diff --git a/src/ZF/Constructible/AC_in_L.thy b/src/ZF/Constructible/AC_in_L.thy
--- a/src/ZF/Constructible/AC_in_L.thy
+++ b/src/ZF/Constructible/AC_in_L.thy
@@ -1,479 +1,479 @@
 (*  Title:      ZF/Constructible/AC_in_L.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>The Axiom of Choice Holds in L!\<close>
 
 theory AC_in_L imports Formula Separation begin
 
 subsection\<open>Extending a Wellordering over a List -- Lexicographic Power\<close>
 
 text\<open>This could be moved into a library.\<close>
 
 consts
   rlist   :: "[i,i]=>i"
 
 inductive
   domains "rlist(A,r)" \<subseteq> "list(A) * list(A)"
   intros
     shorterI:
       "[| length(l') < length(l); l' \<in> list(A); l \<in> list(A) |]
        ==> <l', l> \<in> rlist(A,r)"
 
     sameI:
       "[| <l',l> \<in> rlist(A,r); a \<in> A |]
        ==> <Cons(a,l'), Cons(a,l)> \<in> rlist(A,r)"
 
     diffI:
       "[| length(l') = length(l); <a',a> \<in> r;
           l' \<in> list(A); l \<in> list(A); a' \<in> A; a \<in> A |]
        ==> <Cons(a',l'), Cons(a,l)> \<in> rlist(A,r)"
   type_intros list.intros
 
 
 subsubsection\<open>Type checking\<close>
 
 lemmas rlist_type = rlist.dom_subset
 
 lemmas field_rlist = rlist_type [THEN field_rel_subset]
 
 subsubsection\<open>Linearity\<close>
 
 lemma rlist_Nil_Cons [intro]:
     "[|a \<in> A; l \<in> list(A)|] ==> <[], Cons(a,l)> \<in> rlist(A, r)"
 by (simp add: shorterI)
 
 lemma linear_rlist:
   assumes r: "linear(A,r)" shows "linear(list(A),rlist(A,r))"
 proof -
   { fix xs ys
     have "xs \<in> list(A) \<Longrightarrow> ys \<in> list(A) \<Longrightarrow> \<langle>xs,ys\<rangle> \<in> rlist(A,r) \<or> xs = ys \<or> \<langle>ys,xs\<rangle> \<in> rlist(A, r) "
     proof (induct xs arbitrary: ys rule: list.induct)
       case Nil 
       thus ?case by (induct ys rule: list.induct) (auto simp add: shorterI)
     next
       case (Cons x xs)
       { fix y ys
         assume "y \<in> A" and "ys \<in> list(A)"
         with Cons
         have "\<langle>Cons(x,xs),Cons(y,ys)\<rangle> \<in> rlist(A,r) \<or> x=y & xs = ys \<or> \<langle>Cons(y,ys), Cons(x,xs)\<rangle> \<in> rlist(A,r)" 
           apply (rule_tac i = "length(xs)" and j = "length(ys)" in Ord_linear_lt)
           apply (simp_all add: shorterI)
           apply (rule linearE [OF r, of x y]) 
           apply (auto simp add: diffI intro: sameI) 
           done
       }
       note yConsCase = this
       show ?case using \<open>ys \<in> list(A)\<close>
         by (cases rule: list.cases) (simp_all add: Cons rlist_Nil_Cons yConsCase) 
     qed
   }
   thus ?thesis by (simp add: linear_def) 
 qed
 
 
 subsubsection\<open>Well-foundedness\<close>
 
 text\<open>Nothing preceeds Nil in this ordering.\<close>
 inductive_cases rlist_NilE: " <l,[]> \<in> rlist(A,r)"
 
 inductive_cases rlist_ConsE: " <l', Cons(x,l)> \<in> rlist(A,r)"
 
 lemma not_rlist_Nil [simp]: " <l,[]> \<notin> rlist(A,r)"
 by (blast intro: elim: rlist_NilE)
 
 lemma rlist_imp_length_le: "<l',l> \<in> rlist(A,r) ==> length(l') \<le> length(l)"
 apply (erule rlist.induct)
 apply (simp_all add: leI)
 done
 
 lemma wf_on_rlist_n:
   "[| n \<in> nat; wf[A](r) |] ==> wf[{l \<in> list(A). length(l) = n}](rlist(A,r))"
 apply (induct_tac n)
  apply (rule wf_onI2, simp)
 apply (rule wf_onI2, clarify)
 apply (erule_tac a=y in list.cases, clarify)
  apply (simp (no_asm_use))
 apply clarify
 apply (simp (no_asm_use))
 apply (subgoal_tac "\<forall>l2 \<in> list(A). length(l2) = x \<longrightarrow> Cons(a,l2) \<in> B", blast)
 apply (erule_tac a=a in wf_on_induct, assumption)
 apply (rule ballI)
 apply (rule impI)
 apply (erule_tac a=l2 in wf_on_induct, blast, clarify)
 apply (rename_tac a' l2 l')
 apply (drule_tac x="Cons(a',l')" in bspec, typecheck)
 apply simp
 apply (erule mp, clarify)
 apply (erule rlist_ConsE, auto)
 done
 
 lemma list_eq_UN_length: "list(A) = (\<Union>n\<in>nat. {l \<in> list(A). length(l) = n})"
 by (blast intro: length_type)
 
 
 lemma wf_on_rlist: "wf[A](r) ==> wf[list(A)](rlist(A,r))"
 apply (subst list_eq_UN_length)
 apply (rule wf_on_Union)
   apply (rule wf_imp_wf_on [OF wf_Memrel [of nat]])
  apply (simp add: wf_on_rlist_n)
 apply (frule rlist_type [THEN subsetD])
 apply (simp add: length_type)
 apply (drule rlist_imp_length_le)
 apply (erule leE)
 apply (simp_all add: lt_def)
 done
 
 
 lemma wf_rlist: "wf(r) ==> wf(rlist(field(r),r))"
 apply (simp add: wf_iff_wf_on_field)
 apply (rule wf_on_subset_A [OF _ field_rlist])
 apply (blast intro: wf_on_rlist)
 done
 
 lemma well_ord_rlist:
      "well_ord(A,r) ==> well_ord(list(A), rlist(A,r))"
 apply (rule well_ordI)
 apply (simp add: well_ord_def wf_on_rlist)
 apply (simp add: well_ord_def tot_ord_def linear_rlist)
 done
 
 
 subsection\<open>An Injection from Formulas into the Natural Numbers\<close>
 
 text\<open>There is a well-known bijection between \<^term>\<open>nat*nat\<close> and \<^term>\<open>nat\<close> given by the expression f(m,n) = triangle(m+n) + m, where triangle(k)
 enumerates the triangular numbers and can be defined by triangle(0)=0,
 triangle(succ(k)) = succ(k + triangle(k)).  Some small amount of effort is
 needed to show that f is a bijection.  We already know that such a bijection exists by the theorem \<open>well_ord_InfCard_square_eq\<close>:
 @{thm[display] well_ord_InfCard_square_eq[no_vars]}
 
 However, this result merely states that there is a bijection between the two
 sets.  It provides no means of naming a specific bijection.  Therefore, we
 conduct the proofs under the assumption that a bijection exists.  The simplest
 way to organize this is to use a locale.\<close>
 
 text\<open>Locale for any arbitrary injection between \<^term>\<open>nat*nat\<close>
       and \<^term>\<open>nat\<close>\<close>
 locale Nat_Times_Nat =
   fixes fn
   assumes fn_inj: "fn \<in> inj(nat*nat, nat)"
 
 
 consts   enum :: "[i,i]=>i"
 primrec
   "enum(f, Member(x,y)) = f ` <0, f ` <x,y>>"
   "enum(f, Equal(x,y)) = f ` <1, f ` <x,y>>"
   "enum(f, Nand(p,q)) = f ` <2, f ` <enum(f,p), enum(f,q)>>"
   "enum(f, Forall(p)) = f ` <succ(2), enum(f,p)>"
 
 lemma (in Nat_Times_Nat) fn_type [TC,simp]:
     "[|x \<in> nat; y \<in> nat|] ==> fn`<x,y> \<in> nat"
 by (blast intro: inj_is_fun [OF fn_inj] apply_funtype)
 
 lemma (in Nat_Times_Nat) fn_iff:
     "[|x \<in> nat; y \<in> nat; u \<in> nat; v \<in> nat|]
      ==> (fn`<x,y> = fn`<u,v>) \<longleftrightarrow> (x=u & y=v)"
 by (blast dest: inj_apply_equality [OF fn_inj])
 
 lemma (in Nat_Times_Nat) enum_type [TC,simp]:
     "p \<in> formula ==> enum(fn,p) \<in> nat"
 by (induct_tac p, simp_all)
 
 lemma (in Nat_Times_Nat) enum_inject [rule_format]:
     "p \<in> formula ==> \<forall>q\<in>formula. enum(fn,p) = enum(fn,q) \<longrightarrow> p=q"
 apply (induct_tac p, simp_all)
    apply (rule ballI)
    apply (erule formula.cases)
    apply (simp_all add: fn_iff)
   apply (rule ballI)
   apply (erule formula.cases)
   apply (simp_all add: fn_iff)
  apply (rule ballI)
  apply (erule_tac a=qa in formula.cases)
  apply (simp_all add: fn_iff)
  apply blast
 apply (rule ballI)
 apply (erule_tac a=q in formula.cases)
 apply (simp_all add: fn_iff, blast)
 done
 
 lemma (in Nat_Times_Nat) inj_formula_nat:
     "(\<lambda>p \<in> formula. enum(fn,p)) \<in> inj(formula, nat)"
 apply (simp add: inj_def lam_type)
 apply (blast intro: enum_inject)
 done
 
 lemma (in Nat_Times_Nat) well_ord_formula:
     "well_ord(formula, measure(formula, enum(fn)))"
 apply (rule well_ord_measure, simp)
 apply (blast intro: enum_inject)
 done
 
 lemmas nat_times_nat_lepoll_nat =
     InfCard_nat [THEN InfCard_square_eqpoll, THEN eqpoll_imp_lepoll]
 
 
 text\<open>Not needed--but interesting?\<close>
 theorem formula_lepoll_nat: "formula \<lesssim> nat"
 apply (insert nat_times_nat_lepoll_nat)
 apply (unfold lepoll_def)
 apply (blast intro: Nat_Times_Nat.inj_formula_nat Nat_Times_Nat.intro)
 done
 
 
 subsection\<open>Defining the Wellordering on \<^term>\<open>DPow(A)\<close>\<close>
 
 text\<open>The objective is to build a wellordering on \<^term>\<open>DPow(A)\<close> from a
 given one on \<^term>\<open>A\<close>.  We first introduce wellorderings for environments,
 which are lists built over \<^term>\<open>A\<close>.  We combine it with the enumeration of
 formulas.  The order type of the resulting wellordering gives us a map from
 (environment, formula) pairs into the ordinals.  For each member of \<^term>\<open>DPow(A)\<close>, we take the minimum such ordinal.\<close>
 
 definition
   env_form_r :: "[i,i,i]=>i" where
     \<comment> \<open>wellordering on (environment, formula) pairs\<close>
    "env_form_r(f,r,A) ==
       rmult(list(A), rlist(A, r),
             formula, measure(formula, enum(f)))"
 
 definition
   env_form_map :: "[i,i,i,i]=>i" where
     \<comment> \<open>map from (environment, formula) pairs to ordinals\<close>
    "env_form_map(f,r,A,z)
       == ordermap(list(A) * formula, env_form_r(f,r,A)) ` z"
 
 definition
   DPow_ord :: "[i,i,i,i,i]=>o" where
     \<comment> \<open>predicate that holds if \<^term>\<open>k\<close> is a valid index for \<^term>\<open>X\<close>\<close>
    "DPow_ord(f,r,A,X,k) ==
            \<exists>env \<in> list(A). \<exists>p \<in> formula.
              arity(p) \<le> succ(length(env)) &
              X = {x\<in>A. sats(A, p, Cons(x,env))} &
              env_form_map(f,r,A,<env,p>) = k"
 
 definition
   DPow_least :: "[i,i,i,i]=>i" where
     \<comment> \<open>function yielding the smallest index for \<^term>\<open>X\<close>\<close>
    "DPow_least(f,r,A,X) == \<mu> k. DPow_ord(f,r,A,X,k)"
 
 definition
   DPow_r :: "[i,i,i]=>i" where
     \<comment> \<open>a wellordering on \<^term>\<open>DPow(A)\<close>\<close>
    "DPow_r(f,r,A) == measure(DPow(A), DPow_least(f,r,A))"
 
 
 lemma (in Nat_Times_Nat) well_ord_env_form_r:
     "well_ord(A,r)
      ==> well_ord(list(A) * formula, env_form_r(fn,r,A))"
 by (simp add: env_form_r_def well_ord_rmult well_ord_rlist well_ord_formula)
 
 lemma (in Nat_Times_Nat) Ord_env_form_map:
     "[|well_ord(A,r); z \<in> list(A) * formula|]
      ==> Ord(env_form_map(fn,r,A,z))"
 by (simp add: env_form_map_def Ord_ordermap well_ord_env_form_r)
 
 lemma DPow_imp_ex_DPow_ord:
     "X \<in> DPow(A) ==> \<exists>k. DPow_ord(fn,r,A,X,k)"
 apply (simp add: DPow_ord_def)
 apply (blast dest!: DPowD)
 done
 
 lemma (in Nat_Times_Nat) DPow_ord_imp_Ord:
      "[|DPow_ord(fn,r,A,X,k); well_ord(A,r)|] ==> Ord(k)"
 apply (simp add: DPow_ord_def, clarify)
 apply (simp add: Ord_env_form_map)
 done
 
 lemma (in Nat_Times_Nat) DPow_imp_DPow_least:
     "[|X \<in> DPow(A); well_ord(A,r)|]
      ==> DPow_ord(fn, r, A, X, DPow_least(fn,r,A,X))"
 apply (simp add: DPow_least_def)
 apply (blast dest: DPow_imp_ex_DPow_ord intro: DPow_ord_imp_Ord LeastI)
 done
 
 lemma (in Nat_Times_Nat) env_form_map_inject:
     "[|env_form_map(fn,r,A,u) = env_form_map(fn,r,A,v); well_ord(A,r);
        u \<in> list(A) * formula;  v \<in> list(A) * formula|]
      ==> u=v"
 apply (simp add: env_form_map_def)
 apply (rule inj_apply_equality [OF bij_is_inj, OF ordermap_bij,
                                 OF well_ord_env_form_r], assumption+)
 done
 
 lemma (in Nat_Times_Nat) DPow_ord_unique:
     "[|DPow_ord(fn,r,A,X,k); DPow_ord(fn,r,A,Y,k); well_ord(A,r)|]
      ==> X=Y"
 apply (simp add: DPow_ord_def, clarify)
 apply (drule env_form_map_inject, auto)
 done
 
 lemma (in Nat_Times_Nat) well_ord_DPow_r:
     "well_ord(A,r) ==> well_ord(DPow(A), DPow_r(fn,r,A))"
 apply (simp add: DPow_r_def)
 apply (rule well_ord_measure)
- apply (simp add: DPow_least_def Ord_Least)
+ apply (simp add: DPow_least_def)
 apply (drule DPow_imp_DPow_least, assumption)+
 apply simp
 apply (blast intro: DPow_ord_unique)
 done
 
 lemma (in Nat_Times_Nat) DPow_r_type:
     "DPow_r(fn,r,A) \<subseteq> DPow(A) * DPow(A)"
 by (simp add: DPow_r_def measure_def, blast)
 
 
 subsection\<open>Limit Construction for Well-Orderings\<close>
 
 text\<open>Now we work towards the transfinite definition of wellorderings for
 \<^term>\<open>Lset(i)\<close>.  We assume as an inductive hypothesis that there is a family
 of wellorderings for smaller ordinals.\<close>
 
 definition
   rlimit :: "[i,i=>i]=>i" where
   \<comment> \<open>Expresses the wellordering at limit ordinals.  The conditional
       lets us remove the premise \<^term>\<open>Limit(i)\<close> from some theorems.\<close>
     "rlimit(i,r) ==
        if Limit(i) then 
          {z: Lset(i) * Lset(i).
           \<exists>x' x. z = <x',x> &
                  (lrank(x') < lrank(x) |
                   (lrank(x') = lrank(x) & <x',x> \<in> r(succ(lrank(x)))))}
        else 0"
 
 definition
   Lset_new :: "i=>i" where
   \<comment> \<open>This constant denotes the set of elements introduced at level
       \<^term>\<open>succ(i)\<close>\<close>
     "Lset_new(i) == {x \<in> Lset(succ(i)). lrank(x) = i}"
 
 lemma Limit_Lset_eq2:
     "Limit(i) ==> Lset(i) = (\<Union>j\<in>i. Lset_new(j))"
 apply (simp add: Limit_Lset_eq)
 apply (rule equalityI)
  apply safe
  apply (subgoal_tac "Ord(y)")
   prefer 2 apply (blast intro: Ord_in_Ord Limit_is_Ord)
  apply (simp_all add: Limit_is_Ord Lset_iff_lrank_lt Lset_new_def
                       Ord_mem_iff_lt)
  apply (blast intro: lt_trans)
 apply (rule_tac x = "succ(lrank(x))" in bexI)
- apply (simp add: Lset_succ_lrank_iff)
+ apply (simp)
 apply (blast intro: Limit_has_succ ltD)
 done
 
 lemma wf_on_Lset:
     "wf[Lset(succ(j))](r(succ(j))) ==> wf[Lset_new(j)](rlimit(i,r))"
 apply (simp add: wf_on_def Lset_new_def)
 apply (erule wf_subset)
 apply (simp add: rlimit_def, force)
 done
 
 lemma wf_on_rlimit:
     "(\<forall>j<i. wf[Lset(j)](r(j))) ==> wf[Lset(i)](rlimit(i,r))"
 apply (case_tac "Limit(i)") 
  prefer 2
  apply (simp add: rlimit_def wf_on_any_0)
 apply (simp add: Limit_Lset_eq2)
 apply (rule wf_on_Union)
   apply (rule wf_imp_wf_on [OF wf_Memrel [of i]])
  apply (blast intro: wf_on_Lset Limit_has_succ Limit_is_Ord ltI)
 apply (force simp add: rlimit_def Limit_is_Ord Lset_iff_lrank_lt Lset_new_def
                        Ord_mem_iff_lt)
 done
 
 lemma linear_rlimit:
     "[|Limit(i); \<forall>j<i. linear(Lset(j), r(j)) |]
      ==> linear(Lset(i), rlimit(i,r))"
 apply (frule Limit_is_Ord)
 apply (simp add: Limit_Lset_eq2 Lset_new_def)
 apply (simp add: linear_def rlimit_def Ball_def lt_Ord Lset_iff_lrank_lt)
 apply (simp add: ltI, clarify)
 apply (rename_tac u v)
 apply (rule_tac i="lrank(u)" and j="lrank(v)" in Ord_linear_lt, simp_all) 
 apply (drule_tac x="succ(lrank(u) \<union> lrank(v))" in ospec)
  apply (simp add: ltI)
 apply (drule_tac x=u in spec, simp)
 apply (drule_tac x=v in spec, simp)
 done
 
 lemma well_ord_rlimit:
     "[|Limit(i); \<forall>j<i. well_ord(Lset(j), r(j)) |]
      ==> well_ord(Lset(i), rlimit(i,r))"
 by (blast intro: well_ordI wf_on_rlimit well_ord_is_wf
                            linear_rlimit well_ord_is_linear)
 
 lemma rlimit_cong:
      "(!!j. j<i ==> r'(j) = r(j)) ==> rlimit(i,r) = rlimit(i,r')"
 apply (simp add: rlimit_def, clarify) 
 apply (rule refl iff_refl Collect_cong ex_cong conj_cong)+
 apply (simp add: Limit_is_Ord Lset_lrank_lt)
 done
 
 
 subsection\<open>Transfinite Definition of the Wellordering on \<^term>\<open>L\<close>\<close>
 
 definition
   L_r :: "[i, i] => i" where
   "L_r(f) == %i.
       transrec3(i, 0, \<lambda>x r. DPow_r(f, r, Lset(x)), 
                 \<lambda>x r. rlimit(x, \<lambda>y. r`y))"
 
 subsubsection\<open>The Corresponding Recursion Equations\<close>
 lemma [simp]: "L_r(f,0) = 0"
 by (simp add: L_r_def)
 
 lemma [simp]: "L_r(f, succ(i)) = DPow_r(f, L_r(f,i), Lset(i))"
 by (simp add: L_r_def)
 
 text\<open>The limit case is non-trivial because of the distinction between
 object-level and meta-level abstraction.\<close>
 lemma [simp]: "Limit(i) ==> L_r(f,i) = rlimit(i, L_r(f))"
 by (simp cong: rlimit_cong add: transrec3_Limit L_r_def ltD)
 
 lemma (in Nat_Times_Nat) L_r_type:
     "Ord(i) ==> L_r(fn,i) \<subseteq> Lset(i) * Lset(i)"
 apply (induct i rule: trans_induct3)
   apply (simp_all add: Lset_succ DPow_r_type well_ord_DPow_r rlimit_def
                        Transset_subset_DPow [OF Transset_Lset], blast)
 done
 
 lemma (in Nat_Times_Nat) well_ord_L_r:
     "Ord(i) ==> well_ord(Lset(i), L_r(fn,i))"
 apply (induct i rule: trans_induct3)
 apply (simp_all add: well_ord0 Lset_succ L_r_type well_ord_DPow_r
                      well_ord_rlimit ltD)
 done
 
 lemma well_ord_L_r:
     "Ord(i) ==> \<exists>r. well_ord(Lset(i), r)"
 apply (insert nat_times_nat_lepoll_nat)
 apply (unfold lepoll_def)
 apply (blast intro: Nat_Times_Nat.well_ord_L_r Nat_Times_Nat.intro)
 done
 
 
 text\<open>Every constructible set is well-ordered! Therefore the Wellordering Theorem and
       the Axiom of Choice hold in \<^term>\<open>L\<close>!!\<close>
 theorem L_implies_AC: assumes x: "L(x)" shows "\<exists>r. well_ord(x,r)"
   using Transset_Lset x
 apply (simp add: Transset_def L_def)
 apply (blast dest!: well_ord_L_r intro: well_ord_subset)
 done
 
 interpretation L?: M_basic L by (rule M_basic_L)
 
 theorem "\<forall>x[L]. \<exists>r. wellordered(L,x,r)"
 proof 
   fix x
   assume "L(x)"
   then obtain r where "well_ord(x,r)" 
     by (blast dest: L_implies_AC) 
   thus "\<exists>r. wellordered(L,x,r)" 
     by (blast intro: well_ord_imp_relativized)
 qed
 
 text\<open>In order to prove \<^term>\<open> \<exists>r[L]. wellordered(L,x,r)\<close>, it's necessary to know 
 that \<^term>\<open>r\<close> is actually constructible. It follows from the assumption ``\<^term>\<open>V\<close> equals \<^term>\<open>L''\<close>, 
 but this reasoning doesn't appear to work in Isabelle.\<close>
 
 end
diff --git a/src/ZF/Constructible/DPow_absolute.thy b/src/ZF/Constructible/DPow_absolute.thy
--- a/src/ZF/Constructible/DPow_absolute.thy
+++ b/src/ZF/Constructible/DPow_absolute.thy
@@ -1,628 +1,627 @@
 (*  Title:      ZF/Constructible/DPow_absolute.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Absoluteness for the Definable Powerset Function\<close>
 
 
 theory DPow_absolute imports Satisfies_absolute begin
 
 
 subsection\<open>Preliminary Internalizations\<close>
 
 subsubsection\<open>The Operator \<^term>\<open>is_formula_rec\<close>\<close>
 
 text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0.  It is buried
    within 11 quantifiers!!\<close>
 
 (* is_formula_rec :: "[i=>o, [i,i,i]=>o, i, i] => o"
    "is_formula_rec(M,MH,p,z)  ==
       \<exists>dp[M]. \<exists>i[M]. \<exists>f[M]. finite_ordinal(M,dp) & is_depth(M,p,dp) & 
        2       1      0
              successor(M,dp,i) & fun_apply(M,f,p,z) & is_transrec(M,MH,i,f)"
 *)
 
 definition
   formula_rec_fm :: "[i, i, i]=>i" where
  "formula_rec_fm(mh,p,z) == 
     Exists(Exists(Exists(
       And(finite_ordinal_fm(2),
        And(depth_fm(p#+3,2),
         And(succ_fm(2,1), 
           And(fun_apply_fm(0,p#+3,z#+3), is_transrec_fm(mh,1,0))))))))"
 
 lemma is_formula_rec_type [TC]:
      "[| p \<in> formula; x \<in> nat; z \<in> nat |] 
       ==> formula_rec_fm(p,x,z) \<in> formula"
 by (simp add: formula_rec_fm_def) 
 
 lemma sats_formula_rec_fm:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A; a8\<in>A; a9\<in>A; a10\<in>A|]
         ==> MH(a2, a1, a0) \<longleftrightarrow> 
             sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
                           Cons(a4,Cons(a5,Cons(a6,Cons(a7,
                                   Cons(a8,Cons(a9,Cons(a10,env))))))))))))"
   shows 
       "[|x \<in> nat; z \<in> nat; env \<in> list(A)|]
        ==> sats(A, formula_rec_fm(p,x,z), env) \<longleftrightarrow> 
            is_formula_rec(##A, MH, nth(x,env), nth(z,env))"
 by (simp add: formula_rec_fm_def sats_is_transrec_fm is_formula_rec_def 
               MH_iff_sats [THEN iff_sym])
 
 lemma formula_rec_iff_sats:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A; a8\<in>A; a9\<in>A; a10\<in>A|]
         ==> MH(a2, a1, a0) \<longleftrightarrow> 
             sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
                           Cons(a4,Cons(a5,Cons(a6,Cons(a7,
                                   Cons(a8,Cons(a9,Cons(a10,env))))))))))))"
   shows
   "[|nth(i,env) = x; nth(k,env) = z; 
       i \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> is_formula_rec(##A, MH, x, z) \<longleftrightarrow> sats(A, formula_rec_fm(p,i,k), env)" 
 by (simp add: sats_formula_rec_fm [OF MH_iff_sats])
 
 theorem formula_rec_reflection:
   assumes MH_reflection:
     "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
                      \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
   shows "REFLECTS[\<lambda>x. is_formula_rec(L, MH(L,x), f(x), h(x)), 
                \<lambda>i x. is_formula_rec(##Lset(i), MH(##Lset(i),x), f(x), h(x))]"
 apply (simp (no_asm_use) only: is_formula_rec_def)
 apply (intro FOL_reflections function_reflections fun_plus_reflections
              depth_reflection is_transrec_reflection MH_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_satisfies\<close>\<close>
 
 (* is_satisfies(M,A,p,z) == is_formula_rec (M, satisfies_MH(M,A), p, z) *)
 definition
   satisfies_fm :: "[i,i,i]=>i" where
     "satisfies_fm(x) == formula_rec_fm (satisfies_MH_fm(x#+5#+6, 2, 1, 0))"
 
 lemma is_satisfies_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> satisfies_fm(x,y,z) \<in> formula"
 by (simp add: satisfies_fm_def)
 
 lemma sats_satisfies_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, satisfies_fm(x,y,z), env) \<longleftrightarrow>
         is_satisfies(##A, nth(x,env), nth(y,env), nth(z,env))"
-by (simp add: satisfies_fm_def is_satisfies_def sats_satisfies_MH_fm
-              sats_formula_rec_fm)
+by (simp add: satisfies_fm_def is_satisfies_def sats_formula_rec_fm)
 
 lemma satisfies_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_satisfies(##A, x, y, z) \<longleftrightarrow> sats(A, satisfies_fm(i,j,k), env)"
-by (simp add: sats_satisfies_fm)
+by (simp)
 
 theorem satisfies_reflection:
      "REFLECTS[\<lambda>x. is_satisfies(L,f(x),g(x),h(x)),
                \<lambda>i x. is_satisfies(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_satisfies_def)
 apply (intro formula_rec_reflection satisfies_MH_reflection)
 done
 
 
 subsection \<open>Relativization of the Operator \<^term>\<open>DPow'\<close>\<close>
 
 lemma DPow'_eq: 
   "DPow'(A) = {z . ep \<in> list(A) * formula, 
                     \<exists>env \<in> list(A). \<exists>p \<in> formula. 
                        ep = <env,p> & z = {x\<in>A. sats(A, p, Cons(x,env))}}"
 by (simp add: DPow'_def, blast) 
 
 
 text\<open>Relativize the use of \<^term>\<open>sats\<close> within \<^term>\<open>DPow'\<close>
 (the comprehension).\<close>
 definition
   is_DPow_sats :: "[i=>o,i,i,i,i] => o" where
    "is_DPow_sats(M,A,env,p,x) ==
       \<forall>n1[M]. \<forall>e[M]. \<forall>sp[M]. 
              is_satisfies(M,A,p,sp) \<longrightarrow> is_Cons(M,x,env,e) \<longrightarrow> 
              fun_apply(M, sp, e, n1) \<longrightarrow> number1(M, n1)"
 
 lemma (in M_satisfies) DPow_sats_abs:
     "[| M(A); env \<in> list(A); p \<in> formula; M(x) |]
     ==> is_DPow_sats(M,A,env,p,x) \<longleftrightarrow> sats(A, p, Cons(x,env))"
 apply (subgoal_tac "M(env)") 
  apply (simp add: is_DPow_sats_def satisfies_closed satisfies_abs) 
 apply (blast dest: transM) 
 done
 
 lemma (in M_satisfies) Collect_DPow_sats_abs:
     "[| M(A); env \<in> list(A); p \<in> formula |]
     ==> Collect(A, is_DPow_sats(M,A,env,p)) = 
         {x \<in> A. sats(A, p, Cons(x,env))}"
 by (simp add: DPow_sats_abs transM [of _ A])
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_DPow_sats\<close>, Internalized\<close>
 
