro: Limit_has_succ VfromI Collect_in_Vfrom)
done

lemma Collect_in_univ:
     "[| X \<in> univ(A);  Transset(A) |] ==> Collect(X,P) \<in> univ(A)"
by (simp add: univ_def Collect_in_VLimit Limit_nat)

lemma "separation(\<lambda>x. x \<in> univ(0), P)"
apply (simp add: separation_def, clarify)
apply (rule_tac x = "Collect(z,P)" in bexI)
apply (blast intro: Collect_in_univ Transset_0)+
done

text\<open>Unordered pairing axiom\<close>
lemma "upair_ax(\<lambda>x. x \<in> univ(0))"
apply (simp add: upair_ax_def upair_def)
apply (blast intro: doubleton_in_univ)
done

text\<open>Union axiom\<close>
lemma "Union_ax(\<lambda>x. x \<in> univ(0))"
apply (simp add: Union_ax_def big_union_def, clarify)
apply (rule_tac x="\<Union>x" in bexI)
 apply (blast intro: univ0_downwards_mem)
apply (blast intro: Union_in_univ Transset_0)
done

text\<open>Powerset axiom\<close>

lemma Pow_in_univ:
     "[| X \<in> univ(A);  Transset(A) |] ==> Pow(X) \<in> univ(A)"
apply (simp add: univ_def Pow_in_VLimit Limit_nat)
done

lemma "power_ax(\<lambda>x. x \<in> univ(0))"
apply (simp add: power_ax_def powerset_def subset_def, clarify)
apply (rule_tac x="Pow(x)" in bexI)
 apply (blast intro: univ0_downwards_mem)
apply (blast intro: Pow_in_univ Transset_0)
done

text\<open>Foundation axiom\<close>
lemma "foundation_ax(\<lambda>x. x \<in> univ(0))"
apply (simp add: foundation_ax_def, clarify)
apply (cut_tac A=x in foundation)
apply (blast intro: univ0_downwards_mem)
done

lemma "replacement(\<lambda>x. x \<in> univ(0), P)"
apply (simp add: replacement_def, clarify)
oops
text\<open>no idea: maybe prove by induction on the rank of A?\<close>

text\<open>Still missing: Replacement, Choice\<close>

subsection\<open>Lemmas Needed to Reduce Some Set Constructions to Instances
      of Separation\<close>

lemma image_iff_Collect: "r `` A = {y \<in> \<Union>(\<Union>(r)). \<exists>p\<in>r. \<exists>x\<in>A. p=<x,y>}"
apply (rule equalityI, auto)
apply (simp add: Pair_def, blast)
done

lemma vimage_iff_Collect:
     "r -`` A = {x \<in> \<Union>(\<Union>(r)). \<exists>p\<in>r. \<exists>y\<in>A. p=<x,y>}"
apply (rule equalityI, auto)
apply (simp add: Pair_def, blast)
done

text\<open>These two lemmas lets us prove \<open>domain_closed\<close> and
      \<open>range_closed\<close> without new instances of separation\<close>

lemma domain_eq_vimage: "domain(r) = r -`` Union(Union(r))"
apply (rule equalityI, auto)
apply (rule vimageI, assumption)
apply (simp add: Pair_def, blast)
done

lemma range_eq_image: "range(r) = r `` Union(Union(r))"
apply (rule equalityI, auto)
apply (rule imageI, assumption)
apply (simp add: Pair_def, blast)
done

lemma replacementD:
    "[| replacement(M,P); M(A);  univalent(M,A,P) |]
     ==> \<exists>Y[M]. (\<forall>b[M]. ((\<exists>x[M]. x\<in>A & P(x,b)) \<longrightarrow> b \<in> Y))"
by (simp add: replacement_def)

lemma strong_replacementD:
    "[| strong_replacement(M,P); M(A);  univalent(M,A,P) |]
     ==> \<exists>Y[M]. (\<forall>b[M]. (b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,b))))"
by (simp add: strong_replacement_def)

lemma separationD:
    "[| separation(M,P); M(z) |] ==> \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z & P(x)"
by (simp add: separation_def)

text\<open>More constants, for order types\<close>

definition
  order_isomorphism :: "[i=>o,i,i,i,i,i] => o" where
    "order_isomorphism(M,A,r,B,s,f) ==
        bijection(M,A,B,f) &
        (\<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow>
          (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
            pair(M,x,y,p) \<longrightarrow> fun_apply(M,f,x,fx) \<longrightarrow> fun_apply(M,f,y,fy) \<longrightarrow>
            pair(M,fx,fy,q) \<longrightarrow> (p\<in>r \<longleftrightarrow> q\<in>s))))"

definition
  pred_set :: "[i=>o,i,i,i,i] => o" where
    "pred_set(M,A,x,r,B) ==
        \<forall>y[M]. y \<in> B \<longleftrightarrow> (\<exists>p[M]. p\<in>r & y \<in> A & pair(M,y,x,p))"

definition
  membership :: "[i=>o,i,i] => o" where \<comment>\<open>membership relation\<close>
    "membership(M,A,r) ==
        \<forall>p[M]. p \<in> r \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>A & x\<in>y & pair(M,x,y,p)))"

subsection\<open>Introducing a Transitive Class Model\<close>

text\<open>The class M is assumed to be transitive and to satisfy some
      relativized ZF axioms\<close>
locale M_trivial =
  fixes M
  assumes transM:           "[| y\<in>x; M(x) |] ==> M(y)"
      and upair_ax:         "upair_ax(M)"
      and Union_ax:         "Union_ax(M)"
      and power_ax:         "power_ax(M)"
      and replacement:      "replacement(M,P)"
      and M_nat [iff]:      "M(nat)"           (*i.e. the axiom of infinity*)

text\<open>Automatically discovers the proof using \<open>transM\<close>, \<open>nat_0I\<close>
and \<open>M_nat\<close>.\<close>
lemma (in M_trivial) nonempty [simp]: "M(0)"
by (blast intro: transM)

lemma (in M_trivial) rall_abs [simp]:
     "M(A) ==> (\<forall>x[M]. x\<in>A \<longrightarrow> P(x)) \<longleftrightarrow> (\<forall>x\<in>A. P(x))"
by (blast intro: transM)

lemma (in M_trivial) rex_abs [simp]:
     "M(A) ==> (\<exists>x[M]. x\<in>A & P(x)) \<longleftrightarrow> (\<exists>x\<in>A. P(x))"
by (blast intro: transM)

lemma (in M_trivial) ball_iff_equiv:
     "M(A) ==> (\<forall>x[M]. (x\<in>A \<longleftrightarrow> P(x))) \<longleftrightarrow>
               (\<forall>x\<in>A. P(x)) & (\<forall>x. P(x) \<longrightarrow> M(x) \<longrightarrow> x\<in>A)"
by (blast intro: transM)

text\<open>Simplifies proofs of equalities when there's an iff-equality
      available for rewriting, universally quantified over M.
      But it's not the only way to prove such equalities: its
      premises @{term "M(A)"} and  @{term "M(B)"} can be too strong.\<close>
lemma (in M_trivial) M_equalityI:
     "[| !!x. M(x) ==> x\<in>A \<longleftrightarrow> x\<in>B; M(A); M(B) |] ==> A=B"
by (blast intro!: equalityI dest: transM)

subsubsection\<open>Trivial Absoluteness Proofs: Empty Set, Pairs, etc.\<close>

lemma (in M_trivial) empty_abs [simp]:
     "M(z) ==> empty(M,z) \<longleftrightarrow> z=0"
apply (simp add: empty_def)
apply (blast intro: transM)
done

lemma (in M_trivial) subset_abs [simp]:
     "M(A) ==> subset(M,A,B) \<longleftrightarrow> A \<subseteq> B"
apply (simp add: subset_def)
apply (blast intro: transM)
done

lemma (in M_trivial) upair_abs [simp]:
     "M(z) ==> upair(M,a,b,z) \<longleftrightarrow> z={a,b}"
apply (simp add: upair_def)
apply (blast intro: transM)
done

lemma (in M_trivial) upair_in_M_iff [iff]:
     "M({a,b}) \<longleftrightarrow> M(a) & M(b)"
apply (insert upair_ax, simp add: upair_ax_def)
apply (blast intro: transM)
done

lemma (in M_trivial) singleton_in_M_iff [iff]:
     "M({a}) \<longleftrightarrow> M(a)"
by (insert upair_in_M_iff [of a a], simp)

lemma (in M_trivial) pair_abs [simp]:
     "M(z) ==> pair(M,a,b,z) \<longleftrightarrow> z=<a,b>"
apply (simp add: pair_def ZF.Pair_def)
apply (blast intro: transM)
done

lemma (in M_trivial) pair_in_M_iff [iff]:
     "M(<a,b>) \<longleftrightarrow> M(a) & M(b)"
by (simp add: ZF.Pair_def)

lemma (in M_trivial) pair_components_in_M:
     "[| <x,y> \<in> A; M(A) |] ==> M(x) & M(y)"
apply (simp add: Pair_def)
apply (blast dest: transM)
done

lemma (in M_trivial) cartprod_abs [simp]:
     "[| M(A); M(B); M(z) |] ==> cartprod(M,A,B,z) \<longleftrightarrow> z = A*B"
apply (simp add: cartprod_def)
apply (rule iffI)
 apply (blast intro!: equalityI intro: transM dest!: rspec)
apply (blast dest: transM)
done

