diff --git a/src/HOL/Conditionally_Complete_Lattices.thy b/src/HOL/Conditionally_Complete_Lattices.thy
--- a/src/HOL/Conditionally_Complete_Lattices.thy
+++ b/src/HOL/Conditionally_Complete_Lattices.thy
@@ -1,743 +1,799 @@
 (*  Title:      HOL/Conditionally_Complete_Lattices.thy
     Author:     Amine Chaieb and L C Paulson, University of Cambridge
     Author:     Johannes Hölzl, TU München
     Author:     Luke S. Serafin, Carnegie Mellon University
 *)
 
 section \<open>Conditionally-complete Lattices\<close>
 
 theory Conditionally_Complete_Lattices
 imports Finite_Set Lattices_Big Set_Interval
 begin
 
+locale preordering_bdd = preordering
+begin
+
+definition bdd :: \<open>'a set \<Rightarrow> bool\<close>
+  where unfold: \<open>bdd A \<longleftrightarrow> (\<exists>M. \<forall>x \<in> A. x \<^bold>\<le> M)\<close>
+
+lemma empty [simp, intro]:
+  \<open>bdd {}\<close>
+  by (simp add: unfold)
+
+lemma I [intro]:
+  \<open>bdd A\<close> if \<open>\<And>x. x \<in> A \<Longrightarrow> x \<^bold>\<le> M\<close>
+  using that by (auto simp add: unfold)
+
+lemma E:
+  assumes \<open>bdd A\<close>
+  obtains M where \<open>\<And>x. x \<in> A \<Longrightarrow> x \<^bold>\<le> M\<close>
+  using assms that by (auto simp add: unfold)
+
+lemma I2:
+  \<open>bdd (f ` A)\<close> if \<open>\<And>x. x \<in> A \<Longrightarrow> f x \<^bold>\<le> M\<close>
+  using that by (auto simp add: unfold)
+
+lemma mono:
+  \<open>bdd A\<close> if \<open>bdd B\<close> \<open>A \<subseteq> B\<close>
+  using that by (auto simp add: unfold)
+
+lemma Int1 [simp]:
+  \<open>bdd (A \<inter> B)\<close> if \<open>bdd A\<close>
+  using mono that by auto
+
+lemma Int2 [simp]:
+  \<open>bdd (A \<inter> B)\<close> if \<open>bdd B\<close>
+  using mono that by auto
+
+end
+
 context preorder
 begin
 
-definition "bdd_above A \<longleftrightarrow> (\<exists>M. \<forall>x \<in> A. x \<le> M)"
-definition "bdd_below A \<longleftrightarrow> (\<exists>m. \<forall>x \<in> A. m \<le> x)"
+sublocale bdd_above: preordering_bdd \<open>(\<le>)\<close> \<open>(<)\<close>
+  defines bdd_above_primitive_def: bdd_above = bdd_above.bdd ..
 
-lemma bdd_aboveI[intro]: "(\<And>x. x \<in> A \<Longrightarrow> x \<le> M) \<Longrightarrow> bdd_above A"
-  by (auto simp: bdd_above_def)
+sublocale bdd_below: preordering_bdd \<open>(\<ge>)\<close> \<open>(>)\<close>
+  defines bdd_below_primitive_def: bdd_below = bdd_below.bdd ..
 
-lemma bdd_belowI[intro]: "(\<And>x. x \<in> A \<Longrightarrow> m \<le> x) \<Longrightarrow> bdd_below A"
-  by (auto simp: bdd_below_def)
+lemma bdd_above_def: \<open>bdd_above A \<longleftrightarrow> (\<exists>M. \<forall>x \<in> A. x \<le> M)\<close>
+  by (fact bdd_above.unfold)
+
+lemma bdd_below_def: \<open>bdd_below A \<longleftrightarrow> (\<exists>M. \<forall>x \<in> A. M \<le> x)\<close>
+  by (fact bdd_below.unfold)
+
+lemma bdd_aboveI: "(\<And>x. x \<in> A \<Longrightarrow> x \<le> M) \<Longrightarrow> bdd_above A"
+  by (fact bdd_above.I)
+
+lemma bdd_belowI: "(\<And>x. x \<in> A \<Longrightarrow> m \<le> x) \<Longrightarrow> bdd_below A"
+  by (fact bdd_below.I)
 
 lemma bdd_aboveI2: "(\<And>x. x \<in> A \<Longrightarrow> f x \<le> M) \<Longrightarrow> bdd_above (f`A)"
-  by force
+  by (fact bdd_above.I2)
 
 lemma bdd_belowI2: "(\<And>x. x \<in> A \<Longrightarrow> m \<le> f x) \<Longrightarrow> bdd_below (f`A)"
-  by force
+  by (fact bdd_below.I2)
 
-lemma bdd_above_empty [simp, intro]: "bdd_above {}"
-  unfolding bdd_above_def by auto
+lemma bdd_above_empty: "bdd_above {}"
+  by (fact bdd_above.empty)
 
-lemma bdd_below_empty [simp, intro]: "bdd_below {}"
-  unfolding bdd_below_def by auto
+lemma bdd_below_empty: "bdd_below {}"
+  by (fact bdd_below.empty)
 
 lemma bdd_above_mono: "bdd_above B \<Longrightarrow> A \<subseteq> B \<Longrightarrow> bdd_above A"
-  by (metis (full_types) bdd_above_def order_class.le_neq_trans psubsetD)
+  by (fact bdd_above.mono)
 
 lemma bdd_below_mono: "bdd_below B \<Longrightarrow> A \<subseteq> B \<Longrightarrow> bdd_below A"
-  by (metis bdd_below_def order_class.le_neq_trans psubsetD)
-
-lemma bdd_above_Int1 [simp]: "bdd_above A \<Longrightarrow> bdd_above (A \<inter> B)"
-  using bdd_above_mono by auto
+  by (fact bdd_below.mono)
 
-lemma bdd_above_Int2 [simp]: "bdd_above B \<Longrightarrow> bdd_above (A \<inter> B)"
-  using bdd_above_mono by auto
+lemma bdd_above_Int1: "bdd_above A \<Longrightarrow> bdd_above (A \<inter> B)"
+  by (fact bdd_above.Int1)
 
-lemma bdd_below_Int1 [simp]: "bdd_below A \<Longrightarrow> bdd_below (A \<inter> B)"
-  using bdd_below_mono by auto
+lemma bdd_above_Int2: "bdd_above B \<Longrightarrow> bdd_above (A \<inter> B)"
+  by (fact bdd_above.Int2)
 
-lemma bdd_below_Int2 [simp]: "bdd_below B \<Longrightarrow> bdd_below (A \<inter> B)"
-  using bdd_below_mono by auto
+lemma bdd_below_Int1: "bdd_below A \<Longrightarrow> bdd_below (A \<inter> B)"
+  by (fact bdd_below.Int1)
+
+lemma bdd_below_Int2: "bdd_below B \<Longrightarrow> bdd_below (A \<inter> B)"
+  by (fact bdd_below.Int2)
 
 lemma bdd_above_Ioo [simp, intro]: "bdd_above {a <..< b}"
   by (auto simp add: bdd_above_def intro!: exI[of _ b] less_imp_le)
 
 lemma bdd_above_Ico [simp, intro]: "bdd_above {a ..< b}"
   by (auto simp add: bdd_above_def intro!: exI[of _ b] less_imp_le)
 
 lemma bdd_above_Iio [simp, intro]: "bdd_above {..< b}"
   by (auto simp add: bdd_above_def intro: exI[of _ b] less_imp_le)
 
 lemma bdd_above_Ioc [simp, intro]: "bdd_above {a <.. b}"
   by (auto simp add: bdd_above_def intro: exI[of _ b] less_imp_le)
 
 lemma bdd_above_Icc [simp, intro]: "bdd_above {a .. b}"
   by (auto simp add: bdd_above_def intro: exI[of _ b] less_imp_le)
 
 lemma bdd_above_Iic [simp, intro]: "bdd_above {.. b}"
   by (auto simp add: bdd_above_def intro: exI[of _ b] less_imp_le)
 
 lemma bdd_below_Ioo [simp, intro]: "bdd_below {a <..< b}"
   by (auto simp add: bdd_below_def intro!: exI[of _ a] less_imp_le)
 
 lemma bdd_below_Ioc [simp, intro]: "bdd_below {a <.. b}"
   by (auto simp add: bdd_below_def intro!: exI[of _ a] less_imp_le)
 
 lemma bdd_below_Ioi [simp, intro]: "bdd_below {a <..}"
   by (auto simp add: bdd_below_def intro: exI[of _ a] less_imp_le)
 
 lemma bdd_below_Ico [simp, intro]: "bdd_below {a ..< b}"
   by (auto simp add: bdd_below_def intro: exI[of _ a] less_imp_le)
 
 lemma bdd_below_Icc [simp, intro]: "bdd_below {a .. b}"
   by (auto simp add: bdd_below_def intro: exI[of _ a] less_imp_le)
 
 lemma bdd_below_Ici [simp, intro]: "bdd_below {a ..}"
   by (auto simp add: bdd_below_def intro: exI[of _ a] less_imp_le)
 
 end
 
-lemma (in order_top) bdd_above_top[simp, intro!]: "bdd_above A"
-  by (rule bdd_aboveI[of _ top]) simp
+context order_top
+begin
 
-lemma (in order_bot) bdd_above_bot[simp, intro!]: "bdd_below A"
-  by (rule bdd_belowI[of _ bot]) simp
+lemma bdd_above_top [simp, intro!]: "bdd_above A"
+  by (rule bdd_aboveI [of _ top]) simp
+
+end
+
+context order_bot
+begin
+
+lemma bdd_below_bot [simp, intro!]: "bdd_below A"
+  by (rule bdd_belowI [of _ bot]) simp
+
+end
 
 lemma bdd_above_image_mono: "mono f \<Longrightarrow> bdd_above A \<Longrightarrow> bdd_above (f`A)"
   by (auto simp: bdd_above_def mono_def)
 
 lemma bdd_below_image_mono: "mono f \<Longrightarrow> bdd_below A \<Longrightarrow> bdd_below (f`A)"
   by (auto simp: bdd_below_def mono_def)
 
 lemma bdd_above_image_antimono: "antimono f \<Longrightarrow> bdd_below A \<Longrightarrow> bdd_above (f`A)"
   by (auto simp: bdd_above_def bdd_below_def antimono_def)
 
 lemma bdd_below_image_antimono: "antimono f \<Longrightarrow> bdd_above A \<Longrightarrow> bdd_below (f`A)"
   by (auto simp: bdd_above_def bdd_below_def antimono_def)
 
 lemma
   fixes X :: "'a::ordered_ab_group_add set"
   shows bdd_above_uminus[simp]: "bdd_above (uminus ` X) \<longleftrightarrow> bdd_below X"
     and bdd_below_uminus[simp]: "bdd_below (uminus ` X) \<longleftrightarrow> bdd_above X"
   using bdd_above_image_antimono[of uminus X] bdd_below_image_antimono[of uminus "uminus`X"]
   using bdd_below_image_antimono[of uminus X] bdd_above_image_antimono[of uminus "uminus`X"]
   by (auto simp: antimono_def image_image)
 
 context lattice
 begin
 
 lemma bdd_above_insert [simp]: "bdd_above (insert a A) = bdd_above A"
   by (auto simp: bdd_above_def intro: le_supI2 sup_ge1)
 
 lemma bdd_below_insert [simp]: "bdd_below (insert a A) = bdd_below A"
   by (auto simp: bdd_below_def intro: le_infI2 inf_le1)
 
 lemma bdd_finite [simp]:
   assumes "finite A" shows bdd_above_finite: "bdd_above A" and bdd_below_finite: "bdd_below A"
   using assms by (induct rule: finite_induct, auto)
 
 lemma bdd_above_Un [simp]: "bdd_above (A \<union> B) = (bdd_above A \<and> bdd_above B)"
 proof
   assume "bdd_above (A \<union> B)"
   thus "bdd_above A \<and> bdd_above B" unfolding bdd_above_def by auto
 next
   assume "bdd_above A \<and> bdd_above B"
   then obtain a b where "\<forall>x\<in>A. x \<le> a" "\<forall>x\<in>B. x \<le> b" unfolding bdd_above_def by auto
   hence "\<forall>x \<in> A \<union> B. x \<le> sup a b" by (auto intro: Un_iff le_supI1 le_supI2)
   thus "bdd_above (A \<union> B)" unfolding bdd_above_def ..
 qed
 
 lemma bdd_below_Un [simp]: "bdd_below (A \<union> B) = (bdd_below A \<and> bdd_below B)"
 proof
   assume "bdd_below (A \<union> B)"
   thus "bdd_below A \<and> bdd_below B" unfolding bdd_below_def by auto
 next
   assume "bdd_below A \<and> bdd_below B"
   then obtain a b where "\<forall>x\<in>A. a \<le> x" "\<forall>x\<in>B. b \<le> x" unfolding bdd_below_def by auto
   hence "\<forall>x \<in> A \<union> B. inf a b \<le> x" by (auto intro: Un_iff le_infI1 le_infI2)
   thus "bdd_below (A \<union> B)" unfolding bdd_below_def ..
 qed
 
 lemma bdd_above_image_sup[simp]:
   "bdd_above ((\<lambda>x. sup (f x) (g x)) ` A) \<longleftrightarrow> bdd_above (f`A) \<and> bdd_above (g`A)"
 by (auto simp: bdd_above_def intro: le_supI1 le_supI2)
 
 lemma bdd_below_image_inf[simp]:
   "bdd_below ((\<lambda>x. inf (f x) (g x)) ` A) \<longleftrightarrow> bdd_below (f`A) \<and> bdd_below (g`A)"
 by (auto simp: bdd_below_def intro: le_infI1 le_infI2)
 
 lemma bdd_below_UN[simp]: "finite I \<Longrightarrow> bdd_below (\<Union>i\<in>I. A i) = (\<forall>i \<in> I. bdd_below (A i))"
 by (induction I rule: finite.induct) auto
 
 lemma bdd_above_UN[simp]: "finite I \<Longrightarrow> bdd_above (\<Union>i\<in>I. A i) = (\<forall>i \<in> I. bdd_above (A i))"
 by (induction I rule: finite.induct) auto
 
 end
 
 
 text \<open>
 
 To avoid name classes with the \<^class>\<open>complete_lattice\<close>-class we prefix \<^const>\<open>Sup\<close> and
 \<^const>\<open>Inf\<close> in theorem names with c.
 