 (* is_DPow_sats(M,A,env,p,x) ==
       \<forall>n1[M]. \<forall>e[M]. \<forall>sp[M]. 
              is_satisfies(M,A,p,sp) \<longrightarrow> is_Cons(M,x,env,e) \<longrightarrow> 
              fun_apply(M, sp, e, n1) \<longrightarrow> number1(M, n1) *)
 
 definition
   DPow_sats_fm :: "[i,i,i,i]=>i" where
   "DPow_sats_fm(A,env,p,x) ==
    Forall(Forall(Forall(
      Implies(satisfies_fm(A#+3,p#+3,0), 
        Implies(Cons_fm(x#+3,env#+3,1), 
          Implies(fun_apply_fm(0,1,2), number1_fm(2)))))))"
 
 lemma is_DPow_sats_type [TC]:
      "[| A \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
       ==> DPow_sats_fm(A,x,y,z) \<in> formula"
 by (simp add: DPow_sats_fm_def)
 
 lemma sats_DPow_sats_fm [simp]:
    "[| u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, DPow_sats_fm(u,x,y,z), env) \<longleftrightarrow>
         is_DPow_sats(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: DPow_sats_fm_def is_DPow_sats_def)
 
 lemma DPow_sats_iff_sats:
   "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
       u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
    ==> is_DPow_sats(##A,nu,nx,ny,nz) \<longleftrightarrow>
        sats(A, DPow_sats_fm(u,x,y,z), env)"
 by simp
 
 theorem DPow_sats_reflection:
      "REFLECTS[\<lambda>x. is_DPow_sats(L,f(x),g(x),h(x),g'(x)),
                \<lambda>i x. is_DPow_sats(##Lset(i),f(x),g(x),h(x),g'(x))]"
 apply (unfold is_DPow_sats_def) 
 apply (intro FOL_reflections function_reflections extra_reflections
              satisfies_reflection)
 done
 
 
 subsection\<open>A Locale for Relativizing the Operator \<^term>\<open>DPow'\<close>\<close>
 
 locale M_DPow = M_satisfies +
  assumes sep:
    "[| M(A); env \<in> list(A); p \<in> formula |]
     ==> separation(M, \<lambda>x. is_DPow_sats(M,A,env,p,x))"
  and rep: 
     "M(A)
     ==> strong_replacement (M, 
          \<lambda>ep z. \<exists>env[M]. \<exists>p[M]. mem_formula(M,p) & mem_list(M,A,env) &
                   pair(M,env,p,ep) & 
                   is_Collect(M, A, \<lambda>x. is_DPow_sats(M,A,env,p,x), z))"
 
 lemma (in M_DPow) sep':
    "[| M(A); env \<in> list(A); p \<in> formula |]
     ==> separation(M, \<lambda>x. sats(A, p, Cons(x,env)))"
 by (insert sep [of A env p], simp add: DPow_sats_abs)
 
 lemma (in M_DPow) rep':
    "M(A)
     ==> strong_replacement (M, 
          \<lambda>ep z. \<exists>env\<in>list(A). \<exists>p\<in>formula.
                   ep = <env,p> & z = {x \<in> A . sats(A, p, Cons(x, env))})" 
 by (insert rep [of A], simp add: Collect_DPow_sats_abs) 
 
 
 lemma univalent_pair_eq:
      "univalent (M, A, \<lambda>xy z. \<exists>x\<in>B. \<exists>y\<in>C. xy = \<langle>x,y\<rangle> \<and> z = f(x,y))"
 by (simp add: univalent_def, blast) 
 
 lemma (in M_DPow) DPow'_closed: "M(A) ==> M(DPow'(A))"
 apply (simp add: DPow'_eq)
 apply (fast intro: rep' sep' univalent_pair_eq)  
 done
 
 text\<open>Relativization of the Operator \<^term>\<open>DPow'\<close>\<close>
 definition 
   is_DPow' :: "[i=>o,i,i] => o" where
     "is_DPow'(M,A,Z) == 
        \<forall>X[M]. X \<in> Z \<longleftrightarrow> 
          subset(M,X,A) & 
            (\<exists>env[M]. \<exists>p[M]. mem_formula(M,p) & mem_list(M,A,env) &
                     is_Collect(M, A, is_DPow_sats(M,A,env,p), X))"
 
 lemma (in M_DPow) DPow'_abs:
     "[|M(A); M(Z)|] ==> is_DPow'(M,A,Z) \<longleftrightarrow> Z = DPow'(A)"
 apply (rule iffI)
  prefer 2 apply (simp add: is_DPow'_def DPow'_def Collect_DPow_sats_abs) 
 apply (rule M_equalityI) 
 apply (simp add: is_DPow'_def DPow'_def Collect_DPow_sats_abs, assumption)
 apply (erule DPow'_closed)
 done
 
 
 subsection\<open>Instantiating the Locale \<open>M_DPow\<close>\<close>
 
 subsubsection\<open>The Instance of Separation\<close>
 
 lemma DPow_separation:
     "[| L(A); env \<in> list(A); p \<in> formula |]
      ==> separation(L, \<lambda>x. is_DPow_sats(L,A,env,p,x))"
 apply (rule gen_separation_multi [OF DPow_sats_reflection, of "{A,env,p}"], 
        auto intro: transL)
 apply (rule_tac env="[A,env,p]" in DPow_LsetI)
 apply (rule DPow_sats_iff_sats sep_rules | simp)+
 done
 
 
 
 subsubsection\<open>The Instance of Replacement\<close>
 
 lemma DPow_replacement_Reflects:
  "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B &
              (\<exists>env[L]. \<exists>p[L].
                mem_formula(L,p) & mem_list(L,A,env) & pair(L,env,p,u) &
                is_Collect (L, A, is_DPow_sats(L,A,env,p), x)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B &
              (\<exists>env \<in> Lset(i). \<exists>p \<in> Lset(i).
                mem_formula(##Lset(i),p) & mem_list(##Lset(i),A,env) & 
                pair(##Lset(i),env,p,u) &
                is_Collect (##Lset(i), A, is_DPow_sats(##Lset(i),A,env,p), x))]"
 apply (unfold is_Collect_def) 
 apply (intro FOL_reflections function_reflections mem_formula_reflection
           mem_list_reflection DPow_sats_reflection)
 done
 
 lemma DPow_replacement:
     "L(A)
     ==> strong_replacement (L, 
          \<lambda>ep z. \<exists>env[L]. \<exists>p[L]. mem_formula(L,p) & mem_list(L,A,env) &
                   pair(L,env,p,ep) & 
                   is_Collect(L, A, \<lambda>x. is_DPow_sats(L,A,env,p,x), z))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{A,B}" 
          in gen_separation_multi [OF DPow_replacement_Reflects], 
        auto)
 apply (unfold is_Collect_def) 
 apply (rule_tac env="[A,B]" in DPow_LsetI)
 apply (rule sep_rules mem_formula_iff_sats mem_list_iff_sats 
             DPow_sats_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Actually Instantiating the Locale\<close>
 
 lemma M_DPow_axioms_L: "M_DPow_axioms(L)"
   apply (rule M_DPow_axioms.intro)
    apply (assumption | rule DPow_separation DPow_replacement)+
   done
 
-theorem M_DPow_L: "PROP M_DPow(L)"
+theorem M_DPow_L: "M_DPow(L)"
   apply (rule M_DPow.intro)
    apply (rule M_satisfies_L)
   apply (rule M_DPow_axioms_L)
   done
 
 lemmas DPow'_closed [intro, simp] = M_DPow.DPow'_closed [OF M_DPow_L]
   and DPow'_abs [intro, simp] = M_DPow.DPow'_abs [OF M_DPow_L]
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_Collect\<close>\<close>
 
 text\<open>The formula \<^term>\<open>is_P\<close> has one free variable, 0, and it is
 enclosed within a single quantifier.\<close>
 
 (* is_Collect :: "[i=>o,i,i=>o,i] => o"
     "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> A & P(x)" *)
 
 definition
   Collect_fm :: "[i, i, i]=>i" where
  "Collect_fm(A,is_P,z) == 
         Forall(Iff(Member(0,succ(z)),
                    And(Member(0,succ(A)), is_P)))"
 
 lemma is_Collect_type [TC]:
      "[| is_P \<in> formula; x \<in> nat; y \<in> nat |] 
       ==> Collect_fm(x,is_P,y) \<in> formula"
 by (simp add: Collect_fm_def)
 
 lemma sats_Collect_fm:
   assumes is_P_iff_sats: 
       "!!a. a \<in> A ==> is_P(a) \<longleftrightarrow> sats(A, p, Cons(a, env))"
   shows 
       "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
        ==> sats(A, Collect_fm(x,p,y), env) \<longleftrightarrow>
            is_Collect(##A, nth(x,env), is_P, nth(y,env))"
 by (simp add: Collect_fm_def is_Collect_def is_P_iff_sats [THEN iff_sym])
 
 lemma Collect_iff_sats:
   assumes is_P_iff_sats: 
       "!!a. a \<in> A ==> is_P(a) \<longleftrightarrow> sats(A, p, Cons(a, env))"
   shows 
   "[| nth(i,env) = x; nth(j,env) = y;
       i \<in> nat; j \<in> nat; env \<in> list(A)|]
    ==> is_Collect(##A, x, is_P, y) \<longleftrightarrow> sats(A, Collect_fm(i,p,j), env)"
 by (simp add: sats_Collect_fm [OF is_P_iff_sats])
 
 
 text\<open>The second argument of \<^term>\<open>is_P\<close> gives it direct access to \<^term>\<open>x\<close>,
   which is essential for handling free variable references.\<close>
 theorem Collect_reflection:
   assumes is_P_reflection:
     "!!h f g. REFLECTS[\<lambda>x. is_P(L, f(x), g(x)),
                      \<lambda>i x. is_P(##Lset(i), f(x), g(x))]"
   shows "REFLECTS[\<lambda>x. is_Collect(L, f(x), is_P(L,x), g(x)),
                \<lambda>i x. is_Collect(##Lset(i), f(x), is_P(##Lset(i), x), g(x))]"
 apply (simp (no_asm_use) only: is_Collect_def)
 apply (intro FOL_reflections is_P_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_Replace\<close>\<close>
 
 text\<open>BEWARE!  The formula \<^term>\<open>is_P\<close> has free variables 0, 1
  and not the usual 1, 0!  It is enclosed within two quantifiers.\<close>
 
 (*  is_Replace :: "[i=>o,i,[i,i]=>o,i] => o"
     "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,u))" *)
 
 definition
   Replace_fm :: "[i, i, i]=>i" where
   "Replace_fm(A,is_P,z) == 
         Forall(Iff(Member(0,succ(z)),
                    Exists(And(Member(0,A#+2), is_P))))"
 
 lemma is_Replace_type [TC]:
      "[| is_P \<in> formula; x \<in> nat; y \<in> nat |] 
       ==> Replace_fm(x,is_P,y) \<in> formula"
 by (simp add: Replace_fm_def)
 
 lemma sats_Replace_fm:
   assumes is_P_iff_sats: 
       "!!a b. [|a \<in> A; b \<in> A|] 
               ==> is_P(a,b) \<longleftrightarrow> sats(A, p, Cons(a,Cons(b,env)))"
   shows 
       "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
        ==> sats(A, Replace_fm(x,p,y), env) \<longleftrightarrow>
            is_Replace(##A, nth(x,env), is_P, nth(y,env))"
 by (simp add: Replace_fm_def is_Replace_def is_P_iff_sats [THEN iff_sym])
 
 lemma Replace_iff_sats:
   assumes is_P_iff_sats: 
       "!!a b. [|a \<in> A; b \<in> A|] 
               ==> is_P(a,b) \<longleftrightarrow> sats(A, p, Cons(a,Cons(b,env)))"
   shows 
   "[| nth(i,env) = x; nth(j,env) = y;
       i \<in> nat; j \<in> nat; env \<in> list(A)|]
    ==> is_Replace(##A, x, is_P, y) \<longleftrightarrow> sats(A, Replace_fm(i,p,j), env)"
 by (simp add: sats_Replace_fm [OF is_P_iff_sats])
 
 
 text\<open>The second argument of \<^term>\<open>is_P\<close> gives it direct access to \<^term>\<open>x\<close>,
   which is essential for handling free variable references.\<close>
 theorem Replace_reflection:
   assumes is_P_reflection:
     "!!h f g. REFLECTS[\<lambda>x. is_P(L, f(x), g(x), h(x)),
                      \<lambda>i x. is_P(##Lset(i), f(x), g(x), h(x))]"
   shows "REFLECTS[\<lambda>x. is_Replace(L, f(x), is_P(L,x), g(x)),
                \<lambda>i x. is_Replace(##Lset(i), f(x), is_P(##Lset(i), x), g(x))]"
 apply (simp (no_asm_use) only: is_Replace_def)
 apply (intro FOL_reflections is_P_reflection)
 done
 
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_DPow'\<close>, Internalized\<close>
 
 (*  "is_DPow'(M,A,Z) == 
        \<forall>X[M]. X \<in> Z \<longleftrightarrow> 
          subset(M,X,A) & 
            (\<exists>env[M]. \<exists>p[M]. mem_formula(M,p) & mem_list(M,A,env) &
                     is_Collect(M, A, is_DPow_sats(M,A,env,p), X))" *)
 
 definition
   DPow'_fm :: "[i,i]=>i" where
     "DPow'_fm(A,Z) == 
       Forall(
        Iff(Member(0,succ(Z)),
         And(subset_fm(0,succ(A)),
          Exists(Exists(
           And(mem_formula_fm(0),
            And(mem_list_fm(A#+3,1),
             Collect_fm(A#+3, 
                        DPow_sats_fm(A#+4, 2, 1, 0), 2))))))))"
 
 lemma is_DPow'_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> DPow'_fm(x,y) \<in> formula"
 by (simp add: DPow'_fm_def)
 
 lemma sats_DPow'_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, DPow'_fm(x,y), env) \<longleftrightarrow>
         is_DPow'(##A, nth(x,env), nth(y,env))"
 by (simp add: DPow'_fm_def is_DPow'_def sats_subset_fm' sats_Collect_fm)
 
 lemma DPow'_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; 
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_DPow'(##A, x, y) \<longleftrightarrow> sats(A, DPow'_fm(i,j), env)"
-by (simp add: sats_DPow'_fm)
+by (simp)
 
 theorem DPow'_reflection:
      "REFLECTS[\<lambda>x. is_DPow'(L,f(x),g(x)),
                \<lambda>i x. is_DPow'(##Lset(i),f(x),g(x))]"
 apply (simp only: is_DPow'_def)
 apply (intro FOL_reflections function_reflections mem_formula_reflection
              mem_list_reflection Collect_reflection DPow_sats_reflection)
 done
 
 
 subsection\<open>A Locale for Relativizing the Operator \<^term>\<open>Lset\<close>\<close>
 
 definition
   transrec_body :: "[i=>o,i,i,i,i] => o" where
     "transrec_body(M,g,x) ==
       \<lambda>y z. \<exists>gy[M]. y \<in> x & fun_apply(M,g,y,gy) & is_DPow'(M,gy,z)"
 
 lemma (in M_DPow) transrec_body_abs:
      "[|M(x); M(g); M(z)|]
     ==> transrec_body(M,g,x,y,z) \<longleftrightarrow> y \<in> x & z = DPow'(g`y)"
 by (simp add: transrec_body_def DPow'_abs transM [of _ x])
 
 locale M_Lset = M_DPow +
  assumes strong_rep:
    "[|M(x); M(g)|] ==> strong_replacement(M, \<lambda>y z. transrec_body(M,g,x,y,z))"
  and transrec_rep: 
     "M(i) ==> transrec_replacement(M, \<lambda>x f u. 
               \<exists>r[M]. is_Replace(M, x, transrec_body(M,f,x), r) & 
                      big_union(M, r, u), i)"
 
 
 lemma (in M_Lset) strong_rep':
    "[|M(x); M(g)|]
     ==> strong_replacement(M, \<lambda>y z. y \<in> x & z = DPow'(g`y))"
 by (insert strong_rep [of x g], simp add: transrec_body_abs)
 
 lemma (in M_Lset) DPow_apply_closed:
    "[|M(f); M(x); y\<in>x|] ==> M(DPow'(f`y))"
 by (blast intro: DPow'_closed dest: transM) 
 
 lemma (in M_Lset) RepFun_DPow_apply_closed:
    "[|M(f); M(x)|] ==> M({DPow'(f`y). y\<in>x})"
 by (blast intro: DPow_apply_closed RepFun_closed2 strong_rep') 
 
 lemma (in M_Lset) RepFun_DPow_abs:
      "[|M(x); M(f); M(r) |]
       ==> is_Replace(M, x, \<lambda>y z. transrec_body(M,f,x,y,z), r) \<longleftrightarrow>
           r =  {DPow'(f`y). y\<in>x}"
 apply (simp add: transrec_body_abs RepFun_def) 
 apply (rule iff_trans) 
 apply (rule Replace_abs) 
 apply (simp_all add: DPow_apply_closed strong_rep') 
 done
 
 lemma (in M_Lset) transrec_rep':
    "M(i) ==> transrec_replacement(M, \<lambda>x f u. u = (\<Union>y\<in>x. DPow'(f ` y)), i)"
 apply (insert transrec_rep [of i]) 
 apply (simp add: RepFun_DPow_apply_closed RepFun_DPow_abs 
        transrec_replacement_def) 
 done
 
 
 text\<open>Relativization of the Operator \<^term>\<open>Lset\<close>\<close>
 
 definition
   is_Lset :: "[i=>o, i, i] => o" where
    \<comment> \<open>We can use the term language below because \<^term>\<open>is_Lset\<close> will
        not have to be internalized: it isn't used in any instance of
        separation.\<close>
    "is_Lset(M,a,z) == is_transrec(M, %x f u. u = (\<Union>y\<in>x. DPow'(f`y)), a, z)"
 
 lemma (in M_Lset) Lset_abs:
   "[|Ord(i);  M(i);  M(z)|] 
    ==> is_Lset(M,i,z) \<longleftrightarrow> z = Lset(i)"
 apply (simp add: is_Lset_def Lset_eq_transrec_DPow') 
 apply (rule transrec_abs)  
 apply (simp_all add: transrec_rep' relation2_def RepFun_DPow_apply_closed)
 done
 
 lemma (in M_Lset) Lset_closed:
   "[|Ord(i);  M(i)|] ==> M(Lset(i))"
 apply (simp add: Lset_eq_transrec_DPow') 
 apply (rule transrec_closed [OF transrec_rep']) 
 apply (simp_all add: relation2_def RepFun_DPow_apply_closed)
 done
 
 
 subsection\<open>Instantiating the Locale \<open>M_Lset\<close>\<close>
 
 subsubsection\<open>The First Instance of Replacement\<close>
 
 lemma strong_rep_Reflects:
  "REFLECTS [\<lambda>u. \<exists>v[L]. v \<in> B & (\<exists>gy[L].
                           v \<in> x & fun_apply(L,g,v,gy) & is_DPow'(L,gy,u)),
    \<lambda>i u. \<exists>v \<in> Lset(i). v \<in> B & (\<exists>gy \<in> Lset(i).
             v \<in> x & fun_apply(##Lset(i),g,v,gy) & is_DPow'(##Lset(i),gy,u))]"
 by (intro FOL_reflections function_reflections DPow'_reflection)
 
 lemma strong_rep:
    "[|L(x); L(g)|] ==> strong_replacement(L, \<lambda>y z. transrec_body(L,g,x,y,z))"
 apply (unfold transrec_body_def)  
 apply (rule strong_replacementI) 
 apply (rule_tac u="{x,g,B}" 
          in gen_separation_multi [OF strong_rep_Reflects], auto)
 apply (rule_tac env="[x,g,B]" in DPow_LsetI)
 apply (rule sep_rules DPow'_iff_sats | simp)+
 done
 
 
 subsubsection\<open>The Second Instance of Replacement\<close>
 
 lemma transrec_rep_Reflects:
  "REFLECTS [\<lambda>x. \<exists>v[L]. v \<in> B &
               (\<exists>y[L]. pair(L,v,y,x) &
              is_wfrec (L, \<lambda>x f u. \<exists>r[L].
                 is_Replace (L, x, \<lambda>y z. 
                      \<exists>gy[L]. y \<in> x & fun_apply(L,f,y,gy) & 
                       is_DPow'(L,gy,z), r) & big_union(L,r,u), mr, v, y)),
     \<lambda>i x. \<exists>v \<in> Lset(i). v \<in> B &
               (\<exists>y \<in> Lset(i). pair(##Lset(i),v,y,x) &
              is_wfrec (##Lset(i), \<lambda>x f u. \<exists>r \<in> Lset(i).
                 is_Replace (##Lset(i), x, \<lambda>y z. 
                      \<exists>gy \<in> Lset(i). y \<in> x & fun_apply(##Lset(i),f,y,gy) & 
                       is_DPow'(##Lset(i),gy,z), r) & 
                       big_union(##Lset(i),r,u), mr, v, y))]" 
 apply (simp only: rex_setclass_is_bex [symmetric])
   \<comment> \<open>Convert \<open>\<exists>y\<in>Lset(i)\<close> to \<open>\<exists>y[##Lset(i)]\<close> within the body
        of the \<^term>\<open>is_wfrec\<close> application.\<close>
 apply (intro FOL_reflections function_reflections 
           is_wfrec_reflection Replace_reflection DPow'_reflection) 
 done
 
 
 lemma transrec_rep: 
     "[|L(j)|]
     ==> transrec_replacement(L, \<lambda>x f u. 
               \<exists>r[L]. is_Replace(L, x, transrec_body(L,f,x), r) & 
                      big_union(L, r, u), j)"
 apply (rule transrec_replacementI, assumption)
 apply (unfold transrec_body_def)  
 apply (rule strong_replacementI)
 apply (rule_tac u="{j,B,Memrel(eclose({j}))}" 
          in gen_separation_multi [OF transrec_rep_Reflects], auto)
 apply (rule_tac env="[j,B,Memrel(eclose({j}))]" in DPow_LsetI)
 apply (rule sep_rules is_wfrec_iff_sats Replace_iff_sats DPow'_iff_sats | 
        simp)+
 done
 
 
 subsubsection\<open>Actually Instantiating \<open>M_Lset\<close>\<close>
 
 lemma M_Lset_axioms_L: "M_Lset_axioms(L)"
   apply (rule M_Lset_axioms.intro)
        apply (assumption | rule strong_rep transrec_rep)+
   done
 
-theorem M_Lset_L: "PROP M_Lset(L)"
+theorem M_Lset_L: "M_Lset(L)"
   apply (rule M_Lset.intro) 
    apply (rule M_DPow_L)
   apply (rule M_Lset_axioms_L) 
   done
 
 text\<open>Finally: the point of the whole theory!\<close>
 lemmas Lset_closed = M_Lset.Lset_closed [OF M_Lset_L]
    and Lset_abs = M_Lset.Lset_abs [OF M_Lset_L]
 
 
 subsection\<open>The Notion of Constructible Set\<close>
 
 definition
   constructible :: "[i=>o,i] => o" where
     "constructible(M,x) ==
        \<exists>i[M]. \<exists>Li[M]. ordinal(M,i) & is_Lset(M,i,Li) & x \<in> Li"
 
 theorem V_equals_L_in_L:
   "L(x) \<longleftrightarrow> constructible(L,x)"
 apply (simp add: constructible_def Lset_abs Lset_closed)
 apply (simp add: L_def)
 apply (blast intro: Ord_in_L) 
 done
 
 end
diff --git a/src/ZF/Constructible/Datatype_absolute.thy b/src/ZF/Constructible/Datatype_absolute.thy
--- a/src/ZF/Constructible/Datatype_absolute.thy
+++ b/src/ZF/Constructible/Datatype_absolute.thy
@@ -1,1012 +1,1012 @@
 (*  Title:      ZF/Constructible/Datatype_absolute.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Absoluteness Properties for Recursive Datatypes\<close>
 
 theory Datatype_absolute imports Formula WF_absolute begin
 
 
 subsection\<open>The lfp of a continuous function can be expressed as a union\<close>
 
 definition
   directed :: "i=>o" where
    "directed(A) == A\<noteq>0 & (\<forall>x\<in>A. \<forall>y\<in>A. x \<union> y \<in> A)"
 
 definition
   contin :: "(i=>i) => o" where
    "contin(h) == (\<forall>A. directed(A) \<longrightarrow> h(\<Union>A) = (\<Union>X\<in>A. h(X)))"
 
 lemma bnd_mono_iterates_subset: "[|bnd_mono(D, h); n \<in> nat|] ==> h^n (0) \<subseteq> D"
 apply (induct_tac n) 
  apply (simp_all add: bnd_mono_def, blast) 
 done
 
 lemma bnd_mono_increasing [rule_format]:
      "[|i \<in> nat; j \<in> nat; bnd_mono(D,h)|] ==> i \<le> j \<longrightarrow> h^i(0) \<subseteq> h^j(0)"
 apply (rule_tac m=i and n=j in diff_induct, simp_all)
 apply (blast del: subsetI
              intro: bnd_mono_iterates_subset bnd_monoD2 [of concl: h]) 
 done
 
 lemma directed_iterates: "bnd_mono(D,h) ==> directed({h^n (0). n\<in>nat})"
 apply (simp add: directed_def, clarify) 
 apply (rename_tac i j)
 apply (rule_tac x="i \<union> j" in bexI) 
 apply (rule_tac i = i and j = j in Ord_linear_le)
 apply (simp_all add: subset_Un_iff [THEN iffD1] le_imp_subset
                      subset_Un_iff2 [THEN iffD1])
 apply (simp_all add: subset_Un_iff [THEN iff_sym] bnd_mono_increasing
                      subset_Un_iff2 [THEN iff_sym])
 done
 
 
 lemma contin_iterates_eq: 
     "[|bnd_mono(D, h); contin(h)|] 
      ==> h(\<Union>n\<in>nat. h^n (0)) = (\<Union>n\<in>nat. h^n (0))"
 apply (simp add: contin_def directed_iterates) 
 apply (rule trans) 
 apply (rule equalityI) 
  apply (simp_all add: UN_subset_iff)
  apply safe
  apply (erule_tac [2] natE) 
   apply (rule_tac a="succ(x)" in UN_I) 
    apply simp_all 
 apply blast 
 done
 
 lemma lfp_subset_Union:
      "[|bnd_mono(D, h); contin(h)|] ==> lfp(D,h) \<subseteq> (\<Union>n\<in>nat. h^n(0))"
 apply (rule lfp_lowerbound) 
  apply (simp add: contin_iterates_eq) 
 apply (simp add: contin_def bnd_mono_iterates_subset UN_subset_iff) 
 done
 
 lemma Union_subset_lfp:
      "bnd_mono(D,h) ==> (\<Union>n\<in>nat. h^n(0)) \<subseteq> lfp(D,h)"
 apply (simp add: UN_subset_iff)
 apply (rule ballI)  
 apply (induct_tac n, simp_all) 
 apply (rule subset_trans [of _ "h(lfp(D,h))"])
  apply (blast dest: bnd_monoD2 [OF _ _ lfp_subset])  
 apply (erule lfp_lemma2) 
 done
 
 lemma lfp_eq_Union:
      "[|bnd_mono(D, h); contin(h)|] ==> lfp(D,h) = (\<Union>n\<in>nat. h^n(0))"
 by (blast del: subsetI 
           intro: lfp_subset_Union Union_subset_lfp)
 
 
 subsubsection\<open>Some Standard Datatype Constructions Preserve Continuity\<close>
 
 lemma contin_imp_mono: "[|X\<subseteq>Y; contin(F)|] ==> F(X) \<subseteq> F(Y)"
 apply (simp add: contin_def) 
 apply (drule_tac x="{X,Y}" in spec) 
 apply (simp add: directed_def subset_Un_iff2 Un_commute) 
 done
 
 lemma sum_contin: "[|contin(F); contin(G)|] ==> contin(\<lambda>X. F(X) + G(X))"
 by (simp add: contin_def, blast)
 
 lemma prod_contin: "[|contin(F); contin(G)|] ==> contin(\<lambda>X. F(X) * G(X))" 
 apply (subgoal_tac "\<forall>B C. F(B) \<subseteq> F(B \<union> C)")
  prefer 2 apply (simp add: Un_upper1 contin_imp_mono) 
 apply (subgoal_tac "\<forall>B C. G(C) \<subseteq> G(B \<union> C)")
  prefer 2 apply (simp add: Un_upper2 contin_imp_mono) 
 apply (simp add: contin_def, clarify) 
 apply (rule equalityI) 
  prefer 2 apply blast 
 apply clarify 
 apply (rename_tac B C) 
 apply (rule_tac a="B \<union> C" in UN_I) 
  apply (simp add: directed_def, blast)  
 done
 
 lemma const_contin: "contin(\<lambda>X. A)"
 by (simp add: contin_def directed_def)
 
 lemma id_contin: "contin(\<lambda>X. X)"
 by (simp add: contin_def)
 
 
 
 subsection \<open>Absoluteness for "Iterates"\<close>
 
 definition
   iterates_MH :: "[i=>o, [i,i]=>o, i, i, i, i] => o" where
    "iterates_MH(M,isF,v,n,g,z) ==
         is_nat_case(M, v, \<lambda>m u. \<exists>gm[M]. fun_apply(M,g,m,gm) & isF(gm,u),
                     n, z)"
 
 definition
   is_iterates :: "[i=>o, [i,i]=>o, i, i, i] => o" where
     "is_iterates(M,isF,v,n,Z) == 
       \<exists>sn[M]. \<exists>msn[M]. successor(M,n,sn) & membership(M,sn,msn) &
                        is_wfrec(M, iterates_MH(M,isF,v), msn, n, Z)"
 
 definition
   iterates_replacement :: "[i=>o, [i,i]=>o, i] => o" where
    "iterates_replacement(M,isF,v) ==
       \<forall>n[M]. n\<in>nat \<longrightarrow> 
          wfrec_replacement(M, iterates_MH(M,isF,v), Memrel(succ(n)))"
 
 lemma (in M_basic) iterates_MH_abs:
   "[| relation1(M,isF,F); M(n); M(g); M(z) |] 
    ==> iterates_MH(M,isF,v,n,g,z) \<longleftrightarrow> z = nat_case(v, \<lambda>m. F(g`m), n)"
 by (simp add: nat_case_abs [of _ "\<lambda>m. F(g ` m)"]
               relation1_def iterates_MH_def)  
 