subsubsection\<open>Absoluteness for Unions and Intersections\<close>

lemma (in M_trivial) union_abs [simp]:
     "[| M(a); M(b); M(z) |] ==> union(M,a,b,z) \<longleftrightarrow> z = a \<union> b"
apply (simp add: union_def)
apply (blast intro: transM)
done

lemma (in M_trivial) inter_abs [simp]:
     "[| M(a); M(b); M(z) |] ==> inter(M,a,b,z) \<longleftrightarrow> z = a \<inter> b"
apply (simp add: inter_def)
apply (blast intro: transM)
done

lemma (in M_trivial) setdiff_abs [simp]:
     "[| M(a); M(b); M(z) |] ==> setdiff(M,a,b,z) \<longleftrightarrow> z = a-b"
apply (simp add: setdiff_def)
apply (blast intro: transM)
done

lemma (in M_trivial) Union_abs [simp]:
     "[| M(A); M(z) |] ==> big_union(M,A,z) \<longleftrightarrow> z = \<Union>(A)"
apply (simp add: big_union_def)
apply (blast intro!: equalityI dest: transM)
done

lemma (in M_trivial) Union_closed [intro,simp]:
     "M(A) ==> M(\<Union>(A))"
by (insert Union_ax, simp add: Union_ax_def)

lemma (in M_trivial) Un_closed [intro,simp]:
     "[| M(A); M(B) |] ==> M(A \<union> B)"
by (simp only: Un_eq_Union, blast)

lemma (in M_trivial) cons_closed [intro,simp]:
     "[| M(a); M(A) |] ==> M(cons(a,A))"
by (subst cons_eq [symmetric], blast)

lemma (in M_trivial) cons_abs [simp]:
     "[| M(b); M(z) |] ==> is_cons(M,a,b,z) \<longleftrightarrow> z = cons(a,b)"
by (simp add: is_cons_def, blast intro: transM)

lemma (in M_trivial) successor_abs [simp]:
     "[| M(a); M(z) |] ==> successor(M,a,z) \<longleftrightarrow> z = succ(a)"
by (simp add: successor_def, blast)

lemma (in M_trivial) succ_in_M_iff [iff]:
     "M(succ(a)) \<longleftrightarrow> M(a)"
apply (simp add: succ_def)
apply (blast intro: transM)
done

subsubsection\<open>Absoluteness for Separation and Replacement\<close>

lemma (in M_trivial) separation_closed [intro,simp]:
     "[| separation(M,P); M(A) |] ==> M(Collect(A,P))"
apply (insert separation, simp add: separation_def)
apply (drule rspec, assumption, clarify)
apply (subgoal_tac "y = Collect(A,P)", blast)
apply (blast dest: transM)
done

lemma separation_iff:
     "separation(M,P) \<longleftrightarrow> (\<forall>z[M]. \<exists>y[M]. is_Collect(M,z,P,y))"
by (simp add: separation_def is_Collect_def)

lemma (in M_trivial) Collect_abs [simp]:
     "[| M(A); M(z) |] ==> is_Collect(M,A,P,z) \<longleftrightarrow> z = Collect(A,P)"
apply (simp add: is_Collect_def)
apply (blast intro!: equalityI dest: transM)
done

text\<open>Probably the premise and conclusion are equivalent\<close>
lemma (in M_trivial) strong_replacementI [rule_format]:
    "[| \<forall>B[M]. separation(M, %u. \<exists>x[M]. x\<in>B & P(x,u)) |]
     ==> strong_replacement(M,P)"
apply (simp add: strong_replacement_def, clarify)
apply (frule replacementD [OF replacement], assumption, clarify)
apply (drule_tac x=A in rspec, clarify)
apply (drule_tac z=Y in separationD, assumption, clarify)
apply (rule_tac x=y in rexI, force, assumption)
done

subsubsection\<open>The Operator @{term is_Replace}\<close>

lemma is_Replace_cong [cong]:
     "[| A=A';
         !!x y. [| M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y);
         z=z' |]
      ==> is_Replace(M, A, %x y. P(x,y), z) \<longleftrightarrow>
          is_Replace(M, A', %x y. P'(x,y), z')"
by (simp add: is_Replace_def)

lemma (in M_trivial) univalent_Replace_iff:
     "[| M(A); univalent(M,A,P);
         !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |]
      ==> u \<in> Replace(A,P) \<longleftrightarrow> (\<exists>x. x\<in>A & P(x,u))"
apply (simp add: Replace_iff univalent_def)
apply (blast dest: transM)
done

(*The last premise expresses that P takes M to M*)
lemma (in M_trivial) strong_replacement_closed [intro,simp]:
     "[| strong_replacement(M,P); M(A); univalent(M,A,P);
         !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] ==> M(Replace(A,P))"
apply (simp add: strong_replacement_def)
apply (drule_tac x=A in rspec, safe)
apply (subgoal_tac "Replace(A,P) = Y")
 apply simp
apply (rule equality_iffI)
apply (simp add: univalent_Replace_iff)
apply (blast dest: transM)
done

lemma (in M_trivial) Replace_abs:
     "[| M(A); M(z); univalent(M,A,P);
         !!x y. [| x\<in>A; P(x,y) |] ==> M(y)  |]
      ==> is_Replace(M,A,P,z) \<longleftrightarrow> z = Replace(A,P)"
apply (simp add: is_Replace_def)
apply (rule iffI)
 apply (rule equality_iffI)
 apply (simp_all add: univalent_Replace_iff)
 apply (blast dest: transM)+
done

(*The first premise can't simply be assumed as a schema.
  It is essential to take care when asserting instances of Replacement.
  Let K be a nonconstructible subset of nat and define
  f(x) = x if x \<in> K and f(x)=0 otherwise.  Then RepFun(nat,f) = cons(0,K), a
  nonconstructible set.  So we cannot assume that M(X) implies M(RepFun(X,f))
  even for f \<in> M -> M.
*)
lemma (in M_trivial) RepFun_closed:
     "[| strong_replacement(M, \<lambda>x y. y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
      ==> M(RepFun(A,f))"
apply (simp add: RepFun_def)
done

lemma Replace_conj_eq: "{y . x \<in> A, x\<in>A & y=f(x)} = {y . x\<in>A, y=f(x)}"
by simp

text\<open>Better than \<open>RepFun_closed\<close> when having the formula @{term "x\<in>A"}
      makes relativization easier.\<close>
lemma (in M_trivial) RepFun_closed2:
     "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
      ==> M(RepFun(A, %x. f(x)))"
apply (simp add: RepFun_def)
apply (frule strong_replacement_closed, assumption)
apply (auto dest: transM  simp add: Replace_conj_eq univalent_def)
done

subsubsection \<open>Absoluteness for @{term Lambda}\<close>

definition
 is_lambda :: "[i=>o, i, [i,i]=>o, i] => o" where
    "is_lambda(M, A, is_b, z) ==
       \<forall>p[M]. p \<in> z \<longleftrightarrow>
        (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))"

lemma (in M_trivial) lam_closed:
     "[| strong_replacement(M, \<lambda>x y. y = <x,b(x)>); M(A); \<forall>x\<in>A. M(b(x)) |]
      ==> M(\<lambda>x\<in>A. b(x))"
by (simp add: lam_def, blast intro: RepFun_closed dest: transM)

text\<open>Better than \<open>lam_closed\<close>: has the formula @{term "x\<in>A"}\<close>
lemma (in M_trivial) lam_closed2:
  "[|strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
     M(A); \<forall>m[M]. m\<in>A \<longrightarrow> M(b(m))|] ==> M(Lambda(A,b))"
apply (simp add: lam_def)
apply (blast intro: RepFun_closed2 dest: transM)
done

lemma (in M_trivial) lambda_abs2:
     "[| Relation1(M,A,is_b,b); M(A); \<forall>m[M]. m\<in>A \<longrightarrow> M(b(m)); M(z) |]
      ==> is_lambda(M,A,is_b,z) \<longleftrightarrow> z = Lambda(A,b)"
apply (simp add: Relation1_def is_lambda_def)
apply (rule iffI)
 prefer 2 apply (simp add: lam_def)
apply (rule equality_iffI)
apply (simp add: lam_def)
apply (rule iffI)
 apply (blast dest: transM)
apply (auto simp add: transM [of _ A])
done

lemma is_lambda_cong [cong]:
     "[| A=A';  z=z';
         !!x y. [| x\<in>A; M(x); M(y) |] ==> is_b(x,y) \<longleftrightarrow> is_b'(x,y) |]
      ==> is_lambda(M, A, %x y. is_b(x,y), z) \<longleftrightarrow>
          is_lambda(M, A', %x y. is_b'(x,y), z')"
by (simp add: is_lambda_def)

lemma (in M_trivial) image_abs [simp]:
     "[| M(r); M(A); M(z) |] ==> image(M,r,A,z) \<longleftrightarrow> z = r``A"
apply (simp add: image_def)
apply (rule iffI)
 apply (blast intro!: equalityI dest: transM, blast)
done

text\<open>What about \<open>Pow_abs\<close>?  Powerset is NOT absolute!
      This result is one direction of absoluteness.\<close>