 \<close>
 
 class conditionally_complete_lattice = lattice + Sup + Inf +
   assumes cInf_lower: "x \<in> X \<Longrightarrow> bdd_below X \<Longrightarrow> Inf X \<le> x"
     and cInf_greatest: "X \<noteq> {} \<Longrightarrow> (\<And>x. x \<in> X \<Longrightarrow> z \<le> x) \<Longrightarrow> z \<le> Inf X"
   assumes cSup_upper: "x \<in> X \<Longrightarrow> bdd_above X \<Longrightarrow> x \<le> Sup X"
     and cSup_least: "X \<noteq> {} \<Longrightarrow> (\<And>x. x \<in> X \<Longrightarrow> x \<le> z) \<Longrightarrow> Sup X \<le> z"
 begin
 
 lemma cSup_upper2: "x \<in> X \<Longrightarrow> y \<le> x \<Longrightarrow> bdd_above X \<Longrightarrow> y \<le> Sup X"
   by (metis cSup_upper order_trans)
 
 lemma cInf_lower2: "x \<in> X \<Longrightarrow> x \<le> y \<Longrightarrow> bdd_below X \<Longrightarrow> Inf X \<le> y"
   by (metis cInf_lower order_trans)
 
 lemma cSup_mono: "B \<noteq> {} \<Longrightarrow> bdd_above A \<Longrightarrow> (\<And>b. b \<in> B \<Longrightarrow> \<exists>a\<in>A. b \<le> a) \<Longrightarrow> Sup B \<le> Sup A"
   by (metis cSup_least cSup_upper2)
 
 lemma cInf_mono: "B \<noteq> {} \<Longrightarrow> bdd_below A \<Longrightarrow> (\<And>b. b \<in> B \<Longrightarrow> \<exists>a\<in>A. a \<le> b) \<Longrightarrow> Inf A \<le> Inf B"
   by (metis cInf_greatest cInf_lower2)
 
 lemma cSup_subset_mono: "A \<noteq> {} \<Longrightarrow> bdd_above B \<Longrightarrow> A \<subseteq> B \<Longrightarrow> Sup A \<le> Sup B"
   by (metis cSup_least cSup_upper subsetD)
 
 lemma cInf_superset_mono: "A \<noteq> {} \<Longrightarrow> bdd_below B \<Longrightarrow> A \<subseteq> B \<Longrightarrow> Inf B \<le> Inf A"
   by (metis cInf_greatest cInf_lower subsetD)
 
 lemma cSup_eq_maximum: "z \<in> X \<Longrightarrow> (\<And>x. x \<in> X \<Longrightarrow> x \<le> z) \<Longrightarrow> Sup X = z"
   by (intro antisym cSup_upper[of z X] cSup_least[of X z]) auto
 
 lemma cInf_eq_minimum: "z \<in> X \<Longrightarrow> (\<And>x. x \<in> X \<Longrightarrow> z \<le> x) \<Longrightarrow> Inf X = z"
   by (intro antisym cInf_lower[of z X] cInf_greatest[of X z]) auto
 
 lemma cSup_le_iff: "S \<noteq> {} \<Longrightarrow> bdd_above S \<Longrightarrow> Sup S \<le> a \<longleftrightarrow> (\<forall>x\<in>S. x \<le> a)"
   by (metis order_trans cSup_upper cSup_least)
 
 lemma le_cInf_iff: "S \<noteq> {} \<Longrightarrow> bdd_below S \<Longrightarrow> a \<le> Inf S \<longleftrightarrow> (\<forall>x\<in>S. a \<le> x)"
   by (metis order_trans cInf_lower cInf_greatest)
 
 lemma cSup_eq_non_empty:
   assumes 1: "X \<noteq> {}"
   assumes 2: "\<And>x. x \<in> X \<Longrightarrow> x \<le> a"
   assumes 3: "\<And>y. (\<And>x. x \<in> X \<Longrightarrow> x \<le> y) \<Longrightarrow> a \<le> y"
   shows "Sup X = a"
   by (intro 3 1 antisym cSup_least) (auto intro: 2 1 cSup_upper)
 
 lemma cInf_eq_non_empty:
   assumes 1: "X \<noteq> {}"
   assumes 2: "\<And>x. x \<in> X \<Longrightarrow> a \<le> x"
   assumes 3: "\<And>y. (\<And>x. x \<in> X \<Longrightarrow> y \<le> x) \<Longrightarrow> y \<le> a"
   shows "Inf X = a"
   by (intro 3 1 antisym cInf_greatest) (auto intro: 2 1 cInf_lower)
 
 lemma cInf_cSup: "S \<noteq> {} \<Longrightarrow> bdd_below S \<Longrightarrow> Inf S = Sup {x. \<forall>s\<in>S. x \<le> s}"
   by (rule cInf_eq_non_empty) (auto intro!: cSup_upper cSup_least simp: bdd_below_def)
 
 lemma cSup_cInf: "S \<noteq> {} \<Longrightarrow> bdd_above S \<Longrightarrow> Sup S = Inf {x. \<forall>s\<in>S. s \<le> x}"
   by (rule cSup_eq_non_empty) (auto intro!: cInf_lower cInf_greatest simp: bdd_above_def)
 
 lemma cSup_insert: "X \<noteq> {} \<Longrightarrow> bdd_above X \<Longrightarrow> Sup (insert a X) = sup a (Sup X)"
   by (intro cSup_eq_non_empty) (auto intro: le_supI2 cSup_upper cSup_least)
 
 lemma cInf_insert: "X \<noteq> {} \<Longrightarrow> bdd_below X \<Longrightarrow> Inf (insert a X) = inf a (Inf X)"
   by (intro cInf_eq_non_empty) (auto intro: le_infI2 cInf_lower cInf_greatest)
 
 lemma cSup_singleton [simp]: "Sup {x} = x"
   by (intro cSup_eq_maximum) auto
 
 lemma cInf_singleton [simp]: "Inf {x} = x"
   by (intro cInf_eq_minimum) auto
 
 lemma cSup_insert_If:  "bdd_above X \<Longrightarrow> Sup (insert a X) = (if X = {} then a else sup a (Sup X))"
   using cSup_insert[of X] by simp
 
 lemma cInf_insert_If: "bdd_below X \<Longrightarrow> Inf (insert a X) = (if X = {} then a else inf a (Inf X))"
   using cInf_insert[of X] by simp
 
 lemma le_cSup_finite: "finite X \<Longrightarrow> x \<in> X \<Longrightarrow> x \<le> Sup X"
 proof (induct X arbitrary: x rule: finite_induct)
   case (insert x X y) then show ?case
     by (cases "X = {}") (auto simp: cSup_insert intro: le_supI2)
 qed simp
 
 lemma cInf_le_finite: "finite X \<Longrightarrow> x \<in> X \<Longrightarrow> Inf X \<le> x"
 proof (induct X arbitrary: x rule: finite_induct)
   case (insert x X y) then show ?case
     by (cases "X = {}") (auto simp: cInf_insert intro: le_infI2)
 qed simp
 
 lemma cSup_eq_Sup_fin: "finite X \<Longrightarrow> X \<noteq> {} \<Longrightarrow> Sup X = Sup_fin X"
   by (induct X rule: finite_ne_induct) (simp_all add: cSup_insert)
 
 lemma cInf_eq_Inf_fin: "finite X \<Longrightarrow> X \<noteq> {} \<Longrightarrow> Inf X = Inf_fin X"
   by (induct X rule: finite_ne_induct) (simp_all add: cInf_insert)
 
 lemma cSup_atMost[simp]: "Sup {..x} = x"
   by (auto intro!: cSup_eq_maximum)
 
 lemma cSup_greaterThanAtMost[simp]: "y < x \<Longrightarrow> Sup {y<..x} = x"
   by (auto intro!: cSup_eq_maximum)
 
 lemma cSup_atLeastAtMost[simp]: "y \<le> x \<Longrightarrow> Sup {y..x} = x"
   by (auto intro!: cSup_eq_maximum)
 
 lemma cInf_atLeast[simp]: "Inf {x..} = x"
   by (auto intro!: cInf_eq_minimum)
 
 lemma cInf_atLeastLessThan[simp]: "y < x \<Longrightarrow> Inf {y..<x} = y"
   by (auto intro!: cInf_eq_minimum)
 
 lemma cInf_atLeastAtMost[simp]: "y \<le> x \<Longrightarrow> Inf {y..x} = y"
   by (auto intro!: cInf_eq_minimum)
 
 lemma cINF_lower: "bdd_below (f ` A) \<Longrightarrow> x \<in> A \<Longrightarrow> \<Sqinter>(f ` A) \<le> f x"
   using cInf_lower [of _ "f ` A"] by simp
 
 lemma cINF_greatest: "A \<noteq> {} \<Longrightarrow> (\<And>x. x \<in> A \<Longrightarrow> m \<le> f x) \<Longrightarrow> m \<le> \<Sqinter>(f ` A)"
   using cInf_greatest [of "f ` A"] by auto
 
 lemma cSUP_upper: "x \<in> A \<Longrightarrow> bdd_above (f ` A) \<Longrightarrow> f x \<le> \<Squnion>(f ` A)"
   using cSup_upper [of _ "f ` A"] by simp
 
 lemma cSUP_least: "A \<noteq> {} \<Longrightarrow> (\<And>x. x \<in> A \<Longrightarrow> f x \<le> M) \<Longrightarrow> \<Squnion>(f ` A) \<le> M"
   using cSup_least [of "f ` A"] by auto
 
 lemma cINF_lower2: "bdd_below (f ` A) \<Longrightarrow> x \<in> A \<Longrightarrow> f x \<le> u \<Longrightarrow> \<Sqinter>(f ` A) \<le> u"
   by (auto intro: cINF_lower order_trans)
 
 lemma cSUP_upper2: "bdd_above (f ` A) \<Longrightarrow> x \<in> A \<Longrightarrow> u \<le> f x \<Longrightarrow> u \<le> \<Squnion>(f ` A)"
   by (auto intro: cSUP_upper order_trans)
 
 lemma cSUP_const [simp]: "A \<noteq> {} \<Longrightarrow> (\<Squnion>x\<in>A. c) = c"
   by (intro antisym cSUP_least) (auto intro: cSUP_upper)
 
 lemma cINF_const [simp]: "A \<noteq> {} \<Longrightarrow> (\<Sqinter>x\<in>A. c) = c"
   by (intro antisym cINF_greatest) (auto intro: cINF_lower)
 
 lemma le_cINF_iff: "A \<noteq> {} \<Longrightarrow> bdd_below (f ` A) \<Longrightarrow> u \<le> \<Sqinter>(f ` A) \<longleftrightarrow> (\<forall>x\<in>A. u \<le> f x)"
   by (metis cINF_greatest cINF_lower order_trans)
 
 lemma cSUP_le_iff: "A \<noteq> {} \<Longrightarrow> bdd_above (f ` A) \<Longrightarrow> \<Squnion>(f ` A) \<le> u \<longleftrightarrow> (\<forall>x\<in>A. f x \<le> u)"
   by (metis cSUP_least cSUP_upper order_trans)
 
 lemma less_cINF_D: "bdd_below (f`A) \<Longrightarrow> y < (\<Sqinter>i\<in>A. f i) \<Longrightarrow> i \<in> A \<Longrightarrow> y < f i"
   by (metis cINF_lower less_le_trans)
 
 lemma cSUP_lessD: "bdd_above (f`A) \<Longrightarrow> (\<Squnion>i\<in>A. f i) < y \<Longrightarrow> i \<in> A \<Longrightarrow> f i < y"
   by (metis cSUP_upper le_less_trans)
 
 lemma cINF_insert: "A \<noteq> {} \<Longrightarrow> bdd_below (f ` A) \<Longrightarrow> \<Sqinter>(f ` insert a A) = inf (f a) (\<Sqinter>(f ` A))"
   by (simp add: cInf_insert)
 
 lemma cSUP_insert: "A \<noteq> {} \<Longrightarrow> bdd_above (f ` A) \<Longrightarrow> \<Squnion>(f ` insert a A) = sup (f a) (\<Squnion>(f ` A))"
   by (simp add: cSup_insert)
 
 lemma cINF_mono: "B \<noteq> {} \<Longrightarrow> bdd_below (f ` A) \<Longrightarrow> (\<And>m. m \<in> B \<Longrightarrow> \<exists>n\<in>A. f n \<le> g m) \<Longrightarrow> \<Sqinter>(f ` A) \<le> \<Sqinter>(g ` B)"
   using cInf_mono [of "g ` B" "f ` A"] by auto
 
 lemma cSUP_mono: "A \<noteq> {} \<Longrightarrow> bdd_above (g ` B) \<Longrightarrow> (\<And>n. n \<in> A \<Longrightarrow> \<exists>m\<in>B. f n \<le> g m) \<Longrightarrow> \<Squnion>(f ` A) \<le> \<Squnion>(g ` B)"
   using cSup_mono [of "f ` A" "g ` B"] by auto
 
 lemma cINF_superset_mono: "A \<noteq> {} \<Longrightarrow> bdd_below (g ` B) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> (\<And>x. x \<in> B \<Longrightarrow> g x \<le> f x) \<Longrightarrow> \<Sqinter>(g ` B) \<le> \<Sqinter>(f ` A)"
   by (rule cINF_mono) auto
 
 lemma cSUP_subset_mono: 
   "\<lbrakk>A \<noteq> {}; bdd_above (g ` B); A \<subseteq> B; \<And>x. x \<in> A \<Longrightarrow> f x \<le> g x\<rbrakk> \<Longrightarrow> \<Squnion> (f ` A) \<le> \<Squnion> (g ` B)"
   by (rule cSUP_mono) auto
 
 lemma less_eq_cInf_inter: "bdd_below A \<Longrightarrow> bdd_below B \<Longrightarrow> A \<inter> B \<noteq> {} \<Longrightarrow> inf (Inf A) (Inf B) \<le> Inf (A \<inter> B)"
   by (metis cInf_superset_mono lattice_class.inf_sup_ord(1) le_infI1)
 
 lemma cSup_inter_less_eq: "bdd_above A \<Longrightarrow> bdd_above B \<Longrightarrow> A \<inter> B \<noteq> {} \<Longrightarrow> Sup (A \<inter> B) \<le> sup (Sup A) (Sup B) "
   by (metis cSup_subset_mono lattice_class.inf_sup_ord(1) le_supI1)
 
 lemma cInf_union_distrib: "A \<noteq> {} \<Longrightarrow> bdd_below A \<Longrightarrow> B \<noteq> {} \<Longrightarrow> bdd_below B \<Longrightarrow> Inf (A \<union> B) = inf (Inf A) (Inf B)"
   by (intro antisym le_infI cInf_greatest cInf_lower) (auto intro: le_infI1 le_infI2 cInf_lower)
 
 lemma cINF_union: "A \<noteq> {} \<Longrightarrow> bdd_below (f ` A) \<Longrightarrow> B \<noteq> {} \<Longrightarrow> bdd_below (f ` B) \<Longrightarrow> \<Sqinter> (f ` (A \<union> B)) = \<Sqinter> (f ` A) \<sqinter> \<Sqinter> (f ` B)"
   using cInf_union_distrib [of "f ` A" "f ` B"] by (simp add: image_Un)
 
 lemma cSup_union_distrib: "A \<noteq> {} \<Longrightarrow> bdd_above A \<Longrightarrow> B \<noteq> {} \<Longrightarrow> bdd_above B \<Longrightarrow> Sup (A \<union> B) = sup (Sup A) (Sup B)"
   by (intro antisym le_supI cSup_least cSup_upper) (auto intro: le_supI1 le_supI2 cSup_upper)
 
 lemma cSUP_union: "A \<noteq> {} \<Longrightarrow> bdd_above (f ` A) \<Longrightarrow> B \<noteq> {} \<Longrightarrow> bdd_above (f ` B) \<Longrightarrow> \<Squnion> (f ` (A \<union> B)) = \<Squnion> (f ` A) \<squnion> \<Squnion> (f ` B)"
   using cSup_union_distrib [of "f ` A" "f ` B"] by (simp add: image_Un)
 
 lemma cINF_inf_distrib: "A \<noteq> {} \<Longrightarrow> bdd_below (f`A) \<Longrightarrow> bdd_below (g`A) \<Longrightarrow> \<Sqinter> (f ` A) \<sqinter> \<Sqinter> (g ` A) = (\<Sqinter>a\<in>A. inf (f a) (g a))"
   by (intro antisym le_infI cINF_greatest cINF_lower2)
      (auto intro: le_infI1 le_infI2 cINF_greatest cINF_lower le_infI)
 
 lemma SUP_sup_distrib: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> bdd_above (g`A) \<Longrightarrow> \<Squnion> (f ` A) \<squnion> \<Squnion> (g ` A) = (\<Squnion>a\<in>A. sup (f a) (g a))"
   by (intro antisym le_supI cSUP_least cSUP_upper2)
      (auto intro: le_supI1 le_supI2 cSUP_least cSUP_upper le_supI)
 
 lemma cInf_le_cSup:
   "A \<noteq> {} \<Longrightarrow> bdd_above A \<Longrightarrow> bdd_below A \<Longrightarrow> Inf A \<le> Sup A"
   by (auto intro!: cSup_upper2[of "SOME a. a \<in> A"] intro: someI cInf_lower)
 
 end
 
 instance complete_lattice \<subseteq> conditionally_complete_lattice
   by standard (auto intro: Sup_upper Sup_least Inf_lower Inf_greatest)
 
 lemma cSup_eq:
   fixes a :: "'a :: {conditionally_complete_lattice, no_bot}"
   assumes upper: "\<And>x. x \<in> X \<Longrightarrow> x \<le> a"
   assumes least: "\<And>y. (\<And>x. x \<in> X \<Longrightarrow> x \<le> y) \<Longrightarrow> a \<le> y"
   shows "Sup X = a"
 proof cases
   assume "X = {}" with lt_ex[of a] least show ?thesis by (auto simp: less_le_not_le)
 qed (intro cSup_eq_non_empty assms)
 
 lemma cInf_eq:
   fixes a :: "'a :: {conditionally_complete_lattice, no_top}"
   assumes upper: "\<And>x. x \<in> X \<Longrightarrow> a \<le> x"
   assumes least: "\<And>y. (\<And>x. x \<in> X \<Longrightarrow> y \<le> x) \<Longrightarrow> y \<le> a"
   shows "Inf X = a"
 proof cases
   assume "X = {}" with gt_ex[of a] least show ?thesis by (auto simp: less_le_not_le)
 qed (intro cInf_eq_non_empty assms)
 
 class conditionally_complete_linorder = conditionally_complete_lattice + linorder
 begin
 
 lemma less_cSup_iff:
   "X \<noteq> {} \<Longrightarrow> bdd_above X \<Longrightarrow> y < Sup X \<longleftrightarrow> (\<exists>x\<in>X. y < x)"
   by (rule iffI) (metis cSup_least not_less, metis cSup_upper less_le_trans)
 
 lemma cInf_less_iff: "X \<noteq> {} \<Longrightarrow> bdd_below X \<Longrightarrow> Inf X < y \<longleftrightarrow> (\<exists>x\<in>X. x < y)"
   by (rule iffI) (metis cInf_greatest not_less, metis cInf_lower le_less_trans)
 