-lemma (in M_basic) iterates_imp_wfrec_replacement:
+lemma (in M_trancl) iterates_imp_wfrec_replacement:
   "[|relation1(M,isF,F); n \<in> nat; iterates_replacement(M,isF,v)|] 
    ==> wfrec_replacement(M, \<lambda>n f z. z = nat_case(v, \<lambda>m. F(f`m), n), 
                        Memrel(succ(n)))" 
 by (simp add: iterates_replacement_def iterates_MH_abs)
 
 theorem (in M_trancl) iterates_abs:
   "[| iterates_replacement(M,isF,v); relation1(M,isF,F);
       n \<in> nat; M(v); M(z); \<forall>x[M]. M(F(x)) |] 
    ==> is_iterates(M,isF,v,n,z) \<longleftrightarrow> z = iterates(F,n,v)" 
 apply (frule iterates_imp_wfrec_replacement, assumption+)
-apply (simp add: wf_Memrel trans_Memrel relation_Memrel nat_into_M
+apply (simp add: wf_Memrel trans_Memrel relation_Memrel 
                  is_iterates_def relation2_def iterates_MH_abs 
                  iterates_nat_def recursor_def transrec_def 
                  eclose_sing_Ord_eq nat_into_M
          trans_wfrec_abs [of _ _ _ _ "\<lambda>n g. nat_case(v, \<lambda>m. F(g`m), n)"])
 done
 
 
 lemma (in M_trancl) iterates_closed [intro,simp]:
   "[| iterates_replacement(M,isF,v); relation1(M,isF,F);
       n \<in> nat; M(v); \<forall>x[M]. M(F(x)) |] 
    ==> M(iterates(F,n,v))"
 apply (frule iterates_imp_wfrec_replacement, assumption+)
-apply (simp add: wf_Memrel trans_Memrel relation_Memrel nat_into_M
+apply (simp add: wf_Memrel trans_Memrel relation_Memrel 
                  relation2_def iterates_MH_abs 
                  iterates_nat_def recursor_def transrec_def 
                  eclose_sing_Ord_eq nat_into_M
          trans_wfrec_closed [of _ _ _ "\<lambda>n g. nat_case(v, \<lambda>m. F(g`m), n)"])
 done
 
 
 subsection \<open>lists without univ\<close>
 
 lemmas datatype_univs = Inl_in_univ Inr_in_univ 
                         Pair_in_univ nat_into_univ A_into_univ 
 
 lemma list_fun_bnd_mono: "bnd_mono(univ(A), \<lambda>X. {0} + A*X)"
 apply (rule bnd_monoI)
  apply (intro subset_refl zero_subset_univ A_subset_univ 
               sum_subset_univ Sigma_subset_univ) 
 apply (rule subset_refl sum_mono Sigma_mono | assumption)+
 done
 
 lemma list_fun_contin: "contin(\<lambda>X. {0} + A*X)"
 by (intro sum_contin prod_contin id_contin const_contin) 
 
 text\<open>Re-expresses lists using sum and product\<close>
 lemma list_eq_lfp2: "list(A) = lfp(univ(A), \<lambda>X. {0} + A*X)"
 apply (simp add: list_def) 
 apply (rule equalityI) 
  apply (rule lfp_lowerbound) 
   prefer 2 apply (rule lfp_subset)
  apply (clarify, subst lfp_unfold [OF list_fun_bnd_mono])
  apply (simp add: Nil_def Cons_def)
  apply blast 
 txt\<open>Opposite inclusion\<close>
 apply (rule lfp_lowerbound) 
  prefer 2 apply (rule lfp_subset) 
 apply (clarify, subst lfp_unfold [OF list.bnd_mono]) 
 apply (simp add: Nil_def Cons_def)
 apply (blast intro: datatype_univs
              dest: lfp_subset [THEN subsetD])
 done
 
 text\<open>Re-expresses lists using "iterates", no univ.\<close>
 lemma list_eq_Union:
      "list(A) = (\<Union>n\<in>nat. (\<lambda>X. {0} + A*X) ^ n (0))"
 by (simp add: list_eq_lfp2 lfp_eq_Union list_fun_bnd_mono list_fun_contin)
 
 
 definition
   is_list_functor :: "[i=>o,i,i,i] => o" where
     "is_list_functor(M,A,X,Z) == 
         \<exists>n1[M]. \<exists>AX[M]. 
          number1(M,n1) & cartprod(M,A,X,AX) & is_sum(M,n1,AX,Z)"
 
 lemma (in M_basic) list_functor_abs [simp]: 
      "[| M(A); M(X); M(Z) |] ==> is_list_functor(M,A,X,Z) \<longleftrightarrow> (Z = {0} + A*X)"
 by (simp add: is_list_functor_def singleton_0 nat_into_M)
 
 
 subsection \<open>formulas without univ\<close>
 
 lemma formula_fun_bnd_mono:
      "bnd_mono(univ(0), \<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))"
 apply (rule bnd_monoI)
  apply (intro subset_refl zero_subset_univ A_subset_univ 
               sum_subset_univ Sigma_subset_univ nat_subset_univ) 
 apply (rule subset_refl sum_mono Sigma_mono | assumption)+
 done
 
 lemma formula_fun_contin:
      "contin(\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))"
 by (intro sum_contin prod_contin id_contin const_contin) 
 
 
 text\<open>Re-expresses formulas using sum and product\<close>
 lemma formula_eq_lfp2:
     "formula = lfp(univ(0), \<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))"
 apply (simp add: formula_def) 
 apply (rule equalityI) 
  apply (rule lfp_lowerbound) 
   prefer 2 apply (rule lfp_subset)
  apply (clarify, subst lfp_unfold [OF formula_fun_bnd_mono])
  apply (simp add: Member_def Equal_def Nand_def Forall_def)
  apply blast 
 txt\<open>Opposite inclusion\<close>
 apply (rule lfp_lowerbound) 
  prefer 2 apply (rule lfp_subset, clarify) 
 apply (subst lfp_unfold [OF formula.bnd_mono, simplified]) 
 apply (simp add: Member_def Equal_def Nand_def Forall_def)  
 apply (elim sumE SigmaE, simp_all) 
 apply (blast intro: datatype_univs dest: lfp_subset [THEN subsetD])+  
 done
 
 text\<open>Re-expresses formulas using "iterates", no univ.\<close>
 lemma formula_eq_Union:
      "formula = 
       (\<Union>n\<in>nat. (\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X)) ^ n (0))"
 by (simp add: formula_eq_lfp2 lfp_eq_Union formula_fun_bnd_mono 
               formula_fun_contin)
 
 
 definition
   is_formula_functor :: "[i=>o,i,i] => o" where
     "is_formula_functor(M,X,Z) == 
         \<exists>nat'[M]. \<exists>natnat[M]. \<exists>natnatsum[M]. \<exists>XX[M]. \<exists>X3[M]. 
           omega(M,nat') & cartprod(M,nat',nat',natnat) & 
           is_sum(M,natnat,natnat,natnatsum) &
           cartprod(M,X,X,XX) & is_sum(M,XX,X,X3) & 
           is_sum(M,natnatsum,X3,Z)"
 
-lemma (in M_basic) formula_functor_abs [simp]: 
+lemma (in M_trancl) formula_functor_abs [simp]: 
      "[| M(X); M(Z) |] 
       ==> is_formula_functor(M,X,Z) \<longleftrightarrow> 
           Z = ((nat*nat) + (nat*nat)) + (X*X + X)"
 by (simp add: is_formula_functor_def) 
 
 
 subsection\<open>\<^term>\<open>M\<close> Contains the List and Formula Datatypes\<close>
 
 definition
   list_N :: "[i,i] => i" where
     "list_N(A,n) == (\<lambda>X. {0} + A * X)^n (0)"
 
 lemma Nil_in_list_N [simp]: "[] \<in> list_N(A,succ(n))"
 by (simp add: list_N_def Nil_def)
 
 lemma Cons_in_list_N [simp]:
      "Cons(a,l) \<in> list_N(A,succ(n)) \<longleftrightarrow> a\<in>A & l \<in> list_N(A,n)"
 by (simp add: list_N_def Cons_def) 
 
 text\<open>These two aren't simprules because they reveal the underlying
 list representation.\<close>
 lemma list_N_0: "list_N(A,0) = 0"
 by (simp add: list_N_def)
 
 lemma list_N_succ: "list_N(A,succ(n)) = {0} + A * (list_N(A,n))"
 by (simp add: list_N_def)
 
 lemma list_N_imp_list:
   "[| l \<in> list_N(A,n); n \<in> nat |] ==> l \<in> list(A)"
 by (force simp add: list_eq_Union list_N_def)
 
 lemma list_N_imp_length_lt [rule_format]:
      "n \<in> nat ==> \<forall>l \<in> list_N(A,n). length(l) < n"
 apply (induct_tac n)  
 apply (auto simp add: list_N_0 list_N_succ 
                       Nil_def [symmetric] Cons_def [symmetric]) 
 done
 
 lemma list_imp_list_N [rule_format]:
      "l \<in> list(A) ==> \<forall>n\<in>nat. length(l) < n \<longrightarrow> l \<in> list_N(A, n)"
 apply (induct_tac l)
 apply (force elim: natE)+
 done
 
 lemma list_N_imp_eq_length:
       "[|n \<in> nat; l \<notin> list_N(A, n); l \<in> list_N(A, succ(n))|] 
        ==> n = length(l)"
 apply (rule le_anti_sym) 
  prefer 2 apply (simp add: list_N_imp_length_lt) 
 apply (frule list_N_imp_list, simp)
 apply (simp add: not_lt_iff_le [symmetric]) 
 apply (blast intro: list_imp_list_N) 
 done
   
 text\<open>Express \<^term>\<open>list_rec\<close> without using \<^term>\<open>rank\<close> or \<^term>\<open>Vset\<close>,
 neither of which is absolute.\<close>
 lemma (in M_trivial) list_rec_eq:
   "l \<in> list(A) ==>
    list_rec(a,g,l) = 
    transrec (succ(length(l)),
       \<lambda>x h. Lambda (list(A),
                     list_case' (a, 
                            \<lambda>a l. g(a, l, h ` succ(length(l)) ` l)))) ` l"
 apply (induct_tac l) 
 apply (subst transrec, simp) 
 apply (subst transrec) 
 apply (simp add: list_imp_list_N) 
 done
 
 definition
   is_list_N :: "[i=>o,i,i,i] => o" where
     "is_list_N(M,A,n,Z) == 
       \<exists>zero[M]. empty(M,zero) & 
                 is_iterates(M, is_list_functor(M,A), zero, n, Z)"
 
 definition  
   mem_list :: "[i=>o,i,i] => o" where
     "mem_list(M,A,l) == 
       \<exists>n[M]. \<exists>listn[M]. 
        finite_ordinal(M,n) & is_list_N(M,A,n,listn) & l \<in> listn"
 
 definition
   is_list :: "[i=>o,i,i] => o" where
     "is_list(M,A,Z) == \<forall>l[M]. l \<in> Z \<longleftrightarrow> mem_list(M,A,l)"
 
 subsubsection\<open>Towards Absoluteness of \<^term>\<open>formula_rec\<close>\<close>
 
 consts   depth :: "i=>i"
 primrec
   "depth(Member(x,y)) = 0"
   "depth(Equal(x,y))  = 0"
   "depth(Nand(p,q)) = succ(depth(p) \<union> depth(q))"
   "depth(Forall(p)) = succ(depth(p))"
 
 lemma depth_type [TC]: "p \<in> formula ==> depth(p) \<in> nat"
 by (induct_tac p, simp_all) 
 
 
 definition
   formula_N :: "i => i" where
     "formula_N(n) == (\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X)) ^ n (0)"
 
 lemma Member_in_formula_N [simp]:
      "Member(x,y) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> nat & y \<in> nat"
 by (simp add: formula_N_def Member_def) 
 
 lemma Equal_in_formula_N [simp]:
      "Equal(x,y) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> nat & y \<in> nat"
 by (simp add: formula_N_def Equal_def) 
 
 lemma Nand_in_formula_N [simp]:
      "Nand(x,y) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> formula_N(n) & y \<in> formula_N(n)"
 by (simp add: formula_N_def Nand_def) 
 
 lemma Forall_in_formula_N [simp]:
      "Forall(x) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> formula_N(n)"
 by (simp add: formula_N_def Forall_def) 
 
 text\<open>These two aren't simprules because they reveal the underlying
 formula representation.\<close>
 lemma formula_N_0: "formula_N(0) = 0"
 by (simp add: formula_N_def)
 
 lemma formula_N_succ:
      "formula_N(succ(n)) = 
       ((nat*nat) + (nat*nat)) + (formula_N(n) * formula_N(n) + formula_N(n))"
 by (simp add: formula_N_def)
 
 lemma formula_N_imp_formula:
   "[| p \<in> formula_N(n); n \<in> nat |] ==> p \<in> formula"
 by (force simp add: formula_eq_Union formula_N_def)
 
 lemma formula_N_imp_depth_lt [rule_format]:
      "n \<in> nat ==> \<forall>p \<in> formula_N(n). depth(p) < n"
 apply (induct_tac n)  
 apply (auto simp add: formula_N_0 formula_N_succ 
                       depth_type formula_N_imp_formula Un_least_lt_iff
                       Member_def [symmetric] Equal_def [symmetric]
                       Nand_def [symmetric] Forall_def [symmetric]) 
 done
 
 lemma formula_imp_formula_N [rule_format]:
      "p \<in> formula ==> \<forall>n\<in>nat. depth(p) < n \<longrightarrow> p \<in> formula_N(n)"
 apply (induct_tac p)
 apply (simp_all add: succ_Un_distrib Un_least_lt_iff) 
 apply (force elim: natE)+
 done
 
 lemma formula_N_imp_eq_depth:
       "[|n \<in> nat; p \<notin> formula_N(n); p \<in> formula_N(succ(n))|] 
        ==> n = depth(p)"
 apply (rule le_anti_sym) 
  prefer 2 apply (simp add: formula_N_imp_depth_lt) 
 apply (frule formula_N_imp_formula, simp)
 apply (simp add: not_lt_iff_le [symmetric]) 
 apply (blast intro: formula_imp_formula_N) 
 done
 
 
 text\<open>This result and the next are unused.\<close>
 lemma formula_N_mono [rule_format]:
   "[| m \<in> nat; n \<in> nat |] ==> m\<le>n \<longrightarrow> formula_N(m) \<subseteq> formula_N(n)"
 apply (rule_tac m = m and n = n in diff_induct)
 apply (simp_all add: formula_N_0 formula_N_succ, blast) 
 done
 
 lemma formula_N_distrib:
   "[| m \<in> nat; n \<in> nat |] ==> formula_N(m \<union> n) = formula_N(m) \<union> formula_N(n)"
 apply (rule_tac i = m and j = n in Ord_linear_le, auto) 
 apply (simp_all add: subset_Un_iff [THEN iffD1] subset_Un_iff2 [THEN iffD1] 
                      le_imp_subset formula_N_mono)
 done
 
 definition
   is_formula_N :: "[i=>o,i,i] => o" where
     "is_formula_N(M,n,Z) == 
       \<exists>zero[M]. empty(M,zero) & 
                 is_iterates(M, is_formula_functor(M), zero, n, Z)"
 
 
 definition  
   mem_formula :: "[i=>o,i] => o" where
     "mem_formula(M,p) == 
       \<exists>n[M]. \<exists>formn[M]. 
        finite_ordinal(M,n) & is_formula_N(M,n,formn) & p \<in> formn"
 
 definition
   is_formula :: "[i=>o,i] => o" where
     "is_formula(M,Z) == \<forall>p[M]. p \<in> Z \<longleftrightarrow> mem_formula(M,p)"
 
 locale M_datatypes = M_trancl +
  assumes list_replacement1:
    "M(A) ==> iterates_replacement(M, is_list_functor(M,A), 0)"
   and list_replacement2:
    "M(A) ==> strong_replacement(M,
          \<lambda>n y. n\<in>nat & is_iterates(M, is_list_functor(M,A), 0, n, y))"
   and formula_replacement1:
    "iterates_replacement(M, is_formula_functor(M), 0)"
   and formula_replacement2:
    "strong_replacement(M,
          \<lambda>n y. n\<in>nat & is_iterates(M, is_formula_functor(M), 0, n, y))"
   and nth_replacement:
    "M(l) ==> iterates_replacement(M, %l t. is_tl(M,l,t), l)"
 
 
 subsubsection\<open>Absoluteness of the List Construction\<close>
 
 lemma (in M_datatypes) list_replacement2':
   "M(A) ==> strong_replacement(M, \<lambda>n y. n\<in>nat & y = (\<lambda>X. {0} + A * X)^n (0))"
 apply (insert list_replacement2 [of A])
 apply (rule strong_replacement_cong [THEN iffD1])
 apply (rule conj_cong [OF iff_refl iterates_abs [of "is_list_functor(M,A)"]])
 apply (simp_all add: list_replacement1 relation1_def)
 done
 
 lemma (in M_datatypes) list_closed [intro,simp]:
      "M(A) ==> M(list(A))"
 apply (insert list_replacement1)
 by  (simp add: RepFun_closed2 list_eq_Union
                list_replacement2' relation1_def
                iterates_closed [of "is_list_functor(M,A)"])
 
 text\<open>WARNING: use only with \<open>dest:\<close> or with variables fixed!\<close>
 lemmas (in M_datatypes) list_into_M = transM [OF _ list_closed]
 
 lemma (in M_datatypes) list_N_abs [simp]:
      "[|M(A); n\<in>nat; M(Z)|]
       ==> is_list_N(M,A,n,Z) \<longleftrightarrow> Z = list_N(A,n)"
 apply (insert list_replacement1)
 apply (simp add: is_list_N_def list_N_def relation1_def nat_into_M
                  iterates_abs [of "is_list_functor(M,A)" _ "\<lambda>X. {0} + A*X"])
 done
 
 lemma (in M_datatypes) list_N_closed [intro,simp]:
      "[|M(A); n\<in>nat|] ==> M(list_N(A,n))"
 apply (insert list_replacement1)
 apply (simp add: is_list_N_def list_N_def relation1_def nat_into_M
                  iterates_closed [of "is_list_functor(M,A)"])
 done
 
 lemma (in M_datatypes) mem_list_abs [simp]:
      "M(A) ==> mem_list(M,A,l) \<longleftrightarrow> l \<in> list(A)"
 apply (insert list_replacement1)
 apply (simp add: mem_list_def list_N_def relation1_def list_eq_Union
                  iterates_closed [of "is_list_functor(M,A)"])
 done
 
 lemma (in M_datatypes) list_abs [simp]:
      "[|M(A); M(Z)|] ==> is_list(M,A,Z) \<longleftrightarrow> Z = list(A)"
 apply (simp add: is_list_def, safe)
 apply (rule M_equalityI, simp_all)
 done
 
 subsubsection\<open>Absoluteness of Formulas\<close>
 
 lemma (in M_datatypes) formula_replacement2':
   "strong_replacement(M, \<lambda>n y. n\<in>nat & y = (\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))^n (0))"
 apply (insert formula_replacement2)
 apply (rule strong_replacement_cong [THEN iffD1])
 apply (rule conj_cong [OF iff_refl iterates_abs [of "is_formula_functor(M)"]])
 apply (simp_all add: formula_replacement1 relation1_def)
 done
 
 lemma (in M_datatypes) formula_closed [intro,simp]:
      "M(formula)"
 apply (insert formula_replacement1)
 apply  (simp add: RepFun_closed2 formula_eq_Union
                   formula_replacement2' relation1_def
                   iterates_closed [of "is_formula_functor(M)"])
 done
 
 lemmas (in M_datatypes) formula_into_M = transM [OF _ formula_closed]
 
 lemma (in M_datatypes) formula_N_abs [simp]:
      "[|n\<in>nat; M(Z)|]
       ==> is_formula_N(M,n,Z) \<longleftrightarrow> Z = formula_N(n)"
 apply (insert formula_replacement1)
 apply (simp add: is_formula_N_def formula_N_def relation1_def nat_into_M
                  iterates_abs [of "is_formula_functor(M)" _
                                   "\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X)"])
 done
 
 lemma (in M_datatypes) formula_N_closed [intro,simp]:
      "n\<in>nat ==> M(formula_N(n))"
 apply (insert formula_replacement1)
 apply (simp add: is_formula_N_def formula_N_def relation1_def nat_into_M
                  iterates_closed [of "is_formula_functor(M)"])
 done
 
 lemma (in M_datatypes) mem_formula_abs [simp]:
      "mem_formula(M,l) \<longleftrightarrow> l \<in> formula"
 apply (insert formula_replacement1)
 apply (simp add: mem_formula_def relation1_def formula_eq_Union formula_N_def
                  iterates_closed [of "is_formula_functor(M)"])
 done
 
 lemma (in M_datatypes) formula_abs [simp]:
      "[|M(Z)|] ==> is_formula(M,Z) \<longleftrightarrow> Z = formula"
 apply (simp add: is_formula_def, safe)
 apply (rule M_equalityI, simp_all)
 done
 
 
 subsection\<open>Absoluteness for \<open>\<epsilon>\<close>-Closure: the \<^term>\<open>eclose\<close> Operator\<close>
 
 text\<open>Re-expresses eclose using "iterates"\<close>
 lemma eclose_eq_Union:
      "eclose(A) = (\<Union>n\<in>nat. Union^n (A))"
 apply (simp add: eclose_def)
 apply (rule UN_cong)
 apply (rule refl)
 apply (induct_tac n)
 apply (simp add: nat_rec_0)
 apply (simp add: nat_rec_succ)
 done
 
 definition
   is_eclose_n :: "[i=>o,i,i,i] => o" where
     "is_eclose_n(M,A,n,Z) == is_iterates(M, big_union(M), A, n, Z)"
 
 definition
   mem_eclose :: "[i=>o,i,i] => o" where
     "mem_eclose(M,A,l) ==
       \<exists>n[M]. \<exists>eclosen[M].
        finite_ordinal(M,n) & is_eclose_n(M,A,n,eclosen) & l \<in> eclosen"
 
 definition
   is_eclose :: "[i=>o,i,i] => o" where
     "is_eclose(M,A,Z) == \<forall>u[M]. u \<in> Z \<longleftrightarrow> mem_eclose(M,A,u)"
 
 
 locale M_eclose = M_datatypes +
  assumes eclose_replacement1:
    "M(A) ==> iterates_replacement(M, big_union(M), A)"
   and eclose_replacement2:
    "M(A) ==> strong_replacement(M,
          \<lambda>n y. n\<in>nat & is_iterates(M, big_union(M), A, n, y))"
 
 lemma (in M_eclose) eclose_replacement2':
   "M(A) ==> strong_replacement(M, \<lambda>n y. n\<in>nat & y = Union^n (A))"
 apply (insert eclose_replacement2 [of A])
 apply (rule strong_replacement_cong [THEN iffD1])
 apply (rule conj_cong [OF iff_refl iterates_abs [of "big_union(M)"]])
 apply (simp_all add: eclose_replacement1 relation1_def)
 done
 
 lemma (in M_eclose) eclose_closed [intro,simp]:
      "M(A) ==> M(eclose(A))"
 apply (insert eclose_replacement1)
 by  (simp add: RepFun_closed2 eclose_eq_Union
                eclose_replacement2' relation1_def
                iterates_closed [of "big_union(M)"])
 
 lemma (in M_eclose) is_eclose_n_abs [simp]:
      "[|M(A); n\<in>nat; M(Z)|] ==> is_eclose_n(M,A,n,Z) \<longleftrightarrow> Z = Union^n (A)"
 apply (insert eclose_replacement1)
 apply (simp add: is_eclose_n_def relation1_def nat_into_M
                  iterates_abs [of "big_union(M)" _ "Union"])
 done
 
 lemma (in M_eclose) mem_eclose_abs [simp]:
      "M(A) ==> mem_eclose(M,A,l) \<longleftrightarrow> l \<in> eclose(A)"
 apply (insert eclose_replacement1)
 apply (simp add: mem_eclose_def relation1_def eclose_eq_Union
                  iterates_closed [of "big_union(M)"])
 done
 
 lemma (in M_eclose) eclose_abs [simp]:
      "[|M(A); M(Z)|] ==> is_eclose(M,A,Z) \<longleftrightarrow> Z = eclose(A)"
 apply (simp add: is_eclose_def, safe)
 apply (rule M_equalityI, simp_all)
 done
 
 
 subsection \<open>Absoluteness for \<^term>\<open>transrec\<close>\<close>
 
 text\<open>\<^prop>\<open>transrec(a,H) \<equiv> wfrec(Memrel(eclose({a})), a, H)\<close>\<close>
 
 definition
   is_transrec :: "[i=>o, [i,i,i]=>o, i, i] => o" where
    "is_transrec(M,MH,a,z) ==
       \<exists>sa[M]. \<exists>esa[M]. \<exists>mesa[M].
        upair(M,a,a,sa) & is_eclose(M,sa,esa) & membership(M,esa,mesa) &
        is_wfrec(M,MH,mesa,a,z)"
 
 definition
   transrec_replacement :: "[i=>o, [i,i,i]=>o, i] => o" where
    "transrec_replacement(M,MH,a) ==
       \<exists>sa[M]. \<exists>esa[M]. \<exists>mesa[M].
        upair(M,a,a,sa) & is_eclose(M,sa,esa) & membership(M,esa,mesa) &
        wfrec_replacement(M,MH,mesa)"
 
 text\<open>The condition \<^term>\<open>Ord(i)\<close> lets us use the simpler
   \<open>trans_wfrec_abs\<close> rather than \<open>trans_wfrec_abs\<close>,
   which I haven't even proved yet.\<close>
 theorem (in M_eclose) transrec_abs:
   "[|transrec_replacement(M,MH,i);  relation2(M,MH,H);
      Ord(i);  M(i);  M(z);
      \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|]
    ==> is_transrec(M,MH,i,z) \<longleftrightarrow> z = transrec(i,H)"
 by (simp add: trans_wfrec_abs transrec_replacement_def is_transrec_def
        transrec_def eclose_sing_Ord_eq wf_Memrel trans_Memrel relation_Memrel)
 
 
 theorem (in M_eclose) transrec_closed:
      "[|transrec_replacement(M,MH,i);  relation2(M,MH,H);
         Ord(i);  M(i);
         \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|]
       ==> M(transrec(i,H))"
 by (simp add: trans_wfrec_closed transrec_replacement_def is_transrec_def
         transrec_def eclose_sing_Ord_eq wf_Memrel trans_Memrel relation_Memrel)
 
 
 text\<open>Helps to prove instances of \<^term>\<open>transrec_replacement\<close>\<close>
 lemma (in M_eclose) transrec_replacementI:
    "[|M(a);
       strong_replacement (M,
                   \<lambda>x z. \<exists>y[M]. pair(M, x, y, z) &
                                is_wfrec(M,MH,Memrel(eclose({a})),x,y))|]
     ==> transrec_replacement(M,MH,a)"
 by (simp add: transrec_replacement_def wfrec_replacement_def)
 
 
 subsection\<open>Absoluteness for the List Operator \<^term>\<open>length\<close>\<close>
 text\<open>But it is never used.\<close>
 
 definition
   is_length :: "[i=>o,i,i,i] => o" where
     "is_length(M,A,l,n) ==
        \<exists>sn[M]. \<exists>list_n[M]. \<exists>list_sn[M].
         is_list_N(M,A,n,list_n) & l \<notin> list_n &
         successor(M,n,sn) & is_list_N(M,A,sn,list_sn) & l \<in> list_sn"
 
 
 lemma (in M_datatypes) length_abs [simp]:
      "[|M(A); l \<in> list(A); n \<in> nat|] ==> is_length(M,A,l,n) \<longleftrightarrow> n = length(l)"
 apply (subgoal_tac "M(l) & M(n)")
  prefer 2 apply (blast dest: transM)
 apply (simp add: is_length_def)
 apply (blast intro: list_imp_list_N nat_into_Ord list_N_imp_eq_length
              dest: list_N_imp_length_lt)
 done
 
 text\<open>Proof is trivial since \<^term>\<open>length\<close> returns natural numbers.\<close>
 lemma (in M_trivial) length_closed [intro,simp]:
      "l \<in> list(A) ==> M(length(l))"
 by (simp add: nat_into_M)
 
 
 subsection \<open>Absoluteness for the List Operator \<^term>\<open>nth\<close>\<close>
 
 lemma nth_eq_hd_iterates_tl [rule_format]:
      "xs \<in> list(A) ==> \<forall>n \<in> nat. nth(n,xs) = hd' (tl'^n (xs))"
 apply (induct_tac xs)
 apply (simp add: iterates_tl_Nil hd'_Nil, clarify)
 apply (erule natE)
 apply (simp add: hd'_Cons)
 apply (simp add: tl'_Cons iterates_commute)
 done
 
 lemma (in M_basic) iterates_tl'_closed:
      "[|n \<in> nat; M(x)|] ==> M(tl'^n (x))"
 apply (induct_tac n, simp)
 apply (simp add: tl'_Cons tl'_closed)
 done
 
 text\<open>Immediate by type-checking\<close>
 lemma (in M_datatypes) nth_closed [intro,simp]:
      "[|xs \<in> list(A); n \<in> nat; M(A)|] ==> M(nth(n,xs))"
 apply (case_tac "n < length(xs)")
  apply (blast intro: nth_type transM)
 apply (simp add: not_lt_iff_le nth_eq_0)
 done
 
 definition
   is_nth :: "[i=>o,i,i,i] => o" where
     "is_nth(M,n,l,Z) ==
       \<exists>X[M]. is_iterates(M, is_tl(M), l, n, X) & is_hd(M,X,Z)"
 
 lemma (in M_datatypes) nth_abs [simp]:
      "[|M(A); n \<in> nat; l \<in> list(A); M(Z)|]
       ==> is_nth(M,n,l,Z) \<longleftrightarrow> Z = nth(n,l)"
 apply (subgoal_tac "M(l)")
  prefer 2 apply (blast intro: transM)
 apply (simp add: is_nth_def nth_eq_hd_iterates_tl nat_into_M
                  tl'_closed iterates_tl'_closed
                  iterates_abs [OF _ relation1_tl] nth_replacement)
 done
 
 
 subsection\<open>Relativization and Absoluteness for the \<^term>\<open>formula\<close> Constructors\<close>
 
 definition
   is_Member :: "[i=>o,i,i,i] => o" where
      \<comment> \<open>because \<^term>\<open>Member(x,y) \<equiv> Inl(Inl(\<langle>x,y\<rangle>))\<close>\<close>
     "is_Member(M,x,y,Z) ==
         \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inl(M,u,Z)"
 
 lemma (in M_trivial) Member_abs [simp]:
      "[|M(x); M(y); M(Z)|] ==> is_Member(M,x,y,Z) \<longleftrightarrow> (Z = Member(x,y))"
 by (simp add: is_Member_def Member_def)
 
 lemma (in M_trivial) Member_in_M_iff [iff]:
      "M(Member(x,y)) \<longleftrightarrow> M(x) & M(y)"
 by (simp add: Member_def)
 
 definition
   is_Equal :: "[i=>o,i,i,i] => o" where
      \<comment> \<open>because \<^term>\<open>Equal(x,y) \<equiv> Inl(Inr(\<langle>x,y\<rangle>))\<close>\<close>
     "is_Equal(M,x,y,Z) ==
         \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inr(M,p,u) & is_Inl(M,u,Z)"
 
 lemma (in M_trivial) Equal_abs [simp]:
      "[|M(x); M(y); M(Z)|] ==> is_Equal(M,x,y,Z) \<longleftrightarrow> (Z = Equal(x,y))"
 by (simp add: is_Equal_def Equal_def)
 
 lemma (in M_trivial) Equal_in_M_iff [iff]: "M(Equal(x,y)) \<longleftrightarrow> M(x) & M(y)"
 by (simp add: Equal_def)
 
 definition
   is_Nand :: "[i=>o,i,i,i] => o" where
      \<comment> \<open>because \<^term>\<open>Nand(x,y) \<equiv> Inr(Inl(\<langle>x,y\<rangle>))\<close>\<close>
     "is_Nand(M,x,y,Z) ==
         \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inr(M,u,Z)"
 
 lemma (in M_trivial) Nand_abs [simp]:
      "[|M(x); M(y); M(Z)|] ==> is_Nand(M,x,y,Z) \<longleftrightarrow> (Z = Nand(x,y))"
 by (simp add: is_Nand_def Nand_def)
 
 lemma (in M_trivial) Nand_in_M_iff [iff]: "M(Nand(x,y)) \<longleftrightarrow> M(x) & M(y)"
 by (simp add: Nand_def)
 
 definition
   is_Forall :: "[i=>o,i,i] => o" where
      \<comment> \<open>because \<^term>\<open>Forall(x) \<equiv> Inr(Inr(p))\<close>\<close>
     "is_Forall(M,p,Z) == \<exists>u[M]. is_Inr(M,p,u) & is_Inr(M,u,Z)"
 
 lemma (in M_trivial) Forall_abs [simp]:
      "[|M(x); M(Z)|] ==> is_Forall(M,x,Z) \<longleftrightarrow> (Z = Forall(x))"
 by (simp add: is_Forall_def Forall_def)
 
 lemma (in M_trivial) Forall_in_M_iff [iff]: "M(Forall(x)) \<longleftrightarrow> M(x)"
 by (simp add: Forall_def)
 