lemma (in M_trivial) powerset_Pow:
     "powerset(M, x, Pow(x))"
by (simp add: powerset_def)

text\<open>But we can't prove that the powerset in \<open>M\<close> includes the
      real powerset.\<close>
lemma (in M_trivial) powerset_imp_subset_Pow:
     "[| powerset(M,x,y); M(y) |] ==> y \<subseteq> Pow(x)"
apply (simp add: powerset_def)
apply (blast dest: transM)
done

subsubsection\<open>Absoluteness for the Natural Numbers\<close>

lemma (in M_trivial) nat_into_M [intro]:
     "n \<in> nat ==> M(n)"
by (induct n rule: nat_induct, simp_all)

lemma (in M_trivial) nat_case_closed [intro,simp]:
  "[|M(k); M(a); \<forall>m[M]. M(b(m))|] ==> M(nat_case(a,b,k))"
apply (case_tac "k=0", simp)
apply (case_tac "\<exists>m. k = succ(m)", force)
apply (simp add: nat_case_def)
done

lemma (in M_trivial) quasinat_abs [simp]:
     "M(z) ==> is_quasinat(M,z) \<longleftrightarrow> quasinat(z)"
by (auto simp add: is_quasinat_def quasinat_def)

lemma (in M_trivial) nat_case_abs [simp]:
     "[| relation1(M,is_b,b); M(k); M(z) |]
      ==> is_nat_case(M,a,is_b,k,z) \<longleftrightarrow> z = nat_case(a,b,k)"
apply (case_tac "quasinat(k)")
 prefer 2
 apply (simp add: is_nat_case_def non_nat_case)
 apply (force simp add: quasinat_def)
apply (simp add: quasinat_def is_nat_case_def)
apply (elim disjE exE)
 apply (simp_all add: relation1_def)
done

(*NOT for the simplifier.  The assumption M(z') is apparently necessary, but
  causes the error "Failed congruence proof!"  It may be better to replace
  is_nat_case by nat_case before attempting congruence reasoning.*)
lemma is_nat_case_cong:
     "[| a = a'; k = k';  z = z';  M(z');
       !!x y. [| M(x); M(y) |] ==> is_b(x,y) \<longleftrightarrow> is_b'(x,y) |]
      ==> is_nat_case(M, a, is_b, k, z) \<longleftrightarrow> is_nat_case(M, a', is_b', k', z')"
by (simp add: is_nat_case_def)

subsection\<open>Absoluteness for Ordinals\<close>
text\<open>These results constitute Theorem IV 5.1 of Kunen (page 126).\<close>

lemma (in M_trivial) lt_closed:
     "[| j<i; M(i) |] ==> M(j)"
by (blast dest: ltD intro: transM)

lemma (in M_trivial) transitive_set_abs [simp]:
     "M(a) ==> transitive_set(M,a) \<longleftrightarrow> Transset(a)"
by (simp add: transitive_set_def Transset_def)

lemma (in M_trivial) ordinal_abs [simp]:
     "M(a) ==> ordinal(M,a) \<longleftrightarrow> Ord(a)"
by (simp add: ordinal_def Ord_def)

lemma (in M_trivial) limit_ordinal_abs [simp]:
     "M(a) ==> limit_ordinal(M,a) \<longleftrightarrow> Limit(a)"
apply (unfold Limit_def limit_ordinal_def)
apply (simp add: Ord_0_lt_iff)
apply (simp add: lt_def, blast)
done

lemma (in M_trivial) successor_ordinal_abs [simp]:
     "M(a) ==> successor_ordinal(M,a) \<longleftrightarrow> Ord(a) & (\<exists>b[M]. a = succ(b))"
apply (simp add: successor_ordinal_def, safe)
apply (drule Ord_cases_disj, auto)
done

lemma finite_Ord_is_nat:
      "[| Ord(a); ~ Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a \<in> nat"
by (induct a rule: trans_induct3, simp_all)

lemma (in M_trivial) finite_ordinal_abs [simp]:
     "M(a) ==> finite_ordinal(M,a) \<longleftrightarrow> a \<in> nat"
apply (simp add: finite_ordinal_def)
apply (blast intro: finite_Ord_is_nat intro: nat_into_Ord
             dest: Ord_trans naturals_not_limit)
done

lemma Limit_non_Limit_implies_nat:
     "[| Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a = nat"
apply (rule le_anti_sym)
apply (rule all_lt_imp_le, blast, blast intro: Limit_is_Ord)
 apply (simp add: lt_def)
 apply (blast intro: Ord_in_Ord Ord_trans finite_Ord_is_nat)
apply (erule nat_le_Limit)
done

lemma (in M_trivial) omega_abs [simp]:
     "M(a) ==> omega(M,a) \<longleftrightarrow> a = nat"
apply (simp add: omega_def)
apply (blast intro: Limit_non_Limit_implies_nat dest: naturals_not_limit)
done

lemma (in M_trivial) number1_abs [simp]:
     "M(a) ==> number1(M,a) \<longleftrightarrow> a = 1"
by (simp add: number1_def)

lemma (in M_trivial) number2_abs [simp]:
     "M(a) ==> number2(M,a) \<longleftrightarrow> a = succ(1)"
by (simp add: number2_def)

lemma (in M_trivial) number3_abs [simp]:
     "M(a) ==> number3(M,a) \<longleftrightarrow> a = succ(succ(1))"
by (simp add: number3_def)

text\<open>Kunen continued to 20...\<close>

(*Could not get this to work.  The \<lambda>x\<in>nat is essential because everything
  but the recursion variable must stay unchanged.  But then the recursion
  equations only hold for x\<in>nat (or in some other set) and not for the
  whole of the class M.
  consts
    natnumber_aux :: "[i=>o,i] => i"

  primrec
      "natnumber_aux(M,0) = (\<lambda>x\<in>nat. if empty(M,x) then 1 else 0)"
      "natnumber_aux(M,succ(n)) =
           (\<lambda>x\<in>nat. if (\<exists>y[M]. natnumber_aux(M,n)`y=1 & successor(M,y,x))
                     then 1 else 0)"

  definition
    natnumber :: "[i=>o,i,i] => o"
      "natnumber(M,n,x) == natnumber_aux(M,n)`x = 1"

  lemma (in M_trivial) [simp]:
       "natnumber(M,0,x) == x=0"
*)

subsection\<open>Some instances of separation and strong replacement\<close>

locale M_basic = M_trivial +
assumes Inter_separation:
     "M(A) ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>A \<longrightarrow> x\<in>y)"
  and Diff_separation:
     "M(B) ==> separation(M, \<lambda>x. x \<notin> B)"
  and cartprod_separation:
     "[| M(A); M(B) |]
      ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,z)))"
  and image_separation:
     "[| M(A); M(r) |]
      ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,p)))"
  and converse_separation:
     "M(r) ==> separation(M,
         \<lambda>z. \<exists>p[M]. p\<in>r & (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))"
  and restrict_separation:
     "M(A) ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. pair(M,x,y,z)))"
  and comp_separation:
     "[| M(r); M(s) |]
      ==> separation(M, \<lambda>xz. \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
                  pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) &
                  xy\<in>s & yz\<in>r)"
  and pred_separation:
     "[| M(r); M(x) |] ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & pair(M,y,x,p))"
  and Memrel_separation:
     "separation(M, \<lambda>z. \<exists>x[M]. \<exists>y[M]. pair(M,x,y,z) & x \<in> y)"
  and funspace_succ_replacement:
     "M(n) ==>
      strong_replacement(M, \<lambda>p z. \<exists>f[M]. \<exists>b[M]. \<exists>nb[M]. \<exists>cnbf[M].
                pair(M,f,b,p) & pair(M,n,b,nb) & is_cons(M,nb,f,cnbf) &
                upair(M,cnbf,cnbf,z))"
  and is_recfun_separation:
     \<comment>\<open>for well-founded recursion: used to prove \<open>is_recfun_equal\<close>\<close>
     "[| M(r); M(f); M(g); M(a); M(b) |]
     ==> separation(M,
            \<lambda>x. \<exists>xa[M]. \<exists>xb[M].
                pair(M,x,a,xa) & xa \<in> r & pair(M,x,b,xb) & xb \<in> r &
                (\<exists>fx[M]. \<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) &
                                   fx \<noteq> gx))"

lemma (in M_basic) cartprod_iff_lemma:
     "[| M(C);  \<forall>u[M]. u \<in> C \<longleftrightarrow> (\<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}});
         powerset(M, A \<union> B, p1); powerset(M, p1, p2);  M(p2) |]
       ==> C = {u \<in> p2 . \<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}}"
apply (simp add: powerset_def)
apply (rule equalityI, clarify, simp)
 apply (frule transM, assumption)
 apply (frule transM, assumption, simp (no_asm_simp))
 apply blast
apply clarify
apply (frule transM, assumption, force)
done

lemma (in M_basic) cartprod_iff:
     "[| M(A); M(B); M(C) |]
      ==> cartprod(M,A,B,C) \<longleftrightarrow>
          (\<exists>p1[M]. \<exists>p2[M]. powerset(M,A \<union> B,p1) & powerset(M,p1,p2) &
                   C = {z \<in> p2. \<exists>x\<in>A. \<exists>y\<in>B. z = <x,y>})"
apply (simp add: Pair_def cartprod_def, safe)
defer 1
  apply (simp add: powerset_def)
 apply blast
txt\<open>Final, difficult case: the left-to-right direction of the theorem.\<close>
apply (insert power_ax, simp add: power_ax_def)
apply (frule_tac x="A \<union> B" and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
apply (blast, clarify)
apply (drule_tac x=z and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
apply assumption
apply (blast intro: cartprod_iff_lemma)
done