 lemma cINF_less_iff: "A \<noteq> {} \<Longrightarrow> bdd_below (f`A) \<Longrightarrow> (\<Sqinter>i\<in>A. f i) < a \<longleftrightarrow> (\<exists>x\<in>A. f x < a)"
   using cInf_less_iff[of "f`A"] by auto
 
 lemma less_cSUP_iff: "A \<noteq> {} \<Longrightarrow> bdd_above (f`A) \<Longrightarrow> a < (\<Squnion>i\<in>A. f i) \<longleftrightarrow> (\<exists>x\<in>A. a < f x)"
   using less_cSup_iff[of "f`A"] by auto
 
 lemma less_cSupE:
   assumes "y < Sup X" "X \<noteq> {}" obtains x where "x \<in> X" "y < x"
   by (metis cSup_least assms not_le that)
 
 lemma less_cSupD:
   "X \<noteq> {} \<Longrightarrow> z < Sup X \<Longrightarrow> \<exists>x\<in>X. z < x"
   by (metis less_cSup_iff not_le_imp_less bdd_above_def)
 
 lemma cInf_lessD:
   "X \<noteq> {} \<Longrightarrow> Inf X < z \<Longrightarrow> \<exists>x\<in>X. x < z"
   by (metis cInf_less_iff not_le_imp_less bdd_below_def)
 
 lemma complete_interval:
   assumes "a < b" and "P a" and "\<not> P b"
   shows "\<exists>c. a \<le> c \<and> c \<le> b \<and> (\<forall>x. a \<le> x \<and> x < c \<longrightarrow> P x) \<and>
              (\<forall>d. (\<forall>x. a \<le> x \<and> x < d \<longrightarrow> P x) \<longrightarrow> d \<le> c)"
 proof (rule exI [where x = "Sup {d. \<forall>x. a \<le> x \<and> x < d \<longrightarrow> P x}"], auto)
   show "a \<le> Sup {d. \<forall>c. a \<le> c \<and> c < d \<longrightarrow> P c}"
     by (rule cSup_upper, auto simp: bdd_above_def)
        (metis \<open>a < b\<close> \<open>\<not> P b\<close> linear less_le)
 next
   show "Sup {d. \<forall>c. a \<le> c \<and> c < d \<longrightarrow> P c} \<le> b"
     apply (rule cSup_least)
     apply auto
     apply (metis less_le_not_le)
     apply (metis \<open>a<b\<close> \<open>\<not> P b\<close> linear less_le)
     done
 next
   fix x
   assume x: "a \<le> x" and lt: "x < Sup {d. \<forall>c. a \<le> c \<and> c < d \<longrightarrow> P c}"
   show "P x"
     apply (rule less_cSupE [OF lt], auto)
     apply (metis less_le_not_le)
     apply (metis x)
     done
 next
   fix d
     assume 0: "\<forall>x. a \<le> x \<and> x < d \<longrightarrow> P x"
     thus "d \<le> Sup {d. \<forall>c. a \<le> c \<and> c < d \<longrightarrow> P c}"
       by (rule_tac cSup_upper, auto simp: bdd_above_def)
          (metis \<open>a<b\<close> \<open>\<not> P b\<close> linear less_le)
 qed
 
 end
 
 instance complete_linorder < conditionally_complete_linorder
   ..
 
 lemma cSup_eq_Max: "finite (X::'a::conditionally_complete_linorder set) \<Longrightarrow> X \<noteq> {} \<Longrightarrow> Sup X = Max X"
   using cSup_eq_Sup_fin[of X] by (simp add: Sup_fin_Max)
 
 lemma cInf_eq_Min: "finite (X::'a::conditionally_complete_linorder set) \<Longrightarrow> X \<noteq> {} \<Longrightarrow> Inf X = Min X"
   using cInf_eq_Inf_fin[of X] by (simp add: Inf_fin_Min)
 
 lemma cSup_lessThan[simp]: "Sup {..<x::'a::{conditionally_complete_linorder, no_bot, dense_linorder}} = x"
   by (auto intro!: cSup_eq_non_empty intro: dense_le)
 
 lemma cSup_greaterThanLessThan[simp]: "y < x \<Longrightarrow> Sup {y<..<x::'a::{conditionally_complete_linorder, dense_linorder}} = x"
   by (auto intro!: cSup_eq_non_empty intro: dense_le_bounded)
 
 lemma cSup_atLeastLessThan[simp]: "y < x \<Longrightarrow> Sup {y..<x::'a::{conditionally_complete_linorder, dense_linorder}} = x"
   by (auto intro!: cSup_eq_non_empty intro: dense_le_bounded)
 
 lemma cInf_greaterThan[simp]: "Inf {x::'a::{conditionally_complete_linorder, no_top, dense_linorder} <..} = x"
   by (auto intro!: cInf_eq_non_empty intro: dense_ge)
 
 lemma cInf_greaterThanAtMost[simp]: "y < x \<Longrightarrow> Inf {y<..x::'a::{conditionally_complete_linorder, dense_linorder}} = y"
   by (auto intro!: cInf_eq_non_empty intro: dense_ge_bounded)
 
 lemma cInf_greaterThanLessThan[simp]: "y < x \<Longrightarrow> Inf {y<..<x::'a::{conditionally_complete_linorder, dense_linorder}} = y"
   by (auto intro!: cInf_eq_non_empty intro: dense_ge_bounded)
 
 lemma Inf_insert_finite:
   fixes S :: "'a::conditionally_complete_linorder set"
   shows "finite S \<Longrightarrow> Inf (insert x S) = (if S = {} then x else min x (Inf S))"
   by (simp add: cInf_eq_Min)
 
 lemma Sup_insert_finite:
   fixes S :: "'a::conditionally_complete_linorder set"
   shows "finite S \<Longrightarrow> Sup (insert x S) = (if S = {} then x else max x (Sup S))"
   by (simp add: cSup_insert sup_max)
 
 lemma finite_imp_less_Inf:
   fixes a :: "'a::conditionally_complete_linorder"
   shows "\<lbrakk>finite X; x \<in> X; \<And>x. x\<in>X \<Longrightarrow> a < x\<rbrakk> \<Longrightarrow> a < Inf X"
   by (induction X rule: finite_induct) (simp_all add: cInf_eq_Min Inf_insert_finite)
 
 lemma finite_less_Inf_iff:
   fixes a :: "'a :: conditionally_complete_linorder"
   shows "\<lbrakk>finite X; X \<noteq> {}\<rbrakk> \<Longrightarrow> a < Inf X \<longleftrightarrow> (\<forall>x \<in> X. a < x)"
   by (auto simp: cInf_eq_Min)
 
 lemma finite_imp_Sup_less:
   fixes a :: "'a::conditionally_complete_linorder"
   shows "\<lbrakk>finite X; x \<in> X; \<And>x. x\<in>X \<Longrightarrow> a > x\<rbrakk> \<Longrightarrow> a > Sup X"
   by (induction X rule: finite_induct) (simp_all add: cSup_eq_Max Sup_insert_finite)
 
 lemma finite_Sup_less_iff:
   fixes a :: "'a :: conditionally_complete_linorder"
   shows "\<lbrakk>finite X; X \<noteq> {}\<rbrakk> \<Longrightarrow> a > Sup X \<longleftrightarrow> (\<forall>x \<in> X. a > x)"
   by (auto simp: cSup_eq_Max)
 
 class linear_continuum = conditionally_complete_linorder + dense_linorder +
   assumes UNIV_not_singleton: "\<exists>a b::'a. a \<noteq> b"
 begin
 
 lemma ex_gt_or_lt: "\<exists>b. a < b \<or> b < a"
   by (metis UNIV_not_singleton neq_iff)
 
 end
 
 instantiation nat :: conditionally_complete_linorder
 begin
 
 definition "Sup (X::nat set) = (if X={} then 0 else Max X)"
 definition "Inf (X::nat set) = (LEAST n. n \<in> X)"
 
 lemma bdd_above_nat: "bdd_above X \<longleftrightarrow> finite (X::nat set)"
 proof
   assume "bdd_above X"
   then obtain z where "X \<subseteq> {.. z}"
     by (auto simp: bdd_above_def)
   then show "finite X"
     by (rule finite_subset) simp
 qed simp
 
 instance
 proof
   fix x :: nat
   fix X :: "nat set"
   show "Inf X \<le> x" if "x \<in> X" "bdd_below X"
     using that by (simp add: Inf_nat_def Least_le)
   show "x \<le> Inf X" if "X \<noteq> {}" "\<And>y. y \<in> X \<Longrightarrow> x \<le> y"
     using that unfolding Inf_nat_def ex_in_conv[symmetric] by (rule LeastI2_ex)
   show "x \<le> Sup X" if "x \<in> X" "bdd_above X"
     using that by (auto simp add: Sup_nat_def bdd_above_nat)
   show "Sup X \<le> x" if "X \<noteq> {}" "\<And>y. y \<in> X \<Longrightarrow> y \<le> x"
   proof -
     from that have "bdd_above X"
       by (auto simp: bdd_above_def)
     with that show ?thesis 
       by (simp add: Sup_nat_def bdd_above_nat)
   qed
 qed
 
 end
 
 lemma Inf_nat_def1:
   fixes K::"nat set"
   assumes "K \<noteq> {}"
   shows "Inf K \<in> K"
 by (auto simp add: Min_def Inf_nat_def) (meson LeastI assms bot.extremum_unique subsetI)
 
 lemma Sup_nat_empty [simp]: "Sup {} = (0::nat)"
   by (auto simp add: Sup_nat_def) 
 
 
 
 instantiation int :: conditionally_complete_linorder
 begin
 
 definition "Sup (X::int set) = (THE x. x \<in> X \<and> (\<forall>y\<in>X. y \<le> x))"
 definition "Inf (X::int set) = - (Sup (uminus ` X))"
 
 instance
 proof
   { fix x :: int and X :: "int set" assume "X \<noteq> {}" "bdd_above X"
     then obtain x y where "X \<subseteq> {..y}" "x \<in> X"
       by (auto simp: bdd_above_def)
     then have *: "finite (X \<inter> {x..y})" "X \<inter> {x..y} \<noteq> {}" and "x \<le> y"
       by (auto simp: subset_eq)
     have "\<exists>!x\<in>X. (\<forall>y\<in>X. y \<le> x)"
     proof
       { fix z assume "z \<in> X"
         have "z \<le> Max (X \<inter> {x..y})"
         proof cases
           assume "x \<le> z" with \<open>z \<in> X\<close> \<open>X \<subseteq> {..y}\<close> *(1) show ?thesis
             by (auto intro!: Max_ge)
         next
           assume "\<not> x \<le> z"
           then have "z < x" by simp
           also have "x \<le> Max (X \<inter> {x..y})"
             using \<open>x \<in> X\<close> *(1) \<open>x \<le> y\<close> by (intro Max_ge) auto
           finally show ?thesis by simp
         qed }
       note le = this
       with Max_in[OF *] show ex: "Max (X \<inter> {x..y}) \<in> X \<and> (\<forall>z\<in>X. z \<le> Max (X \<inter> {x..y}))" by auto
 
       fix z assume *: "z \<in> X \<and> (\<forall>y\<in>X. y \<le> z)"
       with le have "z \<le> Max (X \<inter> {x..y})"
         by auto
       moreover have "Max (X \<inter> {x..y}) \<le> z"
         using * ex by auto
       ultimately show "z = Max (X \<inter> {x..y})"
         by auto
     qed
     then have "Sup X \<in> X \<and> (\<forall>y\<in>X. y \<le> Sup X)"
       unfolding Sup_int_def by (rule theI') }
   note Sup_int = this
 
   { fix x :: int and X :: "int set" assume "x \<in> X" "bdd_above X" then show "x \<le> Sup X"
       using Sup_int[of X] by auto }
   note le_Sup = this
   { fix x :: int and X :: "int set" assume "X \<noteq> {}" "\<And>y. y \<in> X \<Longrightarrow> y \<le> x" then show "Sup X \<le> x"
       using Sup_int[of X] by (auto simp: bdd_above_def) }
   note Sup_le = this
 
   { fix x :: int and X :: "int set" assume "x \<in> X" "bdd_below X" then show "Inf X \<le> x"
       using le_Sup[of "-x" "uminus ` X"] by (auto simp: Inf_int_def) }
   { fix x :: int and X :: "int set" assume "X \<noteq> {}" "\<And>y. y \<in> X \<Longrightarrow> x \<le> y" then show "x \<le> Inf X"
       using Sup_le[of "uminus ` X" "-x"] by (force simp: Inf_int_def) }
 qed
 end
 
 lemma interval_cases:
   fixes S :: "'a :: conditionally_complete_linorder set"
   assumes ivl: "\<And>a b x. a \<in> S \<Longrightarrow> b \<in> S \<Longrightarrow> a \<le> x \<Longrightarrow> x \<le> b \<Longrightarrow> x \<in> S"
   shows "\<exists>a b. S = {} \<or>
     S = UNIV \<or>
     S = {..<b} \<or>
     S = {..b} \<or>
     S = {a<..} \<or>
     S = {a..} \<or>
     S = {a<..<b} \<or>
     S = {a<..b} \<or>
     S = {a..<b} \<or>
     S = {a..b}"
 proof -
   define lower upper where "lower = {x. \<exists>s\<in>S. s \<le> x}" and "upper = {x. \<exists>s\<in>S. x \<le> s}"
   with ivl have "S = lower \<inter> upper"
     by auto
   moreover
   have "\<exists>a. upper = UNIV \<or> upper = {} \<or> upper = {.. a} \<or> upper = {..< a}"
   proof cases
     assume *: "bdd_above S \<and> S \<noteq> {}"
     from * have "upper \<subseteq> {.. Sup S}"
       by (auto simp: upper_def intro: cSup_upper2)
     moreover from * have "{..< Sup S} \<subseteq> upper"
       by (force simp add: less_cSup_iff upper_def subset_eq Ball_def)
     ultimately have "upper = {.. Sup S} \<or> upper = {..< Sup S}"
       unfolding ivl_disj_un(2)[symmetric] by auto
     then show ?thesis by auto
   next
     assume "\<not> (bdd_above S \<and> S \<noteq> {})"
     then have "upper = UNIV \<or> upper = {}"
       by (auto simp: upper_def bdd_above_def not_le dest: less_imp_le)
     then show ?thesis
       by auto
   qed
   moreover
   have "\<exists>b. lower = UNIV \<or> lower = {} \<or> lower = {b ..} \<or> lower = {b <..}"
   proof cases
     assume *: "bdd_below S \<and> S \<noteq> {}"
     from * have "lower \<subseteq> {Inf S ..}"
       by (auto simp: lower_def intro: cInf_lower2)
     moreover from * have "{Inf S <..} \<subseteq> lower"
       by (force simp add: cInf_less_iff lower_def subset_eq Ball_def)
     ultimately have "lower = {Inf S ..} \<or> lower = {Inf S <..}"
       unfolding ivl_disj_un(1)[symmetric] by auto
     then show ?thesis by auto
   next
     assume "\<not> (bdd_below S \<and> S \<noteq> {})"
     then have "lower = UNIV \<or> lower = {}"
       by (auto simp: lower_def bdd_below_def not_le dest: less_imp_le)
     then show ?thesis
       by auto
   qed
   ultimately show ?thesis
     unfolding greaterThanAtMost_def greaterThanLessThan_def atLeastAtMost_def atLeastLessThan_def
     by (metis inf_bot_left inf_bot_right inf_top.left_neutral inf_top.right_neutral)
 qed
 
 lemma cSUP_eq_cINF_D:
   fixes f :: "_ \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes eq: "(\<Squnion>x\<in>A. f x) = (\<Sqinter>x\<in>A. f x)"
      and bdd: "bdd_above (f ` A)" "bdd_below (f ` A)"
      and a: "a \<in> A"
   shows "f a = (\<Sqinter>x\<in>A. f x)"
 apply (rule antisym)
 using a bdd
 apply (auto simp: cINF_lower)
 apply (metis eq cSUP_upper)
 done
 
 lemma cSUP_UNION:
   fixes f :: "_ \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes ne: "A \<noteq> {}" "\<And>x. x \<in> A \<Longrightarrow> B(x) \<noteq> {}"
       and bdd_UN: "bdd_above (\<Union>x\<in>A. f ` B x)"
   shows "(\<Squnion>z \<in> \<Union>x\<in>A. B x. f z) = (\<Squnion>x\<in>A. \<Squnion>z\<in>B x. f z)"
 proof -
   have bdd: "\<And>x. x \<in> A \<Longrightarrow> bdd_above (f ` B x)"
     using bdd_UN by (meson UN_upper bdd_above_mono)
   obtain M where "\<And>x y. x \<in> A \<Longrightarrow> y \<in> B(x) \<Longrightarrow> f y \<le> M"
     using bdd_UN by (auto simp: bdd_above_def)
   then have bdd2: "bdd_above ((\<lambda>x. \<Squnion>z\<in>B x. f z) ` A)"
     unfolding bdd_above_def by (force simp: bdd cSUP_le_iff ne(2))
   have "(\<Squnion>z \<in> \<Union>x\<in>A. B x. f z) \<le> (\<Squnion>x\<in>A. \<Squnion>z\<in>B x. f z)"
     using assms by (fastforce simp add: intro!: cSUP_least intro: cSUP_upper2 simp: bdd2 bdd)
   moreover have "(\<Squnion>x\<in>A. \<Squnion>z\<in>B x. f z) \<le> (\<Squnion> z \<in> \<Union>x\<in>A. B x. f z)"
     using assms by (fastforce simp add: intro!: cSUP_least intro: cSUP_upper simp: image_UN bdd_UN)
   ultimately show ?thesis
     by (rule order_antisym)
 qed
 