 
 
 subsection \<open>Absoluteness for \<^term>\<open>formula_rec\<close>\<close>
 
 definition
   formula_rec_case :: "[[i,i]=>i, [i,i]=>i, [i,i,i,i]=>i, [i,i]=>i, i, i] => i" where
     \<comment> \<open>the instance of \<^term>\<open>formula_case\<close> in \<^term>\<open>formula_rec\<close>\<close>
    "formula_rec_case(a,b,c,d,h) ==
         formula_case (a, b,
                 \<lambda>u v. c(u, v, h ` succ(depth(u)) ` u,
                               h ` succ(depth(v)) ` v),
                 \<lambda>u. d(u, h ` succ(depth(u)) ` u))"
 
 text\<open>Unfold \<^term>\<open>formula_rec\<close> to \<^term>\<open>formula_rec_case\<close>.
      Express \<^term>\<open>formula_rec\<close> without using \<^term>\<open>rank\<close> or \<^term>\<open>Vset\<close>,
 neither of which is absolute.\<close>
 lemma (in M_trivial) formula_rec_eq:
   "p \<in> formula ==>
    formula_rec(a,b,c,d,p) =
    transrec (succ(depth(p)),
              \<lambda>x h. Lambda (formula, formula_rec_case(a,b,c,d,h))) ` p"
 apply (simp add: formula_rec_case_def)
 apply (induct_tac p)
    txt\<open>Base case for \<^term>\<open>Member\<close>\<close>
    apply (subst transrec, simp add: formula.intros)
   txt\<open>Base case for \<^term>\<open>Equal\<close>\<close>
   apply (subst transrec, simp add: formula.intros)
  txt\<open>Inductive step for \<^term>\<open>Nand\<close>\<close>
  apply (subst transrec)
  apply (simp add: succ_Un_distrib formula.intros)
 txt\<open>Inductive step for \<^term>\<open>Forall\<close>\<close>
 apply (subst transrec)
 apply (simp add: formula_imp_formula_N formula.intros)
 done
 
 
 subsubsection\<open>Absoluteness for the Formula Operator \<^term>\<open>depth\<close>\<close>
 
 definition
   is_depth :: "[i=>o,i,i] => o" where
     "is_depth(M,p,n) ==
        \<exists>sn[M]. \<exists>formula_n[M]. \<exists>formula_sn[M].
         is_formula_N(M,n,formula_n) & p \<notin> formula_n &
         successor(M,n,sn) & is_formula_N(M,sn,formula_sn) & p \<in> formula_sn"
 
 
 lemma (in M_datatypes) depth_abs [simp]:
      "[|p \<in> formula; n \<in> nat|] ==> is_depth(M,p,n) \<longleftrightarrow> n = depth(p)"
 apply (subgoal_tac "M(p) & M(n)")
  prefer 2 apply (blast dest: transM)
 apply (simp add: is_depth_def)
 apply (blast intro: formula_imp_formula_N nat_into_Ord formula_N_imp_eq_depth
              dest: formula_N_imp_depth_lt)
 done
 
 text\<open>Proof is trivial since \<^term>\<open>depth\<close> returns natural numbers.\<close>
 lemma (in M_trivial) depth_closed [intro,simp]:
      "p \<in> formula ==> M(depth(p))"
 by (simp add: nat_into_M)
 
 
 subsubsection\<open>\<^term>\<open>is_formula_case\<close>: relativization of \<^term>\<open>formula_case\<close>\<close>
 
 definition
  is_formula_case ::
     "[i=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i]=>o, i, i] => o" where
   \<comment> \<open>no constraint on non-formulas\<close>
   "is_formula_case(M, is_a, is_b, is_c, is_d, p, z) ==
       (\<forall>x[M]. \<forall>y[M]. finite_ordinal(M,x) \<longrightarrow> finite_ordinal(M,y) \<longrightarrow>
                       is_Member(M,x,y,p) \<longrightarrow> is_a(x,y,z)) &
       (\<forall>x[M]. \<forall>y[M]. finite_ordinal(M,x) \<longrightarrow> finite_ordinal(M,y) \<longrightarrow>
                       is_Equal(M,x,y,p) \<longrightarrow> is_b(x,y,z)) &
       (\<forall>x[M]. \<forall>y[M]. mem_formula(M,x) \<longrightarrow> mem_formula(M,y) \<longrightarrow>
                      is_Nand(M,x,y,p) \<longrightarrow> is_c(x,y,z)) &
       (\<forall>x[M]. mem_formula(M,x) \<longrightarrow> is_Forall(M,x,p) \<longrightarrow> is_d(x,z))"
 
 lemma (in M_datatypes) formula_case_abs [simp]:
      "[| Relation2(M,nat,nat,is_a,a); Relation2(M,nat,nat,is_b,b);
          Relation2(M,formula,formula,is_c,c); Relation1(M,formula,is_d,d);
          p \<in> formula; M(z) |]
       ==> is_formula_case(M,is_a,is_b,is_c,is_d,p,z) \<longleftrightarrow>
           z = formula_case(a,b,c,d,p)"
 apply (simp add: formula_into_M is_formula_case_def)
 apply (erule formula.cases)
    apply (simp_all add: Relation1_def Relation2_def)
 done
 
 lemma (in M_datatypes) formula_case_closed [intro,simp]:
   "[|p \<in> formula;
      \<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> M(a(x,y));
      \<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> M(b(x,y));
      \<forall>x[M]. \<forall>y[M]. x\<in>formula \<longrightarrow> y\<in>formula \<longrightarrow> M(c(x,y));
      \<forall>x[M]. x\<in>formula \<longrightarrow> M(d(x))|] ==> M(formula_case(a,b,c,d,p))"
 by (erule formula.cases, simp_all)
 
 
 subsubsection \<open>Absoluteness for \<^term>\<open>formula_rec\<close>: Final Results\<close>
 
 definition
   is_formula_rec :: "[i=>o, [i,i,i]=>o, i, i] => o" where
     \<comment> \<open>predicate to relativize the functional \<^term>\<open>formula_rec\<close>\<close>
    "is_formula_rec(M,MH,p,z)  ==
       \<exists>dp[M]. \<exists>i[M]. \<exists>f[M]. finite_ordinal(M,dp) & is_depth(M,p,dp) &
              successor(M,dp,i) & fun_apply(M,f,p,z) & is_transrec(M,MH,i,f)"
 
 
 text\<open>Sufficient conditions to relativize the instance of \<^term>\<open>formula_case\<close>
       in \<^term>\<open>formula_rec\<close>\<close>
 lemma (in M_datatypes) Relation1_formula_rec_case:
      "[|Relation2(M, nat, nat, is_a, a);
         Relation2(M, nat, nat, is_b, b);
         Relation2 (M, formula, formula,
            is_c, \<lambda>u v. c(u, v, h`succ(depth(u))`u, h`succ(depth(v))`v));
         Relation1(M, formula,
            is_d, \<lambda>u. d(u, h ` succ(depth(u)) ` u));
         M(h) |]
       ==> Relation1(M, formula,
                          is_formula_case (M, is_a, is_b, is_c, is_d),
                          formula_rec_case(a, b, c, d, h))"
 apply (simp (no_asm) add: formula_rec_case_def Relation1_def)
-apply (simp add: formula_case_abs)
+apply (simp)
 done
 
 
 text\<open>This locale packages the premises of the following theorems,
       which is the normal purpose of locales.  It doesn't accumulate
-      constraints on the class \<^term>\<open>M\<close>, as in most of this deveopment.\<close>
+      constraints on the class \<^term>\<open>M\<close>, as in most of this development.\<close>
 locale Formula_Rec = M_eclose +
   fixes a and is_a and b and is_b and c and is_c and d and is_d and MH
   defines
       "MH(u::i,f,z) ==
         \<forall>fml[M]. is_formula(M,fml) \<longrightarrow>
              is_lambda
          (M, fml, is_formula_case (M, is_a, is_b, is_c(f), is_d(f)), z)"
 
   assumes a_closed: "[|x\<in>nat; y\<in>nat|] ==> M(a(x,y))"
       and a_rel:    "Relation2(M, nat, nat, is_a, a)"
       and b_closed: "[|x\<in>nat; y\<in>nat|] ==> M(b(x,y))"
       and b_rel:    "Relation2(M, nat, nat, is_b, b)"
       and c_closed: "[|x \<in> formula; y \<in> formula; M(gx); M(gy)|]
                      ==> M(c(x, y, gx, gy))"
       and c_rel:
          "M(f) ==>
           Relation2 (M, formula, formula, is_c(f),
              \<lambda>u v. c(u, v, f ` succ(depth(u)) ` u, f ` succ(depth(v)) ` v))"
       and d_closed: "[|x \<in> formula; M(gx)|] ==> M(d(x, gx))"
       and d_rel:
          "M(f) ==>
           Relation1(M, formula, is_d(f), \<lambda>u. d(u, f ` succ(depth(u)) ` u))"
       and fr_replace: "n \<in> nat ==> transrec_replacement(M,MH,n)"
       and fr_lam_replace:
            "M(g) ==>
             strong_replacement
               (M, \<lambda>x y. x \<in> formula &
                   y = \<langle>x, formula_rec_case(a,b,c,d,g,x)\<rangle>)"
 
 lemma (in Formula_Rec) formula_rec_case_closed:
     "[|M(g); p \<in> formula|] ==> M(formula_rec_case(a, b, c, d, g, p))"
 by (simp add: formula_rec_case_def a_closed b_closed c_closed d_closed)
 
 lemma (in Formula_Rec) formula_rec_lam_closed:
     "M(g) ==> M(Lambda (formula, formula_rec_case(a,b,c,d,g)))"
 by (simp add: lam_closed2 fr_lam_replace formula_rec_case_closed)
 
 lemma (in Formula_Rec) MH_rel2:
      "relation2 (M, MH,
              \<lambda>x h. Lambda (formula, formula_rec_case(a,b,c,d,h)))"
 apply (simp add: relation2_def MH_def, clarify)
 apply (rule lambda_abs2)
 apply (rule Relation1_formula_rec_case)
 apply (simp_all add: a_rel b_rel c_rel d_rel formula_rec_case_closed)
 done
 
 lemma (in Formula_Rec) fr_transrec_closed:
     "n \<in> nat
      ==> M(transrec
           (n, \<lambda>x h. Lambda(formula, formula_rec_case(a, b, c, d, h))))"
 by (simp add: transrec_closed [OF fr_replace MH_rel2]
               nat_into_M formula_rec_lam_closed)
 
 text\<open>The main two results: \<^term>\<open>formula_rec\<close> is absolute for \<^term>\<open>M\<close>.\<close>
 theorem (in Formula_Rec) formula_rec_closed:
     "p \<in> formula ==> M(formula_rec(a,b,c,d,p))"
 by (simp add: formula_rec_eq fr_transrec_closed
               transM [OF _ formula_closed])
 
 theorem (in Formula_Rec) formula_rec_abs:
   "[| p \<in> formula; M(z)|]
    ==> is_formula_rec(M,MH,p,z) \<longleftrightarrow> z = formula_rec(a,b,c,d,p)"
 by (simp add: is_formula_rec_def formula_rec_eq transM [OF _ formula_closed]
               transrec_abs [OF fr_replace MH_rel2] depth_type
               fr_transrec_closed formula_rec_lam_closed eq_commute)
 
 
 end
diff --git a/src/ZF/Constructible/Formula.thy b/src/ZF/Constructible/Formula.thy
--- a/src/ZF/Constructible/Formula.thy
+++ b/src/ZF/Constructible/Formula.thy
@@ -1,1042 +1,1042 @@
 (*  Title:      ZF/Constructible/Formula.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>First-Order Formulas and the Definition of the Class L\<close>
 
 theory Formula imports ZF begin
 
 subsection\<open>Internalized formulas of FOL\<close>
 
 text\<open>De Bruijn representation.
   Unbound variables get their denotations from an environment.\<close>
 
 consts   formula :: i
 datatype
   "formula" = Member ("x \<in> nat", "y \<in> nat")
             | Equal  ("x \<in> nat", "y \<in> nat")
             | Nand ("p \<in> formula", "q \<in> formula")
             | Forall ("p \<in> formula")
 
 declare formula.intros [TC]
 
 definition
   Neg :: "i=>i" where
   "Neg(p) == Nand(p,p)"
 
 definition
   And :: "[i,i]=>i" where
   "And(p,q) == Neg(Nand(p,q))"
 
 definition
   Or :: "[i,i]=>i" where
   "Or(p,q) == Nand(Neg(p),Neg(q))"
 
 definition
   Implies :: "[i,i]=>i" where
   "Implies(p,q) == Nand(p,Neg(q))"
 
 definition
   Iff :: "[i,i]=>i" where
   "Iff(p,q) == And(Implies(p,q), Implies(q,p))"
 
 definition
   Exists :: "i=>i" where
   "Exists(p) == Neg(Forall(Neg(p)))"
 
 lemma Neg_type [TC]: "p \<in> formula ==> Neg(p) \<in> formula"
 by (simp add: Neg_def)
 
 lemma And_type [TC]: "[| p \<in> formula; q \<in> formula |] ==> And(p,q) \<in> formula"
 by (simp add: And_def)
 
 lemma Or_type [TC]: "[| p \<in> formula; q \<in> formula |] ==> Or(p,q) \<in> formula"
 by (simp add: Or_def)
 
 lemma Implies_type [TC]:
      "[| p \<in> formula; q \<in> formula |] ==> Implies(p,q) \<in> formula"
 by (simp add: Implies_def)
 
 lemma Iff_type [TC]:
      "[| p \<in> formula; q \<in> formula |] ==> Iff(p,q) \<in> formula"
 by (simp add: Iff_def)
 
 lemma Exists_type [TC]: "p \<in> formula ==> Exists(p) \<in> formula"
 by (simp add: Exists_def)
 
 
 consts   satisfies :: "[i,i]=>i"
 primrec (*explicit lambda is required because the environment varies*)
   "satisfies(A,Member(x,y)) =
       (\<lambda>env \<in> list(A). bool_of_o (nth(x,env) \<in> nth(y,env)))"
 
   "satisfies(A,Equal(x,y)) =
       (\<lambda>env \<in> list(A). bool_of_o (nth(x,env) = nth(y,env)))"
 
   "satisfies(A,Nand(p,q)) =
       (\<lambda>env \<in> list(A). not ((satisfies(A,p)`env) and (satisfies(A,q)`env)))"
 
   "satisfies(A,Forall(p)) =
       (\<lambda>env \<in> list(A). bool_of_o (\<forall>x\<in>A. satisfies(A,p) ` (Cons(x,env)) = 1))"
 
 
 lemma "p \<in> formula ==> satisfies(A,p) \<in> list(A) -> bool"
 by (induct set: formula) simp_all
 
 abbreviation
   sats :: "[i,i,i] => o" where
   "sats(A,p,env) == satisfies(A,p)`env = 1"
 
 lemma [simp]:
   "env \<in> list(A)
    ==> sats(A, Member(x,y), env) \<longleftrightarrow> nth(x,env) \<in> nth(y,env)"
 by simp
 
 lemma [simp]:
   "env \<in> list(A)
    ==> sats(A, Equal(x,y), env) \<longleftrightarrow> nth(x,env) = nth(y,env)"
 by simp
 
 lemma sats_Nand_iff [simp]:
   "env \<in> list(A)
    ==> (sats(A, Nand(p,q), env)) \<longleftrightarrow> ~ (sats(A,p,env) & sats(A,q,env))"
 by (simp add: Bool.and_def Bool.not_def cond_def)
 
 lemma sats_Forall_iff [simp]:
   "env \<in> list(A)
    ==> sats(A, Forall(p), env) \<longleftrightarrow> (\<forall>x\<in>A. sats(A, p, Cons(x,env)))"
 by simp
 
 declare satisfies.simps [simp del]
 
 subsection\<open>Dividing line between primitive and derived connectives\<close>
 
 lemma sats_Neg_iff [simp]:
   "env \<in> list(A)
    ==> sats(A, Neg(p), env) \<longleftrightarrow> ~ sats(A,p,env)"
 by (simp add: Neg_def)
 
 lemma sats_And_iff [simp]:
   "env \<in> list(A)
    ==> (sats(A, And(p,q), env)) \<longleftrightarrow> sats(A,p,env) & sats(A,q,env)"
 by (simp add: And_def)
 
 lemma sats_Or_iff [simp]:
   "env \<in> list(A)
    ==> (sats(A, Or(p,q), env)) \<longleftrightarrow> sats(A,p,env) | sats(A,q,env)"
 by (simp add: Or_def)
 
 lemma sats_Implies_iff [simp]:
   "env \<in> list(A)
    ==> (sats(A, Implies(p,q), env)) \<longleftrightarrow> (sats(A,p,env) \<longrightarrow> sats(A,q,env))"
 by (simp add: Implies_def, blast)
 
 lemma sats_Iff_iff [simp]:
   "env \<in> list(A)
    ==> (sats(A, Iff(p,q), env)) \<longleftrightarrow> (sats(A,p,env) \<longleftrightarrow> sats(A,q,env))"
 by (simp add: Iff_def, blast)
 
 lemma sats_Exists_iff [simp]:
   "env \<in> list(A)
    ==> sats(A, Exists(p), env) \<longleftrightarrow> (\<exists>x\<in>A. sats(A, p, Cons(x,env)))"
 by (simp add: Exists_def)
 
 
 subsubsection\<open>Derived rules to help build up formulas\<close>
 
 lemma mem_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; env \<in> list(A)|]
        ==> (x\<in>y) \<longleftrightarrow> sats(A, Member(i,j), env)"
 by (simp add: satisfies.simps)
 
 lemma equal_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; env \<in> list(A)|]
        ==> (x=y) \<longleftrightarrow> sats(A, Equal(i,j), env)"
 by (simp add: satisfies.simps)
 
 lemma not_iff_sats:
       "[| P \<longleftrightarrow> sats(A,p,env); env \<in> list(A)|]
        ==> (~P) \<longleftrightarrow> sats(A, Neg(p), env)"
 by simp
 
 lemma conj_iff_sats:
       "[| P \<longleftrightarrow> sats(A,p,env); Q \<longleftrightarrow> sats(A,q,env); env \<in> list(A)|]
        ==> (P & Q) \<longleftrightarrow> sats(A, And(p,q), env)"
-by (simp add: sats_And_iff)
+by (simp)
 
 lemma disj_iff_sats:
       "[| P \<longleftrightarrow> sats(A,p,env); Q \<longleftrightarrow> sats(A,q,env); env \<in> list(A)|]
        ==> (P | Q) \<longleftrightarrow> sats(A, Or(p,q), env)"
-by (simp add: sats_Or_iff)
+by (simp)
 
 lemma iff_iff_sats:
       "[| P \<longleftrightarrow> sats(A,p,env); Q \<longleftrightarrow> sats(A,q,env); env \<in> list(A)|]
        ==> (P \<longleftrightarrow> Q) \<longleftrightarrow> sats(A, Iff(p,q), env)"
-by (simp add: sats_Forall_iff)
+by (simp)
 
 lemma imp_iff_sats:
       "[| P \<longleftrightarrow> sats(A,p,env); Q \<longleftrightarrow> sats(A,q,env); env \<in> list(A)|]
        ==> (P \<longrightarrow> Q) \<longleftrightarrow> sats(A, Implies(p,q), env)"
-by (simp add: sats_Forall_iff)
+by (simp)
 
 lemma ball_iff_sats:
       "[| !!x. x\<in>A ==> P(x) \<longleftrightarrow> sats(A, p, Cons(x, env)); env \<in> list(A)|]
        ==> (\<forall>x\<in>A. P(x)) \<longleftrightarrow> sats(A, Forall(p), env)"
-by (simp add: sats_Forall_iff)
+by (simp)
 
 lemma bex_iff_sats:
       "[| !!x. x\<in>A ==> P(x) \<longleftrightarrow> sats(A, p, Cons(x, env)); env \<in> list(A)|]
        ==> (\<exists>x\<in>A. P(x)) \<longleftrightarrow> sats(A, Exists(p), env)"
-by (simp add: sats_Exists_iff)
+by (simp)
 
 lemmas FOL_iff_sats =
         mem_iff_sats equal_iff_sats not_iff_sats conj_iff_sats
         disj_iff_sats imp_iff_sats iff_iff_sats imp_iff_sats ball_iff_sats
         bex_iff_sats
 
 
 subsection\<open>Arity of a Formula: Maximum Free de Bruijn Index\<close>
 
 consts   arity :: "i=>i"
 primrec
   "arity(Member(x,y)) = succ(x) \<union> succ(y)"
 
   "arity(Equal(x,y)) = succ(x) \<union> succ(y)"
 
   "arity(Nand(p,q)) = arity(p) \<union> arity(q)"
 
   "arity(Forall(p)) = Arith.pred(arity(p))"
 
 
 lemma arity_type [TC]: "p \<in> formula ==> arity(p) \<in> nat"
 by (induct_tac p, simp_all)
 
 lemma arity_Neg [simp]: "arity(Neg(p)) = arity(p)"
 by (simp add: Neg_def)
 
 lemma arity_And [simp]: "arity(And(p,q)) = arity(p) \<union> arity(q)"
 by (simp add: And_def)
 
 lemma arity_Or [simp]: "arity(Or(p,q)) = arity(p) \<union> arity(q)"
 by (simp add: Or_def)
 
 lemma arity_Implies [simp]: "arity(Implies(p,q)) = arity(p) \<union> arity(q)"
 by (simp add: Implies_def)
 
 lemma arity_Iff [simp]: "arity(Iff(p,q)) = arity(p) \<union> arity(q)"
 by (simp add: Iff_def, blast)
 
 lemma arity_Exists [simp]: "arity(Exists(p)) = Arith.pred(arity(p))"
 by (simp add: Exists_def)
 
 
 lemma arity_sats_iff [rule_format]:
   "[| p \<in> formula; extra \<in> list(A) |]
    ==> \<forall>env \<in> list(A).
            arity(p) \<le> length(env) \<longrightarrow>
            sats(A, p, env @ extra) \<longleftrightarrow> sats(A, p, env)"
 apply (induct_tac p)
 apply (simp_all add: Arith.pred_def nth_append Un_least_lt_iff nat_imp_quasinat
                 split: split_nat_case, auto)
 done
 
 lemma arity_sats1_iff:
   "[| arity(p) \<le> succ(length(env)); p \<in> formula; x \<in> A; env \<in> list(A);
       extra \<in> list(A) |]
    ==> sats(A, p, Cons(x, env @ extra)) \<longleftrightarrow> sats(A, p, Cons(x, env))"
 apply (insert arity_sats_iff [of p extra A "Cons(x,env)"])
 apply simp
 done
 
 
 subsection\<open>Renaming Some de Bruijn Variables\<close>
 
 definition
   incr_var :: "[i,i]=>i" where
   "incr_var(x,nq) == if x<nq then x else succ(x)"
 
 lemma incr_var_lt: "x<nq ==> incr_var(x,nq) = x"
 by (simp add: incr_var_def)
 
 lemma incr_var_le: "nq\<le>x ==> incr_var(x,nq) = succ(x)"
 apply (simp add: incr_var_def)
 apply (blast dest: lt_trans1)
 done
 
 consts   incr_bv :: "i=>i"
 primrec
   "incr_bv(Member(x,y)) =
       (\<lambda>nq \<in> nat. Member (incr_var(x,nq), incr_var(y,nq)))"
 
   "incr_bv(Equal(x,y)) =
       (\<lambda>nq \<in> nat. Equal (incr_var(x,nq), incr_var(y,nq)))"
 
   "incr_bv(Nand(p,q)) =
       (\<lambda>nq \<in> nat. Nand (incr_bv(p)`nq, incr_bv(q)`nq))"
 
   "incr_bv(Forall(p)) =
       (\<lambda>nq \<in> nat. Forall (incr_bv(p) ` succ(nq)))"
 
 
 lemma [TC]: "x \<in> nat ==> incr_var(x,nq) \<in> nat"
 by (simp add: incr_var_def)
 
 lemma incr_bv_type [TC]: "p \<in> formula ==> incr_bv(p) \<in> nat -> formula"
 by (induct_tac p, simp_all)
 
 text\<open>Obviously, \<^term>\<open>DPow\<close> is closed under complements and finite
 intersections and unions.  Needs an inductive lemma to allow two lists of
 parameters to be combined.\<close>
 
 lemma sats_incr_bv_iff [rule_format]:
   "[| p \<in> formula; env \<in> list(A); x \<in> A |]
    ==> \<forall>bvs \<in> list(A).
            sats(A, incr_bv(p) ` length(bvs), bvs @ Cons(x,env)) \<longleftrightarrow>
            sats(A, p, bvs@env)"
 apply (induct_tac p)
 apply (simp_all add: incr_var_def nth_append succ_lt_iff length_type)
 apply (auto simp add: diff_succ not_lt_iff_le)
 done
 
 
 (*the following two lemmas prevent huge case splits in arity_incr_bv_lemma*)
 lemma incr_var_lemma:
      "[| x \<in> nat; y \<in> nat; nq \<le> x |]
       ==> succ(x) \<union> incr_var(y,nq) = succ(x \<union> y)"
 apply (simp add: incr_var_def Ord_Un_if, auto)
   apply (blast intro: leI)
  apply (simp add: not_lt_iff_le)
  apply (blast intro: le_anti_sym)
 apply (blast dest: lt_trans2)
 done
 
 lemma incr_And_lemma:
      "y < x ==> y \<union> succ(x) = succ(x \<union> y)"
 apply (simp add: Ord_Un_if lt_Ord lt_Ord2 succ_lt_iff)
 apply (blast dest: lt_asym)
 done
 
 lemma arity_incr_bv_lemma [rule_format]:
   "p \<in> formula
    ==> \<forall>n \<in> nat. arity (incr_bv(p) ` n) =
                  (if n < arity(p) then succ(arity(p)) else arity(p))"
 apply (induct_tac p)
 apply (simp_all add: imp_disj not_lt_iff_le Un_least_lt_iff lt_Un_iff le_Un_iff
                      succ_Un_distrib [symmetric] incr_var_lt incr_var_le
                      Un_commute incr_var_lemma Arith.pred_def nat_imp_quasinat
             split: split_nat_case)
  txt\<open>the Forall case reduces to linear arithmetic\<close>
  prefer 2
  apply clarify
  apply (blast dest: lt_trans1)
 txt\<open>left with the And case\<close>
 apply safe
  apply (blast intro: incr_And_lemma lt_trans1)
 apply (subst incr_And_lemma)
  apply (blast intro: lt_trans1)
 apply (simp add: Un_commute)
 done
 
 
 subsection\<open>Renaming all but the First de Bruijn Variable\<close>
 
 definition
   incr_bv1 :: "i => i" where
   "incr_bv1(p) == incr_bv(p)`1"
 
 
 lemma incr_bv1_type [TC]: "p \<in> formula ==> incr_bv1(p) \<in> formula"
 by (simp add: incr_bv1_def)
 
 (*For renaming all but the bound variable at level 0*)
 lemma sats_incr_bv1_iff:
   "[| p \<in> formula; env \<in> list(A); x \<in> A; y \<in> A |]
    ==> sats(A, incr_bv1(p), Cons(x, Cons(y, env))) \<longleftrightarrow>
        sats(A, p, Cons(x,env))"
 apply (insert sats_incr_bv_iff [of p env A y "Cons(x,Nil)"])
 apply (simp add: incr_bv1_def)
 done
 
 lemma formula_add_params1 [rule_format]:
   "[| p \<in> formula; n \<in> nat; x \<in> A |]
    ==> \<forall>bvs \<in> list(A). \<forall>env \<in> list(A).
           length(bvs) = n \<longrightarrow>
           sats(A, iterates(incr_bv1, n, p), Cons(x, bvs@env)) \<longleftrightarrow>
           sats(A, p, Cons(x,env))"
 apply (induct_tac n, simp, clarify)
 apply (erule list.cases)
 apply (simp_all add: sats_incr_bv1_iff)
 done
 
 
 lemma arity_incr_bv1_eq:
   "p \<in> formula
    ==> arity(incr_bv1(p)) =
         (if 1 < arity(p) then succ(arity(p)) else arity(p))"
 apply (insert arity_incr_bv_lemma [of p 1])
 apply (simp add: incr_bv1_def)
 done
 
 lemma arity_iterates_incr_bv1_eq:
   "[| p \<in> formula; n \<in> nat |]
    ==> arity(incr_bv1^n(p)) =
          (if 1 < arity(p) then n #+ arity(p) else arity(p))"
 apply (induct_tac n)
 apply (simp_all add: arity_incr_bv1_eq)
 apply (simp add: not_lt_iff_le)
 apply (blast intro: le_trans add_le_self2 arity_type)
 done
 
 
 
 subsection\<open>Definable Powerset\<close>
 
 text\<open>The definable powerset operation: Kunen's definition VI 1.1, page 165.\<close>
 definition
   DPow :: "i => i" where
   "DPow(A) == {X \<in> Pow(A).
                \<exists>env \<in> list(A). \<exists>p \<in> formula.
                  arity(p) \<le> succ(length(env)) &
                  X = {x\<in>A. sats(A, p, Cons(x,env))}}"
 
 lemma DPowI:
   "[|env \<in> list(A);  p \<in> formula;  arity(p) \<le> succ(length(env))|]
    ==> {x\<in>A. sats(A, p, Cons(x,env))} \<in> DPow(A)"
 by (simp add: DPow_def, blast)
 
 text\<open>With this rule we can specify \<^term>\<open>p\<close> later.\<close>
 lemma DPowI2 [rule_format]:
   "[|\<forall>x\<in>A. P(x) \<longleftrightarrow> sats(A, p, Cons(x,env));
      env \<in> list(A);  p \<in> formula;  arity(p) \<le> succ(length(env))|]
    ==> {x\<in>A. P(x)} \<in> DPow(A)"
 by (simp add: DPow_def, blast)
 
 lemma DPowD:
   "X \<in> DPow(A)
    ==> X \<subseteq> A &
        (\<exists>env \<in> list(A).
         \<exists>p \<in> formula. arity(p) \<le> succ(length(env)) &
                       X = {x\<in>A. sats(A, p, Cons(x,env))})"
 by (simp add: DPow_def)
 
 lemmas DPow_imp_subset = DPowD [THEN conjunct1]
 