lemma (in M_basic) cartprod_closed_lemma:
     "[| M(A); M(B) |] ==> \<exists>C[M]. cartprod(M,A,B,C)"
apply (simp del: cartprod_abs add: cartprod_iff)
apply (insert power_ax, simp add: power_ax_def)
apply (frule_tac x="A \<union> B" and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
apply (blast, clarify)
apply (drule_tac x=z and P="\<lambda>x. rex(M,Q(x))" for Q in rspec, auto)
apply (intro rexI conjI, simp+)
apply (insert cartprod_separation [of A B], simp)
done

text\<open>All the lemmas above are necessary because Powerset is not absolute.
      I should have used Replacement instead!\<close>
lemma (in M_basic) cartprod_closed [intro,simp]:
     "[| M(A); M(B) |] ==> M(A*B)"
by (frule cartprod_closed_lemma, assumption, force)

lemma (in M_basic) sum_closed [intro,simp]:
     "[| M(A); M(B) |] ==> M(A+B)"
by (simp add: sum_def)

lemma (in M_basic) sum_abs [simp]:
     "[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) \<longleftrightarrow> (Z = A+B)"
by (simp add: is_sum_def sum_def singleton_0 nat_into_M)

lemma (in M_trivial) Inl_in_M_iff [iff]:
     "M(Inl(a)) \<longleftrightarrow> M(a)"
by (simp add: Inl_def)

lemma (in M_trivial) Inl_abs [simp]:
     "M(Z) ==> is_Inl(M,a,Z) \<longleftrightarrow> (Z = Inl(a))"
by (simp add: is_Inl_def Inl_def)

lemma (in M_trivial) Inr_in_M_iff [iff]:
     "M(Inr(a)) \<longleftrightarrow> M(a)"
by (simp add: Inr_def)

lemma (in M_trivial) Inr_abs [simp]:
     "M(Z) ==> is_Inr(M,a,Z) \<longleftrightarrow> (Z = Inr(a))"
by (simp add: is_Inr_def Inr_def)

subsubsection \<open>converse of a relation\<close>

lemma (in M_basic) M_converse_iff:
     "M(r) ==>
      converse(r) =
      {z \<in> \<Union>(\<Union>(r)) * \<Union>(\<Union>(r)).
       \<exists>p\<in>r. \<exists>x[M]. \<exists>y[M]. p = \<langle>x,y\<rangle> & z = \<langle>y,x\<rangle>}"
apply (rule equalityI)
 prefer 2 apply (blast dest: transM, clarify, simp)
apply (simp add: Pair_def)
apply (blast dest: transM)
done

lemma (in M_basic) converse_closed [intro,simp]:
     "M(r) ==> M(converse(r))"
apply (simp add: M_converse_iff)
apply (insert converse_separation [of r], simp)
done

lemma (in M_basic) converse_abs [simp]:
     "[| M(r); M(z) |] ==> is_converse(M,r,z) \<longleftrightarrow> z = converse(r)"
apply (simp add: is_converse_def)
apply (rule iffI)
 prefer 2 apply blast
apply (rule M_equalityI)
  apply simp
  apply (blast dest: transM)+
done

subsubsection \<open>image, preimage, domain, range\<close>

lemma (in M_basic) image_closed [intro,simp]:
     "[| M(A); M(r) |] ==> M(r``A)"
apply (simp add: image_iff_Collect)
apply (insert image_separation [of A r], simp)
done

lemma (in M_basic) vimage_abs [simp]:
     "[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) \<longleftrightarrow> z = r-``A"
apply (simp add: pre_image_def)
apply (rule iffI)
 apply (blast intro!: equalityI dest: transM, blast)
done

lemma (in M_basic) vimage_closed [intro,simp]:
     "[| M(A); M(r) |] ==> M(r-``A)"
by (simp add: vimage_def)

subsubsection\<open>Domain, range and field\<close>

lemma (in M_basic) domain_abs [simp]:
     "[| M(r); M(z) |] ==> is_domain(M,r,z) \<longleftrightarrow> z = domain(r)"
apply (simp add: is_domain_def)
apply (blast intro!: equalityI dest: transM)
done

lemma (in M_basic) domain_closed [intro,simp]:
     "M(r) ==> M(domain(r))"
apply (simp add: domain_eq_vimage)
done

lemma (in M_basic) range_abs [simp]:
     "[| M(r); M(z) |] ==> is_range(M,r,z) \<longleftrightarrow> z = range(r)"
apply (simp add: is_range_def)
apply (blast intro!: equalityI dest: transM)
done

lemma (in M_basic) range_closed [intro,simp]:
     "M(r) ==> M(range(r))"
apply (simp add: range_eq_image)
done

lemma (in M_basic) field_abs [simp]:
     "[| M(r); M(z) |] ==> is_field(M,r,z) \<longleftrightarrow> z = field(r)"
by (simp add: domain_closed range_closed is_field_def field_def)

lemma (in M_basic) field_closed [intro,simp]:
     "M(r) ==> M(field(r))"
by (simp add: domain_closed range_closed Un_closed field_def)

subsubsection\<open>Relations, functions and application\<close>

lemma (in M_basic) relation_abs [simp]:
     "M(r) ==> is_relation(M,r) \<longleftrightarrow> relation(r)"
apply (simp add: is_relation_def relation_def)
apply (blast dest!: bspec dest: pair_components_in_M)+
done

lemma (in M_basic) function_abs [simp]:
     "M(r) ==> is_function(M,r) \<longleftrightarrow> function(r)"
apply (simp add: is_function_def function_def, safe)
   apply (frule transM, assumption)
  apply (blast dest: pair_components_in_M)+
done

lemma (in M_basic) apply_closed [intro,simp]:
     "[|M(f); M(a)|] ==> M(f`a)"
by (simp add: apply_def)

lemma (in M_basic) apply_abs [simp]:
     "[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) \<longleftrightarrow> f`x = y"
apply (simp add: fun_apply_def apply_def, blast)
done

lemma (in M_basic) typed_function_abs [simp]:
     "[| M(A); M(f) |] ==> typed_function(M,A,B,f) \<longleftrightarrow> f \<in> A -> B"
apply (auto simp add: typed_function_def relation_def Pi_iff)
apply (blast dest: pair_components_in_M)+
done

lemma (in M_basic) injection_abs [simp]:
     "[| M(A); M(f) |] ==> injection(M,A,B,f) \<longleftrightarrow> f \<in> inj(A,B)"
apply (simp add: injection_def apply_iff inj_def apply_closed)
apply (blast dest: transM [of _ A])
done

lemma (in M_basic) surjection_abs [simp]:
     "[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) \<longleftrightarrow> f \<in> surj(A,B)"
by (simp add: surjection_def surj_def)

lemma (in M_basic) bijection_abs [simp]:
     "[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) \<longleftrightarrow> f \<in> bij(A,B)"
by (simp add: bijection_def bij_def)

subsubsection\<open>Composition of relations\<close>

lemma (in M_basic) M_comp_iff:
     "[| M(r); M(s) |]
      ==> r O s =
          {xz \<in> domain(s) * range(r).
            \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. xz = \<langle>x,z\<rangle> & \<langle>x,y\<rangle> \<in> s & \<langle>y,z\<rangle> \<in> r}"
apply (simp add: comp_def)
apply (rule equalityI)
 apply clarify
 apply simp
 apply  (blast dest:  transM)+
done

lemma (in M_basic) comp_closed [intro,simp]:
     "[| M(r); M(s) |] ==> M(r O s)"
apply (simp add: M_comp_iff)
apply (insert comp_separation [of r s], simp)
done

lemma (in M_basic) composition_abs [simp]:
     "[| M(r); M(s); M(t) |] ==> composition(M,r,s,t) \<longleftrightarrow> t = r O s"
apply safe
 txt\<open>Proving @{term "composition(M, r, s, r O s)"}\<close>
 prefer 2
 apply (simp add: composition_def comp_def)
 apply (blast dest: transM)
txt\<open>Opposite implication\<close>
apply (rule M_equalityI)
  apply (simp add: composition_def comp_def)
  apply (blast del: allE dest: transM)+
done

text\<open>no longer needed\<close>
lemma (in M_basic) restriction_is_function:
     "[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |]
      ==> function(z)"
apply (simp add: restriction_def ball_iff_equiv)
apply (unfold function_def, blast)
done

lemma (in M_basic) restriction_abs [simp]:
     "[| M(f); M(A); M(z) |]
      ==> restriction(M,f,A,z) \<longleftrightarrow> z = restrict(f,A)"
apply (simp add: ball_iff_equiv restriction_def restrict_def)
apply (blast intro!: equalityI dest: transM)
done

lemma (in M_basic) M_restrict_iff:
     "M(r) ==> restrict(r,A) = {z \<in> r . \<exists>x\<in>A. \<exists>y[M]. z = \<langle>x, y\<rangle>}"
by (simp add: restrict_def, blast dest: transM)

lemma (in M_basic) restrict_closed [intro,simp]:
     "[| M(A); M(r) |] ==> M(restrict(r,A))"
apply (simp add: M_restrict_iff)
apply (insert restrict_separation [of A], simp)
done

lemma (in M_basic) Inter_abs [simp]:
     "[| M(A); M(z) |] ==> big_inter(M,A,z) \<longleftrightarrow> z = \<Inter>(A)"
apply (simp add: big_inter_def Inter_def)
apply (blast intro!: equalityI dest: transM)
done

lemma (in M_basic) Inter_closed [intro,simp]:
     "M(A) ==> M(\<Inter>(A))"
by (insert Inter_separation, simp add: Inter_def)

lemma (in M_basic) Int_closed [intro,simp]:
     "[| M(A); M(B) |] ==> M(A \<inter> B)"
apply (subgoal_tac "M({A,B})")
apply (frule Inter_closed, force+)
done

lemma (in M_basic) Diff_closed [intro,simp]:
     "[|M(A); M(B)|] ==> M(A-B)"
by (insert Diff_separation, simp add: Diff_def)

subsubsection\<open>Some Facts About Separation Axioms\<close>

lemma (in M_basic) separation_conj:
     "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) & Q(z))"
by (simp del: separation_closed
         add: separation_iff Collect_Int_Collect_eq [symmetric])