 lemma cINF_UNION:
   fixes f :: "_ \<Rightarrow> 'b::conditionally_complete_lattice"
   assumes ne: "A \<noteq> {}" "\<And>x. x \<in> A \<Longrightarrow> B(x) \<noteq> {}"
       and bdd_UN: "bdd_below (\<Union>x\<in>A. f ` B x)"
   shows "(\<Sqinter>z \<in> \<Union>x\<in>A. B x. f z) = (\<Sqinter>x\<in>A. \<Sqinter>z\<in>B x. f z)"
 proof -
   have bdd: "\<And>x. x \<in> A \<Longrightarrow> bdd_below (f ` B x)"
     using bdd_UN by (meson UN_upper bdd_below_mono)
   obtain M where "\<And>x y. x \<in> A \<Longrightarrow> y \<in> B(x) \<Longrightarrow> f y \<ge> M"
     using bdd_UN by (auto simp: bdd_below_def)
   then have bdd2: "bdd_below ((\<lambda>x. \<Sqinter>z\<in>B x. f z) ` A)"
     unfolding bdd_below_def by (force simp: bdd le_cINF_iff ne(2))
   have "(\<Sqinter>z \<in> \<Union>x\<in>A. B x. f z) \<le> (\<Sqinter>x\<in>A. \<Sqinter>z\<in>B x. f z)"
     using assms by (fastforce simp add: intro!: cINF_greatest intro: cINF_lower simp: bdd2 bdd)
   moreover have "(\<Sqinter>x\<in>A. \<Sqinter>z\<in>B x. f z) \<le> (\<Sqinter>z \<in> \<Union>x\<in>A. B x. f z)"
     using assms  by (fastforce simp add: intro!: cINF_greatest intro: cINF_lower2  simp: bdd bdd_UN bdd2)
   ultimately show ?thesis
     by (rule order_antisym)
 qed
 
 lemma cSup_abs_le:
   fixes S :: "('a::{linordered_idom,conditionally_complete_linorder}) set"
   shows "S \<noteq> {} \<Longrightarrow> (\<And>x. x\<in>S \<Longrightarrow> \<bar>x\<bar> \<le> a) \<Longrightarrow> \<bar>Sup S\<bar> \<le> a"
   apply (auto simp add: abs_le_iff intro: cSup_least)
   by (metis bdd_aboveI cSup_upper neg_le_iff_le order_trans)
 
 end
diff --git a/src/HOL/Orderings.thy b/src/HOL/Orderings.thy
--- a/src/HOL/Orderings.thy
+++ b/src/HOL/Orderings.thy
@@ -1,1745 +1,1801 @@
 (*  Title:      HOL/Orderings.thy
     Author:     Tobias Nipkow, Markus Wenzel, and Larry Paulson
 *)
 
 section \<open>Abstract orderings\<close>
 
 theory Orderings
 imports HOL
 keywords "print_orders" :: diag
 begin
 
 ML_file \<open>~~/src/Provers/order.ML\<close>
 
 subsection \<open>Abstract ordering\<close>
 
-locale ordering =
-  fixes less_eq :: "'a \<Rightarrow> 'a \<Rightarrow> bool" (infix "\<^bold>\<le>" 50)
-   and less :: "'a \<Rightarrow> 'a \<Rightarrow> bool" (infix "\<^bold><" 50)
-  assumes strict_iff_order: "a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> a \<noteq> b"
-  assumes refl: "a \<^bold>\<le> a" \<comment> \<open>not \<open>iff\<close>: makes problems due to multiple (dual) interpretations\<close>
-    and antisym: "a \<^bold>\<le> b \<Longrightarrow> b \<^bold>\<le> a \<Longrightarrow> a = b"
-    and trans: "a \<^bold>\<le> b \<Longrightarrow> b \<^bold>\<le> c \<Longrightarrow> a \<^bold>\<le> c"
+locale partial_preordering =
+  fixes less_eq :: \<open>'a \<Rightarrow> 'a \<Rightarrow> bool\<close> (infix \<open>\<^bold>\<le>\<close> 50)
+  assumes refl: \<open>a \<^bold>\<le> a\<close> \<comment> \<open>not \<open>iff\<close>: makes problems due to multiple (dual) interpretations\<close>
+    and trans: \<open>a \<^bold>\<le> b \<Longrightarrow> b \<^bold>\<le> c \<Longrightarrow> a \<^bold>\<le> c\<close>
+
+locale preordering = partial_preordering +
+  fixes less :: \<open>'a \<Rightarrow> 'a \<Rightarrow> bool\<close> (infix \<open>\<^bold><\<close> 50)
+  assumes strict_iff_not: \<open>a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> \<not> b \<^bold>\<le> a\<close>
 begin
 
 lemma strict_implies_order:
-  "a \<^bold>< b \<Longrightarrow> a \<^bold>\<le> b"
-  by (simp add: strict_iff_order)
+  \<open>a \<^bold>< b \<Longrightarrow> a \<^bold>\<le> b\<close>
+  by (simp add: strict_iff_not)
+
+lemma irrefl: \<comment> \<open>not \<open>iff\<close>: makes problems due to multiple (dual) interpretations\<close>
+  \<open>\<not> a \<^bold>< a\<close>
+  by (simp add: strict_iff_not)
+
+lemma asym:
+  \<open>a \<^bold>< b \<Longrightarrow> b \<^bold>< a \<Longrightarrow> False\<close>
+  by (auto simp add: strict_iff_not)
+
+lemma strict_trans1:
+  \<open>a \<^bold>\<le> b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c\<close>
+  by (auto simp add: strict_iff_not intro: trans)
+
+lemma strict_trans2:
+  \<open>a \<^bold>< b \<Longrightarrow> b \<^bold>\<le> c \<Longrightarrow> a \<^bold>< c\<close>
+  by (auto simp add: strict_iff_not intro: trans)
+
+lemma strict_trans:
+  \<open>a \<^bold>< b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c\<close>
+  by (auto intro: strict_trans1 strict_implies_order)
+
+end
+
+lemma preordering_strictI: \<comment> \<open>Alternative introduction rule with bias towards strict order\<close>
+  fixes less_eq (infix \<open>\<^bold>\<le>\<close> 50)
+    and less (infix \<open>\<^bold><\<close> 50)
+  assumes less_eq_less: \<open>\<And>a b. a \<^bold>\<le> b \<longleftrightarrow> a \<^bold>< b \<or> a = b\<close>
+    assumes asym: \<open>\<And>a b. a \<^bold>< b \<Longrightarrow> \<not> b \<^bold>< a\<close>
+  assumes irrefl: \<open>\<And>a. \<not> a \<^bold>< a\<close>
+  assumes trans: \<open>\<And>a b c. a \<^bold>< b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c\<close>
+  shows \<open>preordering (\<^bold>\<le>) (\<^bold><)\<close>
+proof
+  fix a b
+  show \<open>a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> \<not> b \<^bold>\<le> a\<close>
+    by (auto simp add: less_eq_less asym irrefl)
+next
+  fix a
+  show \<open>a \<^bold>\<le> a\<close>
+    by (auto simp add: less_eq_less)
+next
+  fix a b c
+  assume \<open>a \<^bold>\<le> b\<close> and \<open>b \<^bold>\<le> c\<close> then show \<open>a \<^bold>\<le> c\<close>
+    by (auto simp add: less_eq_less intro: trans)
+qed
+
+lemma preordering_dualI:
+  fixes less_eq (infix \<open>\<^bold>\<le>\<close> 50)
+    and less (infix \<open>\<^bold><\<close> 50)
+  assumes \<open>preordering (\<lambda>a b. b \<^bold>\<le> a) (\<lambda>a b. b \<^bold>< a)\<close>
+  shows \<open>preordering (\<^bold>\<le>) (\<^bold><)\<close>
+proof -
+  from assms interpret preordering \<open>\<lambda>a b. b \<^bold>\<le> a\<close> \<open>\<lambda>a b. b \<^bold>< a\<close> .
+  show ?thesis
+    by standard (auto simp: strict_iff_not refl intro: trans)
+qed
+
+locale ordering = partial_preordering +
+  fixes less :: \<open>'a \<Rightarrow> 'a \<Rightarrow> bool\<close> (infix \<open>\<^bold><\<close> 50)
+  assumes strict_iff_order: \<open>a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> a \<noteq> b\<close>
+  assumes antisym: \<open>a \<^bold>\<le> b \<Longrightarrow> b \<^bold>\<le> a \<Longrightarrow> a = b\<close>
+begin
+
+sublocale preordering \<open>(\<^bold>\<le>)\<close> \<open>(\<^bold><)\<close>
+proof
+  show \<open>a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> \<not> b \<^bold>\<le> a\<close> for a b
+    by (auto simp add: strict_iff_order intro: antisym)
+qed
 
 lemma strict_implies_not_eq:
-  "a \<^bold>< b \<Longrightarrow> a \<noteq> b"
+  \<open>a \<^bold>< b \<Longrightarrow> a \<noteq> b\<close>
   by (simp add: strict_iff_order)
 
 lemma not_eq_order_implies_strict:
-  "a \<noteq> b \<Longrightarrow> a \<^bold>\<le> b \<Longrightarrow> a \<^bold>< b"
+  \<open>a \<noteq> b \<Longrightarrow> a \<^bold>\<le> b \<Longrightarrow> a \<^bold>< b\<close>
   by (simp add: strict_iff_order)
 
 lemma order_iff_strict:
-  "a \<^bold>\<le> b \<longleftrightarrow> a \<^bold>< b \<or> a = b"
+  \<open>a \<^bold>\<le> b \<longleftrightarrow> a \<^bold>< b \<or> a = b\<close>
   by (auto simp add: strict_iff_order refl)
 
-lemma irrefl: \<comment> \<open>not \<open>iff\<close>: makes problems due to multiple (dual) interpretations\<close>
-  "\<not> a \<^bold>< a"
-  by (simp add: strict_iff_order)
-
-lemma asym:
-  "a \<^bold>< b \<Longrightarrow> b \<^bold>< a \<Longrightarrow> False"
-  by (auto simp add: strict_iff_order intro: antisym)
-
-lemma strict_trans1:
-  "a \<^bold>\<le> b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c"
-  by (auto simp add: strict_iff_order intro: trans antisym)
-
-lemma strict_trans2:
-  "a \<^bold>< b \<Longrightarrow> b \<^bold>\<le> c \<Longrightarrow> a \<^bold>< c"
-  by (auto simp add: strict_iff_order intro: trans antisym)
-
-lemma strict_trans:
-  "a \<^bold>< b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c"
-  by (auto intro: strict_trans1 strict_implies_order)
-
-lemma eq_iff: "a = b \<longleftrightarrow> a \<^bold>\<le> b \<and> b \<^bold>\<le> a"
+lemma eq_iff: \<open>a = b \<longleftrightarrow> a \<^bold>\<le> b \<and> b \<^bold>\<le> a\<close>
   by (auto simp add: refl intro: antisym)
 
 end
 
-text \<open>Alternative introduction rule with bias towards strict order\<close>
-
-lemma ordering_strictI:
-  fixes less_eq (infix "\<^bold>\<le>" 50)
-    and less (infix "\<^bold><" 50)
-  assumes less_eq_less: "\<And>a b. a \<^bold>\<le> b \<longleftrightarrow> a \<^bold>< b \<or> a = b"
-    assumes asym: "\<And>a b. a \<^bold>< b \<Longrightarrow> \<not> b \<^bold>< a"
-  assumes irrefl: "\<And>a. \<not> a \<^bold>< a"
-  assumes trans: "\<And>a b c. a \<^bold>< b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c"
-  shows "ordering less_eq less"
+lemma ordering_strictI: \<comment> \<open>Alternative introduction rule with bias towards strict order\<close>
+  fixes less_eq (infix \<open>\<^bold>\<le>\<close> 50)
+    and less (infix \<open>\<^bold><\<close> 50)
+  assumes less_eq_less: \<open>\<And>a b. a \<^bold>\<le> b \<longleftrightarrow> a \<^bold>< b \<or> a = b\<close>
+    assumes asym: \<open>\<And>a b. a \<^bold>< b \<Longrightarrow> \<not> b \<^bold>< a\<close>
+  assumes irrefl: \<open>\<And>a. \<not> a \<^bold>< a\<close>
+  assumes trans: \<open>\<And>a b c. a \<^bold>< b \<Longrightarrow> b \<^bold>< c \<Longrightarrow> a \<^bold>< c\<close>
+  shows \<open>ordering (\<^bold>\<le>) (\<^bold><)\<close>
 proof
   fix a b
-  show "a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> a \<noteq> b"
+  show \<open>a \<^bold>< b \<longleftrightarrow> a \<^bold>\<le> b \<and> a \<noteq> b\<close>
     by (auto simp add: less_eq_less asym irrefl)
 next
   fix a
-  show "a \<^bold>\<le> a"
+  show \<open>a \<^bold>\<le> a\<close>
     by (auto simp add: less_eq_less)
 next
   fix a b c
-  assume "a \<^bold>\<le> b" and "b \<^bold>\<le> c" then show "a \<^bold>\<le> c"
+  assume \<open>a \<^bold>\<le> b\<close> and \<open>b \<^bold>\<le> c\<close> then show \<open>a \<^bold>\<le> c\<close>
     by (auto simp add: less_eq_less intro: trans)
 next
   fix a b
-  assume "a \<^bold>\<le> b" and "b \<^bold>\<le> a" then show "a = b"
+  assume \<open>a \<^bold>\<le> b\<close> and \<open>b \<^bold>\<le> a\<close> then show \<open>a = b\<close>
     by (auto simp add: less_eq_less asym)
 qed
 
 lemma ordering_dualI:
-  fixes less_eq (infix "\<^bold>\<le>" 50)
-    and less (infix "\<^bold><" 50)
-  assumes "ordering (\<lambda>a b. b \<^bold>\<le> a) (\<lambda>a b. b \<^bold>< a)"
-  shows "ordering less_eq less"
+  fixes less_eq (infix \<open>\<^bold>\<le>\<close> 50)
+    and less (infix \<open>\<^bold><\<close> 50)
+  assumes \<open>ordering (\<lambda>a b. b \<^bold>\<le> a) (\<lambda>a b. b \<^bold>< a)\<close>
+  shows \<open>ordering (\<^bold>\<le>) (\<^bold><)\<close>
 proof -
-  from assms interpret ordering "\<lambda>a b. b \<^bold>\<le> a" "\<lambda>a b. b \<^bold>< a" .
+  from assms interpret ordering \<open>\<lambda>a b. b \<^bold>\<le> a\<close> \<open>\<lambda>a b. b \<^bold>< a\<close> .
   show ?thesis
     by standard (auto simp: strict_iff_order refl intro: antisym trans)
 qed
 
 locale ordering_top = ordering +
-  fixes top :: "'a"  ("\<^bold>\<top>")
-  assumes extremum [simp]: "a \<^bold>\<le> \<^bold>\<top>"
+  fixes top :: \<open>'a\<close>  (\<open>\<^bold>\<top>\<close>)
+  assumes extremum [simp]: \<open>a \<^bold>\<le> \<^bold>\<top>\<close>
 begin
 
 lemma extremum_uniqueI:
-  "\<^bold>\<top> \<^bold>\<le> a \<Longrightarrow> a = \<^bold>\<top>"
+  \<open>\<^bold>\<top> \<^bold>\<le> a \<Longrightarrow> a = \<^bold>\<top>\<close>
   by (rule antisym) auto
 
 lemma extremum_unique:
-  "\<^bold>\<top> \<^bold>\<le> a \<longleftrightarrow> a = \<^bold>\<top>"
+  \<open>\<^bold>\<top> \<^bold>\<le> a \<longleftrightarrow> a = \<^bold>\<top>\<close>
   by (auto intro: antisym)
 
 lemma extremum_strict [simp]:
-  "\<not> (\<^bold>\<top> \<^bold>< a)"
+  \<open>\<not> (\<^bold>\<top> \<^bold>< a)\<close>
   using extremum [of a] by (auto simp add: order_iff_strict intro: asym irrefl)
 
 lemma not_eq_extremum:
-  "a \<noteq> \<^bold>\<top> \<longleftrightarrow> a \<^bold>< \<^bold>\<top>"
+  \<open>a \<noteq> \<^bold>\<top> \<longleftrightarrow> a \<^bold>< \<^bold>\<top>\<close>
   by (auto simp add: order_iff_strict intro: not_eq_order_implies_strict extremum)
 
 end
 
 
 subsection \<open>Syntactic orders\<close>
 
 class ord =
   fixes less_eq :: "'a \<Rightarrow> 'a \<Rightarrow> bool"
     and less :: "'a \<Rightarrow> 'a \<Rightarrow> bool"
 begin
 
 notation
   less_eq  ("'(\<le>')") and
   less_eq  ("(_/ \<le> _)"  [51, 51] 50) and
   less  ("'(<')") and
   less  ("(_/ < _)"  [51, 51] 50)
 
 abbreviation (input)
   greater_eq  (infix "\<ge>" 50)
   where "x \<ge> y \<equiv> y \<le> x"
 
 abbreviation (input)
   greater  (infix ">" 50)
   where "x > y \<equiv> y < x"
 
 notation (ASCII)
   less_eq  ("'(<=')") and
   less_eq  ("(_/ <= _)" [51, 51] 50)
 
 notation (input)
   greater_eq  (infix ">=" 50)
 
 end
 
 
 subsection \<open>Quasi orders\<close>
 
 class preorder = ord +
   assumes less_le_not_le: "x < y \<longleftrightarrow> x \<le> y \<and> \<not> (y \<le> x)"
   and order_refl [iff]: "x \<le> x"
   and order_trans: "x \<le> y \<Longrightarrow> y \<le> z \<Longrightarrow> x \<le> z"
 begin
 