 (*Kunen's Lemma VI 1.2*)
 lemma "[| p \<in> formula; env \<in> list(A); arity(p) \<le> succ(length(env)) |]
        ==> {x\<in>A. sats(A, p, Cons(x,env))} \<in> DPow(A)"
 by (blast intro: DPowI)
 
 lemma DPow_subset_Pow: "DPow(A) \<subseteq> Pow(A)"
 by (simp add: DPow_def, blast)
 
 lemma empty_in_DPow: "0 \<in> DPow(A)"
 apply (simp add: DPow_def)
 apply (rule_tac x=Nil in bexI)
  apply (rule_tac x="Neg(Equal(0,0))" in bexI)
   apply (auto simp add: Un_least_lt_iff)
 done
 
 lemma Compl_in_DPow: "X \<in> DPow(A) ==> (A-X) \<in> DPow(A)"
 apply (simp add: DPow_def, clarify, auto)
 apply (rule bexI)
  apply (rule_tac x="Neg(p)" in bexI)
   apply auto
 done
 
 lemma Int_in_DPow: "[| X \<in> DPow(A); Y \<in> DPow(A) |] ==> X \<inter> Y \<in> DPow(A)"
 apply (simp add: DPow_def, auto)
 apply (rename_tac envp p envq q)
 apply (rule_tac x="envp@envq" in bexI)
  apply (rule_tac x="And(p, iterates(incr_bv1,length(envp),q))" in bexI)
   apply typecheck
 apply (rule conjI)
 (*finally check the arity!*)
- apply (simp add: arity_iterates_incr_bv1_eq length_app Un_least_lt_iff)
+ apply (simp add: arity_iterates_incr_bv1_eq Un_least_lt_iff)
  apply (force intro: add_le_self le_trans)
 apply (simp add: arity_sats1_iff formula_add_params1, blast)
 done
 
 lemma Un_in_DPow: "[| X \<in> DPow(A); Y \<in> DPow(A) |] ==> X \<union> Y \<in> DPow(A)"
 apply (subgoal_tac "X \<union> Y = A - ((A-X) \<inter> (A-Y))")
 apply (simp add: Int_in_DPow Compl_in_DPow)
 apply (simp add: DPow_def, blast)
 done
 
 lemma singleton_in_DPow: "a \<in> A ==> {a} \<in> DPow(A)"
 apply (simp add: DPow_def)
 apply (rule_tac x="Cons(a,Nil)" in bexI)
  apply (rule_tac x="Equal(0,1)" in bexI)
   apply typecheck
 apply (force simp add: succ_Un_distrib [symmetric])
 done
 
 lemma cons_in_DPow: "[| a \<in> A; X \<in> DPow(A) |] ==> cons(a,X) \<in> DPow(A)"
 apply (rule cons_eq [THEN subst])
 apply (blast intro: singleton_in_DPow Un_in_DPow)
 done
 
 (*Part of Lemma 1.3*)
 lemma Fin_into_DPow: "X \<in> Fin(A) ==> X \<in> DPow(A)"
 apply (erule Fin.induct)
  apply (rule empty_in_DPow)
 apply (blast intro: cons_in_DPow)
 done
 
 text\<open>\<^term>\<open>DPow\<close> is not monotonic.  For example, let \<^term>\<open>A\<close> be some
 non-constructible set of natural numbers, and let \<^term>\<open>B\<close> be \<^term>\<open>nat\<close>.
 Then \<^term>\<open>A<=B\<close> and obviously \<^term>\<open>A \<in> DPow(A)\<close> but \<^term>\<open>A \<notin>
 DPow(B)\<close>.\<close>
 
 (*This may be true but the proof looks difficult, requiring relativization
 lemma DPow_insert: "DPow (cons(a,A)) = DPow(A) \<union> {cons(a,X) . X \<in> DPow(A)}"
 apply (rule equalityI, safe)
 oops
 *)
 
 lemma Finite_Pow_subset_Pow: "Finite(A) ==> Pow(A) \<subseteq> DPow(A)"
 by (blast intro: Fin_into_DPow Finite_into_Fin Fin_subset)
 
 lemma Finite_DPow_eq_Pow: "Finite(A) ==> DPow(A) = Pow(A)"
 apply (rule equalityI)
 apply (rule DPow_subset_Pow)
 apply (erule Finite_Pow_subset_Pow)
 done
 
 
 subsection\<open>Internalized Formulas for the Ordinals\<close>
 
 text\<open>The \<open>sats\<close> theorems below differ from the usual form in that they
 include an element of absoluteness.  That is, they relate internalized
 formulas to real concepts such as the subset relation, rather than to the
 relativized concepts defined in theory \<open>Relative\<close>.  This lets us prove
 the theorem as \<open>Ords_in_DPow\<close> without first having to instantiate the
 locale \<open>M_trivial\<close>.  Note that the present theory does not even take
 \<open>Relative\<close> as a parent.\<close>
 
 subsubsection\<open>The subset relation\<close>
 
 definition
   subset_fm :: "[i,i]=>i" where
   "subset_fm(x,y) == Forall(Implies(Member(0,succ(x)), Member(0,succ(y))))"
 
 lemma subset_type [TC]: "[| x \<in> nat; y \<in> nat |] ==> subset_fm(x,y) \<in> formula"
 by (simp add: subset_fm_def)
 
 lemma arity_subset_fm [simp]:
      "[| x \<in> nat; y \<in> nat |] ==> arity(subset_fm(x,y)) = succ(x) \<union> succ(y)"
 by (simp add: subset_fm_def succ_Un_distrib [symmetric])
 
 lemma sats_subset_fm [simp]:
    "[|x < length(env); y \<in> nat; env \<in> list(A); Transset(A)|]
     ==> sats(A, subset_fm(x,y), env) \<longleftrightarrow> nth(x,env) \<subseteq> nth(y,env)"
 apply (frule lt_length_in_nat, assumption)
 apply (simp add: subset_fm_def Transset_def)
 apply (blast intro: nth_type)
 done
 
 subsubsection\<open>Transitive sets\<close>
 
 definition
   transset_fm :: "i=>i" where
   "transset_fm(x) == Forall(Implies(Member(0,succ(x)), subset_fm(0,succ(x))))"
 
 lemma transset_type [TC]: "x \<in> nat ==> transset_fm(x) \<in> formula"
 by (simp add: transset_fm_def)
 
 lemma arity_transset_fm [simp]:
      "x \<in> nat ==> arity(transset_fm(x)) = succ(x)"
 by (simp add: transset_fm_def succ_Un_distrib [symmetric])
 
 lemma sats_transset_fm [simp]:
    "[|x < length(env); env \<in> list(A); Transset(A)|]
     ==> sats(A, transset_fm(x), env) \<longleftrightarrow> Transset(nth(x,env))"
 apply (frule lt_nat_in_nat, erule length_type)
 apply (simp add: transset_fm_def Transset_def)
 apply (blast intro: nth_type)
 done
 
 subsubsection\<open>Ordinals\<close>
 
 definition
   ordinal_fm :: "i=>i" where
   "ordinal_fm(x) ==
     And(transset_fm(x), Forall(Implies(Member(0,succ(x)), transset_fm(0))))"
 
 lemma ordinal_type [TC]: "x \<in> nat ==> ordinal_fm(x) \<in> formula"
 by (simp add: ordinal_fm_def)
 
 lemma arity_ordinal_fm [simp]:
      "x \<in> nat ==> arity(ordinal_fm(x)) = succ(x)"
 by (simp add: ordinal_fm_def succ_Un_distrib [symmetric])
 
 lemma sats_ordinal_fm:
    "[|x < length(env); env \<in> list(A); Transset(A)|]
     ==> sats(A, ordinal_fm(x), env) \<longleftrightarrow> Ord(nth(x,env))"
 apply (frule lt_nat_in_nat, erule length_type)
 apply (simp add: ordinal_fm_def Ord_def Transset_def)
 apply (blast intro: nth_type)
 done
 
 text\<open>The subset consisting of the ordinals is definable.  Essential lemma for
 \<open>Ord_in_Lset\<close>.  This result is the objective of the present subsection.\<close>
 theorem Ords_in_DPow: "Transset(A) ==> {x \<in> A. Ord(x)} \<in> DPow(A)"
 apply (simp add: DPow_def Collect_subset)
 apply (rule_tac x=Nil in bexI)
  apply (rule_tac x="ordinal_fm(0)" in bexI)
 apply (simp_all add: sats_ordinal_fm)
 done
 
 
 subsection\<open>Constant Lset: Levels of the Constructible Universe\<close>
 
 definition
   Lset :: "i=>i" where
   "Lset(i) == transrec(i, %x f. \<Union>y\<in>x. DPow(f`y))"
 
 definition
   L :: "i=>o" where \<comment> \<open>Kunen's definition VI 1.5, page 167\<close>
   "L(x) == \<exists>i. Ord(i) & x \<in> Lset(i)"
 
 text\<open>NOT SUITABLE FOR REWRITING -- RECURSIVE!\<close>
 lemma Lset: "Lset(i) = (\<Union>j\<in>i. DPow(Lset(j)))"
 by (subst Lset_def [THEN def_transrec], simp)
 
 lemma LsetI: "[|y\<in>x; A \<in> DPow(Lset(y))|] ==> A \<in> Lset(x)"
 by (subst Lset, blast)
 
 lemma LsetD: "A \<in> Lset(x) ==> \<exists>y\<in>x. A \<in> DPow(Lset(y))"
 apply (insert Lset [of x])
 apply (blast intro: elim: equalityE)
 done
 
 subsubsection\<open>Transitivity\<close>
 
 lemma elem_subset_in_DPow: "[|X \<in> A; X \<subseteq> A|] ==> X \<in> DPow(A)"
 apply (simp add: Transset_def DPow_def)
 apply (rule_tac x="[X]" in bexI)
  apply (rule_tac x="Member(0,1)" in bexI)
   apply (auto simp add: Un_least_lt_iff)
 done
 
 lemma Transset_subset_DPow: "Transset(A) ==> A \<subseteq> DPow(A)"
 apply clarify
 apply (simp add: Transset_def)
 apply (blast intro: elem_subset_in_DPow)
 done
 
 lemma Transset_DPow: "Transset(A) ==> Transset(DPow(A))"
 apply (simp add: Transset_def)
 apply (blast intro: elem_subset_in_DPow dest: DPowD)
 done
 
 text\<open>Kunen's VI 1.6 (a)\<close>
 lemma Transset_Lset: "Transset(Lset(i))"
 apply (rule_tac a=i in eps_induct)
 apply (subst Lset)
 apply (blast intro!: Transset_Union_family Transset_Un Transset_DPow)
 done
 
 lemma mem_Lset_imp_subset_Lset: "a \<in> Lset(i) ==> a \<subseteq> Lset(i)"
 apply (insert Transset_Lset)
 apply (simp add: Transset_def)
 done
 
 subsubsection\<open>Monotonicity\<close>
 
 text\<open>Kunen's VI 1.6 (b)\<close>
 lemma Lset_mono [rule_format]:
      "\<forall>j. i<=j \<longrightarrow> Lset(i) \<subseteq> Lset(j)"
 proof (induct i rule: eps_induct, intro allI impI)
   fix x j
   assume "\<forall>y\<in>x. \<forall>j. y \<subseteq> j \<longrightarrow> Lset(y) \<subseteq> Lset(j)"
      and "x \<subseteq> j"
   thus "Lset(x) \<subseteq> Lset(j)"
     by (force simp add: Lset [of x] Lset [of j])
 qed
 
 text\<open>This version lets us remove the premise \<^term>\<open>Ord(i)\<close> sometimes.\<close>
 lemma Lset_mono_mem [rule_format]:
      "\<forall>j. i \<in> j \<longrightarrow> Lset(i) \<subseteq> Lset(j)"
 proof (induct i rule: eps_induct, intro allI impI)
   fix x j
   assume "\<forall>y\<in>x. \<forall>j. y \<in> j \<longrightarrow> Lset(y) \<subseteq> Lset(j)"
      and "x \<in> j"
   thus "Lset(x) \<subseteq> Lset(j)"
     by (force simp add: Lset [of j]
               intro!: bexI intro: elem_subset_in_DPow dest: LsetD DPowD)
 qed
 
 
 text\<open>Useful with Reflection to bump up the ordinal\<close>
 lemma subset_Lset_ltD: "[|A \<subseteq> Lset(i); i < j|] ==> A \<subseteq> Lset(j)"
 by (blast dest: ltD [THEN Lset_mono_mem])
 
 subsubsection\<open>0, successor and limit equations for Lset\<close>
 
 lemma Lset_0 [simp]: "Lset(0) = 0"
 by (subst Lset, blast)
 
 lemma Lset_succ_subset1: "DPow(Lset(i)) \<subseteq> Lset(succ(i))"
 by (subst Lset, rule succI1 [THEN RepFunI, THEN Union_upper])
 
 lemma Lset_succ_subset2: "Lset(succ(i)) \<subseteq> DPow(Lset(i))"
 apply (subst Lset, rule UN_least)
 apply (erule succE)
  apply blast
 apply clarify
 apply (rule elem_subset_in_DPow)
  apply (subst Lset)
  apply blast
 apply (blast intro: dest: DPowD Lset_mono_mem)
 done
 
 lemma Lset_succ: "Lset(succ(i)) = DPow(Lset(i))"
 by (intro equalityI Lset_succ_subset1 Lset_succ_subset2)
 
 lemma Lset_Union [simp]: "Lset(\<Union>(X)) = (\<Union>y\<in>X. Lset(y))"
 apply (subst Lset)
 apply (rule equalityI)
  txt\<open>first inclusion\<close>
  apply (rule UN_least)
  apply (erule UnionE)
  apply (rule subset_trans)
   apply (erule_tac [2] UN_upper, subst Lset, erule UN_upper)
 txt\<open>opposite inclusion\<close>
 apply (rule UN_least)
 apply (subst Lset, blast)
 done
 
 subsubsection\<open>Lset applied to Limit ordinals\<close>
 
 lemma Limit_Lset_eq:
     "Limit(i) ==> Lset(i) = (\<Union>y\<in>i. Lset(y))"
 by (simp add: Lset_Union [symmetric] Limit_Union_eq)
 
 lemma lt_LsetI: "[| a \<in> Lset(j);  j<i |] ==> a \<in> Lset(i)"
 by (blast dest: Lset_mono [OF le_imp_subset [OF leI]])
 
 lemma Limit_LsetE:
     "[| a \<in> Lset(i);  ~R ==> Limit(i);
         !!x. [| x<i;  a \<in> Lset(x) |] ==> R
      |] ==> R"
 apply (rule classical)
 apply (rule Limit_Lset_eq [THEN equalityD1, THEN subsetD, THEN UN_E])
   prefer 2 apply assumption
  apply blast
 apply (blast intro: ltI  Limit_is_Ord)
 done
 
 subsubsection\<open>Basic closure properties\<close>
 
 lemma zero_in_Lset: "y \<in> x ==> 0 \<in> Lset(x)"
 by (subst Lset, blast intro: empty_in_DPow)
 
 lemma notin_Lset: "x \<notin> Lset(x)"
 apply (rule_tac a=x in eps_induct)
 apply (subst Lset)
 apply (blast dest: DPowD)
 done
 
 
 subsection\<open>Constructible Ordinals: Kunen's VI 1.9 (b)\<close>
 
 lemma Ords_of_Lset_eq: "Ord(i) ==> {x\<in>Lset(i). Ord(x)} = i"
 apply (erule trans_induct3)
   apply (simp_all add: Lset_succ Limit_Lset_eq Limit_Union_eq)
 txt\<open>The successor case remains.\<close>
 apply (rule equalityI)
 txt\<open>First inclusion\<close>
  apply clarify
  apply (erule Ord_linear_lt, assumption)
    apply (blast dest: DPow_imp_subset ltD notE [OF notin_Lset])
   apply blast
  apply (blast dest: ltD)
 txt\<open>Opposite inclusion, \<^term>\<open>succ(x) \<subseteq> DPow(Lset(x)) \<inter> ON\<close>\<close>
 apply auto
 txt\<open>Key case:\<close>
   apply (erule subst, rule Ords_in_DPow [OF Transset_Lset])
  apply (blast intro: elem_subset_in_DPow dest: OrdmemD elim: equalityE)
 apply (blast intro: Ord_in_Ord)
 done
 
 
 lemma Ord_subset_Lset: "Ord(i) ==> i \<subseteq> Lset(i)"
 by (subst Ords_of_Lset_eq [symmetric], assumption, fast)
 
 lemma Ord_in_Lset: "Ord(i) ==> i \<in> Lset(succ(i))"
 apply (simp add: Lset_succ)
 apply (subst Ords_of_Lset_eq [symmetric], assumption,
        rule Ords_in_DPow [OF Transset_Lset])
 done
 
 lemma Ord_in_L: "Ord(i) ==> L(i)"
 by (simp add: L_def, blast intro: Ord_in_Lset)
 
 subsubsection\<open>Unions\<close>
 
 lemma Union_in_Lset:
      "X \<in> Lset(i) ==> \<Union>(X) \<in> Lset(succ(i))"
 apply (insert Transset_Lset)
 apply (rule LsetI [OF succI1])
 apply (simp add: Transset_def DPow_def)
 apply (intro conjI, blast)
 txt\<open>Now to create the formula \<^term>\<open>\<exists>y. y \<in> X \<and> x \<in> y\<close>\<close>
 apply (rule_tac x="Cons(X,Nil)" in bexI)
  apply (rule_tac x="Exists(And(Member(0,2), Member(1,0)))" in bexI)
   apply typecheck
 apply (simp add: succ_Un_distrib [symmetric], blast)
 done
 
 theorem Union_in_L: "L(X) ==> L(\<Union>(X))"
 by (simp add: L_def, blast dest: Union_in_Lset)
 
 subsubsection\<open>Finite sets and ordered pairs\<close>
 
 lemma singleton_in_Lset: "a \<in> Lset(i) ==> {a} \<in> Lset(succ(i))"
 by (simp add: Lset_succ singleton_in_DPow)
 
 lemma doubleton_in_Lset:
      "[| a \<in> Lset(i);  b \<in> Lset(i) |] ==> {a,b} \<in> Lset(succ(i))"
 by (simp add: Lset_succ empty_in_DPow cons_in_DPow)
 
 lemma Pair_in_Lset:
     "[| a \<in> Lset(i);  b \<in> Lset(i); Ord(i) |] ==> <a,b> \<in> Lset(succ(succ(i)))"
 apply (unfold Pair_def)
 apply (blast intro: doubleton_in_Lset)
 done
 
 lemmas Lset_UnI1 = Un_upper1 [THEN Lset_mono [THEN subsetD]]
 lemmas Lset_UnI2 = Un_upper2 [THEN Lset_mono [THEN subsetD]]
 
 text\<open>Hard work is finding a single \<^term>\<open>j \<in> i\<close> such that \<^term>\<open>{a,b} \<subseteq> Lset(j)\<close>\<close>
 lemma doubleton_in_LLimit:
     "[| a \<in> Lset(i);  b \<in> Lset(i);  Limit(i) |] ==> {a,b} \<in> Lset(i)"
 apply (erule Limit_LsetE, assumption)
 apply (erule Limit_LsetE, assumption)
 apply (blast intro: lt_LsetI [OF doubleton_in_Lset]
                     Lset_UnI1 Lset_UnI2 Limit_has_succ Un_least_lt)
 done
 
 theorem doubleton_in_L: "[| L(a); L(b) |] ==> L({a, b})"
 apply (simp add: L_def, clarify)
 apply (drule Ord2_imp_greater_Limit, assumption)
 apply (blast intro: lt_LsetI doubleton_in_LLimit Limit_is_Ord)
 done
 
 lemma Pair_in_LLimit:
     "[| a \<in> Lset(i);  b \<in> Lset(i);  Limit(i) |] ==> <a,b> \<in> Lset(i)"
 txt\<open>Infer that a, b occur at ordinals x,xa < i.\<close>
 apply (erule Limit_LsetE, assumption)
 apply (erule Limit_LsetE, assumption)
 txt\<open>Infer that \<^term>\<open>succ(succ(x \<union> xa)) < i\<close>\<close>
 apply (blast intro: lt_Ord lt_LsetI [OF Pair_in_Lset]
                     Lset_UnI1 Lset_UnI2 Limit_has_succ Un_least_lt)
 done
 
 
 
 text\<open>The rank function for the constructible universe\<close>
 definition
   lrank :: "i=>i" where \<comment> \<open>Kunen's definition VI 1.7\<close>
   "lrank(x) == \<mu> i. x \<in> Lset(succ(i))"
 
 lemma L_I: "[|x \<in> Lset(i); Ord(i)|] ==> L(x)"
 by (simp add: L_def, blast)
 
 lemma L_D: "L(x) ==> \<exists>i. Ord(i) & x \<in> Lset(i)"
 by (simp add: L_def)
 
 lemma Ord_lrank [simp]: "Ord(lrank(a))"
 by (simp add: lrank_def)
 
 lemma Lset_lrank_lt [rule_format]: "Ord(i) ==> x \<in> Lset(i) \<longrightarrow> lrank(x) < i"
 apply (erule trans_induct3)
   apply simp
  apply (simp only: lrank_def)
  apply (blast intro: Least_le)
 apply (simp_all add: Limit_Lset_eq)
 apply (blast intro: ltI Limit_is_Ord lt_trans)
 done
 
 text\<open>Kunen's VI 1.8.  The proof is much harder than the text would
 suggest.  For a start, it needs the previous lemma, which is proved by
 induction.\<close>
 lemma Lset_iff_lrank_lt: "Ord(i) ==> x \<in> Lset(i) \<longleftrightarrow> L(x) & lrank(x) < i"
 apply (simp add: L_def, auto)
  apply (blast intro: Lset_lrank_lt)
  apply (unfold lrank_def)
 apply (drule succI1 [THEN Lset_mono_mem, THEN subsetD])
 apply (drule_tac P="\<lambda>i. x \<in> Lset(succ(i))" in LeastI, assumption)
 apply (blast intro!: le_imp_subset Lset_mono [THEN subsetD])
 done
 
 lemma Lset_succ_lrank_iff [simp]: "x \<in> Lset(succ(lrank(x))) \<longleftrightarrow> L(x)"
 by (simp add: Lset_iff_lrank_lt)
 
 text\<open>Kunen's VI 1.9 (a)\<close>
 lemma lrank_of_Ord: "Ord(i) ==> lrank(i) = i"
 apply (unfold lrank_def)
 apply (rule Least_equality)
   apply (erule Ord_in_Lset)
  apply assumption
 apply (insert notin_Lset [of i])
 apply (blast intro!: le_imp_subset Lset_mono [THEN subsetD])
 done
 
 
 text\<open>This is lrank(lrank(a)) = lrank(a)\<close>
 declare Ord_lrank [THEN lrank_of_Ord, simp]
 
 text\<open>Kunen's VI 1.10\<close>
 lemma Lset_in_Lset_succ: "Lset(i) \<in> Lset(succ(i))"
 apply (simp add: Lset_succ DPow_def)
 apply (rule_tac x=Nil in bexI)
  apply (rule_tac x="Equal(0,0)" in bexI)
 apply auto
 done
 
 lemma lrank_Lset: "Ord(i) ==> lrank(Lset(i)) = i"
 apply (unfold lrank_def)
 apply (rule Least_equality)
   apply (rule Lset_in_Lset_succ)
  apply assumption
 apply clarify
 apply (subgoal_tac "Lset(succ(ia)) \<subseteq> Lset(i)")
  apply (blast dest: mem_irrefl)
 apply (blast intro!: le_imp_subset Lset_mono)
 done
 
 text\<open>Kunen's VI 1.11\<close>
 lemma Lset_subset_Vset: "Ord(i) ==> Lset(i) \<subseteq> Vset(i)"
 apply (erule trans_induct)
 apply (subst Lset)
 apply (subst Vset)
 apply (rule UN_mono [OF subset_refl])
 apply (rule subset_trans [OF DPow_subset_Pow])
 apply (rule Pow_mono, blast)
 done
 
 text\<open>Kunen's VI 1.12\<close>
 lemma Lset_subset_Vset': "i \<in> nat ==> Lset(i) = Vset(i)"
 apply (erule nat_induct)
  apply (simp add: Vfrom_0)
 apply (simp add: Lset_succ Vset_succ Finite_Vset Finite_DPow_eq_Pow)
 done
 
 text\<open>Every set of constructible sets is included in some \<^term>\<open>Lset\<close>\<close>
 lemma subset_Lset:
      "(\<forall>x\<in>A. L(x)) ==> \<exists>i. Ord(i) & A \<subseteq> Lset(i)"
 by (rule_tac x = "\<Union>x\<in>A. succ(lrank(x))" in exI, force)
 
 lemma subset_LsetE:
      "[|\<forall>x\<in>A. L(x);
         !!i. [|Ord(i); A \<subseteq> Lset(i)|] ==> P|]
       ==> P"
 by (blast dest: subset_Lset)
 
 subsubsection\<open>For L to satisfy the Powerset axiom\<close>
 
 lemma LPow_env_typing:
     "[| y \<in> Lset(i); Ord(i); y \<subseteq> X |]
      ==> \<exists>z \<in> Pow(X). y \<in> Lset(succ(lrank(z)))"
 by (auto intro: L_I iff: Lset_succ_lrank_iff)
 
 lemma LPow_in_Lset:
      "[|X \<in> Lset(i); Ord(i)|] ==> \<exists>j. Ord(j) & {y \<in> Pow(X). L(y)} \<in> Lset(j)"
 apply (rule_tac x="succ(\<Union>y \<in> Pow(X). succ(lrank(y)))" in exI)
 apply simp
 apply (rule LsetI [OF succI1])
 apply (simp add: DPow_def)
 apply (intro conjI, clarify)
  apply (rule_tac a=x in UN_I, simp+)
 txt\<open>Now to create the formula \<^term>\<open>y \<subseteq> X\<close>\<close>
 apply (rule_tac x="Cons(X,Nil)" in bexI)
  apply (rule_tac x="subset_fm(0,1)" in bexI)
   apply typecheck
  apply (rule conjI)
 apply (simp add: succ_Un_distrib [symmetric])
 apply (rule equality_iffI)
 apply (simp add: Transset_UN [OF Transset_Lset] LPow_env_typing)
 apply (auto intro: L_I iff: Lset_succ_lrank_iff)
 done
 
 theorem LPow_in_L: "L(X) ==> L({y \<in> Pow(X). L(y)})"
 by (blast intro: L_I dest: L_D LPow_in_Lset)
 
 
 subsection\<open>Eliminating \<^term>\<open>arity\<close> from the Definition of \<^term>\<open>Lset\<close>\<close>
 
 lemma nth_zero_eq_0: "n \<in> nat ==> nth(n,[0]) = 0"
 by (induct_tac n, auto)
 
 lemma sats_app_0_iff [rule_format]:
   "[| p \<in> formula; 0 \<in> A |]
    ==> \<forall>env \<in> list(A). sats(A,p, env@[0]) \<longleftrightarrow> sats(A,p,env)"
 apply (induct_tac p)
 apply (simp_all del: app_Cons add: app_Cons [symmetric]
                 add: nth_zero_eq_0 nth_append not_lt_iff_le nth_eq_0)
 done
 
 lemma sats_app_zeroes_iff:
   "[| p \<in> formula; 0 \<in> A; env \<in> list(A); n \<in> nat |]
    ==> sats(A,p,env @ repeat(0,n)) \<longleftrightarrow> sats(A,p,env)"
 apply (induct_tac n, simp)
 apply (simp del: repeat.simps
             add: repeat_succ_app sats_app_0_iff app_assoc [symmetric])
 done
 
 lemma exists_bigger_env:
   "[| p \<in> formula; 0 \<in> A; env \<in> list(A) |]
    ==> \<exists>env' \<in> list(A). arity(p) \<le> succ(length(env')) &
               (\<forall>a\<in>A. sats(A,p,Cons(a,env')) \<longleftrightarrow> sats(A,p,Cons(a,env)))"
 apply (rule_tac x="env @ repeat(0,arity(p))" in bexI)
 apply (simp del: app_Cons add: app_Cons [symmetric]
             add: length_repeat sats_app_zeroes_iff, typecheck)
 done
 
 
 text\<open>A simpler version of \<^term>\<open>DPow\<close>: no arity check!\<close>
 definition
   DPow' :: "i => i" where
   "DPow'(A) == {X \<in> Pow(A).
                 \<exists>env \<in> list(A). \<exists>p \<in> formula.
                     X = {x\<in>A. sats(A, p, Cons(x,env))}}"
 
 lemma DPow_subset_DPow': "DPow(A) \<subseteq> DPow'(A)"
 by (simp add: DPow_def DPow'_def, blast)
 
 lemma DPow'_0: "DPow'(0) = {0}"
 by (auto simp add: DPow'_def)
 
 lemma DPow'_subset_DPow: "0 \<in> A ==> DPow'(A) \<subseteq> DPow(A)"
 apply (auto simp add: DPow'_def DPow_def)
 apply (frule exists_bigger_env, assumption+, force)
 done
 
 lemma DPow_eq_DPow': "Transset(A) ==> DPow(A) = DPow'(A)"
 apply (drule Transset_0_disj)
 apply (erule disjE)
  apply (simp add: DPow'_0 Finite_DPow_eq_Pow)
 apply (rule equalityI)
  apply (rule DPow_subset_DPow')
 apply (erule DPow'_subset_DPow)
 done
 
 text\<open>And thus we can relativize \<^term>\<open>Lset\<close> without bothering with
       \<^term>\<open>arity\<close> and \<^term>\<open>length\<close>\<close>
 lemma Lset_eq_transrec_DPow': "Lset(i) = transrec(i, %x f. \<Union>y\<in>x. DPow'(f`y))"
 apply (rule_tac a=i in eps_induct)
 apply (subst Lset)
 apply (subst transrec)
 apply (simp only: DPow_eq_DPow' [OF Transset_Lset], simp)
 done
 
 text\<open>With this rule we can specify \<^term>\<open>p\<close> later and don't worry about
       arities at all!\<close>
 lemma DPow_LsetI [rule_format]:
   "[|\<forall>x\<in>Lset(i). P(x) \<longleftrightarrow> sats(Lset(i), p, Cons(x,env));
      env \<in> list(Lset(i));  p \<in> formula|]
    ==> {x\<in>Lset(i). P(x)} \<in> DPow(Lset(i))"
 by (simp add: DPow_eq_DPow' [OF Transset_Lset] DPow'_def, blast)
 
 end
diff --git a/src/ZF/Constructible/Internalize.thy b/src/ZF/Constructible/Internalize.thy
--- a/src/ZF/Constructible/Internalize.thy
+++ b/src/ZF/Constructible/Internalize.thy
@@ -1,1483 +1,1483 @@
 (*  Title:      ZF/Constructible/Internalize.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 theory Internalize imports L_axioms Datatype_absolute begin
 
 subsection\<open>Internalized Forms of Data Structuring Operators\<close>
 
 subsubsection\<open>The Formula \<^term>\<open>is_Inl\<close>, Internalized\<close>
 
 (*  is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z) *)
 definition
   Inl_fm :: "[i,i]=>i" where
     "Inl_fm(a,z) == Exists(And(empty_fm(0), pair_fm(0,succ(a),succ(z))))"
 
 lemma Inl_type [TC]:
      "[| x \<in> nat; z \<in> nat |] ==> Inl_fm(x,z) \<in> formula"
 by (simp add: Inl_fm_def)
 
 lemma sats_Inl_fm [simp]:
    "[| x \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, Inl_fm(x,z), env) \<longleftrightarrow> is_Inl(##A, nth(x,env), nth(z,env))"
 by (simp add: Inl_fm_def is_Inl_def)
 
 lemma Inl_iff_sats:
       "[| nth(i,env) = x; nth(k,env) = z;
           i \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_Inl(##A, x, z) \<longleftrightarrow> sats(A, Inl_fm(i,k), env)"
 by simp
 
 theorem Inl_reflection:
      "REFLECTS[\<lambda>x. is_Inl(L,f(x),h(x)),
                \<lambda>i x. is_Inl(##Lset(i),f(x),h(x))]"
 apply (simp only: is_Inl_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_Inr\<close>, Internalized\<close>
 