(*???equalities*)
lemma Collect_Un_Collect_eq:
     "Collect(A,P) \<union> Collect(A,Q) = Collect(A, %x. P(x) | Q(x))"
by blast

lemma Diff_Collect_eq:
     "A - Collect(A,P) = Collect(A, %x. ~ P(x))"
by blast

lemma (in M_trivial) Collect_rall_eq:
     "M(Y) ==> Collect(A, %x. \<forall>y[M]. y\<in>Y \<longrightarrow> P(x,y)) =
               (if Y=0 then A else (\<Inter>y \<in> Y. {x \<in> A. P(x,y)}))"
apply simp
apply (blast intro!: equalityI dest: transM)
done

lemma (in M_basic) separation_disj:
     "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) | Q(z))"
by (simp del: separation_closed
         add: separation_iff Collect_Un_Collect_eq [symmetric])

lemma (in M_basic) separation_neg:
     "separation(M,P) ==> separation(M, \<lambda>z. ~P(z))"
by (simp del: separation_closed
         add: separation_iff Diff_Collect_eq [symmetric])

lemma (in M_basic) separation_imp:
     "[|separation(M,P); separation(M,Q)|]
      ==> separation(M, \<lambda>z. P(z) \<longrightarrow> Q(z))"
by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric])

text\<open>This result is a hint of how little can be done without the Reflection
  Theorem.  The quantifier has to be bounded by a set.  We also need another
  instance of Separation!\<close>
lemma (in M_basic) separation_rall:
     "[|M(Y); \<forall>y[M]. separation(M, \<lambda>x. P(x,y));
        \<forall>z[M]. strong_replacement(M, \<lambda>x y. y = {u \<in> z . P(u,x)})|]
      ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>Y \<longrightarrow> P(x,y))"
apply (simp del: separation_closed rall_abs
         add: separation_iff Collect_rall_eq)
apply (blast intro!: Inter_closed RepFun_closed dest: transM)
done

subsubsection\<open>Functions and function space\<close>

text\<open>The assumption @{term "M(A->B)"} is unusual, but essential: in
all but trivial cases, A->B cannot be expected to belong to @{term M}.\<close>
lemma (in M_basic) is_funspace_abs [simp]:
     "[|M(A); M(B); M(F); M(A->B)|] ==> is_funspace(M,A,B,F) \<longleftrightarrow> F = A->B"
apply (simp add: is_funspace_def)
apply (rule iffI)
 prefer 2 apply blast
apply (rule M_equalityI)
  apply simp_all
done

lemma (in M_basic) succ_fun_eq2:
     "[|M(B); M(n->B)|] ==>
      succ(n) -> B =
      \<Union>{z. p \<in> (n->B)*B, \<exists>f[M]. \<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}"
apply (simp add: succ_fun_eq)
apply (blast dest: transM)
done

lemma (in M_basic) funspace_succ:
     "[|M(n); M(B); M(n->B) |] ==> M(succ(n) -> B)"
apply (insert funspace_succ_replacement [of n], simp)
apply (force simp add: succ_fun_eq2 univalent_def)
done

text\<open>@{term M} contains all finite function spaces.  Needed to prove the
absoluteness of transitive closure.  See the definition of
\<open>rtrancl_alt\<close> in in \<open>WF_absolute.thy\<close>.\<close>
lemma (in M_basic) finite_funspace_closed [intro,simp]:
     "[|n\<in>nat; M(B)|] ==> M(n->B)"
apply (induct_tac n, simp)
apply (simp add: funspace_succ nat_into_M)
done

subsection\<open>Relativization and Absoluteness for Boolean Operators\<close>

definition
  is_bool_of_o :: "[i=>o, o, i] => o" where
   "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))"

definition
  is_not :: "[i=>o, i, i] => o" where
   "is_not(M,a,z) == (number1(M,a)  & empty(M,z)) |
                     (~number1(M,a) & number1(M,z))"

definition
  is_and :: "[i=>o, i, i, i] => o" where
   "is_and(M,a,b,z) == (number1(M,a)  & z=b) |
                       (~number1(M,a) & empty(M,z))"

definition
  is_or :: "[i=>o, i, i, i] => o" where
   "is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) |
                      (~number1(M,a) & z=b)"

lemma (in M_trivial) bool_of_o_abs [simp]:
     "M(z) ==> is_bool_of_o(M,P,z) \<longleftrightarrow> z = bool_of_o(P)"
by (simp add: is_bool_of_o_def bool_of_o_def)

lemma (in M_trivial) not_abs [simp]:
     "[| M(a); M(z)|] ==> is_not(M,a,z) \<longleftrightarrow> z = not(a)"
by (simp add: Bool.not_def cond_def is_not_def)

lemma (in M_trivial) and_abs [simp]:
     "[| M(a); M(b); M(z)|] ==> is_and(M,a,b,z) \<longleftrightarrow> z = a and b"
by (simp add: Bool.and_def cond_def is_and_def)

lemma (in M_trivial) or_abs [simp]:
     "[| M(a); M(b); M(z)|] ==> is_or(M,a,b,z) \<longleftrightarrow> z = a or b"
by (simp add: Bool.or_def cond_def is_or_def)

lemma (in M_trivial) bool_of_o_closed [intro,simp]:
     "M(bool_of_o(P))"
by (simp add: bool_of_o_def)

lemma (in M_trivial) and_closed [intro,simp]:
     "[| M(p); M(q) |] ==> M(p and q)"
by (simp add: and_def cond_def)

lemma (in M_trivial) or_closed [intro,simp]:
     "[| M(p); M(q) |] ==> M(p or q)"
by (simp add: or_def cond_def)

lemma (in M_trivial) not_closed [intro,simp]:
     "M(p) ==> M(not(p))"
by (simp add: Bool.not_def cond_def)

subsection\<open>Relativization and Absoluteness for List Operators\<close>

definition
  is_Nil :: "[i=>o, i] => o" where
     \<comment>\<open>because @{prop "[] \<equiv> Inl(0)"}\<close>
    "is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs)"

definition
  is_Cons :: "[i=>o,i,i,i] => o" where
     \<comment>\<open>because @{prop "Cons(a, l) \<equiv> Inr(\<langle>a,l\<rangle>)"}\<close>
    "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)"

lemma (in M_trivial) Nil_in_M [intro,simp]: "M(Nil)"
by (simp add: Nil_def)

lemma (in M_trivial) Nil_abs [simp]: "M(Z) ==> is_Nil(M,Z) \<longleftrightarrow> (Z = Nil)"
by (simp add: is_Nil_def Nil_def)

lemma (in M_trivial) Cons_in_M_iff [iff]: "M(Cons(a,l)) \<longleftrightarrow> M(a) & M(l)"
by (simp add: Cons_def)

lemma (in M_trivial) Cons_abs [simp]:
     "[|M(a); M(l); M(Z)|] ==> is_Cons(M,a,l,Z) \<longleftrightarrow> (Z = Cons(a,l))"
by (simp add: is_Cons_def Cons_def)

definition
  quasilist :: "i => o" where
    "quasilist(xs) == xs=Nil | (\<exists>x l. xs = Cons(x,l))"

definition
  is_quasilist :: "[i=>o,i] => o" where
    "is_quasilist(M,z) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))"

definition
  list_case' :: "[i, [i,i]=>i, i] => i" where
    \<comment>\<open>A version of @{term list_case} that's always defined.\<close>
    "list_case'(a,b,xs) ==
       if quasilist(xs) then list_case(a,b,xs) else 0"

definition
  is_list_case :: "[i=>o, i, [i,i,i]=>o, i, i] => o" where
    \<comment>\<open>Returns 0 for non-lists\<close>
    "is_list_case(M, a, is_b, xs, z) ==
       (is_Nil(M,xs) \<longrightarrow> z=a) &
       (\<forall>x[M]. \<forall>l[M]. is_Cons(M,x,l,xs) \<longrightarrow> is_b(x,l,z)) &
       (is_quasilist(M,xs) | empty(M,z))"