+sublocale order: preordering less_eq less + dual_order: preordering greater_eq greater
+proof -
+  interpret preordering less_eq less
+    by standard (auto intro: order_trans simp add: less_le_not_le)
+  show \<open>preordering less_eq less\<close>
+    by (fact preordering_axioms)
+  then show \<open>preordering greater_eq greater\<close>
+    by (rule preordering_dualI)
+qed
+
 text \<open>Reflexivity.\<close>
 
 lemma eq_refl: "x = y \<Longrightarrow> x \<le> y"
     \<comment> \<open>This form is useful with the classical reasoner.\<close>
 by (erule ssubst) (rule order_refl)
 
 lemma less_irrefl [iff]: "\<not> x < x"
 by (simp add: less_le_not_le)
 
 lemma less_imp_le: "x < y \<Longrightarrow> x \<le> y"
 by (simp add: less_le_not_le)
 
 
 text \<open>Asymmetry.\<close>
 
 lemma less_not_sym: "x < y \<Longrightarrow> \<not> (y < x)"
 by (simp add: less_le_not_le)
 
 lemma less_asym: "x < y \<Longrightarrow> (\<not> P \<Longrightarrow> y < x) \<Longrightarrow> P"
 by (drule less_not_sym, erule contrapos_np) simp
 
 
 text \<open>Transitivity.\<close>
 
 lemma less_trans: "x < y \<Longrightarrow> y < z \<Longrightarrow> x < z"
 by (auto simp add: less_le_not_le intro: order_trans)
 
 lemma le_less_trans: "x \<le> y \<Longrightarrow> y < z \<Longrightarrow> x < z"
 by (auto simp add: less_le_not_le intro: order_trans)
 
 lemma less_le_trans: "x < y \<Longrightarrow> y \<le> z \<Longrightarrow> x < z"
 by (auto simp add: less_le_not_le intro: order_trans)
 
 
 text \<open>Useful for simplification, but too risky to include by default.\<close>
 
 lemma less_imp_not_less: "x < y \<Longrightarrow> (\<not> y < x) \<longleftrightarrow> True"
 by (blast elim: less_asym)
 
 lemma less_imp_triv: "x < y \<Longrightarrow> (y < x \<longrightarrow> P) \<longleftrightarrow> True"
 by (blast elim: less_asym)
 
 
 text \<open>Transitivity rules for calculational reasoning\<close>
 
 lemma less_asym': "a < b \<Longrightarrow> b < a \<Longrightarrow> P"
 by (rule less_asym)
 
 
 text \<open>Dual order\<close>
 
 lemma dual_preorder:
-  "class.preorder (\<ge>) (>)"
+  \<open>class.preorder (\<ge>) (>)\<close>
   by standard (auto simp add: less_le_not_le intro: order_trans)
 
 end
 
 
 subsection \<open>Partial orders\<close>
 
 class order = preorder +
   assumes antisym: "x \<le> y \<Longrightarrow> y \<le> x \<Longrightarrow> x = y"
 begin
 
 lemma less_le: "x < y \<longleftrightarrow> x \<le> y \<and> x \<noteq> y"
   by (auto simp add: less_le_not_le intro: antisym)
 
 sublocale order: ordering less_eq less + dual_order: ordering greater_eq greater
 proof -
   interpret ordering less_eq less
     by standard (auto intro: antisym order_trans simp add: less_le)
   show "ordering less_eq less"
     by (fact ordering_axioms)
   then show "ordering greater_eq greater"
     by (rule ordering_dualI)
 qed
 
 text \<open>Reflexivity.\<close>
 
 lemma le_less: "x \<le> y \<longleftrightarrow> x < y \<or> x = y"
     \<comment> \<open>NOT suitable for iff, since it can cause PROOF FAILED.\<close>
 by (fact order.order_iff_strict)
 
 lemma le_imp_less_or_eq: "x \<le> y \<Longrightarrow> x < y \<or> x = y"
 by (simp add: less_le)
 
 
 text \<open>Useful for simplification, but too risky to include by default.\<close>
 
 lemma less_imp_not_eq: "x < y \<Longrightarrow> (x = y) \<longleftrightarrow> False"
 by auto
 
 lemma less_imp_not_eq2: "x < y \<Longrightarrow> (y = x) \<longleftrightarrow> False"
 by auto
 
 
 text \<open>Transitivity rules for calculational reasoning\<close>
 
 lemma neq_le_trans: "a \<noteq> b \<Longrightarrow> a \<le> b \<Longrightarrow> a < b"
 by (fact order.not_eq_order_implies_strict)
 
 lemma le_neq_trans: "a \<le> b \<Longrightarrow> a \<noteq> b \<Longrightarrow> a < b"
 by (rule order.not_eq_order_implies_strict)
 
 
 text \<open>Asymmetry.\<close>
 
 lemma eq_iff: "x = y \<longleftrightarrow> x \<le> y \<and> y \<le> x"
   by (fact order.eq_iff)
 
 lemma antisym_conv: "y \<le> x \<Longrightarrow> x \<le> y \<longleftrightarrow> x = y"
   by (simp add: eq_iff)
 
 lemma less_imp_neq: "x < y \<Longrightarrow> x \<noteq> y"
   by (fact order.strict_implies_not_eq)
 
 lemma antisym_conv1: "\<not> x < y \<Longrightarrow> x \<le> y \<longleftrightarrow> x = y"
   by (simp add: local.le_less)
 
 lemma antisym_conv2: "x \<le> y \<Longrightarrow> \<not> x < y \<longleftrightarrow> x = y"
   by (simp add: local.less_le)
 
 lemma leD: "y \<le> x \<Longrightarrow> \<not> x < y"
   by (auto simp: less_le antisym)
 
 text \<open>Least value operator\<close>
 
 definition (in ord)
   Least :: "('a \<Rightarrow> bool) \<Rightarrow> 'a" (binder "LEAST " 10) where
   "Least P = (THE x. P x \<and> (\<forall>y. P y \<longrightarrow> x \<le> y))"
 
 lemma Least_equality:
   assumes "P x"
     and "\<And>y. P y \<Longrightarrow> x \<le> y"
   shows "Least P = x"
 unfolding Least_def by (rule the_equality)
   (blast intro: assms antisym)+
 
 lemma LeastI2_order:
   assumes "P x"
     and "\<And>y. P y \<Longrightarrow> x \<le> y"
     and "\<And>x. P x \<Longrightarrow> \<forall>y. P y \<longrightarrow> x \<le> y \<Longrightarrow> Q x"
   shows "Q (Least P)"
 unfolding Least_def by (rule theI2)
   (blast intro: assms antisym)+
 
 lemma Least_ex1:
   assumes   "\<exists>!x. P x \<and> (\<forall>y. P y \<longrightarrow> x \<le> y)"
   shows     Least1I: "P (Least P)" and Least1_le: "P z \<Longrightarrow> Least P \<le> z"
   using     theI'[OF assms]
   unfolding Least_def
   by        auto
 
 text \<open>Greatest value operator\<close>
 
 definition Greatest :: "('a \<Rightarrow> bool) \<Rightarrow> 'a" (binder "GREATEST " 10) where
 "Greatest P = (THE x. P x \<and> (\<forall>y. P y \<longrightarrow> x \<ge> y))"
 
 lemma GreatestI2_order:
   "\<lbrakk> P x;
     \<And>y. P y \<Longrightarrow> x \<ge> y;
     \<And>x. \<lbrakk> P x; \<forall>y. P y \<longrightarrow> x \<ge> y \<rbrakk> \<Longrightarrow> Q x \<rbrakk>
   \<Longrightarrow> Q (Greatest P)"
 unfolding Greatest_def
 by (rule theI2) (blast intro: antisym)+
 
 lemma Greatest_equality:
   "\<lbrakk> P x;  \<And>y. P y \<Longrightarrow> x \<ge> y \<rbrakk> \<Longrightarrow> Greatest P = x"
 unfolding Greatest_def
 by (rule the_equality) (blast intro: antisym)+
 
 end
 
 lemma ordering_orderI:
   fixes less_eq (infix "\<^bold>\<le>" 50)
     and less (infix "\<^bold><" 50)
   assumes "ordering less_eq less"
   shows "class.order less_eq less"
 proof -
   from assms interpret ordering less_eq less .
   show ?thesis
     by standard (auto intro: antisym trans simp add: refl strict_iff_order)
 qed
 
 lemma order_strictI:
   fixes less (infix "\<sqsubset>" 50)
     and less_eq (infix "\<sqsubseteq>" 50)
   assumes "\<And>a b. a \<sqsubseteq> b \<longleftrightarrow> a \<sqsubset> b \<or> a = b"
     assumes "\<And>a b. a \<sqsubset> b \<Longrightarrow> \<not> b \<sqsubset> a"
   assumes "\<And>a. \<not> a \<sqsubset> a"
   assumes "\<And>a b c. a \<sqsubset> b \<Longrightarrow> b \<sqsubset> c \<Longrightarrow> a \<sqsubset> c"
   shows "class.order less_eq less"
   by (rule ordering_orderI) (rule ordering_strictI, (fact assms)+)
 
 context order
 begin
 
 text \<open>Dual order\<close>
 
 lemma dual_order:
   "class.order (\<ge>) (>)"
   using dual_order.ordering_axioms by (rule ordering_orderI)
 
 end
 
 
 subsection \<open>Linear (total) orders\<close>
 
 class linorder = order +
   assumes linear: "x \<le> y \<or> y \<le> x"
 begin
 
 lemma less_linear: "x < y \<or> x = y \<or> y < x"
 unfolding less_le using less_le linear by blast
 
 lemma le_less_linear: "x \<le> y \<or> y < x"
 by (simp add: le_less less_linear)
 
 lemma le_cases [case_names le ge]:
   "(x \<le> y \<Longrightarrow> P) \<Longrightarrow> (y \<le> x \<Longrightarrow> P) \<Longrightarrow> P"
 using linear by blast
 
 lemma (in linorder) le_cases3:
   "\<lbrakk>\<lbrakk>x \<le> y; y \<le> z\<rbrakk> \<Longrightarrow> P; \<lbrakk>y \<le> x; x \<le> z\<rbrakk> \<Longrightarrow> P; \<lbrakk>x \<le> z; z \<le> y\<rbrakk> \<Longrightarrow> P;
     \<lbrakk>z \<le> y; y \<le> x\<rbrakk> \<Longrightarrow> P; \<lbrakk>y \<le> z; z \<le> x\<rbrakk> \<Longrightarrow> P; \<lbrakk>z \<le> x; x \<le> y\<rbrakk> \<Longrightarrow> P\<rbrakk> \<Longrightarrow> P"
 by (blast intro: le_cases)
 
 lemma linorder_cases [case_names less equal greater]:
   "(x < y \<Longrightarrow> P) \<Longrightarrow> (x = y \<Longrightarrow> P) \<Longrightarrow> (y < x \<Longrightarrow> P) \<Longrightarrow> P"
 using less_linear by blast
 
 lemma linorder_wlog[case_names le sym]:
   "(\<And>a b. a \<le> b \<Longrightarrow> P a b) \<Longrightarrow> (\<And>a b. P b a \<Longrightarrow> P a b) \<Longrightarrow> P a b"
   by (cases rule: le_cases[of a b]) blast+
 
 lemma not_less: "\<not> x < y \<longleftrightarrow> y \<le> x"
   unfolding less_le
   using linear by (blast intro: antisym)
 
 lemma not_less_iff_gr_or_eq: "\<not>(x < y) \<longleftrightarrow> (x > y \<or> x = y)"
   by (auto simp add:not_less le_less)
 
 lemma not_le: "\<not> x \<le> y \<longleftrightarrow> y < x"
   unfolding less_le
   using linear by (blast intro: antisym)
 
 lemma neq_iff: "x \<noteq> y \<longleftrightarrow> x < y \<or> y < x"
 by (cut_tac x = x and y = y in less_linear, auto)
 
 lemma neqE: "x \<noteq> y \<Longrightarrow> (x < y \<Longrightarrow> R) \<Longrightarrow> (y < x \<Longrightarrow> R) \<Longrightarrow> R"
 by (simp add: neq_iff) blast
 
 lemma antisym_conv3: "\<not> y < x \<Longrightarrow> \<not> x < y \<longleftrightarrow> x = y"
 by (blast intro: antisym dest: not_less [THEN iffD1])
 
 lemma leI: "\<not> x < y \<Longrightarrow> y \<le> x"
 unfolding not_less .
 
 lemma not_le_imp_less: "\<not> y \<le> x \<Longrightarrow> x < y"
 unfolding not_le .
 
 lemma linorder_less_wlog[case_names less refl sym]:
      "\<lbrakk>\<And>a b. a < b \<Longrightarrow> P a b;  \<And>a. P a a;  \<And>a b. P b a \<Longrightarrow> P a b\<rbrakk> \<Longrightarrow> P a b"
   using antisym_conv3 by blast
 
 text \<open>Dual order\<close>
 
 lemma dual_linorder:
   "class.linorder (\<ge>) (>)"
 by (rule class.linorder.intro, rule dual_order) (unfold_locales, rule linear)
 
 end
 
 
 text \<open>Alternative introduction rule with bias towards strict order\<close>
 
 lemma linorder_strictI:
   fixes less_eq (infix "\<^bold>\<le>" 50)
     and less (infix "\<^bold><" 50)
   assumes "class.order less_eq less"
   assumes trichotomy: "\<And>a b. a \<^bold>< b \<or> a = b \<or> b \<^bold>< a"
   shows "class.linorder less_eq less"
 proof -
   interpret order less_eq less
     by (fact \<open>class.order less_eq less\<close>)
   show ?thesis
   proof
     fix a b
     show "a \<^bold>\<le> b \<or> b \<^bold>\<le> a"
       using trichotomy by (auto simp add: le_less)
   qed
 qed
 
 
 subsection \<open>Reasoning tools setup\<close>
 
 ML \<open>
 signature ORDERS =
 sig
   val print_structures: Proof.context -> unit
   val order_tac: Proof.context -> thm list -> int -> tactic
   val add_struct: string * term list -> string -> attribute
   val del_struct: string * term list -> attribute
 end;
 
 structure Orders: ORDERS =
 struct
 
 (* context data *)
 
 fun struct_eq ((s1: string, ts1), (s2, ts2)) =
   s1 = s2 andalso eq_list (op aconv) (ts1, ts2);
 
 structure Data = Generic_Data
 (
   type T = ((string * term list) * Order_Tac.less_arith) list;
     (* Order structures:
        identifier of the structure, list of operations and record of theorems
        needed to set up the transitivity reasoner,
        identifier and operations identify the structure uniquely. *)
   val empty = [];
   val extend = I;
   fun merge data = AList.join struct_eq (K fst) data;
 );
 
 fun print_structures ctxt =
   let
     val structs = Data.get (Context.Proof ctxt);
     fun pretty_term t = Pretty.block
       [Pretty.quote (Syntax.pretty_term ctxt t), Pretty.brk 1,
         Pretty.str "::", Pretty.brk 1,
         Pretty.quote (Syntax.pretty_typ ctxt (type_of t))];
     fun pretty_struct ((s, ts), _) = Pretty.block
       [Pretty.str s, Pretty.str ":", Pretty.brk 1,
        Pretty.enclose "(" ")" (Pretty.breaks (map pretty_term ts))];
   in
     Pretty.writeln (Pretty.big_list "order structures:" (map pretty_struct structs))
   end;
 
 val _ =
   Outer_Syntax.command \<^command_keyword>\<open>print_orders\<close>
     "print order structures available to transitivity reasoner"
     (Scan.succeed (Toplevel.keep (print_structures o Toplevel.context_of)));
 