 (*  is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z) *)
 definition
   Inr_fm :: "[i,i]=>i" where
     "Inr_fm(a,z) == Exists(And(number1_fm(0), pair_fm(0,succ(a),succ(z))))"
 
 lemma Inr_type [TC]:
      "[| x \<in> nat; z \<in> nat |] ==> Inr_fm(x,z) \<in> formula"
 by (simp add: Inr_fm_def)
 
 lemma sats_Inr_fm [simp]:
    "[| x \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, Inr_fm(x,z), env) \<longleftrightarrow> is_Inr(##A, nth(x,env), nth(z,env))"
 by (simp add: Inr_fm_def is_Inr_def)
 
 lemma Inr_iff_sats:
       "[| nth(i,env) = x; nth(k,env) = z;
           i \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_Inr(##A, x, z) \<longleftrightarrow> sats(A, Inr_fm(i,k), env)"
 by simp
 
 theorem Inr_reflection:
      "REFLECTS[\<lambda>x. is_Inr(L,f(x),h(x)),
                \<lambda>i x. is_Inr(##Lset(i),f(x),h(x))]"
 apply (simp only: is_Inr_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_Nil\<close>, Internalized\<close>
 
 (* is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs) *)
 
 definition
   Nil_fm :: "i=>i" where
     "Nil_fm(x) == Exists(And(empty_fm(0), Inl_fm(0,succ(x))))"
 
 lemma Nil_type [TC]: "x \<in> nat ==> Nil_fm(x) \<in> formula"
 by (simp add: Nil_fm_def)
 
 lemma sats_Nil_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, Nil_fm(x), env) \<longleftrightarrow> is_Nil(##A, nth(x,env))"
 by (simp add: Nil_fm_def is_Nil_def)
 
 lemma Nil_iff_sats:
       "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
        ==> is_Nil(##A, x) \<longleftrightarrow> sats(A, Nil_fm(i), env)"
 by simp
 
 theorem Nil_reflection:
      "REFLECTS[\<lambda>x. is_Nil(L,f(x)),
                \<lambda>i x. is_Nil(##Lset(i),f(x))]"
 apply (simp only: is_Nil_def)
 apply (intro FOL_reflections function_reflections Inl_reflection)
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_Cons\<close>, Internalized\<close>
 
 
 (*  "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)" *)
 definition
   Cons_fm :: "[i,i,i]=>i" where
     "Cons_fm(a,l,Z) ==
        Exists(And(pair_fm(succ(a),succ(l),0), Inr_fm(0,succ(Z))))"
 
 lemma Cons_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Cons_fm(x,y,z) \<in> formula"
 by (simp add: Cons_fm_def)
 
 lemma sats_Cons_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, Cons_fm(x,y,z), env) \<longleftrightarrow>
        is_Cons(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: Cons_fm_def is_Cons_def)
 
 lemma Cons_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==>is_Cons(##A, x, y, z) \<longleftrightarrow> sats(A, Cons_fm(i,j,k), env)"
 by simp
 
 theorem Cons_reflection:
      "REFLECTS[\<lambda>x. is_Cons(L,f(x),g(x),h(x)),
                \<lambda>i x. is_Cons(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_Cons_def)
 apply (intro FOL_reflections pair_reflection Inr_reflection)
 done
 
 subsubsection\<open>The Formula \<^term>\<open>is_quasilist\<close>, Internalized\<close>
 
 (* is_quasilist(M,xs) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))" *)
 
 definition
   quasilist_fm :: "i=>i" where
     "quasilist_fm(x) ==
        Or(Nil_fm(x), Exists(Exists(Cons_fm(1,0,succ(succ(x))))))"
 
 lemma quasilist_type [TC]: "x \<in> nat ==> quasilist_fm(x) \<in> formula"
 by (simp add: quasilist_fm_def)
 
 lemma sats_quasilist_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, quasilist_fm(x), env) \<longleftrightarrow> is_quasilist(##A, nth(x,env))"
 by (simp add: quasilist_fm_def is_quasilist_def)
 
 lemma quasilist_iff_sats:
       "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
        ==> is_quasilist(##A, x) \<longleftrightarrow> sats(A, quasilist_fm(i), env)"
 by simp
 
 theorem quasilist_reflection:
      "REFLECTS[\<lambda>x. is_quasilist(L,f(x)),
                \<lambda>i x. is_quasilist(##Lset(i),f(x))]"
 apply (simp only: is_quasilist_def)
 apply (intro FOL_reflections Nil_reflection Cons_reflection)
 done
 
 
 subsection\<open>Absoluteness for the Function \<^term>\<open>nth\<close>\<close>
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_hd\<close>, Internalized\<close>
 
 (*   "is_hd(M,xs,H) == 
        (is_Nil(M,xs) \<longrightarrow> empty(M,H)) &
        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
        (is_quasilist(M,xs) | empty(M,H))" *)
 definition
   hd_fm :: "[i,i]=>i" where
     "hd_fm(xs,H) == 
        And(Implies(Nil_fm(xs), empty_fm(H)),
            And(Forall(Forall(Or(Neg(Cons_fm(1,0,xs#+2)), Equal(H#+2,1)))),
                Or(quasilist_fm(xs), empty_fm(H))))"
 
 lemma hd_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> hd_fm(x,y) \<in> formula"
 by (simp add: hd_fm_def) 
 
 lemma sats_hd_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, hd_fm(x,y), env) \<longleftrightarrow> is_hd(##A, nth(x,env), nth(y,env))"
 by (simp add: hd_fm_def is_hd_def)
 
 lemma hd_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_hd(##A, x, y) \<longleftrightarrow> sats(A, hd_fm(i,j), env)"
 by simp
 
 theorem hd_reflection:
      "REFLECTS[\<lambda>x. is_hd(L,f(x),g(x)), 
                \<lambda>i x. is_hd(##Lset(i),f(x),g(x))]"
 apply (simp only: is_hd_def)
 apply (intro FOL_reflections Nil_reflection Cons_reflection
              quasilist_reflection empty_reflection)  
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_tl\<close>, Internalized\<close>
 
 (*     "is_tl(M,xs,T) ==
        (is_Nil(M,xs) \<longrightarrow> T=xs) &
        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
        (is_quasilist(M,xs) | empty(M,T))" *)
 definition
   tl_fm :: "[i,i]=>i" where
     "tl_fm(xs,T) ==
        And(Implies(Nil_fm(xs), Equal(T,xs)),
            And(Forall(Forall(Or(Neg(Cons_fm(1,0,xs#+2)), Equal(T#+2,0)))),
                Or(quasilist_fm(xs), empty_fm(T))))"
 
 lemma tl_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> tl_fm(x,y) \<in> formula"
 by (simp add: tl_fm_def)
 
 lemma sats_tl_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, tl_fm(x,y), env) \<longleftrightarrow> is_tl(##A, nth(x,env), nth(y,env))"
 by (simp add: tl_fm_def is_tl_def)
 
 lemma tl_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_tl(##A, x, y) \<longleftrightarrow> sats(A, tl_fm(i,j), env)"
 by simp
 
 theorem tl_reflection:
      "REFLECTS[\<lambda>x. is_tl(L,f(x),g(x)),
                \<lambda>i x. is_tl(##Lset(i),f(x),g(x))]"
 apply (simp only: is_tl_def)
 apply (intro FOL_reflections Nil_reflection Cons_reflection
              quasilist_reflection empty_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_bool_of_o\<close>\<close>
 
 (*   is_bool_of_o :: "[i=>o, o, i] => o"
    "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))" *)
 
 text\<open>The formula \<^term>\<open>p\<close> has no free variables.\<close>
 definition
   bool_of_o_fm :: "[i, i]=>i" where
   "bool_of_o_fm(p,z) == 
     Or(And(p,number1_fm(z)),
        And(Neg(p),empty_fm(z)))"
 
 lemma is_bool_of_o_type [TC]:
      "[| p \<in> formula; z \<in> nat |] ==> bool_of_o_fm(p,z) \<in> formula"
 by (simp add: bool_of_o_fm_def)
 
 lemma sats_bool_of_o_fm:
   assumes p_iff_sats: "P \<longleftrightarrow> sats(A, p, env)"
   shows 
       "[|z \<in> nat; env \<in> list(A)|]
        ==> sats(A, bool_of_o_fm(p,z), env) \<longleftrightarrow>
            is_bool_of_o(##A, P, nth(z,env))"
 by (simp add: bool_of_o_fm_def is_bool_of_o_def p_iff_sats [THEN iff_sym])
 
 lemma is_bool_of_o_iff_sats:
   "[| P \<longleftrightarrow> sats(A, p, env); nth(k,env) = z; k \<in> nat; env \<in> list(A)|]
    ==> is_bool_of_o(##A, P, z) \<longleftrightarrow> sats(A, bool_of_o_fm(p,k), env)"
 by (simp add: sats_bool_of_o_fm)
 
 theorem bool_of_o_reflection:
      "REFLECTS [P(L), \<lambda>i. P(##Lset(i))] ==>
       REFLECTS[\<lambda>x. is_bool_of_o(L, P(L,x), f(x)),  
                \<lambda>i x. is_bool_of_o(##Lset(i), P(##Lset(i),x), f(x))]"
 apply (simp (no_asm) only: is_bool_of_o_def)
 apply (intro FOL_reflections function_reflections, assumption+)
 done
 
 
 subsection\<open>More Internalizations\<close>
 
 subsubsection\<open>The Operator \<^term>\<open>is_lambda\<close>\<close>
 
 text\<open>The two arguments of \<^term>\<open>p\<close> are always 1, 0. Remember that
  \<^term>\<open>p\<close> will be enclosed by three quantifiers.\<close>
 
 (* is_lambda :: "[i=>o, i, [i,i]=>o, i] => o"
     "is_lambda(M, A, is_b, z) == 
        \<forall>p[M]. p \<in> z \<longleftrightarrow>
         (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))" *)
 definition
   lambda_fm :: "[i, i, i]=>i" where
   "lambda_fm(p,A,z) == 
     Forall(Iff(Member(0,succ(z)),
             Exists(Exists(And(Member(1,A#+3),
                            And(pair_fm(1,0,2), p))))))"
 
 text\<open>We call \<^term>\<open>p\<close> with arguments x, y by equating them with 
   the corresponding quantified variables with de Bruijn indices 1, 0.\<close>
 
 lemma is_lambda_type [TC]:
      "[| p \<in> formula; x \<in> nat; y \<in> nat |] 
       ==> lambda_fm(p,x,y) \<in> formula"
 by (simp add: lambda_fm_def) 
 
 lemma sats_lambda_fm:
   assumes is_b_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|] 
         ==> is_b(a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,env))))"
   shows 
       "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
        ==> sats(A, lambda_fm(p,x,y), env) \<longleftrightarrow> 
            is_lambda(##A, nth(x,env), is_b, nth(y,env))"
 by (simp add: lambda_fm_def is_lambda_def is_b_iff_sats [THEN iff_sym]) 
 
 theorem is_lambda_reflection:
   assumes is_b_reflection:
     "!!f g h. REFLECTS[\<lambda>x. is_b(L, f(x), g(x), h(x)), 
                      \<lambda>i x. is_b(##Lset(i), f(x), g(x), h(x))]"
   shows "REFLECTS[\<lambda>x. is_lambda(L, A(x), is_b(L,x), f(x)), 
                \<lambda>i x. is_lambda(##Lset(i), A(x), is_b(##Lset(i),x), f(x))]"
 apply (simp (no_asm_use) only: is_lambda_def)
 apply (intro FOL_reflections is_b_reflection pair_reflection)
 done
 
 subsubsection\<open>The Operator \<^term>\<open>is_Member\<close>, Internalized\<close>
 
 (*    "is_Member(M,x,y,Z) ==
         \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inl(M,u,Z)" *)
 definition
   Member_fm :: "[i,i,i]=>i" where
     "Member_fm(x,y,Z) ==
        Exists(Exists(And(pair_fm(x#+2,y#+2,1), 
                       And(Inl_fm(1,0), Inl_fm(0,Z#+2)))))"
 
 lemma is_Member_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Member_fm(x,y,z) \<in> formula"
 by (simp add: Member_fm_def)
 
 lemma sats_Member_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, Member_fm(x,y,z), env) \<longleftrightarrow>
         is_Member(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: Member_fm_def is_Member_def)
 
 lemma Member_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_Member(##A, x, y, z) \<longleftrightarrow> sats(A, Member_fm(i,j,k), env)"
-by (simp add: sats_Member_fm)
+by (simp)
 
 theorem Member_reflection:
      "REFLECTS[\<lambda>x. is_Member(L,f(x),g(x),h(x)),
                \<lambda>i x. is_Member(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_Member_def)
 apply (intro FOL_reflections pair_reflection Inl_reflection)
 done
 
 subsubsection\<open>The Operator \<^term>\<open>is_Equal\<close>, Internalized\<close>
 
 (*    "is_Equal(M,x,y,Z) ==
         \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inr(M,p,u) & is_Inl(M,u,Z)" *)
 definition
   Equal_fm :: "[i,i,i]=>i" where
     "Equal_fm(x,y,Z) ==
        Exists(Exists(And(pair_fm(x#+2,y#+2,1), 
                       And(Inr_fm(1,0), Inl_fm(0,Z#+2)))))"
 
 lemma is_Equal_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Equal_fm(x,y,z) \<in> formula"
 by (simp add: Equal_fm_def)
 
 lemma sats_Equal_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, Equal_fm(x,y,z), env) \<longleftrightarrow>
         is_Equal(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: Equal_fm_def is_Equal_def)
 
 lemma Equal_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_Equal(##A, x, y, z) \<longleftrightarrow> sats(A, Equal_fm(i,j,k), env)"
-by (simp add: sats_Equal_fm)
+by (simp)
 
 theorem Equal_reflection:
      "REFLECTS[\<lambda>x. is_Equal(L,f(x),g(x),h(x)),
                \<lambda>i x. is_Equal(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_Equal_def)
 apply (intro FOL_reflections pair_reflection Inl_reflection Inr_reflection)
 done
 
 subsubsection\<open>The Operator \<^term>\<open>is_Nand\<close>, Internalized\<close>
 
 (*    "is_Nand(M,x,y,Z) ==
         \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inr(M,u,Z)" *)
 definition
   Nand_fm :: "[i,i,i]=>i" where
     "Nand_fm(x,y,Z) ==
        Exists(Exists(And(pair_fm(x#+2,y#+2,1), 
                       And(Inl_fm(1,0), Inr_fm(0,Z#+2)))))"
 
 lemma is_Nand_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Nand_fm(x,y,z) \<in> formula"
 by (simp add: Nand_fm_def)
 
 lemma sats_Nand_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, Nand_fm(x,y,z), env) \<longleftrightarrow>
         is_Nand(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: Nand_fm_def is_Nand_def)
 
 lemma Nand_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_Nand(##A, x, y, z) \<longleftrightarrow> sats(A, Nand_fm(i,j,k), env)"
-by (simp add: sats_Nand_fm)
+by (simp)
 
 theorem Nand_reflection:
      "REFLECTS[\<lambda>x. is_Nand(L,f(x),g(x),h(x)),
                \<lambda>i x. is_Nand(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_Nand_def)
 apply (intro FOL_reflections pair_reflection Inl_reflection Inr_reflection)
 done
 
 subsubsection\<open>The Operator \<^term>\<open>is_Forall\<close>, Internalized\<close>
 
 (* "is_Forall(M,p,Z) == \<exists>u[M]. is_Inr(M,p,u) & is_Inr(M,u,Z)" *)
 definition
   Forall_fm :: "[i,i]=>i" where
     "Forall_fm(x,Z) ==
        Exists(And(Inr_fm(succ(x),0), Inr_fm(0,succ(Z))))"
 
 lemma is_Forall_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> Forall_fm(x,y) \<in> formula"
 by (simp add: Forall_fm_def)
 
 lemma sats_Forall_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, Forall_fm(x,y), env) \<longleftrightarrow>
         is_Forall(##A, nth(x,env), nth(y,env))"
 by (simp add: Forall_fm_def is_Forall_def)
 
 lemma Forall_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; 
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_Forall(##A, x, y) \<longleftrightarrow> sats(A, Forall_fm(i,j), env)"
-by (simp add: sats_Forall_fm)
+by (simp)
 
 theorem Forall_reflection:
      "REFLECTS[\<lambda>x. is_Forall(L,f(x),g(x)),
                \<lambda>i x. is_Forall(##Lset(i),f(x),g(x))]"
 apply (simp only: is_Forall_def)
 apply (intro FOL_reflections pair_reflection Inr_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_and\<close>, Internalized\<close>
 
 (* is_and(M,a,b,z) == (number1(M,a)  & z=b) | 
                        (~number1(M,a) & empty(M,z)) *)
 definition
   and_fm :: "[i,i,i]=>i" where
     "and_fm(a,b,z) ==
        Or(And(number1_fm(a), Equal(z,b)),
           And(Neg(number1_fm(a)),empty_fm(z)))"
 
 lemma is_and_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> and_fm(x,y,z) \<in> formula"
 by (simp add: and_fm_def)
 
 lemma sats_and_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, and_fm(x,y,z), env) \<longleftrightarrow>
         is_and(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: and_fm_def is_and_def)
 
 lemma is_and_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_and(##A, x, y, z) \<longleftrightarrow> sats(A, and_fm(i,j,k), env)"
 by simp
 
 theorem is_and_reflection:
      "REFLECTS[\<lambda>x. is_and(L,f(x),g(x),h(x)),
                \<lambda>i x. is_and(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_and_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_or\<close>, Internalized\<close>
 
 (* is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) | 
                      (~number1(M,a) & z=b) *)
 
 definition
   or_fm :: "[i,i,i]=>i" where
     "or_fm(a,b,z) ==
        Or(And(number1_fm(a), number1_fm(z)),
           And(Neg(number1_fm(a)), Equal(z,b)))"
 
 lemma is_or_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> or_fm(x,y,z) \<in> formula"
 by (simp add: or_fm_def)
 
 lemma sats_or_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, or_fm(x,y,z), env) \<longleftrightarrow>
         is_or(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: or_fm_def is_or_def)
 
 lemma is_or_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_or(##A, x, y, z) \<longleftrightarrow> sats(A, or_fm(i,j,k), env)"
 by simp
 
 theorem is_or_reflection:
      "REFLECTS[\<lambda>x. is_or(L,f(x),g(x),h(x)),
                \<lambda>i x. is_or(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_or_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_not\<close>, Internalized\<close>
 
 (* is_not(M,a,z) == (number1(M,a)  & empty(M,z)) | 
                      (~number1(M,a) & number1(M,z)) *)
 definition
   not_fm :: "[i,i]=>i" where
     "not_fm(a,z) ==
        Or(And(number1_fm(a), empty_fm(z)),
           And(Neg(number1_fm(a)), number1_fm(z)))"
 
 lemma is_not_type [TC]:
      "[| x \<in> nat; z \<in> nat |] ==> not_fm(x,z) \<in> formula"
 by (simp add: not_fm_def)
 
 lemma sats_is_not_fm [simp]:
    "[| x \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, not_fm(x,z), env) \<longleftrightarrow> is_not(##A, nth(x,env), nth(z,env))"
 by (simp add: not_fm_def is_not_def)
 
 lemma is_not_iff_sats:
       "[| nth(i,env) = x; nth(k,env) = z;
           i \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_not(##A, x, z) \<longleftrightarrow> sats(A, not_fm(i,k), env)"
 by simp
 
 theorem is_not_reflection:
      "REFLECTS[\<lambda>x. is_not(L,f(x),g(x)),
                \<lambda>i x. is_not(##Lset(i),f(x),g(x))]"
 apply (simp only: is_not_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 lemmas extra_reflections = 
     Inl_reflection Inr_reflection Nil_reflection Cons_reflection
     quasilist_reflection hd_reflection tl_reflection bool_of_o_reflection
     is_lambda_reflection Member_reflection Equal_reflection Nand_reflection
     Forall_reflection is_and_reflection is_or_reflection is_not_reflection
 
 subsection\<open>Well-Founded Recursion!\<close>
 
 subsubsection\<open>The Operator \<^term>\<open>M_is_recfun\<close>\<close>
 
 text\<open>Alternative definition, minimizing nesting of quantifiers around MH\<close>
 lemma M_is_recfun_iff:
    "M_is_recfun(M,MH,r,a,f) \<longleftrightarrow>
     (\<forall>z[M]. z \<in> f \<longleftrightarrow> 
      (\<exists>x[M]. \<exists>f_r_sx[M]. \<exists>y[M]. 
              MH(x, f_r_sx, y) & pair(M,x,y,z) &
              (\<exists>xa[M]. \<exists>sx[M]. \<exists>r_sx[M]. 
                 pair(M,x,a,xa) & upair(M,x,x,sx) &
                pre_image(M,r,sx,r_sx) & restriction(M,f,r_sx,f_r_sx) &
                xa \<in> r)))"
 apply (simp add: M_is_recfun_def)
 apply (rule rall_cong, blast) 
 done
 
 
 (* M_is_recfun :: "[i=>o, [i,i,i]=>o, i, i, i] => o"
    "M_is_recfun(M,MH,r,a,f) ==
      \<forall>z[M]. z \<in> f \<longleftrightarrow>
                2      1           0
 new def     (\<exists>x[M]. \<exists>f_r_sx[M]. \<exists>y[M]. 
              MH(x, f_r_sx, y) & pair(M,x,y,z) &
              (\<exists>xa[M]. \<exists>sx[M]. \<exists>r_sx[M]. 
                 pair(M,x,a,xa) & upair(M,x,x,sx) &
                pre_image(M,r,sx,r_sx) & restriction(M,f,r_sx,f_r_sx) &
                xa \<in> r)"
 *)
 
 text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0 and z\<close>
 definition
   is_recfun_fm :: "[i, i, i, i]=>i" where
   "is_recfun_fm(p,r,a,f) == 
    Forall(Iff(Member(0,succ(f)),
     Exists(Exists(Exists(
      And(p, 
       And(pair_fm(2,0,3),
        Exists(Exists(Exists(
         And(pair_fm(5,a#+7,2),
          And(upair_fm(5,5,1),
           And(pre_image_fm(r#+7,1,0),
            And(restriction_fm(f#+7,0,4), Member(2,r#+7)))))))))))))))"
 
 lemma is_recfun_type [TC]:
      "[| p \<in> formula; x \<in> nat; y \<in> nat; z \<in> nat |] 
       ==> is_recfun_fm(p,x,y,z) \<in> formula"
 by (simp add: is_recfun_fm_def)
 
 
 lemma sats_is_recfun_fm:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A|] 
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,env)))))"
   shows 
       "[|x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
        ==> sats(A, is_recfun_fm(p,x,y,z), env) \<longleftrightarrow>
            M_is_recfun(##A, MH, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: is_recfun_fm_def M_is_recfun_iff MH_iff_sats [THEN iff_sym])
 
 lemma is_recfun_iff_sats:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A|] 
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,env)))))"
   shows
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
       i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> M_is_recfun(##A, MH, x, y, z) \<longleftrightarrow> sats(A, is_recfun_fm(p,i,j,k), env)"
 by (simp add: sats_is_recfun_fm [OF MH_iff_sats]) 
 
 text\<open>The additional variable in the premise, namely \<^term>\<open>f'\<close>, is essential.
 It lets \<^term>\<open>MH\<close> depend upon \<^term>\<open>x\<close>, which seems often necessary.
 The same thing occurs in \<open>is_wfrec_reflection\<close>.\<close>
 theorem is_recfun_reflection:
   assumes MH_reflection:
     "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
                      \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
   shows "REFLECTS[\<lambda>x. M_is_recfun(L, MH(L,x), f(x), g(x), h(x)), 
              \<lambda>i x. M_is_recfun(##Lset(i), MH(##Lset(i),x), f(x), g(x), h(x))]"
 apply (simp (no_asm_use) only: M_is_recfun_def)
 apply (intro FOL_reflections function_reflections
              restriction_reflection MH_reflection)
 done
 
 subsubsection\<open>The Operator \<^term>\<open>is_wfrec\<close>\<close>
 
 text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0;
       \<^term>\<open>p\<close> is enclosed by 5 quantifiers.\<close>
 
 (* is_wfrec :: "[i=>o, i, [i,i,i]=>o, i, i] => o"
     "is_wfrec(M,MH,r,a,z) == 
       \<exists>f[M]. M_is_recfun(M,MH,r,a,f) & MH(a,f,z)" *)
 definition
   is_wfrec_fm :: "[i, i, i, i]=>i" where
   "is_wfrec_fm(p,r,a,z) == 
     Exists(And(is_recfun_fm(p, succ(r), succ(a), 0),
            Exists(Exists(Exists(Exists(
              And(Equal(2,a#+5), And(Equal(1,4), And(Equal(0,z#+5), p)))))))))"
 
 text\<open>We call \<^term>\<open>p\<close> with arguments a, f, z by equating them with 
   the corresponding quantified variables with de Bruijn indices 2, 1, 0.\<close>
 
 text\<open>There's an additional existential quantifier to ensure that the
       environments in both calls to MH have the same length.\<close>
 
 lemma is_wfrec_type [TC]:
      "[| p \<in> formula; x \<in> nat; y \<in> nat; z \<in> nat |] 
       ==> is_wfrec_fm(p,x,y,z) \<in> formula"
 by (simp add: is_wfrec_fm_def) 
 
 lemma sats_is_wfrec_fm:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3 a4. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A|] 
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
   shows 
       "[|x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
        ==> sats(A, is_wfrec_fm(p,x,y,z), env) \<longleftrightarrow> 
            is_wfrec(##A, MH, nth(x,env), nth(y,env), nth(z,env))"
 apply (frule_tac x=z in lt_length_in_nat, assumption)  
 apply (frule lt_length_in_nat, assumption)  
 apply (simp add: is_wfrec_fm_def sats_is_recfun_fm is_wfrec_def MH_iff_sats [THEN iff_sym], blast) 
 done
 
 
 lemma is_wfrec_iff_sats:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3 a4. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A|] 
         ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
   shows
   "[|nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
       i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
    ==> is_wfrec(##A, MH, x, y, z) \<longleftrightarrow> sats(A, is_wfrec_fm(p,i,j,k), env)" 
 by (simp add: sats_is_wfrec_fm [OF MH_iff_sats])
 
 theorem is_wfrec_reflection:
   assumes MH_reflection:
     "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
                      \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
   shows "REFLECTS[\<lambda>x. is_wfrec(L, MH(L,x), f(x), g(x), h(x)), 
                \<lambda>i x. is_wfrec(##Lset(i), MH(##Lset(i),x), f(x), g(x), h(x))]"
 apply (simp (no_asm_use) only: is_wfrec_def)
 apply (intro FOL_reflections MH_reflection is_recfun_reflection)
 done
 
 
 subsection\<open>For Datatypes\<close>
 
 subsubsection\<open>Binary Products, Internalized\<close>
 
 definition
   cartprod_fm :: "[i,i,i]=>i" where
 (* "cartprod(M,A,B,z) ==
         \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))" *)
     "cartprod_fm(A,B,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Exists(And(Member(0,succ(succ(A))),
                          Exists(And(Member(0,succ(succ(succ(B)))),
                                     pair_fm(1,0,2)))))))"
 
 lemma cartprod_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> cartprod_fm(x,y,z) \<in> formula"
 by (simp add: cartprod_fm_def)
 
 lemma sats_cartprod_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, cartprod_fm(x,y,z), env) \<longleftrightarrow>
         cartprod(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: cartprod_fm_def cartprod_def)
 
 lemma cartprod_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> cartprod(##A, x, y, z) \<longleftrightarrow> sats(A, cartprod_fm(i,j,k), env)"
-by (simp add: sats_cartprod_fm)
+by (simp)
 
 theorem cartprod_reflection:
      "REFLECTS[\<lambda>x. cartprod(L,f(x),g(x),h(x)),
                \<lambda>i x. cartprod(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: cartprod_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Binary Sums, Internalized\<close>
 
 (* "is_sum(M,A,B,Z) ==
        \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M].
          3      2       1        0
        number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
        cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"  *)
 definition
   sum_fm :: "[i,i,i]=>i" where
     "sum_fm(A,B,Z) ==
        Exists(Exists(Exists(Exists(
         And(number1_fm(2),
             And(cartprod_fm(2,A#+4,3),
                 And(upair_fm(2,2,1),
                     And(cartprod_fm(1,B#+4,0), union_fm(3,0,Z#+4)))))))))"
 
 lemma sum_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> sum_fm(x,y,z) \<in> formula"
 by (simp add: sum_fm_def)
 
 lemma sats_sum_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, sum_fm(x,y,z), env) \<longleftrightarrow>
         is_sum(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: sum_fm_def is_sum_def)
 
 lemma sum_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_sum(##A, x, y, z) \<longleftrightarrow> sats(A, sum_fm(i,j,k), env)"
 by simp
 
 theorem sum_reflection:
      "REFLECTS[\<lambda>x. is_sum(L,f(x),g(x),h(x)),
                \<lambda>i x. is_sum(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_sum_def)
 apply (intro FOL_reflections function_reflections cartprod_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>quasinat\<close>\<close>
 
 (* "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))" *)
 definition
   quasinat_fm :: "i=>i" where
     "quasinat_fm(z) == Or(empty_fm(z), Exists(succ_fm(0,succ(z))))"
 
 lemma quasinat_type [TC]:
      "x \<in> nat ==> quasinat_fm(x) \<in> formula"
 by (simp add: quasinat_fm_def)
 
 lemma sats_quasinat_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, quasinat_fm(x), env) \<longleftrightarrow> is_quasinat(##A, nth(x,env))"
 by (simp add: quasinat_fm_def is_quasinat_def)
 
 lemma quasinat_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> is_quasinat(##A, x) \<longleftrightarrow> sats(A, quasinat_fm(i), env)"
 by simp
 
 theorem quasinat_reflection:
      "REFLECTS[\<lambda>x. is_quasinat(L,f(x)),
                \<lambda>i x. is_quasinat(##Lset(i),f(x))]"
 apply (simp only: is_quasinat_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_nat_case\<close>\<close>
 text\<open>I could not get it to work with the more natural assumption that 
  \<^term>\<open>is_b\<close> takes two arguments.  Instead it must be a formula where 1 and 0
  stand for \<^term>\<open>m\<close> and \<^term>\<open>b\<close>, respectively.\<close>
 