definition
  hd' :: "i => i" where
    \<comment>\<open>A version of @{term hd} that's always defined.\<close>
    "hd'(xs) == if quasilist(xs) then hd(xs) else 0"

definition
  tl' :: "i => i" where
    \<comment>\<open>A version of @{term tl} that's always defined.\<close>
    "tl'(xs) == if quasilist(xs) then tl(xs) else 0"

definition
  is_hd :: "[i=>o,i,i] => o" where
     \<comment>\<open>@{term "hd([]) = 0"} no constraints if not a list.
          Avoiding implication prevents the simplifier's looping.\<close>
    "is_hd(M,xs,H) ==
       (is_Nil(M,xs) \<longrightarrow> empty(M,H)) &
       (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
       (is_quasilist(M,xs) | empty(M,H))"

definition
  is_tl :: "[i=>o,i,i] => o" where
     \<comment>\<open>@{term "tl([]) = []"}; see comments about @{term is_hd}\<close>
    "is_tl(M,xs,T) ==
       (is_Nil(M,xs) \<longrightarrow> T=xs) &
       (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
       (is_quasilist(M,xs) | empty(M,T))"

subsubsection\<open>@{term quasilist}: For Case-Splitting with @{term list_case'}\<close>

lemma [iff]: "quasilist(Cons(x,l))"
by (simp add: quasilist_def)

lemma list_imp_quasilist: "l \<in> list(A) ==> quasilist(l)"
by (erule list.cases, simp_all)

subsubsection\<open>@{term list_case'}, the Modified Version of @{term list_case}\<close>

lemma list_case'_Nil [simp]: "list_case'(a,b,Nil) = a"
by (simp add: list_case'_def quasilist_def)

lemma list_case'_Cons [simp]: "list_case'(a,b,Cons(x,l)) = b(x,l)"
by (simp add: list_case'_def quasilist_def)

lemma non_list_case: "~ quasilist(x) ==> list_case'(a,b,x) = 0"
by (simp add: quasilist_def list_case'_def)

lemma list_case'_eq_list_case [simp]:
     "xs \<in> list(A) ==>list_case'(a,b,xs) = list_case(a,b,xs)"
by (erule list.cases, simp_all)

lemma (in M_basic) list_case'_closed [intro,simp]:
  "[|M(k); M(a); \<forall>x[M]. \<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))"
apply (case_tac "quasilist(k)")
 apply (simp add: quasilist_def, force)
apply (simp add: non_list_case)
done

lemma (in M_trivial) quasilist_abs [simp]:
     "M(z) ==> is_quasilist(M,z) \<longleftrightarrow> quasilist(z)"
by (auto simp add: is_quasilist_def quasilist_def)

lemma (in M_trivial) list_case_abs [simp]:
     "[| relation2(M,is_b,b); M(k); M(z) |]
      ==> is_list_case(M,a,is_b,k,z) \<longleftrightarrow> z = list_case'(a,b,k)"
apply (case_tac "quasilist(k)")
 prefer 2
 apply (simp add: is_list_case_def non_list_case)
 apply (force simp add: quasilist_def)
apply (simp add: quasilist_def is_list_case_def)
apply (elim disjE exE)
 apply (simp_all add: relation2_def)
done

subsubsection\<open>The Modified Operators @{term hd'} and @{term tl'}\<close>

lemma (in M_trivial) is_hd_Nil: "is_hd(M,[],Z) \<longleftrightarrow> empty(M,Z)"
by (simp add: is_hd_def)

lemma (in M_trivial) is_hd_Cons:
     "[|M(a); M(l)|] ==> is_hd(M,Cons(a,l),Z) \<longleftrightarrow> Z = a"
by (force simp add: is_hd_def)

lemma (in M_trivial) hd_abs [simp]:
     "[|M(x); M(y)|] ==> is_hd(M,x,y) \<longleftrightarrow> y = hd'(x)"
apply (simp add: hd'_def)
apply (intro impI conjI)
 prefer 2 apply (force simp add: is_hd_def)
apply (simp add: quasilist_def is_hd_def)
apply (elim disjE exE, auto)
done

lemma (in M_trivial) is_tl_Nil: "is_tl(M,[],Z) \<longleftrightarrow> Z = []"
by (simp add: is_tl_def)

lemma (in M_trivial) is_tl_Cons:
     "[|M(a); M(l)|] ==> is_tl(M,Cons(a,l),Z) \<longleftrightarrow> Z = l"
by (force simp add: is_tl_def)

lemma (in M_trivial) tl_abs [simp]:
     "[|M(x); M(y)|] ==> is_tl(M,x,y) \<longleftrightarrow> y = tl'(x)"
apply (simp add: tl'_def)
apply (intro impI conjI)
 prefer 2 apply (force simp add: is_tl_def)
apply (simp add: quasilist_def is_tl_def)
apply (elim disjE exE, auto)
done

lemma (in M_trivial) relation1_tl: "relation1(M, is_tl(M), tl')"
by (simp add: relation1_def)

lemma hd'_Nil: "hd'([]) = 0"
by (simp add: hd'_def)

lemma hd'_Cons: "hd'(Cons(a,l)) = a"
by (simp add: hd'_def)

lemma tl'_Nil: "tl'([]) = []"
by (simp add: tl'_def)

lemma tl'_Cons: "tl'(Cons(a,l)) = l"
by (simp add: tl'_def)

lemma iterates_tl_Nil: "n \<in> nat ==> tl'^n ([]) = []"
apply (induct_tac n)
apply (simp_all add: tl'_Nil)
done

lemma (in M_basic) tl'_closed: "M(x) ==> M(tl'(x))"
apply (simp add: tl'_def)
apply (force simp add: quasilist_def)
done

end


theory Demo2 imports Main begin

subsection "data types"

datatype 'a tree = Tip | Node "'a tree" 'a "'a tree"

lemma "Tip \<noteq> Node l x r"
apply simp
done

lemma "(1::nat) \<le> (case t of Tip \<Rightarrow> 1 | Node l x r \<Rightarrow> x+1)"
apply(case_tac t)
apply auto
done

subsection "induction heuristics"

consts itrev :: "'a list \<Rightarrow> 'a list \<Rightarrow> 'a list"
primrec
  "itrev [] ys = ys"
  "itrev (x#xs) ys = itrev xs (x#ys)"

lemma "itrev xs [] = rev xs"

oops
-- solution

lemma "ALL ys. itrev xs ys = rev xs @ ys"
apply(induct xs)
apply(auto)
done

end


section \<open>Transitive Closure Implementation\<close>

theory Transitive_Closure_Meta_Impl
  imports "HOL-Library.Mapping" "HOL-Library.Product_Lexorder" Relpow_Meta_Impl
begin

subsection \<open>Data structure\<close>

definition "un_map \<equiv> fold (\<lambda>(u,b). Mapping.update u b)"

definition "memb_map u m \<equiv> \<not> Option.is_none (Mapping.lookup m u)"

lemma un_keys: "Mapping.keys (un_map as m) = fst ` set as \<union> Mapping.keys m"
  by (induction as arbitrary: m) (auto simp: un_map_def)

lemma update_valid_metas: "valid_meta k v \<Longrightarrow> valid_metas_set valid_meta (Mapping.entries m) \<Longrightarrow>
  valid_metas_set valid_meta (Mapping.entries (Mapping.update k v m))"
  unfolding valid_metas_set_def by (simp add: entries_delete entries_update)

lemma un_map_valid_metas:
  assumes "valid_metas_set valid_meta (set as)"
      and "valid_metas_set valid_meta (Mapping.entries m)"
    shows "valid_metas_set valid_meta (Mapping.entries (un_map as m))"
  using assms
  unfolding un_map_def
proof (induction as arbitrary: m)
  case Nil
  then show ?case by simp
next
  case (Cons a as)
  then have as_valid: "valid_metas_set valid_meta (set as)" unfolding valid_metas_set_def by simp
  obtain k v where kv: "a = (k,v)" by fastforce
  then have "valid_meta k v" using Cons(2) unfolding valid_metas_set_def by simp
  then have "valid_metas_set valid_meta (Mapping.entries (Mapping.update k v m))" using update_valid_metas Cons(3) by fast
  then show ?case using kv as_valid Cons update_valid_metas by simp
qed

interpretation trancl_data_structure_mapping: relpow_data_structure un_map Mapping.entries memb_map Mapping.empty
  unfolding memb_map_def
  by (unfold_locales, auto simp: image_Un un_keys keys_is_none_rep un_map_valid_metas)

subsection \<open>Transitive Closure with successor function\<close>

locale trancl_meta_succ =
  relpow_data_structure un set_of memb empty valid_meta
  for un :: "(('a * 'a) * 'b) list \<Rightarrow> 'c \<Rightarrow> 'c"
    and set_of memb empty valid_meta +
  fixes succ :: "(('a * 'a) * 'b) list \<Rightarrow> (('a * 'a) * 'b) list"
    and rel_meta :: "(('a * 'a) * 'b) list"
  assumes succ_rel_step: "fst ` set (succ as) = {(x,z) | x y z. (x,y) \<in> fst ` set as \<and> (y,z) \<in> fst ` set rel_meta}"
      and succ_valid_metas: "valid_metas (set as) \<Longrightarrow> valid_metas (set (succ as))"
begin

definition "rel \<equiv> fst ` set rel_meta"