 
 (* tactics *)
 
 fun struct_tac ((s, ops), thms) ctxt facts =
   let
     val [eq, le, less] = ops;
     fun decomp thy (\<^const>\<open>Trueprop\<close> $ t) =
           let
             fun excluded t =
               (* exclude numeric types: linear arithmetic subsumes transitivity *)
               let val T = type_of t
               in
                 T = HOLogic.natT orelse T = HOLogic.intT orelse T = HOLogic.realT
               end;
             fun rel (bin_op $ t1 $ t2) =
                   if excluded t1 then NONE
                   else if Pattern.matches thy (eq, bin_op) then SOME (t1, "=", t2)
                   else if Pattern.matches thy (le, bin_op) then SOME (t1, "<=", t2)
                   else if Pattern.matches thy (less, bin_op) then SOME (t1, "<", t2)
                   else NONE
               | rel _ = NONE;
             fun dec (Const (\<^const_name>\<open>Not\<close>, _) $ t) =
                   (case rel t of NONE =>
                     NONE
                   | SOME (t1, rel, t2) => SOME (t1, "~" ^ rel, t2))
               | dec x = rel x;
           in dec t end
       | decomp _ _ = NONE;
   in
     (case s of
       "order" => Order_Tac.partial_tac decomp thms ctxt facts
     | "linorder" => Order_Tac.linear_tac decomp thms ctxt facts
     | _ => error ("Unknown order kind " ^ quote s ^ " encountered in transitivity reasoner"))
   end
 
 fun order_tac ctxt facts =
   FIRST' (map (fn s => CHANGED o struct_tac s ctxt facts) (Data.get (Context.Proof ctxt)));
 
 
 (* attributes *)
 
 fun add_struct s tag =
   Thm.declaration_attribute
     (fn thm => Data.map (AList.map_default struct_eq (s, Order_Tac.empty TrueI) (Order_Tac.update tag thm)));
 fun del_struct s =
   Thm.declaration_attribute
     (fn _ => Data.map (AList.delete struct_eq s));
 
 end;
 \<close>
 
 attribute_setup order = \<open>
   Scan.lift ((Args.add -- Args.name >> (fn (_, s) => SOME s) || Args.del >> K NONE) --|
     Args.colon (* FIXME || Scan.succeed true *) ) -- Scan.lift Args.name --
     Scan.repeat Args.term
     >> (fn ((SOME tag, n), ts) => Orders.add_struct (n, ts) tag
          | ((NONE, n), ts) => Orders.del_struct (n, ts))
 \<close> "theorems controlling transitivity reasoner"
 
 method_setup order = \<open>
   Scan.succeed (fn ctxt => SIMPLE_METHOD' (Orders.order_tac ctxt []))
 \<close> "transitivity reasoner"
 
 
 text \<open>Declarations to set up transitivity reasoner of partial and linear orders.\<close>
 
 context order
 begin
 
 (* The type constraint on @{term (=}) below is necessary since the operation
    is not a parameter of the locale. *)
 
 declare less_irrefl [THEN notE, order add less_reflE: order "(=) :: 'a \<Rightarrow> 'a \<Rightarrow> bool" "(<=)" "(<)"]
 
 declare order_refl  [order add le_refl: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_imp_le [order add less_imp_le: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare antisym [order add eqI: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare eq_refl [order add eqD1: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare sym [THEN eq_refl, order add eqD2: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_trans [order add less_trans: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_le_trans [order add less_le_trans: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare le_less_trans [order add le_less_trans: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare order_trans [order add le_trans: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare le_neq_trans [order add le_neq_trans: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare neq_le_trans [order add neq_le_trans: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_imp_neq [order add less_imp_neq: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare eq_neq_eq_imp_neq [order add eq_neq_eq_imp_neq: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare not_sym [order add not_sym: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 end
 
 context linorder
 begin
 
 declare [[order del: order "(=) :: 'a => 'a => bool" "(<=)" "(<)"]]
 
 declare less_irrefl [THEN notE, order add less_reflE: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare order_refl [order add le_refl: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_imp_le [order add less_imp_le: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare not_less [THEN iffD2, order add not_lessI: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare not_le [THEN iffD2, order add not_leI: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare not_less [THEN iffD1, order add not_lessD: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare not_le [THEN iffD1, order add not_leD: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare antisym [order add eqI: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare eq_refl [order add eqD1: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare sym [THEN eq_refl, order add eqD2: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_trans [order add less_trans: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_le_trans [order add less_le_trans: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare le_less_trans [order add le_less_trans: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare order_trans [order add le_trans: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare le_neq_trans [order add le_neq_trans: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare neq_le_trans [order add neq_le_trans: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare less_imp_neq [order add less_imp_neq: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare eq_neq_eq_imp_neq [order add eq_neq_eq_imp_neq: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 declare not_sym [order add not_sym: linorder "(=) :: 'a => 'a => bool" "(<=)" "(<)"]
 
 end
 
 setup \<open>
   map_theory_simpset (fn ctxt0 => ctxt0 addSolver
     mk_solver "Transitivity" (fn ctxt => Orders.order_tac ctxt (Simplifier.prems_of ctxt)))
   (*Adding the transitivity reasoners also as safe solvers showed a slight
     speed up, but the reasoning strength appears to be not higher (at least
     no breaking of additional proofs in the entire HOL distribution, as
     of 5 March 2004, was observed).*)
 \<close>
 
 ML \<open>
 local
   fun prp t thm = Thm.prop_of thm = t;  (* FIXME proper aconv!? *)
 in
 
 fun antisym_le_simproc ctxt ct =
   (case Thm.term_of ct of
     (le as Const (_, T)) $ r $ s =>
      (let
         val prems = Simplifier.prems_of ctxt;
         val less = Const (\<^const_name>\<open>less\<close>, T);
         val t = HOLogic.mk_Trueprop(le $ s $ r);
       in
         (case find_first (prp t) prems of
           NONE =>
             let val t = HOLogic.mk_Trueprop(HOLogic.Not $ (less $ r $ s)) in
               (case find_first (prp t) prems of
                 NONE => NONE
               | SOME thm => SOME(mk_meta_eq(thm RS @{thm antisym_conv1})))
              end
          | SOME thm => SOME (mk_meta_eq (thm RS @{thm order_class.antisym_conv})))
       end handle THM _ => NONE)
   | _ => NONE);
 
 fun antisym_less_simproc ctxt ct =
   (case Thm.term_of ct of
     NotC $ ((less as Const(_,T)) $ r $ s) =>
      (let
        val prems = Simplifier.prems_of ctxt;
        val le = Const (\<^const_name>\<open>less_eq\<close>, T);
        val t = HOLogic.mk_Trueprop(le $ r $ s);
       in
         (case find_first (prp t) prems of
           NONE =>
             let val t = HOLogic.mk_Trueprop (NotC $ (less $ s $ r)) in
               (case find_first (prp t) prems of
                 NONE => NONE
               | SOME thm => SOME (mk_meta_eq(thm RS @{thm linorder_class.antisym_conv3})))
             end
         | SOME thm => SOME (mk_meta_eq (thm RS @{thm antisym_conv2})))
       end handle THM _ => NONE)
   | _ => NONE);
 
 end;
 \<close>
 
 simproc_setup antisym_le ("(x::'a::order) \<le> y") = "K antisym_le_simproc"
 simproc_setup antisym_less ("\<not> (x::'a::linorder) < y") = "K antisym_less_simproc"
 
 
 subsection \<open>Bounded quantifiers\<close>
 
 syntax (ASCII)
   "_All_less" :: "[idt, 'a, bool] => bool"    ("(3ALL _<_./ _)"  [0, 0, 10] 10)
   "_Ex_less" :: "[idt, 'a, bool] => bool"    ("(3EX _<_./ _)"  [0, 0, 10] 10)
   "_All_less_eq" :: "[idt, 'a, bool] => bool"    ("(3ALL _<=_./ _)" [0, 0, 10] 10)
   "_Ex_less_eq" :: "[idt, 'a, bool] => bool"    ("(3EX _<=_./ _)" [0, 0, 10] 10)
 
   "_All_greater" :: "[idt, 'a, bool] => bool"    ("(3ALL _>_./ _)"  [0, 0, 10] 10)
   "_Ex_greater" :: "[idt, 'a, bool] => bool"    ("(3EX _>_./ _)"  [0, 0, 10] 10)
   "_All_greater_eq" :: "[idt, 'a, bool] => bool"    ("(3ALL _>=_./ _)" [0, 0, 10] 10)
   "_Ex_greater_eq" :: "[idt, 'a, bool] => bool"    ("(3EX _>=_./ _)" [0, 0, 10] 10)
 
   "_All_neq" :: "[idt, 'a, bool] => bool"    ("(3ALL _~=_./ _)"  [0, 0, 10] 10)
   "_Ex_neq" :: "[idt, 'a, bool] => bool"    ("(3EX _~=_./ _)"  [0, 0, 10] 10)
 
 syntax
   "_All_less" :: "[idt, 'a, bool] => bool"    ("(3\<forall>_<_./ _)"  [0, 0, 10] 10)
   "_Ex_less" :: "[idt, 'a, bool] => bool"    ("(3\<exists>_<_./ _)"  [0, 0, 10] 10)
   "_All_less_eq" :: "[idt, 'a, bool] => bool"    ("(3\<forall>_\<le>_./ _)" [0, 0, 10] 10)
   "_Ex_less_eq" :: "[idt, 'a, bool] => bool"    ("(3\<exists>_\<le>_./ _)" [0, 0, 10] 10)
 
   "_All_greater" :: "[idt, 'a, bool] => bool"    ("(3\<forall>_>_./ _)"  [0, 0, 10] 10)
   "_Ex_greater" :: "[idt, 'a, bool] => bool"    ("(3\<exists>_>_./ _)"  [0, 0, 10] 10)
   "_All_greater_eq" :: "[idt, 'a, bool] => bool"    ("(3\<forall>_\<ge>_./ _)" [0, 0, 10] 10)
   "_Ex_greater_eq" :: "[idt, 'a, bool] => bool"    ("(3\<exists>_\<ge>_./ _)" [0, 0, 10] 10)
 
   "_All_neq" :: "[idt, 'a, bool] => bool"    ("(3\<forall>_\<noteq>_./ _)"  [0, 0, 10] 10)
   "_Ex_neq" :: "[idt, 'a, bool] => bool"    ("(3\<exists>_\<noteq>_./ _)"  [0, 0, 10] 10)
 
 syntax (input)
   "_All_less" :: "[idt, 'a, bool] => bool"    ("(3! _<_./ _)"  [0, 0, 10] 10)
   "_Ex_less" :: "[idt, 'a, bool] => bool"    ("(3? _<_./ _)"  [0, 0, 10] 10)
   "_All_less_eq" :: "[idt, 'a, bool] => bool"    ("(3! _<=_./ _)" [0, 0, 10] 10)
   "_Ex_less_eq" :: "[idt, 'a, bool] => bool"    ("(3? _<=_./ _)" [0, 0, 10] 10)
   "_All_neq" :: "[idt, 'a, bool] => bool"    ("(3! _~=_./ _)"  [0, 0, 10] 10)
   "_Ex_neq" :: "[idt, 'a, bool] => bool"    ("(3? _~=_./ _)"  [0, 0, 10] 10)
 
 translations
   "\<forall>x<y. P" \<rightharpoonup> "\<forall>x. x < y \<longrightarrow> P"
   "\<exists>x<y. P" \<rightharpoonup> "\<exists>x. x < y \<and> P"
   "\<forall>x\<le>y. P" \<rightharpoonup> "\<forall>x. x \<le> y \<longrightarrow> P"
   "\<exists>x\<le>y. P" \<rightharpoonup> "\<exists>x. x \<le> y \<and> P"
   "\<forall>x>y. P" \<rightharpoonup> "\<forall>x. x > y \<longrightarrow> P"
   "\<exists>x>y. P" \<rightharpoonup> "\<exists>x. x > y \<and> P"
   "\<forall>x\<ge>y. P" \<rightharpoonup> "\<forall>x. x \<ge> y \<longrightarrow> P"
   "\<exists>x\<ge>y. P" \<rightharpoonup> "\<exists>x. x \<ge> y \<and> P"
   "\<forall>x\<noteq>y. P" \<rightharpoonup> "\<forall>x. x \<noteq> y \<longrightarrow> P"
   "\<exists>x\<noteq>y. P" \<rightharpoonup> "\<exists>x. x \<noteq> y \<and> P"
 
 print_translation \<open>
 let
   val All_binder = Mixfix.binder_name \<^const_syntax>\<open>All\<close>;
   val Ex_binder = Mixfix.binder_name \<^const_syntax>\<open>Ex\<close>;
   val impl = \<^const_syntax>\<open>HOL.implies\<close>;
   val conj = \<^const_syntax>\<open>HOL.conj\<close>;
   val less = \<^const_syntax>\<open>less\<close>;
   val less_eq = \<^const_syntax>\<open>less_eq\<close>;
 
   val trans =
    [((All_binder, impl, less),
     (\<^syntax_const>\<open>_All_less\<close>, \<^syntax_const>\<open>_All_greater\<close>)),
     ((All_binder, impl, less_eq),
     (\<^syntax_const>\<open>_All_less_eq\<close>, \<^syntax_const>\<open>_All_greater_eq\<close>)),
     ((Ex_binder, conj, less),
     (\<^syntax_const>\<open>_Ex_less\<close>, \<^syntax_const>\<open>_Ex_greater\<close>)),
     ((Ex_binder, conj, less_eq),
     (\<^syntax_const>\<open>_Ex_less_eq\<close>, \<^syntax_const>\<open>_Ex_greater_eq\<close>))];
 
   fun matches_bound v t =
     (case t of
       Const (\<^syntax_const>\<open>_bound\<close>, _) $ Free (v', _) => v = v'
     | _ => false);
   fun contains_var v = Term.exists_subterm (fn Free (x, _) => x = v | _ => false);
   fun mk x c n P = Syntax.const c $ Syntax_Trans.mark_bound_body x $ n $ P;
 
   fun tr' q = (q, fn _ =>
     (fn [Const (\<^syntax_const>\<open>_bound\<close>, _) $ Free (v, T),
         Const (c, _) $ (Const (d, _) $ t $ u) $ P] =>
         (case AList.lookup (=) trans (q, c, d) of
           NONE => raise Match
         | SOME (l, g) =>
             if matches_bound v t andalso not (contains_var v u) then mk (v, T) l u P
             else if matches_bound v u andalso not (contains_var v t) then mk (v, T) g t P
             else raise Match)
       | _ => raise Match));
 in [tr' All_binder, tr' Ex_binder] end
 \<close>
 
 
 subsection \<open>Transitivity reasoning\<close>
 
 context ord
 begin
 
 lemma ord_le_eq_trans: "a \<le> b \<Longrightarrow> b = c \<Longrightarrow> a \<le> c"
   by (rule subst)
 
 lemma ord_eq_le_trans: "a = b \<Longrightarrow> b \<le> c \<Longrightarrow> a \<le> c"
   by (rule ssubst)
 
 lemma ord_less_eq_trans: "a < b \<Longrightarrow> b = c \<Longrightarrow> a < c"
   by (rule subst)
 
 lemma ord_eq_less_trans: "a = b \<Longrightarrow> b < c \<Longrightarrow> a < c"
   by (rule ssubst)
 
 end
 
 lemma order_less_subst2: "(a::'a::order) < b ==> f b < (c::'c::order) ==>
   (!!x y. x < y ==> f x < f y) ==> f a < c"
 proof -
   assume r: "!!x y. x < y ==> f x < f y"
   assume "a < b" hence "f a < f b" by (rule r)
   also assume "f b < c"
   finally (less_trans) show ?thesis .
 qed
 
 lemma order_less_subst1: "(a::'a::order) < f b ==> (b::'b::order) < c ==>
   (!!x y. x < y ==> f x < f y) ==> a < f c"
 proof -
   assume r: "!!x y. x < y ==> f x < f y"
   assume "a < f b"
   also assume "b < c" hence "f b < f c" by (rule r)
   finally (less_trans) show ?thesis .
 qed
 
 lemma order_le_less_subst2: "(a::'a::order) <= b ==> f b < (c::'c::order) ==>
   (!!x y. x <= y ==> f x <= f y) ==> f a < c"
 proof -
   assume r: "!!x y. x <= y ==> f x <= f y"
   assume "a <= b" hence "f a <= f b" by (rule r)
   also assume "f b < c"
   finally (le_less_trans) show ?thesis .
 qed
 