 (* is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o"
     "is_nat_case(M, a, is_b, k, z) ==
        (empty(M,k) \<longrightarrow> z=a) &
        (\<forall>m[M]. successor(M,m,k) \<longrightarrow> is_b(m,z)) &
        (is_quasinat(M,k) | empty(M,z))" *)
 text\<open>The formula \<^term>\<open>is_b\<close> has free variables 1 and 0.\<close>
 definition
   is_nat_case_fm :: "[i, i, i, i]=>i" where
  "is_nat_case_fm(a,is_b,k,z) == 
     And(Implies(empty_fm(k), Equal(z,a)),
         And(Forall(Implies(succ_fm(0,succ(k)), 
                    Forall(Implies(Equal(0,succ(succ(z))), is_b)))),
             Or(quasinat_fm(k), empty_fm(z))))"
 
 lemma is_nat_case_type [TC]:
      "[| is_b \<in> formula;  
          x \<in> nat; y \<in> nat; z \<in> nat |] 
       ==> is_nat_case_fm(x,is_b,y,z) \<in> formula"
 by (simp add: is_nat_case_fm_def)
 
 lemma sats_is_nat_case_fm:
   assumes is_b_iff_sats: 
       "!!a. a \<in> A ==> is_b(a,nth(z, env)) \<longleftrightarrow> 
                       sats(A, p, Cons(nth(z,env), Cons(a, env)))"
   shows 
       "[|x \<in> nat; y \<in> nat; z < length(env); env \<in> list(A)|]
        ==> sats(A, is_nat_case_fm(x,p,y,z), env) \<longleftrightarrow>
            is_nat_case(##A, nth(x,env), is_b, nth(y,env), nth(z,env))"
 apply (frule lt_length_in_nat, assumption)
 apply (simp add: is_nat_case_fm_def is_nat_case_def is_b_iff_sats [THEN iff_sym])
 done
 
 lemma is_nat_case_iff_sats:
   "[| (!!a. a \<in> A ==> is_b(a,z) \<longleftrightarrow>
                       sats(A, p, Cons(z, Cons(a,env))));
       nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
       i \<in> nat; j \<in> nat; k < length(env); env \<in> list(A)|]
    ==> is_nat_case(##A, x, is_b, y, z) \<longleftrightarrow> sats(A, is_nat_case_fm(i,p,j,k), env)"
 by (simp add: sats_is_nat_case_fm [of A is_b])
 
 
 text\<open>The second argument of \<^term>\<open>is_b\<close> gives it direct access to \<^term>\<open>x\<close>,
   which is essential for handling free variable references.  Without this
   argument, we cannot prove reflection for \<^term>\<open>iterates_MH\<close>.\<close>
 theorem is_nat_case_reflection:
   assumes is_b_reflection:
     "!!h f g. REFLECTS[\<lambda>x. is_b(L, h(x), f(x), g(x)),
                      \<lambda>i x. is_b(##Lset(i), h(x), f(x), g(x))]"
   shows "REFLECTS[\<lambda>x. is_nat_case(L, f(x), is_b(L,x), g(x), h(x)),
                \<lambda>i x. is_nat_case(##Lset(i), f(x), is_b(##Lset(i), x), g(x), h(x))]"
 apply (simp (no_asm_use) only: is_nat_case_def)
 apply (intro FOL_reflections function_reflections
              restriction_reflection is_b_reflection quasinat_reflection)
 done
 
 
 subsection\<open>The Operator \<^term>\<open>iterates_MH\<close>, Needed for Iteration\<close>
 
 (*  iterates_MH :: "[i=>o, [i,i]=>o, i, i, i, i] => o"
    "iterates_MH(M,isF,v,n,g,z) ==
         is_nat_case(M, v, \<lambda>m u. \<exists>gm[M]. fun_apply(M,g,m,gm) & isF(gm,u),
                     n, z)" *)
 definition
   iterates_MH_fm :: "[i, i, i, i, i]=>i" where
  "iterates_MH_fm(isF,v,n,g,z) == 
     is_nat_case_fm(v, 
       Exists(And(fun_apply_fm(succ(succ(succ(g))),2,0), 
                      Forall(Implies(Equal(0,2), isF)))), 
       n, z)"
 
 lemma iterates_MH_type [TC]:
      "[| p \<in> formula;  
          v \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |] 
       ==> iterates_MH_fm(p,v,x,y,z) \<in> formula"
 by (simp add: iterates_MH_fm_def)
 
 lemma sats_iterates_MH_fm:
   assumes is_F_iff_sats:
       "!!a b c d. [| a \<in> A; b \<in> A; c \<in> A; d \<in> A|]
               ==> is_F(a,b) \<longleftrightarrow>
                   sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d,env)))))"
   shows 
       "[|v \<in> nat; x \<in> nat; y \<in> nat; z < length(env); env \<in> list(A)|]
        ==> sats(A, iterates_MH_fm(p,v,x,y,z), env) \<longleftrightarrow>
            iterates_MH(##A, is_F, nth(v,env), nth(x,env), nth(y,env), nth(z,env))"
 apply (frule lt_length_in_nat, assumption)  
 apply (simp add: iterates_MH_fm_def iterates_MH_def sats_is_nat_case_fm 
               is_F_iff_sats [symmetric])
 apply (rule is_nat_case_cong) 
 apply (simp_all add: setclass_def)
 done
 
 lemma iterates_MH_iff_sats:
   assumes is_F_iff_sats:
       "!!a b c d. [| a \<in> A; b \<in> A; c \<in> A; d \<in> A|]
               ==> is_F(a,b) \<longleftrightarrow>
                   sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d,env)))))"
   shows 
   "[| nth(i',env) = v; nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
       i' \<in> nat; i \<in> nat; j \<in> nat; k < length(env); env \<in> list(A)|]
    ==> iterates_MH(##A, is_F, v, x, y, z) \<longleftrightarrow>
        sats(A, iterates_MH_fm(p,i',i,j,k), env)"
 by (simp add: sats_iterates_MH_fm [OF is_F_iff_sats]) 
 
 text\<open>The second argument of \<^term>\<open>p\<close> gives it direct access to \<^term>\<open>x\<close>,
   which is essential for handling free variable references.  Without this
   argument, we cannot prove reflection for \<^term>\<open>list_N\<close>.\<close>
 theorem iterates_MH_reflection:
   assumes p_reflection:
     "!!f g h. REFLECTS[\<lambda>x. p(L, h(x), f(x), g(x)),
                      \<lambda>i x. p(##Lset(i), h(x), f(x), g(x))]"
  shows "REFLECTS[\<lambda>x. iterates_MH(L, p(L,x), e(x), f(x), g(x), h(x)),
                \<lambda>i x. iterates_MH(##Lset(i), p(##Lset(i),x), e(x), f(x), g(x), h(x))]"
 apply (simp (no_asm_use) only: iterates_MH_def)
 apply (intro FOL_reflections function_reflections is_nat_case_reflection
              restriction_reflection p_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_iterates\<close>\<close>
 
 text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0;
       \<^term>\<open>p\<close> is enclosed by 9 (??) quantifiers.\<close>
 
 (*    "is_iterates(M,isF,v,n,Z) == 
       \<exists>sn[M]. \<exists>msn[M]. successor(M,n,sn) & membership(M,sn,msn) &
        1       0       is_wfrec(M, iterates_MH(M,isF,v), msn, n, Z)"*)
 
 definition
   is_iterates_fm :: "[i, i, i, i]=>i" where
   "is_iterates_fm(p,v,n,Z) == 
      Exists(Exists(
       And(succ_fm(n#+2,1),
        And(Memrel_fm(1,0),
               is_wfrec_fm(iterates_MH_fm(p, v#+7, 2, 1, 0), 
                           0, n#+2, Z#+2)))))"
 
 text\<open>We call \<^term>\<open>p\<close> with arguments a, f, z by equating them with 
   the corresponding quantified variables with de Bruijn indices 2, 1, 0.\<close>
 
 
 lemma is_iterates_type [TC]:
      "[| p \<in> formula; x \<in> nat; y \<in> nat; z \<in> nat |] 
       ==> is_iterates_fm(p,x,y,z) \<in> formula"
 by (simp add: is_iterates_fm_def) 
 
 lemma sats_is_iterates_fm:
   assumes is_F_iff_sats:
       "!!a b c d e f g h i j k. 
               [| a \<in> A; b \<in> A; c \<in> A; d \<in> A; e \<in> A; f \<in> A; 
                  g \<in> A; h \<in> A; i \<in> A; j \<in> A; k \<in> A|]
               ==> is_F(a,b) \<longleftrightarrow>
                   sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d, Cons(e, Cons(f, 
                       Cons(g, Cons(h, Cons(i, Cons(j, Cons(k, env))))))))))))"
   shows 
       "[|x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
        ==> sats(A, is_iterates_fm(p,x,y,z), env) \<longleftrightarrow>
            is_iterates(##A, is_F, nth(x,env), nth(y,env), nth(z,env))"
 apply (frule_tac x=z in lt_length_in_nat, assumption)  
 apply (frule lt_length_in_nat, assumption)  
 apply (simp add: is_iterates_fm_def is_iterates_def sats_is_nat_case_fm 
               is_F_iff_sats [symmetric] sats_is_wfrec_fm sats_iterates_MH_fm)
 done
 
 
 lemma is_iterates_iff_sats:
   assumes is_F_iff_sats:
       "!!a b c d e f g h i j k. 
               [| a \<in> A; b \<in> A; c \<in> A; d \<in> A; e \<in> A; f \<in> A; 
                  g \<in> A; h \<in> A; i \<in> A; j \<in> A; k \<in> A|]
               ==> is_F(a,b) \<longleftrightarrow>
                   sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d, Cons(e, Cons(f, 
                       Cons(g, Cons(h, Cons(i, Cons(j, Cons(k, env))))))))))))"
   shows 
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
       i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
    ==> is_iterates(##A, is_F, x, y, z) \<longleftrightarrow>
        sats(A, is_iterates_fm(p,i,j,k), env)"
 by (simp add: sats_is_iterates_fm [OF is_F_iff_sats]) 
 
 text\<open>The second argument of \<^term>\<open>p\<close> gives it direct access to \<^term>\<open>x\<close>,
   which is essential for handling free variable references.  Without this
   argument, we cannot prove reflection for \<^term>\<open>list_N\<close>.\<close>
 theorem is_iterates_reflection:
   assumes p_reflection:
     "!!f g h. REFLECTS[\<lambda>x. p(L, h(x), f(x), g(x)),
                      \<lambda>i x. p(##Lset(i), h(x), f(x), g(x))]"
  shows "REFLECTS[\<lambda>x. is_iterates(L, p(L,x), f(x), g(x), h(x)),
                \<lambda>i x. is_iterates(##Lset(i), p(##Lset(i),x), f(x), g(x), h(x))]"
 apply (simp (no_asm_use) only: is_iterates_def)
 apply (intro FOL_reflections function_reflections p_reflection
              is_wfrec_reflection iterates_MH_reflection)
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_eclose_n\<close>, Internalized\<close>
 
 (* is_eclose_n(M,A,n,Z) == is_iterates(M, big_union(M), A, n, Z) *)
 
 definition
   eclose_n_fm :: "[i,i,i]=>i" where
   "eclose_n_fm(A,n,Z) == is_iterates_fm(big_union_fm(1,0), A, n, Z)"
 
 lemma eclose_n_fm_type [TC]:
  "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> eclose_n_fm(x,y,z) \<in> formula"
 by (simp add: eclose_n_fm_def)
 
 lemma sats_eclose_n_fm [simp]:
    "[| x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
     ==> sats(A, eclose_n_fm(x,y,z), env) \<longleftrightarrow>
         is_eclose_n(##A, nth(x,env), nth(y,env), nth(z,env))"
 apply (frule_tac x=z in lt_length_in_nat, assumption)  
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (simp add: eclose_n_fm_def is_eclose_n_def 
                  sats_is_iterates_fm) 
 done
 
 lemma eclose_n_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
        ==> is_eclose_n(##A, x, y, z) \<longleftrightarrow> sats(A, eclose_n_fm(i,j,k), env)"
-by (simp add: sats_eclose_n_fm)
+by (simp)
 
 theorem eclose_n_reflection:
      "REFLECTS[\<lambda>x. is_eclose_n(L, f(x), g(x), h(x)),  
                \<lambda>i x. is_eclose_n(##Lset(i), f(x), g(x), h(x))]"
 apply (simp only: is_eclose_n_def)
 apply (intro FOL_reflections function_reflections is_iterates_reflection) 
 done
 
 
 subsubsection\<open>Membership in \<^term>\<open>eclose(A)\<close>\<close>
 
 (* mem_eclose(M,A,l) == 
       \<exists>n[M]. \<exists>eclosen[M]. 
        finite_ordinal(M,n) & is_eclose_n(M,A,n,eclosen) & l \<in> eclosen *)
 definition
   mem_eclose_fm :: "[i,i]=>i" where
     "mem_eclose_fm(x,y) ==
        Exists(Exists(
          And(finite_ordinal_fm(1),
            And(eclose_n_fm(x#+2,1,0), Member(y#+2,0)))))"
 
 lemma mem_eclose_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> mem_eclose_fm(x,y) \<in> formula"
 by (simp add: mem_eclose_fm_def)
 
 lemma sats_mem_eclose_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, mem_eclose_fm(x,y), env) \<longleftrightarrow> mem_eclose(##A, nth(x,env), nth(y,env))"
 by (simp add: mem_eclose_fm_def mem_eclose_def)
 
 lemma mem_eclose_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> mem_eclose(##A, x, y) \<longleftrightarrow> sats(A, mem_eclose_fm(i,j), env)"
 by simp
 
 theorem mem_eclose_reflection:
      "REFLECTS[\<lambda>x. mem_eclose(L,f(x),g(x)),
                \<lambda>i x. mem_eclose(##Lset(i),f(x),g(x))]"
 apply (simp only: mem_eclose_def)
 apply (intro FOL_reflections finite_ordinal_reflection eclose_n_reflection)
 done
 
 
 subsubsection\<open>The Predicate ``Is \<^term>\<open>eclose(A)\<close>''\<close>
 
 (* is_eclose(M,A,Z) == \<forall>l[M]. l \<in> Z \<longleftrightarrow> mem_eclose(M,A,l) *)
 definition
   is_eclose_fm :: "[i,i]=>i" where
     "is_eclose_fm(A,Z) ==
        Forall(Iff(Member(0,succ(Z)), mem_eclose_fm(succ(A),0)))"
 
 lemma is_eclose_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> is_eclose_fm(x,y) \<in> formula"
 by (simp add: is_eclose_fm_def)
 
 lemma sats_is_eclose_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, is_eclose_fm(x,y), env) \<longleftrightarrow> is_eclose(##A, nth(x,env), nth(y,env))"
 by (simp add: is_eclose_fm_def is_eclose_def)
 
 lemma is_eclose_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_eclose(##A, x, y) \<longleftrightarrow> sats(A, is_eclose_fm(i,j), env)"
 by simp
 
 theorem is_eclose_reflection:
      "REFLECTS[\<lambda>x. is_eclose(L,f(x),g(x)),
                \<lambda>i x. is_eclose(##Lset(i),f(x),g(x))]"
 apply (simp only: is_eclose_def)
 apply (intro FOL_reflections mem_eclose_reflection)
 done
 
 
 subsubsection\<open>The List Functor, Internalized\<close>
 
 definition
   list_functor_fm :: "[i,i,i]=>i" where
 (* "is_list_functor(M,A,X,Z) ==
         \<exists>n1[M]. \<exists>AX[M].
          number1(M,n1) & cartprod(M,A,X,AX) & is_sum(M,n1,AX,Z)" *)
     "list_functor_fm(A,X,Z) ==
        Exists(Exists(
         And(number1_fm(1),
             And(cartprod_fm(A#+2,X#+2,0), sum_fm(1,0,Z#+2)))))"
 
 lemma list_functor_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> list_functor_fm(x,y,z) \<in> formula"
 by (simp add: list_functor_fm_def)
 
 lemma sats_list_functor_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, list_functor_fm(x,y,z), env) \<longleftrightarrow>
         is_list_functor(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: list_functor_fm_def is_list_functor_def)
 
 lemma list_functor_iff_sats:
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
       i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> is_list_functor(##A, x, y, z) \<longleftrightarrow> sats(A, list_functor_fm(i,j,k), env)"
 by simp
 
 theorem list_functor_reflection:
      "REFLECTS[\<lambda>x. is_list_functor(L,f(x),g(x),h(x)),
                \<lambda>i x. is_list_functor(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_list_functor_def)
 apply (intro FOL_reflections number1_reflection
              cartprod_reflection sum_reflection)
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_list_N\<close>, Internalized\<close>
 
 (* "is_list_N(M,A,n,Z) == 
       \<exists>zero[M]. empty(M,zero) & 
                 is_iterates(M, is_list_functor(M,A), zero, n, Z)" *)
 
 definition
   list_N_fm :: "[i,i,i]=>i" where
   "list_N_fm(A,n,Z) == 
      Exists(
        And(empty_fm(0),
            is_iterates_fm(list_functor_fm(A#+9#+3,1,0), 0, n#+1, Z#+1)))"
 
 lemma list_N_fm_type [TC]:
  "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> list_N_fm(x,y,z) \<in> formula"
 by (simp add: list_N_fm_def)
 
 lemma sats_list_N_fm [simp]:
    "[| x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
     ==> sats(A, list_N_fm(x,y,z), env) \<longleftrightarrow>
         is_list_N(##A, nth(x,env), nth(y,env), nth(z,env))"
 apply (frule_tac x=z in lt_length_in_nat, assumption)  
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (simp add: list_N_fm_def is_list_N_def sats_is_iterates_fm) 
 done
 
 lemma list_N_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
        ==> is_list_N(##A, x, y, z) \<longleftrightarrow> sats(A, list_N_fm(i,j,k), env)"
-by (simp add: sats_list_N_fm)
+by (simp)
 
 theorem list_N_reflection:
      "REFLECTS[\<lambda>x. is_list_N(L, f(x), g(x), h(x)),  
                \<lambda>i x. is_list_N(##Lset(i), f(x), g(x), h(x))]"
 apply (simp only: is_list_N_def)
 apply (intro FOL_reflections function_reflections 
              is_iterates_reflection list_functor_reflection) 
 done
 
 
 
 subsubsection\<open>The Predicate ``Is A List''\<close>
 
 (* mem_list(M,A,l) == 
       \<exists>n[M]. \<exists>listn[M]. 
        finite_ordinal(M,n) & is_list_N(M,A,n,listn) & l \<in> listn *)
 definition
   mem_list_fm :: "[i,i]=>i" where
     "mem_list_fm(x,y) ==
        Exists(Exists(
          And(finite_ordinal_fm(1),
            And(list_N_fm(x#+2,1,0), Member(y#+2,0)))))"
 
 lemma mem_list_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> mem_list_fm(x,y) \<in> formula"
 by (simp add: mem_list_fm_def)
 
 lemma sats_mem_list_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, mem_list_fm(x,y), env) \<longleftrightarrow> mem_list(##A, nth(x,env), nth(y,env))"
 by (simp add: mem_list_fm_def mem_list_def)
 
 lemma mem_list_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> mem_list(##A, x, y) \<longleftrightarrow> sats(A, mem_list_fm(i,j), env)"
 by simp
 
 theorem mem_list_reflection:
      "REFLECTS[\<lambda>x. mem_list(L,f(x),g(x)),
                \<lambda>i x. mem_list(##Lset(i),f(x),g(x))]"
 apply (simp only: mem_list_def)
 apply (intro FOL_reflections finite_ordinal_reflection list_N_reflection)
 done
 
 
 subsubsection\<open>The Predicate ``Is \<^term>\<open>list(A)\<close>''\<close>
 
 (* is_list(M,A,Z) == \<forall>l[M]. l \<in> Z \<longleftrightarrow> mem_list(M,A,l) *)
 definition
   is_list_fm :: "[i,i]=>i" where
     "is_list_fm(A,Z) ==
        Forall(Iff(Member(0,succ(Z)), mem_list_fm(succ(A),0)))"
 
 lemma is_list_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> is_list_fm(x,y) \<in> formula"
 by (simp add: is_list_fm_def)
 
 lemma sats_is_list_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, is_list_fm(x,y), env) \<longleftrightarrow> is_list(##A, nth(x,env), nth(y,env))"
 by (simp add: is_list_fm_def is_list_def)
 
 lemma is_list_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_list(##A, x, y) \<longleftrightarrow> sats(A, is_list_fm(i,j), env)"
 by simp
 
 theorem is_list_reflection:
      "REFLECTS[\<lambda>x. is_list(L,f(x),g(x)),
                \<lambda>i x. is_list(##Lset(i),f(x),g(x))]"
 apply (simp only: is_list_def)
 apply (intro FOL_reflections mem_list_reflection)
 done
 
 
 subsubsection\<open>The Formula Functor, Internalized\<close>
 
 definition formula_functor_fm :: "[i,i]=>i" where
 (*     "is_formula_functor(M,X,Z) ==
         \<exists>nat'[M]. \<exists>natnat[M]. \<exists>natnatsum[M]. \<exists>XX[M]. \<exists>X3[M].
            4           3               2       1       0
           omega(M,nat') & cartprod(M,nat',nat',natnat) &
           is_sum(M,natnat,natnat,natnatsum) &
           cartprod(M,X,X,XX) & is_sum(M,XX,X,X3) &
           is_sum(M,natnatsum,X3,Z)" *)
     "formula_functor_fm(X,Z) ==
        Exists(Exists(Exists(Exists(Exists(
         And(omega_fm(4),
          And(cartprod_fm(4,4,3),
           And(sum_fm(3,3,2),
            And(cartprod_fm(X#+5,X#+5,1),
             And(sum_fm(1,X#+5,0), sum_fm(2,0,Z#+5)))))))))))"
 
 lemma formula_functor_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> formula_functor_fm(x,y) \<in> formula"
 by (simp add: formula_functor_fm_def)
 
 lemma sats_formula_functor_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, formula_functor_fm(x,y), env) \<longleftrightarrow>
         is_formula_functor(##A, nth(x,env), nth(y,env))"
 by (simp add: formula_functor_fm_def is_formula_functor_def)
 
 lemma formula_functor_iff_sats:
   "[| nth(i,env) = x; nth(j,env) = y;
       i \<in> nat; j \<in> nat; env \<in> list(A)|]
    ==> is_formula_functor(##A, x, y) \<longleftrightarrow> sats(A, formula_functor_fm(i,j), env)"
 by simp
 
 theorem formula_functor_reflection:
      "REFLECTS[\<lambda>x. is_formula_functor(L,f(x),g(x)),
                \<lambda>i x. is_formula_functor(##Lset(i),f(x),g(x))]"
 apply (simp only: is_formula_functor_def)
 apply (intro FOL_reflections omega_reflection
              cartprod_reflection sum_reflection)
 done
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_formula_N\<close>, Internalized\<close>
 
 (*  "is_formula_N(M,n,Z) == 
       \<exists>zero[M]. empty(M,zero) & 
                 is_iterates(M, is_formula_functor(M), zero, n, Z)" *) 
 definition
   formula_N_fm :: "[i,i]=>i" where
   "formula_N_fm(n,Z) == 
      Exists(
        And(empty_fm(0),
            is_iterates_fm(formula_functor_fm(1,0), 0, n#+1, Z#+1)))"
 
 lemma formula_N_fm_type [TC]:
  "[| x \<in> nat; y \<in> nat |] ==> formula_N_fm(x,y) \<in> formula"
 by (simp add: formula_N_fm_def)
 
 lemma sats_formula_N_fm [simp]:
    "[| x < length(env); y < length(env); env \<in> list(A)|]
     ==> sats(A, formula_N_fm(x,y), env) \<longleftrightarrow>
         is_formula_N(##A, nth(x,env), nth(y,env))"
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (frule lt_length_in_nat, assumption)  
 apply (simp add: formula_N_fm_def is_formula_N_def sats_is_iterates_fm) 
 done
 
 lemma formula_N_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; 
           i < length(env); j < length(env); env \<in> list(A)|]
        ==> is_formula_N(##A, x, y) \<longleftrightarrow> sats(A, formula_N_fm(i,j), env)"
-by (simp add: sats_formula_N_fm)
+by (simp)
 
 theorem formula_N_reflection:
      "REFLECTS[\<lambda>x. is_formula_N(L, f(x), g(x)),  
                \<lambda>i x. is_formula_N(##Lset(i), f(x), g(x))]"
 apply (simp only: is_formula_N_def)
 apply (intro FOL_reflections function_reflections 
              is_iterates_reflection formula_functor_reflection) 
 done
 
 
 
 subsubsection\<open>The Predicate ``Is A Formula''\<close>
 
 (*  mem_formula(M,p) == 
       \<exists>n[M]. \<exists>formn[M]. 
        finite_ordinal(M,n) & is_formula_N(M,n,formn) & p \<in> formn *)
 definition
   mem_formula_fm :: "i=>i" where
     "mem_formula_fm(x) ==
        Exists(Exists(
          And(finite_ordinal_fm(1),
            And(formula_N_fm(1,0), Member(x#+2,0)))))"
 
 lemma mem_formula_type [TC]:
      "x \<in> nat ==> mem_formula_fm(x) \<in> formula"
 by (simp add: mem_formula_fm_def)
 
 lemma sats_mem_formula_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, mem_formula_fm(x), env) \<longleftrightarrow> mem_formula(##A, nth(x,env))"
 by (simp add: mem_formula_fm_def mem_formula_def)
 
 lemma mem_formula_iff_sats:
       "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
        ==> mem_formula(##A, x) \<longleftrightarrow> sats(A, mem_formula_fm(i), env)"
 by simp
 
 theorem mem_formula_reflection:
      "REFLECTS[\<lambda>x. mem_formula(L,f(x)),
                \<lambda>i x. mem_formula(##Lset(i),f(x))]"
 apply (simp only: mem_formula_def)
 apply (intro FOL_reflections finite_ordinal_reflection formula_N_reflection)
 done
 
 
 
 subsubsection\<open>The Predicate ``Is \<^term>\<open>formula\<close>''\<close>
 
 (* is_formula(M,Z) == \<forall>p[M]. p \<in> Z \<longleftrightarrow> mem_formula(M,p) *)
 definition
   is_formula_fm :: "i=>i" where
     "is_formula_fm(Z) == Forall(Iff(Member(0,succ(Z)), mem_formula_fm(0)))"
 
 lemma is_formula_type [TC]:
      "x \<in> nat ==> is_formula_fm(x) \<in> formula"
 by (simp add: is_formula_fm_def)
 
 lemma sats_is_formula_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, is_formula_fm(x), env) \<longleftrightarrow> is_formula(##A, nth(x,env))"
 by (simp add: is_formula_fm_def is_formula_def)
 
 lemma is_formula_iff_sats:
       "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
        ==> is_formula(##A, x) \<longleftrightarrow> sats(A, is_formula_fm(i), env)"
 by simp
 
 theorem is_formula_reflection:
      "REFLECTS[\<lambda>x. is_formula(L,f(x)),
                \<lambda>i x. is_formula(##Lset(i),f(x))]"
 apply (simp only: is_formula_def)
 apply (intro FOL_reflections mem_formula_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_transrec\<close>\<close>
 
 text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0.  It is buried
    within eight quantifiers!
    We call \<^term>\<open>p\<close> with arguments a, f, z by equating them with 
   the corresponding quantified variables with de Bruijn indices 2, 1, 0.\<close>
 
 (* is_transrec :: "[i=>o, [i,i,i]=>o, i, i] => o"
    "is_transrec(M,MH,a,z) == 
       \<exists>sa[M]. \<exists>esa[M]. \<exists>mesa[M]. 
        2       1         0
        upair(M,a,a,sa) & is_eclose(M,sa,esa) & membership(M,esa,mesa) &
        is_wfrec(M,MH,mesa,a,z)" *)
 definition
   is_transrec_fm :: "[i, i, i]=>i" where
  "is_transrec_fm(p,a,z) == 
     Exists(Exists(Exists(
       And(upair_fm(a#+3,a#+3,2),
        And(is_eclose_fm(2,1),
         And(Memrel_fm(1,0), is_wfrec_fm(p,0,a#+3,z#+3)))))))"
 
 
 lemma is_transrec_type [TC]:
      "[| p \<in> formula; x \<in> nat; z \<in> nat |] 
       ==> is_transrec_fm(p,x,z) \<in> formula"
 by (simp add: is_transrec_fm_def) 
 
 lemma sats_is_transrec_fm:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3 a4 a5 a6 a7. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A|] 
         ==> MH(a2, a1, a0) \<longleftrightarrow> 
             sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
                           Cons(a4,Cons(a5,Cons(a6,Cons(a7,env)))))))))"
   shows 
       "[|x < length(env); z < length(env); env \<in> list(A)|]
        ==> sats(A, is_transrec_fm(p,x,z), env) \<longleftrightarrow> 
            is_transrec(##A, MH, nth(x,env), nth(z,env))"
 apply (frule_tac x=z in lt_length_in_nat, assumption)  
 apply (frule_tac x=x in lt_length_in_nat, assumption)  
 apply (simp add: is_transrec_fm_def sats_is_wfrec_fm is_transrec_def MH_iff_sats [THEN iff_sym]) 
 done
 
 
 lemma is_transrec_iff_sats:
   assumes MH_iff_sats: 
       "!!a0 a1 a2 a3 a4 a5 a6 a7. 
         [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A|] 
         ==> MH(a2, a1, a0) \<longleftrightarrow> 
             sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
                           Cons(a4,Cons(a5,Cons(a6,Cons(a7,env)))))))))"
   shows
   "[|nth(i,env) = x; nth(k,env) = z; 
       i < length(env); k < length(env); env \<in> list(A)|]
    ==> is_transrec(##A, MH, x, z) \<longleftrightarrow> sats(A, is_transrec_fm(p,i,k), env)" 
 by (simp add: sats_is_transrec_fm [OF MH_iff_sats])
 
 theorem is_transrec_reflection:
   assumes MH_reflection:
     "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
                      \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
   shows "REFLECTS[\<lambda>x. is_transrec(L, MH(L,x), f(x), h(x)), 
                \<lambda>i x. is_transrec(##Lset(i), MH(##Lset(i),x), f(x), h(x))]"
 apply (simp (no_asm_use) only: is_transrec_def)
 apply (intro FOL_reflections function_reflections MH_reflection 
              is_wfrec_reflection is_eclose_reflection)
 done
 
 end
diff --git a/src/ZF/Constructible/L_axioms.thy b/src/ZF/Constructible/L_axioms.thy
--- a/src/ZF/Constructible/L_axioms.thy
+++ b/src/ZF/Constructible/L_axioms.thy
@@ -1,1392 +1,1403 @@
 (*  Title:      ZF/Constructible/L_axioms.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>The ZF Axioms (Except Separation) in L\<close>
 
 theory L_axioms imports Formula Relative Reflection MetaExists begin
 
 text \<open>The class L satisfies the premises of locale \<open>M_trivial\<close>\<close>
 
 lemma transL: "[| y\<in>x; L(x) |] ==> L(y)"
 apply (insert Transset_Lset)
 apply (simp add: Transset_def L_def, blast)
 done
 
 lemma nonempty: "L(0)"
 apply (simp add: L_def)
 apply (blast intro: zero_in_Lset)
 done
 
 theorem upair_ax: "upair_ax(L)"
 apply (simp add: upair_ax_def upair_def, clarify)
 apply (rule_tac x="{x,y}" in rexI)
 apply (simp_all add: doubleton_in_L)
 done
 
 theorem Union_ax: "Union_ax(L)"
 apply (simp add: Union_ax_def big_union_def, clarify)
 apply (rule_tac x="\<Union>(x)" in rexI)
 apply (simp_all add: Union_in_L, auto)
 apply (blast intro: transL)
 done
 
 theorem power_ax: "power_ax(L)"
 apply (simp add: power_ax_def powerset_def Relative.subset_def, clarify)
 apply (rule_tac x="{y \<in> Pow(x). L(y)}" in rexI)
 apply (simp_all add: LPow_in_L, auto)
 apply (blast intro: transL)
 done
 
 text\<open>We don't actually need \<^term>\<open>L\<close> to satisfy the foundation axiom.\<close>
 theorem foundation_ax: "foundation_ax(L)"
 apply (simp add: foundation_ax_def)
 apply (rule rallI) 
 apply (cut_tac A=x in foundation)
 apply (blast intro: transL)
 done
 
 subsection\<open>For L to satisfy Replacement\<close>
 
 (*Can't move these to Formula unless the definition of univalent is moved
 there too!*)
 
 lemma LReplace_in_Lset:
      "[|X \<in> Lset(i); univalent(L,X,Q); Ord(i)|]
       ==> \<exists>j. Ord(j) & Replace(X, %x y. Q(x,y) & L(y)) \<subseteq> Lset(j)"
 apply (rule_tac x="\<Union>y \<in> Replace(X, %x y. Q(x,y) & L(y)). succ(lrank(y))"
        in exI)
 apply simp
 apply clarify
 apply (rule_tac a=x in UN_I)
  apply (simp_all add: Replace_iff univalent_def)
 apply (blast dest: transL L_I)
 done
 
 lemma LReplace_in_L:
      "[|L(X); univalent(L,X,Q)|]
       ==> \<exists>Y. L(Y) & Replace(X, %x y. Q(x,y) & L(y)) \<subseteq> Y"
 apply (drule L_D, clarify)
 apply (drule LReplace_in_Lset, assumption+)
 apply (blast intro: L_I Lset_in_Lset_succ)
 done
 
 theorem replacement: "replacement(L,P)"
 apply (simp add: replacement_def, clarify)
 apply (frule LReplace_in_L, assumption+, clarify)
 apply (rule_tac x=Y in rexI)
 apply (simp_all add: Replace_iff univalent_def, blast)
 done
 