definition "succ_rel \<equiv> {((x,y),(x,z)) | x y z. (y,z) \<in> rel}"

lemma succ_succ_rel: "fst ` set (succ as) = {b. \<exists>a\<in>fst ` set as. (a, b) \<in> succ_rel}" (is "?l = ?r")
proof
  show "?l \<subseteq> ?r" unfolding succ_rel_def rel_def succ_rel_step by blast
  show "?r \<subseteq> ?l"
  proof
    fix b
    assume "b \<in> ?r"
    then obtain a where a: "a \<in> fst ` set as" and "(a,b) \<in> succ_rel" by blast
    then obtain x y z where "a = (x,y) \<and> b = (x,z) \<and> (y,z) \<in> rel" unfolding succ_rel_def by auto
    then show "b \<in> ?l" unfolding succ_rel_step rel_def using a by auto
  qed
qed

sublocale relpow_meta_succ: relpow_meta_succ un set_of memb empty valid_meta succ succ_rel
  using succ_succ_rel succ_valid_metas by unfold_locales

lemma rel_succ_comp_gen: "{b. \<exists>a. a \<in> as \<and> (a,b) \<in> succ_rel ^^ m} = as O rel ^^ m" (is "?l m = ?r m")
proof
  show "?l m \<subseteq> ?r m"
  proof (induction m)
    case 0
    then show ?case by auto
  next
    case (Suc m)
    show ?case
    proof
      fix b
      assume b_in_l: "b \<in> ?l (Suc m)"
      then obtain a z
        where "a \<in> as"
          and "(a,z) \<in> succ_rel ^^ m"
          and zb: "(z,b) \<in> succ_rel" by auto
      then have "z \<in> as O rel ^^ m" using Suc by blast
      then show "b \<in> ?r (Suc m)" using zb unfolding succ_rel_def by auto
    qed
  qed
next
  show "?r m \<subseteq> ?l m"
  proof (induction m)
    case 0
    then show ?case by auto
  next
    case (Suc m)
    show ?case
    proof
      fix b
      assume "b \<in> ?r (Suc m)"
      then obtain z where y_in_r: "z \<in> ?r m" and "b \<in> {z} O rel" by auto
      then have zb_relpow_rel: "(z, b) \<in> succ_rel" using succ_rel_def by blast
      have "z \<in> ?l m" using y_in_r Suc by auto
      then show "b \<in> ?l (Suc m)" using zb_relpow_rel by auto
    qed
  qed
qed

lemma rel_succ_comp: "{b. \<exists>a. a \<in> rel \<and> (a,b) \<in> succ_rel ^^ m} = rel ^^ Suc m"
  unfolding rel_succ_comp_gen using relpow_commute by simp

lemma ntrancl_Suc: "ntrancl (Suc n) rel = ntrancl n rel \<union> rel ^^ Suc (Suc n)" (is "?l = ?r")
proof-
  have "{i. 0 < i \<and> i \<le> Suc (Suc n)} = {i. 0 < i \<and> i \<le> Suc n} \<union> {Suc (Suc n)}" by auto
  then have "ntrancl (Suc n) rel = \<Union> ((^^) rel ` ({i. 0 < i \<and> i \<le> Suc n} \<union> {Suc (Suc n)}))" unfolding ntrancl_def by auto
  also have "\<dots> = ntrancl n rel \<union> rel ^^ Suc (Suc n)" unfolding ntrancl_def by auto
  finally show ?thesis .
qed

lemma relpow_impl_ntrancl: "{b. \<exists>a m. a \<in> rel \<and> m \<le> n \<and> (a, b) \<in> succ_rel ^^ m}
    = ntrancl n rel" (is "?l n = ?r n")
proof (induction n)
  case 0
  then show ?case by auto
next
  case (Suc n)
  have "?l (Suc n) = {b. \<exists>a m. a \<in> rel \<and> (m \<le> n \<or> m = Suc n) \<and> (a, b) \<in> succ_rel ^^ m}" by (simp add: le_Suc_eq)
  then have "?l (Suc n) = ?l n \<union> {b. \<exists>a. a \<in> rel \<and> (a, b) \<in> succ_rel ^^ Suc n}" by force
  also have "\<dots> = ?l n \<union> rel ^^ Suc (Suc n)" using rel_succ_comp by blast
  also have "\<dots> = ntrancl n rel \<union> rel ^^ Suc (Suc n)" using Suc by simp
  also have "\<dots> = ntrancl (Suc n) rel" using ntrancl_Suc by simp
  finally show ?case .
qed

lemma ntrancl_mono: "n \<le> m \<Longrightarrow> ntrancl n rel \<subseteq> ntrancl m rel" unfolding ntrancl_def by force

lemma ntrancl_bounded: "finite r \<Longrightarrow> ntrancl (card r - 1 + n) r = r\<^sup>+"
  by (induction n, simp add: finite_trancl_ntranl, fastforce)

theorem relpow_meta_trancl: "fst ` set_of (relpow_meta_impl succ un memb rel_meta empty (length rel_meta)) = trancl rel"
proof -
  have "ntrancl (length rel_meta) rel = trancl rel"
  proof
    have card_leq: "card rel - 1 \<le> length rel_meta"
      by (metis List.finite_set card_image_le card_length diff_le_self le_trans rel_def)
    have "finite rel" unfolding rel_def by simp
    then have "trancl rel = ntrancl (card rel - 1) rel" by (simp add: finite_trancl_ntranl)
    then show "trancl rel \<subseteq> ntrancl (length rel_meta) rel" using card_leq ntrancl_mono by simp
  next
    show "ntrancl (length rel_meta) rel \<subseteq> trancl rel" using ntrancl_bounded
      by (metis List.finite_set le_add2 list.set_map ntrancl_mono rel_def)
  qed
  then show ?thesis using relpow_meta_succ.trancl_meta_impl rel_def relpow_impl_ntrancl by simp
qed

end

fun to_rel_map :: "(('a * 'a) * 'b) list \<Rightarrow> ('a, ('a * 'b) list) mapping" where
  "to_rel_map [] = Mapping.empty"
| "to_rel_map (((x,y),b)#xs) = (let m = to_rel_map xs in
    Mapping.update x ((y,b) # Mapping.lookup_default [] m x) m)"

fun succ_map :: "('b \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> ('a, ('a * 'b) list) mapping \<Rightarrow> (('a * 'a) * 'b) list \<Rightarrow> (('a * 'a) * 'b) list" where
  "succ_map combine_meta rel_map [] = []"
| "succ_map combine_meta rel_map (((x,y),b)#xs) =
    map (\<lambda>(z,b'). ((x,z), combine_meta b b')) (Mapping.lookup_default [] rel_map y) @ succ_map combine_meta rel_map xs"

locale trancl_meta_map =
  relpow_data_structure un set_of memb empty valid_meta
  for un :: "(('a::linorder \<times> 'a) \<times> 'b) list \<Rightarrow> 'c \<Rightarrow> 'c"
    and set_of memb empty valid_meta +
  fixes combine_meta :: "'b \<Rightarrow> 'b \<Rightarrow> 'b"
    and rel_meta :: "(('a \<times> 'a) \<times> 'b) list"
  assumes combine_meta_valid: "valid_meta (x,y) b1 \<Longrightarrow> valid_meta (y,z) b2 \<Longrightarrow> valid_meta (x,z) (combine_meta b1 b2)"
      and valid_rel_meta: "valid_metas_set valid_meta (set rel_meta)"
begin

abbreviation "succ \<equiv> succ_map combine_meta (to_rel_map rel_meta)"

lemma rel_map_default_lookup: "set (Mapping.lookup_default [] (to_rel_map rel) y) = {(z,b). ((y,z),b) \<in> set rel}"
  by (induction rel) (auto simp: lookup_default_empty lookup_default_update' Let_def split: if_splits)

lemma set_succ: "set (succ as)
  = {((x,z),combine_meta p q) | x y z p q. ((x,y),p) \<in> set as \<and> ((y,z),q) \<in> set rel_meta}" (is "?l as = ?r as")
proof (induction as)
  case Nil
  then show ?case by simp
next
  case (Cons a as)
  then obtain x y p where a_xyb: "a = ((x,y),p)" by (metis surj_pair)
  then have "?l (a#as) = {((x,z),combine_meta p q) | z q. ((y,z),q) \<in> set rel_meta} \<union> ?l as" using rel_map_default_lookup by fastforce
  also have "\<dots> = ?r (a#as)" using a_xyb Cons by fastforce
  finally show ?case .
qed

lemma succ_rel_meta: "fst ` set (succ as) = {(x,z) | x y z. (x, y) \<in> fst ` set as \<and> (y, z) \<in> fst ` set rel_meta}"
  unfolding set_succ by force

lemma succ_valid_meta:
  assumes valid_as: "valid_metas_set valid_meta (set as)"
    shows "valid_metas_set valid_meta (set (succ as))"
  unfolding valid_metas_set_def
proof
  fix b
  assume "b \<in> set (succ as)"
  then obtain x y z p q
    where "b = ((x,z),combine_meta p q)"
      and "((x,y),p) \<in> set as"
      and "((y,z),q) \<in> set rel_meta" using set_succ by auto
  then show "case b of (u,r) \<Rightarrow> valid_meta u r" using combine_meta_valid valid_rel_meta valid_as by (auto simp: valid_metas_set_def split: prod.splits)
qed