 lemma order_le_less_subst1: "(a::'a::order) <= f b ==> (b::'b::order) < c ==>
   (!!x y. x < y ==> f x < f y) ==> a < f c"
 proof -
   assume r: "!!x y. x < y ==> f x < f y"
   assume "a <= f b"
   also assume "b < c" hence "f b < f c" by (rule r)
   finally (le_less_trans) show ?thesis .
 qed
 
 lemma order_less_le_subst2: "(a::'a::order) < b ==> f b <= (c::'c::order) ==>
   (!!x y. x < y ==> f x < f y) ==> f a < c"
 proof -
   assume r: "!!x y. x < y ==> f x < f y"
   assume "a < b" hence "f a < f b" by (rule r)
   also assume "f b <= c"
   finally (less_le_trans) show ?thesis .
 qed
 
 lemma order_less_le_subst1: "(a::'a::order) < f b ==> (b::'b::order) <= c ==>
   (!!x y. x <= y ==> f x <= f y) ==> a < f c"
 proof -
   assume r: "!!x y. x <= y ==> f x <= f y"
   assume "a < f b"
   also assume "b <= c" hence "f b <= f c" by (rule r)
   finally (less_le_trans) show ?thesis .
 qed
 
 lemma order_subst1: "(a::'a::order) <= f b ==> (b::'b::order) <= c ==>
   (!!x y. x <= y ==> f x <= f y) ==> a <= f c"
 proof -
   assume r: "!!x y. x <= y ==> f x <= f y"
   assume "a <= f b"
   also assume "b <= c" hence "f b <= f c" by (rule r)
   finally (order_trans) show ?thesis .
 qed
 
 lemma order_subst2: "(a::'a::order) <= b ==> f b <= (c::'c::order) ==>
   (!!x y. x <= y ==> f x <= f y) ==> f a <= c"
 proof -
   assume r: "!!x y. x <= y ==> f x <= f y"
   assume "a <= b" hence "f a <= f b" by (rule r)
   also assume "f b <= c"
   finally (order_trans) show ?thesis .
 qed
 
 lemma ord_le_eq_subst: "a <= b ==> f b = c ==>
   (!!x y. x <= y ==> f x <= f y) ==> f a <= c"
 proof -
   assume r: "!!x y. x <= y ==> f x <= f y"
   assume "a <= b" hence "f a <= f b" by (rule r)
   also assume "f b = c"
   finally (ord_le_eq_trans) show ?thesis .
 qed
 
 lemma ord_eq_le_subst: "a = f b ==> b <= c ==>
   (!!x y. x <= y ==> f x <= f y) ==> a <= f c"
 proof -
   assume r: "!!x y. x <= y ==> f x <= f y"
   assume "a = f b"
   also assume "b <= c" hence "f b <= f c" by (rule r)
   finally (ord_eq_le_trans) show ?thesis .
 qed
 
 lemma ord_less_eq_subst: "a < b ==> f b = c ==>
   (!!x y. x < y ==> f x < f y) ==> f a < c"
 proof -
   assume r: "!!x y. x < y ==> f x < f y"
   assume "a < b" hence "f a < f b" by (rule r)
   also assume "f b = c"
   finally (ord_less_eq_trans) show ?thesis .
 qed
 
 lemma ord_eq_less_subst: "a = f b ==> b < c ==>
   (!!x y. x < y ==> f x < f y) ==> a < f c"
 proof -
   assume r: "!!x y. x < y ==> f x < f y"
   assume "a = f b"
   also assume "b < c" hence "f b < f c" by (rule r)
   finally (ord_eq_less_trans) show ?thesis .
 qed
 
 text \<open>
   Note that this list of rules is in reverse order of priorities.
 \<close>
 
 lemmas [trans] =
   order_less_subst2
   order_less_subst1
   order_le_less_subst2
   order_le_less_subst1
   order_less_le_subst2
   order_less_le_subst1
   order_subst2
   order_subst1
   ord_le_eq_subst
   ord_eq_le_subst
   ord_less_eq_subst
   ord_eq_less_subst
   forw_subst
   back_subst
   rev_mp
   mp
 
 lemmas (in order) [trans] =
   neq_le_trans
   le_neq_trans
 
 lemmas (in preorder) [trans] =
   less_trans
   less_asym'
   le_less_trans
   less_le_trans
   order_trans
 
 lemmas (in order) [trans] =
   antisym
 
 lemmas (in ord) [trans] =
   ord_le_eq_trans
   ord_eq_le_trans
   ord_less_eq_trans
   ord_eq_less_trans
 
 lemmas [trans] =
   trans
 
 lemmas order_trans_rules =
   order_less_subst2
   order_less_subst1
   order_le_less_subst2
   order_le_less_subst1
   order_less_le_subst2
   order_less_le_subst1
   order_subst2
   order_subst1
   ord_le_eq_subst
   ord_eq_le_subst
   ord_less_eq_subst
   ord_eq_less_subst
   forw_subst
   back_subst
   rev_mp
   mp
   neq_le_trans
   le_neq_trans
   less_trans
   less_asym'
   le_less_trans
   less_le_trans
   order_trans
   antisym
   ord_le_eq_trans
   ord_eq_le_trans
   ord_less_eq_trans
   ord_eq_less_trans
   trans
 
 text \<open>These support proving chains of decreasing inequalities
     a >= b >= c ... in Isar proofs.\<close>
 
 lemma xt1 [no_atp]:
   "a = b \<Longrightarrow> b > c \<Longrightarrow> a > c"
   "a > b \<Longrightarrow> b = c \<Longrightarrow> a > c"
   "a = b \<Longrightarrow> b \<ge> c \<Longrightarrow> a \<ge> c"
   "a \<ge> b \<Longrightarrow> b = c \<Longrightarrow> a \<ge> c"
   "(x::'a::order) \<ge> y \<Longrightarrow> y \<ge> x \<Longrightarrow> x = y"
   "(x::'a::order) \<ge> y \<Longrightarrow> y \<ge> z \<Longrightarrow> x \<ge> z"
   "(x::'a::order) > y \<Longrightarrow> y \<ge> z \<Longrightarrow> x > z"
   "(x::'a::order) \<ge> y \<Longrightarrow> y > z \<Longrightarrow> x > z"
   "(a::'a::order) > b \<Longrightarrow> b > a \<Longrightarrow> P"
   "(x::'a::order) > y \<Longrightarrow> y > z \<Longrightarrow> x > z"
   "(a::'a::order) \<ge> b \<Longrightarrow> a \<noteq> b \<Longrightarrow> a > b"
   "(a::'a::order) \<noteq> b \<Longrightarrow> a \<ge> b \<Longrightarrow> a > b"
   "a = f b \<Longrightarrow> b > c \<Longrightarrow> (\<And>x y. x > y \<Longrightarrow> f x > f y) \<Longrightarrow> a > f c"
   "a > b \<Longrightarrow> f b = c \<Longrightarrow> (\<And>x y. x > y \<Longrightarrow> f x > f y) \<Longrightarrow> f a > c"
   "a = f b \<Longrightarrow> b \<ge> c \<Longrightarrow> (\<And>x y. x \<ge> y \<Longrightarrow> f x \<ge> f y) \<Longrightarrow> a \<ge> f c"
   "a \<ge> b \<Longrightarrow> f b = c \<Longrightarrow> (\<And>x y. x \<ge> y \<Longrightarrow> f x \<ge> f y) \<Longrightarrow> f a \<ge> c"
   by auto
 
 lemma xt2 [no_atp]:
   "(a::'a::order) >= f b ==> b >= c ==> (!!x y. x >= y ==> f x >= f y) ==> a >= f c"
 by (subgoal_tac "f b >= f c", force, force)
 
 lemma xt3 [no_atp]: "(a::'a::order) >= b ==> (f b::'b::order) >= c ==>
     (!!x y. x >= y ==> f x >= f y) ==> f a >= c"
 by (subgoal_tac "f a >= f b", force, force)
 
 lemma xt4 [no_atp]: "(a::'a::order) > f b ==> (b::'b::order) >= c ==>
   (!!x y. x >= y ==> f x >= f y) ==> a > f c"
 by (subgoal_tac "f b >= f c", force, force)
 
 lemma xt5 [no_atp]: "(a::'a::order) > b ==> (f b::'b::order) >= c==>
     (!!x y. x > y ==> f x > f y) ==> f a > c"
 by (subgoal_tac "f a > f b", force, force)
 
 lemma xt6 [no_atp]: "(a::'a::order) >= f b ==> b > c ==>
     (!!x y. x > y ==> f x > f y) ==> a > f c"
 by (subgoal_tac "f b > f c", force, force)
 
 lemma xt7 [no_atp]: "(a::'a::order) >= b ==> (f b::'b::order) > c ==>
     (!!x y. x >= y ==> f x >= f y) ==> f a > c"
 by (subgoal_tac "f a >= f b", force, force)
 
 lemma xt8 [no_atp]: "(a::'a::order) > f b ==> (b::'b::order) > c ==>
     (!!x y. x > y ==> f x > f y) ==> a > f c"
 by (subgoal_tac "f b > f c", force, force)
 
 lemma xt9 [no_atp]: "(a::'a::order) > b ==> (f b::'b::order) > c ==>
     (!!x y. x > y ==> f x > f y) ==> f a > c"
 by (subgoal_tac "f a > f b", force, force)
 
 lemmas xtrans = xt1 xt2 xt3 xt4 xt5 xt6 xt7 xt8 xt9
 
 (*
   Since "a >= b" abbreviates "b <= a", the abbreviation "..." stands
   for the wrong thing in an Isar proof.
 
   The extra transitivity rules can be used as follows:
 
 lemma "(a::'a::order) > z"
 proof -
   have "a >= b" (is "_ >= ?rhs")
     sorry
   also have "?rhs >= c" (is "_ >= ?rhs")
     sorry
   also (xtrans) have "?rhs = d" (is "_ = ?rhs")
     sorry
   also (xtrans) have "?rhs >= e" (is "_ >= ?rhs")
     sorry
   also (xtrans) have "?rhs > f" (is "_ > ?rhs")
     sorry
   also (xtrans) have "?rhs > z"
     sorry
   finally (xtrans) show ?thesis .
 qed
 
   Alternatively, one can use "declare xtrans [trans]" and then
   leave out the "(xtrans)" above.
 *)
 
 
 subsection \<open>Monotonicity\<close>
 
 context order
 begin
 
 definition mono :: "('a \<Rightarrow> 'b::order) \<Rightarrow> bool" where
   "mono f \<longleftrightarrow> (\<forall>x y. x \<le> y \<longrightarrow> f x \<le> f y)"
 
 lemma monoI [intro?]:
   fixes f :: "'a \<Rightarrow> 'b::order"
   shows "(\<And>x y. x \<le> y \<Longrightarrow> f x \<le> f y) \<Longrightarrow> mono f"
   unfolding mono_def by iprover
 
 lemma monoD [dest?]:
   fixes f :: "'a \<Rightarrow> 'b::order"
   shows "mono f \<Longrightarrow> x \<le> y \<Longrightarrow> f x \<le> f y"
   unfolding mono_def by iprover
 
 lemma monoE:
   fixes f :: "'a \<Rightarrow> 'b::order"
   assumes "mono f"
   assumes "x \<le> y"
   obtains "f x \<le> f y"
 proof
   from assms show "f x \<le> f y" by (simp add: mono_def)
 qed
 
 definition antimono :: "('a \<Rightarrow> 'b::order) \<Rightarrow> bool" where
   "antimono f \<longleftrightarrow> (\<forall>x y. x \<le> y \<longrightarrow> f x \<ge> f y)"
 
 lemma antimonoI [intro?]:
   fixes f :: "'a \<Rightarrow> 'b::order"
   shows "(\<And>x y. x \<le> y \<Longrightarrow> f x \<ge> f y) \<Longrightarrow> antimono f"
   unfolding antimono_def by iprover
 
 lemma antimonoD [dest?]:
   fixes f :: "'a \<Rightarrow> 'b::order"
   shows "antimono f \<Longrightarrow> x \<le> y \<Longrightarrow> f x \<ge> f y"
   unfolding antimono_def by iprover
 
 lemma antimonoE:
   fixes f :: "'a \<Rightarrow> 'b::order"
   assumes "antimono f"
   assumes "x \<le> y"
   obtains "f x \<ge> f y"
 proof
   from assms show "f x \<ge> f y" by (simp add: antimono_def)
 qed
 
 definition strict_mono :: "('a \<Rightarrow> 'b::order) \<Rightarrow> bool" where
   "strict_mono f \<longleftrightarrow> (\<forall>x y. x < y \<longrightarrow> f x < f y)"
 
 lemma strict_monoI [intro?]:
   assumes "\<And>x y. x < y \<Longrightarrow> f x < f y"
   shows "strict_mono f"
   using assms unfolding strict_mono_def by auto
 
 lemma strict_monoD [dest?]:
   "strict_mono f \<Longrightarrow> x < y \<Longrightarrow> f x < f y"
   unfolding strict_mono_def by auto
 
 lemma strict_mono_mono [dest?]:
   assumes "strict_mono f"
   shows "mono f"
 proof (rule monoI)
   fix x y
   assume "x \<le> y"
   show "f x \<le> f y"
   proof (cases "x = y")
     case True then show ?thesis by simp
   next
     case False with \<open>x \<le> y\<close> have "x < y" by simp
     with assms strict_monoD have "f x < f y" by auto
     then show ?thesis by simp
   qed
 qed
 
 end
 
 context linorder
 begin
 
 lemma mono_invE:
   fixes f :: "'a \<Rightarrow> 'b::order"
   assumes "mono f"
   assumes "f x < f y"
   obtains "x \<le> y"
 proof
   show "x \<le> y"
   proof (rule ccontr)
     assume "\<not> x \<le> y"
     then have "y \<le> x" by simp
     with \<open>mono f\<close> obtain "f y \<le> f x" by (rule monoE)
     with \<open>f x < f y\<close> show False by simp
   qed
 qed
 
 lemma mono_strict_invE:
   fixes f :: "'a \<Rightarrow> 'b::order"
   assumes "mono f"
   assumes "f x < f y"
   obtains "x < y"
 proof
   show "x < y"
   proof (rule ccontr)
     assume "\<not> x < y"
     then have "y \<le> x" by simp
     with \<open>mono f\<close> obtain "f y \<le> f x" by (rule monoE)
     with \<open>f x < f y\<close> show False by simp
   qed
 qed
 
 lemma strict_mono_eq:
   assumes "strict_mono f"
   shows "f x = f y \<longleftrightarrow> x = y"
 proof
   assume "f x = f y"
   show "x = y" proof (cases x y rule: linorder_cases)
     case less with assms strict_monoD have "f x < f y" by auto
     with \<open>f x = f y\<close> show ?thesis by simp
   next
     case equal then show ?thesis .
   next
     case greater with assms strict_monoD have "f y < f x" by auto
     with \<open>f x = f y\<close> show ?thesis by simp
   qed
 qed simp
 
 lemma strict_mono_less_eq:
   assumes "strict_mono f"
   shows "f x \<le> f y \<longleftrightarrow> x \<le> y"
 proof
   assume "x \<le> y"
   with assms strict_mono_mono monoD show "f x \<le> f y" by auto
 next
   assume "f x \<le> f y"
   show "x \<le> y" proof (rule ccontr)
     assume "\<not> x \<le> y" then have "y < x" by simp
     with assms strict_monoD have "f y < f x" by auto
     with \<open>f x \<le> f y\<close> show False by simp
   qed
 qed
 
 lemma strict_mono_less:
   assumes "strict_mono f"
   shows "f x < f y \<longleftrightarrow> x < y"
   using assms
     by (auto simp add: less_le Orderings.less_le strict_mono_eq strict_mono_less_eq)
 
 end
 
 
 subsection \<open>min and max -- fundamental\<close>
 
 definition (in ord) min :: "'a \<Rightarrow> 'a \<Rightarrow> 'a" where
   "min a b = (if a \<le> b then a else b)"
 
 definition (in ord) max :: "'a \<Rightarrow> 'a \<Rightarrow> 'a" where
   "max a b = (if a \<le> b then b else a)"
 
 lemma min_absorb1: "x \<le> y \<Longrightarrow> min x y = x"
   by (simp add: min_def)
 
 lemma max_absorb2: "x \<le> y \<Longrightarrow> max x y = y"
   by (simp add: max_def)
 
 lemma min_absorb2: "(y::'a::order) \<le> x \<Longrightarrow> min x y = y"
   by (simp add:min_def)
 
 lemma max_absorb1: "(y::'a::order) \<le> x \<Longrightarrow> max x y = x"
   by (simp add: max_def)
 
 lemma max_min_same [simp]:
   fixes x y :: "'a :: linorder"
   shows "max x (min x y) = x" "max (min x y) x = x" "max (min x y) y = y" "max y (min x y) = y"
 by(auto simp add: max_def min_def)
 
 
 subsection \<open>(Unique) top and bottom elements\<close>
 
 class bot =
   fixes bot :: 'a ("\<bottom>")
 