sublocale trancl_meta_succ un set_of memb empty valid_meta succ rel_meta
  by unfold_locales (auto simp: succ_rel_meta succ_valid_meta)

end

locale trancl_meta_rbt =
  fixes combine_meta :: "'b \<Rightarrow> 'b \<Rightarrow> 'b"
    and valid_meta :: "(('a::linorder) \<times> 'a) \<Rightarrow> 'b \<Rightarrow> bool"
    and rel_meta :: "(('a \<times> 'a) \<times> 'b) list"
  assumes combine_meta_valid: "valid_meta (x,y) b1 \<Longrightarrow> valid_meta (y,z) b2 \<Longrightarrow> valid_meta (x,z) (combine_meta b1 b2)"
      and valid_rel_meta: "valid_metas_set valid_meta (set rel_meta)"
begin

sublocale trancl_meta_map un_map Mapping.entries memb_map Mapping.empty valid_meta combine_meta rel_meta
  by unfold_locales (auto simp: combine_meta_valid valid_rel_meta)

abbreviation "trancl_meta_impl \<equiv> (relpow_meta_impl succ un_map memb_map rel_meta Mapping.empty (length rel_meta))"

thm relpow_meta_trancl

thm relpow_meta_succ.relpow_valid_metas

end

subsection \<open>Transitive Closure with can\_combine function\<close>

locale relpow_meta_combine =
  relpow_data_structure un set_of memb empty valid_meta
  for un :: "(('a::linorder) * 'b) list \<Rightarrow> 'c \<Rightarrow> 'c" and set_of memb empty valid_meta +
  fixes can_combine :: "'a \<Rightarrow> 'a \<Rightarrow> bool"
    and combine :: "'a \<Rightarrow> 'a \<Rightarrow> 'a"
    and combine_meta :: "'a \<Rightarrow> 'b \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> 'b"
    and as :: "('a \<times> 'b) list"
  assumes valid_meta_combine: "can_combine k1 k2 \<Longrightarrow> valid_meta k1 v1 \<Longrightarrow> valid_meta k2 v2
      \<Longrightarrow> valid_meta (combine k1 k2) (combine_meta k1 v1 k2 v2)"
    and as_valid_metas: "valid_metas (set as)"
begin

fun succ :: "(('a * 'b) list \<Rightarrow> ('a * 'b) list)" where
  "succ [] = []"
| "succ ((a,p)#xs) =
    map (\<lambda>(b,q). (combine a b, combine_meta a p b q)) (filter (\<lambda>(b,q). can_combine a b) as)
    @ succ xs"

definition relpow_meta_combine_impl :: 'c where
  "relpow_meta_combine_impl = relpow_meta_impl succ un memb as empty (length as)"

definition "rel_succ \<equiv> {(a,combine a b) |a b. b \<in> fst ` set as \<and> can_combine a b}"

lemma succ_aux: "set (map (\<lambda>(b,q). (combine a b, combine_meta a p b q)) (filter (\<lambda>(b,q). can_combine a b) as))
    = {(combine a b, combine_meta a p b q) | b q. (b,q) \<in> set as \<and> can_combine a b}" by auto

lemma succ_set: "set (succ xs) = {(combine a b, combine_meta a p b q) |a p b q. (a,p) \<in> set xs \<and> (b,q) \<in> set as \<and> can_combine a b}"
  by (induction xs) (simp,fastforce)

lemma succ_rel_succ: "fst ` set (succ xs) = {b. \<exists>a\<in>fst ` set xs. (a, b) \<in> rel_succ}"
proof -
  have "fst ` set (succ xs) = fst ` {(combine a b, combine_meta a p b q) | a p b q. (a,p) \<in> set xs \<and>(b,q) \<in> set as \<and> can_combine a b}" using succ_set by simp
  also have "\<dots> = {combine a b | a p b q. (a,p) \<in> set xs \<and>(b,q) \<in> set as \<and> can_combine a b}" by force
  also have "\<dots> = {b. \<exists>a\<in>fst ` set xs. (a, b) \<in> rel_succ}" unfolding rel_succ_def by force
  finally show ?thesis .
qed

lemma succ_valid_metas: "valid_metas (set as) \<Longrightarrow> valid_metas (set xs) \<Longrightarrow> valid_metas (set (succ xs))"
  unfolding valid_metas_set_def
  using succ_set valid_meta_combine by (auto split: prod.splits)

sublocale relpow_meta_succ un set_of memb empty valid_meta succ rel_succ
  using succ_rel_succ succ_valid_metas as_valid_metas by unfold_locales

end

locale trancl_meta_combine_impl =
  relpow_data_structure un set_of memb empty valid_meta
  for un :: "(('a::linorder * 'a) * 'b) list \<Rightarrow> 'c \<Rightarrow> 'c" and set_of memb empty valid_meta +
  fixes rel_meta :: "(('a \<times> 'a) \<times> 'b) list"
    and combine_meta :: "'b \<Rightarrow> 'b \<Rightarrow> 'b"
  assumes rel_valid_metas: "valid_metas (set rel_meta)"
    and valid_meta_combine_meta: "valid_meta (x, y) pxy \<Longrightarrow> valid_meta (y, z) pyz
      \<Longrightarrow> valid_meta (x, z) (combine_meta pxy pyz)"
begin

definition can_combine :: "('a * 'a) \<Rightarrow> ('a * 'a) \<Rightarrow> bool" where
  "can_combine = (\<lambda>(x, y) (y', z). y = y')"

definition combine :: "('a * 'a) \<Rightarrow> ('a * 'a) \<Rightarrow> ('a * 'a)" where
  "combine = (\<lambda>(x, y) (y', z). (x, z))"

sublocale relpow_meta_combine un set_of memb empty valid_meta can_combine combine "\<lambda>u b1 v b2. combine_meta b1 b2" rel_meta
  by unfold_locales (auto simp: valid_meta_combine_meta combine_def can_combine_def rel_valid_metas)

lemma succ_rel_meta: "fst ` set (succ as) = {(x,z) | x y z. (x,y) \<in> fst ` set as \<and> (y,z) \<in> fst ` set rel_meta}" (is "?l = ?r")
proof
  show "?l \<subseteq> ?r"
  proof
    fix c
    assume "c \<in> ?l"
    then obtain a p b q where c: "c = combine a b" and a_as: "(a, p) \<in> set as" and b_rel_meta: "(b, q) \<in> set rel_meta \<and> can_combine a b" using succ_set by auto
    then obtain x y z where a: "a = (x,y)" and b: "b = (y,z)" unfolding can_combine_def by blast
    have fst_set_ab: "a \<in> fst ` set as \<and> b \<in> fst ` set rel_meta" using a_as b_rel_meta by force
    have c_xy: "c = (x,z)" by (simp add: c combine_def a b)
    then show "c \<in> ?r" using fst_set_ab by (auto simp add: a b c combine_def)
  qed
  show "?l \<supseteq> ?r"
  proof
    fix c
    assume "c \<in> ?r"
    then obtain x y z where c: "c = (x,z)" and xy_as: "(x,y) \<in> fst ` set as" and yz_rel_meta: "(y,z) \<in> fst ` set rel_meta" by auto
    then obtain p q where xy_p_as: "((x,y),p) \<in> set as" and yz_q_rel_meta: "((y,z),q) \<in> set rel_meta" by auto
    have c_combine: "c = combine (x,y) (y,z)" by (simp add: c combine_def)
    have can_combine: "can_combine (x,y) (y,z)" by (simp add: can_combine_def)
    then show "c \<in> ?l" unfolding succ_set using xy_p_as yz_q_rel_meta c_combine by force
  qed
qed

sublocale trancl_meta_succ: trancl_meta_succ un set_of memb empty valid_meta succ rel_meta
  by unfold_locales (auto simp add: succ_rel_meta succ_valid_metas rel_valid_metas)

theorem trancl_meta_combine: "keys_of (relpow_meta_impl succ un memb rel_meta empty (length rel_meta)) = trancl_meta_succ.rel\<^sup>+"
  using trancl_meta_succ.relpow_meta_trancl .

end

end


theory Check
  imports Submission
begin

theorem no_cycle: "(\<forall>a b. E a b \<longrightarrow> (f::'a \<Rightarrow> nat) a \<le> f b) \<Longrightarrow> (\<forall>w. E v w \<longrightarrow> f v < f w) \<Longrightarrow> \<not> (\<exists>xs. path E (v # xs @ [v]))"
  by (rule Submission.no_cycle)

theorem lval_upd_state_same: "x \<notin> vars_of a \<Longrightarrow> lval a (s(x := v)) = lval a s"
  by (rule Submission.lval_upd_state_same)

theorem lval_replace: "(x \<notin> vars_of a) \<Longrightarrow> (bounds_of a \<inter> vars_of e = {}) \<Longrightarrow> lval (replace e x a) (s(x := lval e s)) = lval a s"
  by (rule Submission.lval_replace)

lemma linearize_correct: "(\<forall>x. x \<in> vars_of e \<longrightarrow> CHR ''v'' \<notin> set x) \<Longrightarrow> (bounds_of e = {}) \<Longrightarrow> lval (linearize e) s = lval e s"
  by (rule Submission.linearize_correct)

end