 class order_bot = order + bot +
   assumes bot_least: "\<bottom> \<le> a"
 begin
 
 sublocale bot: ordering_top greater_eq greater bot
   by standard (fact bot_least)
 
 lemma le_bot:
   "a \<le> \<bottom> \<Longrightarrow> a = \<bottom>"
   by (fact bot.extremum_uniqueI)
 
 lemma bot_unique:
   "a \<le> \<bottom> \<longleftrightarrow> a = \<bottom>"
   by (fact bot.extremum_unique)
 
 lemma not_less_bot:
   "\<not> a < \<bottom>"
   by (fact bot.extremum_strict)
 
 lemma bot_less:
   "a \<noteq> \<bottom> \<longleftrightarrow> \<bottom> < a"
   by (fact bot.not_eq_extremum)
 
 lemma max_bot[simp]: "max bot x = x"
 by(simp add: max_def bot_unique)
 
 lemma max_bot2[simp]: "max x bot = x"
 by(simp add: max_def bot_unique)
 
 lemma min_bot[simp]: "min bot x = bot"
 by(simp add: min_def bot_unique)
 
 lemma min_bot2[simp]: "min x bot = bot"
 by(simp add: min_def bot_unique)
 
 end
 
 class top =
   fixes top :: 'a ("\<top>")
 
 class order_top = order + top +
   assumes top_greatest: "a \<le> \<top>"
 begin
 
 sublocale top: ordering_top less_eq less top
   by standard (fact top_greatest)
 
 lemma top_le:
   "\<top> \<le> a \<Longrightarrow> a = \<top>"
   by (fact top.extremum_uniqueI)
 
 lemma top_unique:
   "\<top> \<le> a \<longleftrightarrow> a = \<top>"
   by (fact top.extremum_unique)
 
 lemma not_top_less:
   "\<not> \<top> < a"
   by (fact top.extremum_strict)
 
 lemma less_top:
   "a \<noteq> \<top> \<longleftrightarrow> a < \<top>"
   by (fact top.not_eq_extremum)
 
 lemma max_top[simp]: "max top x = top"
 by(simp add: max_def top_unique)
 
 lemma max_top2[simp]: "max x top = top"
 by(simp add: max_def top_unique)
 
 lemma min_top[simp]: "min top x = x"
 by(simp add: min_def top_unique)
 
 lemma min_top2[simp]: "min x top = x"
 by(simp add: min_def top_unique)
 
 end
 
 
 subsection \<open>Dense orders\<close>
 
 class dense_order = order +
   assumes dense: "x < y \<Longrightarrow> (\<exists>z. x < z \<and> z < y)"
 
 class dense_linorder = linorder + dense_order
 begin
 
 lemma dense_le:
   fixes y z :: 'a
   assumes "\<And>x. x < y \<Longrightarrow> x \<le> z"
   shows "y \<le> z"
 proof (rule ccontr)
   assume "\<not> ?thesis"
   hence "z < y" by simp
   from dense[OF this]
   obtain x where "x < y" and "z < x" by safe
   moreover have "x \<le> z" using assms[OF \<open>x < y\<close>] .
   ultimately show False by auto
 qed
 
 lemma dense_le_bounded:
   fixes x y z :: 'a
   assumes "x < y"
   assumes *: "\<And>w. \<lbrakk> x < w ; w < y \<rbrakk> \<Longrightarrow> w \<le> z"
   shows "y \<le> z"
 proof (rule dense_le)
   fix w assume "w < y"
   from dense[OF \<open>x < y\<close>] obtain u where "x < u" "u < y" by safe
   from linear[of u w]
   show "w \<le> z"
   proof (rule disjE)
     assume "u \<le> w"
     from less_le_trans[OF \<open>x < u\<close> \<open>u \<le> w\<close>] \<open>w < y\<close>
     show "w \<le> z" by (rule *)
   next
     assume "w \<le> u"
     from \<open>w \<le> u\<close> *[OF \<open>x < u\<close> \<open>u < y\<close>]
     show "w \<le> z" by (rule order_trans)
   qed
 qed
 
 lemma dense_ge:
   fixes y z :: 'a
   assumes "\<And>x. z < x \<Longrightarrow> y \<le> x"
   shows "y \<le> z"
 proof (rule ccontr)
   assume "\<not> ?thesis"
   hence "z < y" by simp
   from dense[OF this]
   obtain x where "x < y" and "z < x" by safe
   moreover have "y \<le> x" using assms[OF \<open>z < x\<close>] .
   ultimately show False by auto
 qed
 
 lemma dense_ge_bounded:
   fixes x y z :: 'a
   assumes "z < x"
   assumes *: "\<And>w. \<lbrakk> z < w ; w < x \<rbrakk> \<Longrightarrow> y \<le> w"
   shows "y \<le> z"
 proof (rule dense_ge)
   fix w assume "z < w"
   from dense[OF \<open>z < x\<close>] obtain u where "z < u" "u < x" by safe
   from linear[of u w]
   show "y \<le> w"
   proof (rule disjE)
     assume "w \<le> u"
     from \<open>z < w\<close> le_less_trans[OF \<open>w \<le> u\<close> \<open>u < x\<close>]
     show "y \<le> w" by (rule *)
   next
     assume "u \<le> w"
     from *[OF \<open>z < u\<close> \<open>u < x\<close>] \<open>u \<le> w\<close>
     show "y \<le> w" by (rule order_trans)
   qed
 qed
 
 end
 
 class no_top = order +
   assumes gt_ex: "\<exists>y. x < y"
 
 class no_bot = order +
   assumes lt_ex: "\<exists>y. y < x"
 
 class unbounded_dense_linorder = dense_linorder + no_top + no_bot
 
 
 subsection \<open>Wellorders\<close>
 
 class wellorder = linorder +
   assumes less_induct [case_names less]: "(\<And>x. (\<And>y. y < x \<Longrightarrow> P y) \<Longrightarrow> P x) \<Longrightarrow> P a"
 begin
 
 lemma wellorder_Least_lemma:
   fixes k :: 'a
   assumes "P k"
   shows LeastI: "P (LEAST x. P x)" and Least_le: "(LEAST x. P x) \<le> k"
 proof -
   have "P (LEAST x. P x) \<and> (LEAST x. P x) \<le> k"
   using assms proof (induct k rule: less_induct)
     case (less x) then have "P x" by simp
     show ?case proof (rule classical)
       assume assm: "\<not> (P (LEAST a. P a) \<and> (LEAST a. P a) \<le> x)"
       have "\<And>y. P y \<Longrightarrow> x \<le> y"
       proof (rule classical)
         fix y
         assume "P y" and "\<not> x \<le> y"
         with less have "P (LEAST a. P a)" and "(LEAST a. P a) \<le> y"
           by (auto simp add: not_le)
         with assm have "x < (LEAST a. P a)" and "(LEAST a. P a) \<le> y"
           by auto
         then show "x \<le> y" by auto
       qed
       with \<open>P x\<close> have Least: "(LEAST a. P a) = x"
         by (rule Least_equality)
       with \<open>P x\<close> show ?thesis by simp
     qed
   qed
   then show "P (LEAST x. P x)" and "(LEAST x. P x) \<le> k" by auto
 qed
 
 \<comment> \<open>The following 3 lemmas are due to Brian Huffman\<close>
 lemma LeastI_ex: "\<exists>x. P x \<Longrightarrow> P (Least P)"
   by (erule exE) (erule LeastI)
 
 lemma LeastI2:
   "P a \<Longrightarrow> (\<And>x. P x \<Longrightarrow> Q x) \<Longrightarrow> Q (Least P)"
   by (blast intro: LeastI)
 
 lemma LeastI2_ex:
   "\<exists>a. P a \<Longrightarrow> (\<And>x. P x \<Longrightarrow> Q x) \<Longrightarrow> Q (Least P)"
   by (blast intro: LeastI_ex)
 
 lemma LeastI2_wellorder:
   assumes "P a"
   and "\<And>a. \<lbrakk> P a; \<forall>b. P b \<longrightarrow> a \<le> b \<rbrakk> \<Longrightarrow> Q a"
   shows "Q (Least P)"
 proof (rule LeastI2_order)
   show "P (Least P)" using \<open>P a\<close> by (rule LeastI)
 next
   fix y assume "P y" thus "Least P \<le> y" by (rule Least_le)
 next
   fix x assume "P x" "\<forall>y. P y \<longrightarrow> x \<le> y" thus "Q x" by (rule assms(2))
 qed
 
 lemma LeastI2_wellorder_ex:
   assumes "\<exists>x. P x"
   and "\<And>a. \<lbrakk> P a; \<forall>b. P b \<longrightarrow> a \<le> b \<rbrakk> \<Longrightarrow> Q a"
   shows "Q (Least P)"
 using assms by clarify (blast intro!: LeastI2_wellorder)
 
 lemma not_less_Least: "k < (LEAST x. P x) \<Longrightarrow> \<not> P k"
 apply (simp add: not_le [symmetric])
 apply (erule contrapos_nn)
 apply (erule Least_le)
 done
 
 lemma exists_least_iff: "(\<exists>n. P n) \<longleftrightarrow> (\<exists>n. P n \<and> (\<forall>m < n. \<not> P m))" (is "?lhs \<longleftrightarrow> ?rhs")
 proof
   assume ?rhs thus ?lhs by blast
 next
   assume H: ?lhs then obtain n where n: "P n" by blast
   let ?x = "Least P"
   { fix m assume m: "m < ?x"
     from not_less_Least[OF m] have "\<not> P m" . }
   with LeastI_ex[OF H] show ?rhs by blast
 qed
 
 end
 
 
 subsection \<open>Order on \<^typ>\<open>bool\<close>\<close>
 
 instantiation bool :: "{order_bot, order_top, linorder}"
 begin
 
 definition
   le_bool_def [simp]: "P \<le> Q \<longleftrightarrow> P \<longrightarrow> Q"
 
 definition
   [simp]: "(P::bool) < Q \<longleftrightarrow> \<not> P \<and> Q"
 
 definition
   [simp]: "\<bottom> \<longleftrightarrow> False"
 
 definition
   [simp]: "\<top> \<longleftrightarrow> True"
 
 instance proof
 qed auto
 
 end
 
 lemma le_boolI: "(P \<Longrightarrow> Q) \<Longrightarrow> P \<le> Q"
   by simp
 
 lemma le_boolI': "P \<longrightarrow> Q \<Longrightarrow> P \<le> Q"
   by simp
 
 lemma le_boolE: "P \<le> Q \<Longrightarrow> P \<Longrightarrow> (Q \<Longrightarrow> R) \<Longrightarrow> R"
   by simp
 
 lemma le_boolD: "P \<le> Q \<Longrightarrow> P \<longrightarrow> Q"
   by simp
 
 lemma bot_boolE: "\<bottom> \<Longrightarrow> P"
   by simp
 
 lemma top_boolI: \<top>
   by simp
 
 lemma [code]:
   "False \<le> b \<longleftrightarrow> True"
   "True \<le> b \<longleftrightarrow> b"
   "False < b \<longleftrightarrow> b"
   "True < b \<longleftrightarrow> False"
   by simp_all
 
 
 subsection \<open>Order on \<^typ>\<open>_ \<Rightarrow> _\<close>\<close>
 
 instantiation "fun" :: (type, ord) ord
 begin
 
 definition
   le_fun_def: "f \<le> g \<longleftrightarrow> (\<forall>x. f x \<le> g x)"
 
 definition
   "(f::'a \<Rightarrow> 'b) < g \<longleftrightarrow> f \<le> g \<and> \<not> (g \<le> f)"
 
 instance ..
 
 end
 
 instance "fun" :: (type, preorder) preorder proof
 qed (auto simp add: le_fun_def less_fun_def
   intro: order_trans antisym)
 
 instance "fun" :: (type, order) order proof
 qed (auto simp add: le_fun_def intro: antisym)
 
 instantiation "fun" :: (type, bot) bot
 begin
 
 definition
   "\<bottom> = (\<lambda>x. \<bottom>)"
 
 instance ..
 
 end
 
 instantiation "fun" :: (type, order_bot) order_bot
 begin
 
 lemma bot_apply [simp, code]:
   "\<bottom> x = \<bottom>"
   by (simp add: bot_fun_def)
 
 instance proof
 qed (simp add: le_fun_def)
 
 end
 
 instantiation "fun" :: (type, top) top
 begin
 
 definition
   [no_atp]: "\<top> = (\<lambda>x. \<top>)"
 
 instance ..
 
 end
 
 instantiation "fun" :: (type, order_top) order_top
 begin
 
 lemma top_apply [simp, code]:
   "\<top> x = \<top>"
   by (simp add: top_fun_def)
 
 instance proof
 qed (simp add: le_fun_def)
 
 end
 
 lemma le_funI: "(\<And>x. f x \<le> g x) \<Longrightarrow> f \<le> g"
   unfolding le_fun_def by simp
 
 lemma le_funE: "f \<le> g \<Longrightarrow> (f x \<le> g x \<Longrightarrow> P) \<Longrightarrow> P"
   unfolding le_fun_def by simp
 
 lemma le_funD: "f \<le> g \<Longrightarrow> f x \<le> g x"
   by (rule le_funE)
 
 lemma mono_compose: "mono Q \<Longrightarrow> mono (\<lambda>i x. Q i (f x))"
   unfolding mono_def le_fun_def by auto
 
 
 subsection \<open>Order on unary and binary predicates\<close>
 
 lemma predicate1I:
   assumes PQ: "\<And>x. P x \<Longrightarrow> Q x"
   shows "P \<le> Q"
   apply (rule le_funI)
   apply (rule le_boolI)
   apply (rule PQ)
   apply assumption
   done
 
 lemma predicate1D:
   "P \<le> Q \<Longrightarrow> P x \<Longrightarrow> Q x"
   apply (erule le_funE)
   apply (erule le_boolE)
   apply assumption+
   done
 
 lemma rev_predicate1D:
   "P x \<Longrightarrow> P \<le> Q \<Longrightarrow> Q x"
   by (rule predicate1D)
 
 lemma predicate2I:
   assumes PQ: "\<And>x y. P x y \<Longrightarrow> Q x y"
   shows "P \<le> Q"
   apply (rule le_funI)+
   apply (rule le_boolI)
   apply (rule PQ)
   apply assumption
   done
 
 lemma predicate2D:
   "P \<le> Q \<Longrightarrow> P x y \<Longrightarrow> Q x y"
   apply (erule le_funE)+
   apply (erule le_boolE)
   apply assumption+
   done
 
 lemma rev_predicate2D:
   "P x y \<Longrightarrow> P \<le> Q \<Longrightarrow> Q x y"
   by (rule predicate2D)
 
 lemma bot1E [no_atp]: "\<bottom> x \<Longrightarrow> P"
   by (simp add: bot_fun_def)
 
 lemma bot2E: "\<bottom> x y \<Longrightarrow> P"
   by (simp add: bot_fun_def)
 
 lemma top1I: "\<top> x"
   by (simp add: top_fun_def)
 
 lemma top2I: "\<top> x y"
   by (simp add: top_fun_def)
 
 
 subsection \<open>Name duplicates\<close>
 
 lemmas order_eq_refl = preorder_class.eq_refl
 lemmas order_less_irrefl = preorder_class.less_irrefl
 lemmas order_less_imp_le = preorder_class.less_imp_le
 lemmas order_less_not_sym = preorder_class.less_not_sym
 lemmas order_less_asym = preorder_class.less_asym
 lemmas order_less_trans = preorder_class.less_trans
 lemmas order_le_less_trans = preorder_class.le_less_trans
 lemmas order_less_le_trans = preorder_class.less_le_trans
 lemmas order_less_imp_not_less = preorder_class.less_imp_not_less
 lemmas order_less_imp_triv = preorder_class.less_imp_triv
 lemmas order_less_asym' = preorder_class.less_asym'
 
 lemmas order_less_le = order_class.less_le
 lemmas order_le_less = order_class.le_less
 lemmas order_le_imp_less_or_eq = order_class.le_imp_less_or_eq
 lemmas order_less_imp_not_eq = order_class.less_imp_not_eq
 lemmas order_less_imp_not_eq2 = order_class.less_imp_not_eq2
 lemmas order_neq_le_trans = order_class.neq_le_trans
 lemmas order_le_neq_trans = order_class.le_neq_trans
 lemmas order_antisym = order_class.antisym
 lemmas order_eq_iff = order_class.eq_iff
 lemmas order_antisym_conv = order_class.antisym_conv
 
 lemmas linorder_linear = linorder_class.linear
 lemmas linorder_less_linear = linorder_class.less_linear
 lemmas linorder_le_less_linear = linorder_class.le_less_linear
 lemmas linorder_le_cases = linorder_class.le_cases
 lemmas linorder_not_less = linorder_class.not_less
 lemmas linorder_not_le = linorder_class.not_le
 lemmas linorder_neq_iff = linorder_class.neq_iff
 lemmas linorder_neqE = linorder_class.neqE
 
 end