+lemma strong_replacementI [rule_format]:
+    "[| \<forall>B[L]. separation(L, %u. \<exists>x[L]. x\<in>B & P(x,u)) |]
+     ==> strong_replacement(L,P)"
+apply (simp add: strong_replacement_def, clarify)
+apply (frule replacementD [OF replacement], assumption, clarify)
+apply (drule_tac x=A in rspec, clarify)
+apply (drule_tac z=Y in separationD, assumption, clarify)
+apply (rule_tac x=y in rexI, force, assumption)
+done
+
+
 subsection\<open>Instantiating the locale \<open>M_trivial\<close>\<close>
 text\<open>No instances of Separation yet.\<close>
 
 lemma Lset_mono_le: "mono_le_subset(Lset)"
 by (simp add: mono_le_subset_def le_imp_subset Lset_mono)
 
 lemma Lset_cont: "cont_Ord(Lset)"
 by (simp add: cont_Ord_def Limit_Lset_eq OUnion_def Limit_is_Ord)
 
 lemmas L_nat = Ord_in_L [OF Ord_nat]
 
-theorem M_trivial_L: "PROP M_trivial(L)"
+theorem M_trivial_L: "M_trivial(L)"
   apply (rule M_trivial.intro)
-       apply (erule (1) transL)
+  apply (rule M_trans.intro)
+    apply (erule (1) transL)
+   apply(rule exI,rule  nonempty)
+  apply (rule M_trivial_axioms.intro)
       apply (rule upair_ax)
-     apply (rule Union_ax)
-    apply (rule power_ax)
-   apply (rule replacement)
-  apply (rule L_nat)
+   apply (rule Union_ax)
   done
 
 interpretation L?: M_trivial L by (rule M_trivial_L)
 
 (* Replaces the following declarations...
 lemmas rall_abs = M_trivial.rall_abs [OF M_trivial_L]
   and rex_abs = M_trivial.rex_abs [OF M_trivial_L]
 ...
 declare rall_abs [simp]
 declare rex_abs [simp]
 ...and dozens of similar ones.
 *)
 
 subsection\<open>Instantiation of the locale \<open>reflection\<close>\<close>
 
 text\<open>instances of locale constants\<close>
 
 definition
   L_F0 :: "[i=>o,i] => i" where
     "L_F0(P,y) == \<mu> b. (\<exists>z. L(z) \<and> P(<y,z>)) \<longrightarrow> (\<exists>z\<in>Lset(b). P(<y,z>))"
 
 definition
   L_FF :: "[i=>o,i] => i" where
     "L_FF(P)   == \<lambda>a. \<Union>y\<in>Lset(a). L_F0(P,y)"
 
 definition
   L_ClEx :: "[i=>o,i] => o" where
     "L_ClEx(P) == \<lambda>a. Limit(a) \<and> normalize(L_FF(P),a) = a"
 
 
 text\<open>We must use the meta-existential quantifier; otherwise the reflection
       terms become enormous!\<close>
 definition
   L_Reflects :: "[i=>o,[i,i]=>o] => prop"  (\<open>(3REFLECTS/ [_,/ _])\<close>) where
     "REFLECTS[P,Q] == (\<Or>Cl. Closed_Unbounded(Cl) &
                            (\<forall>a. Cl(a) \<longrightarrow> (\<forall>x \<in> Lset(a). P(x) \<longleftrightarrow> Q(a,x))))"
 
 
 theorem Triv_reflection:
      "REFLECTS[P, \<lambda>a x. P(x)]"
 apply (simp add: L_Reflects_def)
 apply (rule meta_exI)
 apply (rule Closed_Unbounded_Ord)
 done
 
 theorem Not_reflection:
      "REFLECTS[P,Q] ==> REFLECTS[\<lambda>x. ~P(x), \<lambda>a x. ~Q(a,x)]"
 apply (unfold L_Reflects_def)
 apply (erule meta_exE)
 apply (rule_tac x=Cl in meta_exI, simp)
 done
 
 theorem And_reflection:
      "[| REFLECTS[P,Q]; REFLECTS[P',Q'] |]
       ==> REFLECTS[\<lambda>x. P(x) \<and> P'(x), \<lambda>a x. Q(a,x) \<and> Q'(a,x)]"
 apply (unfold L_Reflects_def)
 apply (elim meta_exE)
 apply (rule_tac x="\<lambda>a. Cl(a) \<and> Cla(a)" in meta_exI)
 apply (simp add: Closed_Unbounded_Int, blast)
 done
 
 theorem Or_reflection:
      "[| REFLECTS[P,Q]; REFLECTS[P',Q'] |]
       ==> REFLECTS[\<lambda>x. P(x) \<or> P'(x), \<lambda>a x. Q(a,x) \<or> Q'(a,x)]"
 apply (unfold L_Reflects_def)
 apply (elim meta_exE)
 apply (rule_tac x="\<lambda>a. Cl(a) \<and> Cla(a)" in meta_exI)
 apply (simp add: Closed_Unbounded_Int, blast)
 done
 
 theorem Imp_reflection:
      "[| REFLECTS[P,Q]; REFLECTS[P',Q'] |]
       ==> REFLECTS[\<lambda>x. P(x) \<longrightarrow> P'(x), \<lambda>a x. Q(a,x) \<longrightarrow> Q'(a,x)]"
 apply (unfold L_Reflects_def)
 apply (elim meta_exE)
 apply (rule_tac x="\<lambda>a. Cl(a) \<and> Cla(a)" in meta_exI)
 apply (simp add: Closed_Unbounded_Int, blast)
 done
 
 theorem Iff_reflection:
      "[| REFLECTS[P,Q]; REFLECTS[P',Q'] |]
       ==> REFLECTS[\<lambda>x. P(x) \<longleftrightarrow> P'(x), \<lambda>a x. Q(a,x) \<longleftrightarrow> Q'(a,x)]"
 apply (unfold L_Reflects_def)
 apply (elim meta_exE)
 apply (rule_tac x="\<lambda>a. Cl(a) \<and> Cla(a)" in meta_exI)
 apply (simp add: Closed_Unbounded_Int, blast)
 done
 
 
 lemma reflection_Lset: "reflection(Lset)"
 by (blast intro: reflection.intro Lset_mono_le Lset_cont 
                  Formula.Pair_in_LLimit)+
 
 
 theorem Ex_reflection:
      "REFLECTS[\<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x))]
       ==> REFLECTS[\<lambda>x. \<exists>z. L(z) \<and> P(x,z), \<lambda>a x. \<exists>z\<in>Lset(a). Q(a,x,z)]"
 apply (unfold L_Reflects_def L_ClEx_def L_FF_def L_F0_def L_def)
 apply (elim meta_exE)
 apply (rule meta_exI)
 apply (erule reflection.Ex_reflection [OF reflection_Lset])
 done
 
 theorem All_reflection:
      "REFLECTS[\<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x))]
       ==> REFLECTS[\<lambda>x. \<forall>z. L(z) \<longrightarrow> P(x,z), \<lambda>a x. \<forall>z\<in>Lset(a). Q(a,x,z)]"
 apply (unfold L_Reflects_def L_ClEx_def L_FF_def L_F0_def L_def)
 apply (elim meta_exE)
 apply (rule meta_exI)
 apply (erule reflection.All_reflection [OF reflection_Lset])
 done
 
 theorem Rex_reflection:
      "REFLECTS[ \<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x))]
       ==> REFLECTS[\<lambda>x. \<exists>z[L]. P(x,z), \<lambda>a x. \<exists>z\<in>Lset(a). Q(a,x,z)]"
 apply (unfold rex_def)
 apply (intro And_reflection Ex_reflection, assumption)
 done
 
 theorem Rall_reflection:
      "REFLECTS[\<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x))]
       ==> REFLECTS[\<lambda>x. \<forall>z[L]. P(x,z), \<lambda>a x. \<forall>z\<in>Lset(a). Q(a,x,z)]"
 apply (unfold rall_def)
 apply (intro Imp_reflection All_reflection, assumption)
 done
 
 text\<open>This version handles an alternative form of the bounded quantifier
       in the second argument of \<open>REFLECTS\<close>.\<close>
 theorem Rex_reflection':
      "REFLECTS[\<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x))]
       ==> REFLECTS[\<lambda>x. \<exists>z[L]. P(x,z), \<lambda>a x. \<exists>z[##Lset(a)]. Q(a,x,z)]"
 apply (unfold setclass_def rex_def)
 apply (erule Rex_reflection [unfolded rex_def Bex_def]) 
 done
 
 text\<open>As above.\<close>
 theorem Rall_reflection':
      "REFLECTS[\<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x))]
       ==> REFLECTS[\<lambda>x. \<forall>z[L]. P(x,z), \<lambda>a x. \<forall>z[##Lset(a)]. Q(a,x,z)]"
 apply (unfold setclass_def rall_def)
 apply (erule Rall_reflection [unfolded rall_def Ball_def]) 
 done
 
 lemmas FOL_reflections =
         Triv_reflection Not_reflection And_reflection Or_reflection
         Imp_reflection Iff_reflection Ex_reflection All_reflection
         Rex_reflection Rall_reflection Rex_reflection' Rall_reflection'
 
 lemma ReflectsD:
      "[|REFLECTS[P,Q]; Ord(i)|]
       ==> \<exists>j. i<j & (\<forall>x \<in> Lset(j). P(x) \<longleftrightarrow> Q(j,x))"
 apply (unfold L_Reflects_def Closed_Unbounded_def)
 apply (elim meta_exE, clarify)
 apply (blast dest!: UnboundedD)
 done
 
 lemma ReflectsE:
      "[| REFLECTS[P,Q]; Ord(i);
          !!j. [|i<j;  \<forall>x \<in> Lset(j). P(x) \<longleftrightarrow> Q(j,x)|] ==> R |]
       ==> R"
 by (drule ReflectsD, assumption, blast)
 
 lemma Collect_mem_eq: "{x\<in>A. x\<in>B} = A \<inter> B"
 by blast
 
 
 subsection\<open>Internalized Formulas for some Set-Theoretic Concepts\<close>
 
 subsubsection\<open>Some numbers to help write de Bruijn indices\<close>
 
 abbreviation
   digit3 :: i   (\<open>3\<close>) where "3 == succ(2)"
 
 abbreviation
   digit4 :: i   (\<open>4\<close>) where "4 == succ(3)"
 
 abbreviation
   digit5 :: i   (\<open>5\<close>) where "5 == succ(4)"
 
 abbreviation
   digit6 :: i   (\<open>6\<close>) where "6 == succ(5)"
 
 abbreviation
   digit7 :: i   (\<open>7\<close>) where "7 == succ(6)"
 
 abbreviation
   digit8 :: i   (\<open>8\<close>) where "8 == succ(7)"
 
 abbreviation
   digit9 :: i   (\<open>9\<close>) where "9 == succ(8)"
 
 
 subsubsection\<open>The Empty Set, Internalized\<close>
 
 definition
   empty_fm :: "i=>i" where
     "empty_fm(x) == Forall(Neg(Member(0,succ(x))))"
 
 lemma empty_type [TC]:
      "x \<in> nat ==> empty_fm(x) \<in> formula"
 by (simp add: empty_fm_def)
 
 lemma sats_empty_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, empty_fm(x), env) \<longleftrightarrow> empty(##A, nth(x,env))"
 by (simp add: empty_fm_def empty_def)
 
 lemma empty_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> empty(##A, x) \<longleftrightarrow> sats(A, empty_fm(i), env)"
 by simp
 
 theorem empty_reflection:
      "REFLECTS[\<lambda>x. empty(L,f(x)),
                \<lambda>i x. empty(##Lset(i),f(x))]"
 apply (simp only: empty_def)
 apply (intro FOL_reflections)
 done
 
 text\<open>Not used.  But maybe useful?\<close>
 lemma Transset_sats_empty_fm_eq_0:
    "[| n \<in> nat; env \<in> list(A); Transset(A)|]
     ==> sats(A, empty_fm(n), env) \<longleftrightarrow> nth(n,env) = 0"
 apply (simp add: empty_fm_def empty_def Transset_def, auto)
 apply (case_tac "n < length(env)")
 apply (frule nth_type, assumption+, blast)
 apply (simp_all add: not_lt_iff_le nth_eq_0)
 done
 
 
 subsubsection\<open>Unordered Pairs, Internalized\<close>
 
 definition
   upair_fm :: "[i,i,i]=>i" where
     "upair_fm(x,y,z) ==
        And(Member(x,z),
            And(Member(y,z),
                Forall(Implies(Member(0,succ(z)),
                               Or(Equal(0,succ(x)), Equal(0,succ(y)))))))"
 
 lemma upair_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> upair_fm(x,y,z) \<in> formula"
 by (simp add: upair_fm_def)
 
 lemma sats_upair_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, upair_fm(x,y,z), env) \<longleftrightarrow>
             upair(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: upair_fm_def upair_def)
 
 lemma upair_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> upair(##A, x, y, z) \<longleftrightarrow> sats(A, upair_fm(i,j,k), env)"
-by (simp add: sats_upair_fm)
+by (simp)
 
 text\<open>Useful? At least it refers to "real" unordered pairs\<close>
 lemma sats_upair_fm2 [simp]:
    "[| x \<in> nat; y \<in> nat; z < length(env); env \<in> list(A); Transset(A)|]
     ==> sats(A, upair_fm(x,y,z), env) \<longleftrightarrow>
         nth(z,env) = {nth(x,env), nth(y,env)}"
 apply (frule lt_length_in_nat, assumption)
 apply (simp add: upair_fm_def Transset_def, auto)
 apply (blast intro: nth_type)
 done
 
 theorem upair_reflection:
      "REFLECTS[\<lambda>x. upair(L,f(x),g(x),h(x)),
                \<lambda>i x. upair(##Lset(i),f(x),g(x),h(x))]"
 apply (simp add: upair_def)
 apply (intro FOL_reflections)
 done
 
 subsubsection\<open>Ordered pairs, Internalized\<close>
 
 definition
   pair_fm :: "[i,i,i]=>i" where
     "pair_fm(x,y,z) ==
        Exists(And(upair_fm(succ(x),succ(x),0),
               Exists(And(upair_fm(succ(succ(x)),succ(succ(y)),0),
                          upair_fm(1,0,succ(succ(z)))))))"
 
 lemma pair_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> pair_fm(x,y,z) \<in> formula"
 by (simp add: pair_fm_def)
 
 lemma sats_pair_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, pair_fm(x,y,z), env) \<longleftrightarrow>
         pair(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: pair_fm_def pair_def)
 
 lemma pair_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> pair(##A, x, y, z) \<longleftrightarrow> sats(A, pair_fm(i,j,k), env)"
-by (simp add: sats_pair_fm)
+by (simp)
 
 theorem pair_reflection:
      "REFLECTS[\<lambda>x. pair(L,f(x),g(x),h(x)),
                \<lambda>i x. pair(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: pair_def)
 apply (intro FOL_reflections upair_reflection)
 done
 
 
 subsubsection\<open>Binary Unions, Internalized\<close>
 
 definition
   union_fm :: "[i,i,i]=>i" where
     "union_fm(x,y,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Or(Member(0,succ(x)),Member(0,succ(y)))))"
 
 lemma union_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> union_fm(x,y,z) \<in> formula"
 by (simp add: union_fm_def)
 
 lemma sats_union_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, union_fm(x,y,z), env) \<longleftrightarrow>
         union(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: union_fm_def union_def)
 
 lemma union_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> union(##A, x, y, z) \<longleftrightarrow> sats(A, union_fm(i,j,k), env)"
-by (simp add: sats_union_fm)
+by (simp)
 
 theorem union_reflection:
      "REFLECTS[\<lambda>x. union(L,f(x),g(x),h(x)),
                \<lambda>i x. union(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: union_def)
 apply (intro FOL_reflections)
 done
 
 
 subsubsection\<open>Set ``Cons,'' Internalized\<close>
 
 definition
   cons_fm :: "[i,i,i]=>i" where
     "cons_fm(x,y,z) ==
        Exists(And(upair_fm(succ(x),succ(x),0),
                   union_fm(0,succ(y),succ(z))))"
 
 
 lemma cons_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> cons_fm(x,y,z) \<in> formula"
 by (simp add: cons_fm_def)
 
 lemma sats_cons_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, cons_fm(x,y,z), env) \<longleftrightarrow>
         is_cons(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: cons_fm_def is_cons_def)
 
 lemma cons_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_cons(##A, x, y, z) \<longleftrightarrow> sats(A, cons_fm(i,j,k), env)"
 by simp
 
 theorem cons_reflection:
      "REFLECTS[\<lambda>x. is_cons(L,f(x),g(x),h(x)),
                \<lambda>i x. is_cons(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_cons_def)
 apply (intro FOL_reflections upair_reflection union_reflection)
 done
 
 
 subsubsection\<open>Successor Function, Internalized\<close>
 
 definition
   succ_fm :: "[i,i]=>i" where
     "succ_fm(x,y) == cons_fm(x,x,y)"
 
 lemma succ_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> succ_fm(x,y) \<in> formula"
 by (simp add: succ_fm_def)
 
 lemma sats_succ_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, succ_fm(x,y), env) \<longleftrightarrow>
         successor(##A, nth(x,env), nth(y,env))"
 by (simp add: succ_fm_def successor_def)
 
 lemma successor_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> successor(##A, x, y) \<longleftrightarrow> sats(A, succ_fm(i,j), env)"
 by simp
 
 theorem successor_reflection:
      "REFLECTS[\<lambda>x. successor(L,f(x),g(x)),
                \<lambda>i x. successor(##Lset(i),f(x),g(x))]"
 apply (simp only: successor_def)
 apply (intro cons_reflection)
 done
 
 
 subsubsection\<open>The Number 1, Internalized\<close>
 
 (* "number1(M,a) == (\<exists>x[M]. empty(M,x) & successor(M,x,a))" *)
 definition
   number1_fm :: "i=>i" where
     "number1_fm(a) == Exists(And(empty_fm(0), succ_fm(0,succ(a))))"
 
 lemma number1_type [TC]:
      "x \<in> nat ==> number1_fm(x) \<in> formula"
 by (simp add: number1_fm_def)
 
 lemma sats_number1_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, number1_fm(x), env) \<longleftrightarrow> number1(##A, nth(x,env))"
 by (simp add: number1_fm_def number1_def)
 
 lemma number1_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> number1(##A, x) \<longleftrightarrow> sats(A, number1_fm(i), env)"
 by simp
 
 theorem number1_reflection:
      "REFLECTS[\<lambda>x. number1(L,f(x)),
                \<lambda>i x. number1(##Lset(i),f(x))]"
 apply (simp only: number1_def)
 apply (intro FOL_reflections empty_reflection successor_reflection)
 done
 
 
 subsubsection\<open>Big Union, Internalized\<close>
 
 (*  "big_union(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y\<in>A & x \<in> y)" *)
 definition
   big_union_fm :: "[i,i]=>i" where
     "big_union_fm(A,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Exists(And(Member(0,succ(succ(A))), Member(1,0)))))"
 
 lemma big_union_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> big_union_fm(x,y) \<in> formula"
 by (simp add: big_union_fm_def)
 
 lemma sats_big_union_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, big_union_fm(x,y), env) \<longleftrightarrow>
         big_union(##A, nth(x,env), nth(y,env))"
 by (simp add: big_union_fm_def big_union_def)
 
 lemma big_union_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> big_union(##A, x, y) \<longleftrightarrow> sats(A, big_union_fm(i,j), env)"
 by simp
 
 theorem big_union_reflection:
      "REFLECTS[\<lambda>x. big_union(L,f(x),g(x)),
                \<lambda>i x. big_union(##Lset(i),f(x),g(x))]"
 apply (simp only: big_union_def)
 apply (intro FOL_reflections)
 done
 
 
 subsubsection\<open>Variants of Satisfaction Definitions for Ordinals, etc.\<close>
 
 text\<open>The \<open>sats\<close> theorems below are standard versions of the ones proved
 in theory \<open>Formula\<close>.  They relate elements of type \<^term>\<open>formula\<close> to
 relativized concepts such as \<^term>\<open>subset\<close> or \<^term>\<open>ordinal\<close> rather than to
 real concepts such as \<^term>\<open>Ord\<close>.  Now that we have instantiated the locale
 \<open>M_trivial\<close>, we no longer require the earlier versions.\<close>
 
 lemma sats_subset_fm':
    "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, subset_fm(x,y), env) \<longleftrightarrow> subset(##A, nth(x,env), nth(y,env))"
 by (simp add: subset_fm_def Relative.subset_def)
 
 theorem subset_reflection:
      "REFLECTS[\<lambda>x. subset(L,f(x),g(x)),
                \<lambda>i x. subset(##Lset(i),f(x),g(x))]"
 apply (simp only: Relative.subset_def)
 apply (intro FOL_reflections)
 done
 
 lemma sats_transset_fm':
    "[|x \<in> nat; env \<in> list(A)|]
     ==> sats(A, transset_fm(x), env) \<longleftrightarrow> transitive_set(##A, nth(x,env))"
 by (simp add: sats_subset_fm' transset_fm_def transitive_set_def)
 
 theorem transitive_set_reflection:
      "REFLECTS[\<lambda>x. transitive_set(L,f(x)),
                \<lambda>i x. transitive_set(##Lset(i),f(x))]"
 apply (simp only: transitive_set_def)
 apply (intro FOL_reflections subset_reflection)
 done
 
 lemma sats_ordinal_fm':
    "[|x \<in> nat; env \<in> list(A)|]
     ==> sats(A, ordinal_fm(x), env) \<longleftrightarrow> ordinal(##A,nth(x,env))"
 by (simp add: sats_transset_fm' ordinal_fm_def ordinal_def)
 
 lemma ordinal_iff_sats:
       "[| nth(i,env) = x;  i \<in> nat; env \<in> list(A)|]
        ==> ordinal(##A, x) \<longleftrightarrow> sats(A, ordinal_fm(i), env)"
 by (simp add: sats_ordinal_fm')
 
 theorem ordinal_reflection:
      "REFLECTS[\<lambda>x. ordinal(L,f(x)), \<lambda>i x. ordinal(##Lset(i),f(x))]"
 apply (simp only: ordinal_def)
 apply (intro FOL_reflections transitive_set_reflection)
 done
 
 
 subsubsection\<open>Membership Relation, Internalized\<close>
 
 definition
   Memrel_fm :: "[i,i]=>i" where
     "Memrel_fm(A,r) ==
        Forall(Iff(Member(0,succ(r)),
                   Exists(And(Member(0,succ(succ(A))),
                              Exists(And(Member(0,succ(succ(succ(A)))),
                                         And(Member(1,0),
                                             pair_fm(1,0,2))))))))"
 
 lemma Memrel_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> Memrel_fm(x,y) \<in> formula"
 by (simp add: Memrel_fm_def)
 
 lemma sats_Memrel_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, Memrel_fm(x,y), env) \<longleftrightarrow>
         membership(##A, nth(x,env), nth(y,env))"
 by (simp add: Memrel_fm_def membership_def)
 
 lemma Memrel_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> membership(##A, x, y) \<longleftrightarrow> sats(A, Memrel_fm(i,j), env)"
 by simp
 
 theorem membership_reflection:
      "REFLECTS[\<lambda>x. membership(L,f(x),g(x)),
                \<lambda>i x. membership(##Lset(i),f(x),g(x))]"
 apply (simp only: membership_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 subsubsection\<open>Predecessor Set, Internalized\<close>
 
 definition
   pred_set_fm :: "[i,i,i,i]=>i" where
     "pred_set_fm(A,x,r,B) ==
        Forall(Iff(Member(0,succ(B)),
                   Exists(And(Member(0,succ(succ(r))),
                              And(Member(1,succ(succ(A))),
                                  pair_fm(1,succ(succ(x)),0))))))"
 
 
 lemma pred_set_type [TC]:
      "[| A \<in> nat; x \<in> nat; r \<in> nat; B \<in> nat |]
       ==> pred_set_fm(A,x,r,B) \<in> formula"
 by (simp add: pred_set_fm_def)
 
 lemma sats_pred_set_fm [simp]:
    "[| U \<in> nat; x \<in> nat; r \<in> nat; B \<in> nat; env \<in> list(A)|]
     ==> sats(A, pred_set_fm(U,x,r,B), env) \<longleftrightarrow>
         pred_set(##A, nth(U,env), nth(x,env), nth(r,env), nth(B,env))"
 by (simp add: pred_set_fm_def pred_set_def)
 
 lemma pred_set_iff_sats:
       "[| nth(i,env) = U; nth(j,env) = x; nth(k,env) = r; nth(l,env) = B;
           i \<in> nat; j \<in> nat; k \<in> nat; l \<in> nat; env \<in> list(A)|]
        ==> pred_set(##A,U,x,r,B) \<longleftrightarrow> sats(A, pred_set_fm(i,j,k,l), env)"
-by (simp add: sats_pred_set_fm)
+by (simp)
 
 theorem pred_set_reflection:
      "REFLECTS[\<lambda>x. pred_set(L,f(x),g(x),h(x),b(x)),
                \<lambda>i x. pred_set(##Lset(i),f(x),g(x),h(x),b(x))]"
 apply (simp only: pred_set_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 
 subsubsection\<open>Domain of a Relation, Internalized\<close>
 
 (* "is_domain(M,r,z) ==
         \<forall>x[M]. (x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w))))" *)
 definition
   domain_fm :: "[i,i]=>i" where
     "domain_fm(r,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Exists(And(Member(0,succ(succ(r))),
                              Exists(pair_fm(2,0,1))))))"
 
 lemma domain_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> domain_fm(x,y) \<in> formula"
 by (simp add: domain_fm_def)
 
 lemma sats_domain_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, domain_fm(x,y), env) \<longleftrightarrow>
         is_domain(##A, nth(x,env), nth(y,env))"
 by (simp add: domain_fm_def is_domain_def)
 
 lemma domain_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_domain(##A, x, y) \<longleftrightarrow> sats(A, domain_fm(i,j), env)"
 by simp
 
 theorem domain_reflection:
      "REFLECTS[\<lambda>x. is_domain(L,f(x),g(x)),
                \<lambda>i x. is_domain(##Lset(i),f(x),g(x))]"
 apply (simp only: is_domain_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Range of a Relation, Internalized\<close>
 
 (* "is_range(M,r,z) ==
         \<forall>y[M]. (y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w))))" *)
 definition
   range_fm :: "[i,i]=>i" where
     "range_fm(r,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Exists(And(Member(0,succ(succ(r))),
                              Exists(pair_fm(0,2,1))))))"
 
 lemma range_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> range_fm(x,y) \<in> formula"
 by (simp add: range_fm_def)
 
 lemma sats_range_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, range_fm(x,y), env) \<longleftrightarrow>
         is_range(##A, nth(x,env), nth(y,env))"
 by (simp add: range_fm_def is_range_def)
 
 lemma range_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_range(##A, x, y) \<longleftrightarrow> sats(A, range_fm(i,j), env)"
 by simp
 
 theorem range_reflection:
      "REFLECTS[\<lambda>x. is_range(L,f(x),g(x)),
                \<lambda>i x. is_range(##Lset(i),f(x),g(x))]"
 apply (simp only: is_range_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Field of a Relation, Internalized\<close>
 
 (* "is_field(M,r,z) ==
         \<exists>dr[M]. is_domain(M,r,dr) &
             (\<exists>rr[M]. is_range(M,r,rr) & union(M,dr,rr,z))" *)
 definition
   field_fm :: "[i,i]=>i" where
     "field_fm(r,z) ==
        Exists(And(domain_fm(succ(r),0),
               Exists(And(range_fm(succ(succ(r)),0),
                          union_fm(1,0,succ(succ(z)))))))"
 
 lemma field_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> field_fm(x,y) \<in> formula"
 by (simp add: field_fm_def)
 
 lemma sats_field_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, field_fm(x,y), env) \<longleftrightarrow>
         is_field(##A, nth(x,env), nth(y,env))"
 by (simp add: field_fm_def is_field_def)
 
 lemma field_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> is_field(##A, x, y) \<longleftrightarrow> sats(A, field_fm(i,j), env)"
 by simp
 
 theorem field_reflection:
      "REFLECTS[\<lambda>x. is_field(L,f(x),g(x)),
                \<lambda>i x. is_field(##Lset(i),f(x),g(x))]"
 apply (simp only: is_field_def)
 apply (intro FOL_reflections domain_reflection range_reflection
              union_reflection)
 done
 
 
 subsubsection\<open>Image under a Relation, Internalized\<close>
 
 (* "image(M,r,A,z) ==
         \<forall>y[M]. (y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w))))" *)
 definition
   image_fm :: "[i,i,i]=>i" where
     "image_fm(r,A,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Exists(And(Member(0,succ(succ(r))),
                              Exists(And(Member(0,succ(succ(succ(A)))),
                                         pair_fm(0,2,1)))))))"
 
 lemma image_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> image_fm(x,y,z) \<in> formula"
 by (simp add: image_fm_def)
 
 lemma sats_image_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, image_fm(x,y,z), env) \<longleftrightarrow>
         image(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: image_fm_def Relative.image_def)
 
 lemma image_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> image(##A, x, y, z) \<longleftrightarrow> sats(A, image_fm(i,j,k), env)"
-by (simp add: sats_image_fm)
+by (simp)
 
 theorem image_reflection:
      "REFLECTS[\<lambda>x. image(L,f(x),g(x),h(x)),
                \<lambda>i x. image(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: Relative.image_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Pre-Image under a Relation, Internalized\<close>
 
 (* "pre_image(M,r,A,z) ==
         \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))" *)
 definition
   pre_image_fm :: "[i,i,i]=>i" where
     "pre_image_fm(r,A,z) ==
        Forall(Iff(Member(0,succ(z)),
                   Exists(And(Member(0,succ(succ(r))),
                              Exists(And(Member(0,succ(succ(succ(A)))),
                                         pair_fm(2,0,1)))))))"
 
 lemma pre_image_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> pre_image_fm(x,y,z) \<in> formula"
 by (simp add: pre_image_fm_def)
 
 lemma sats_pre_image_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, pre_image_fm(x,y,z), env) \<longleftrightarrow>
         pre_image(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: pre_image_fm_def Relative.pre_image_def)
 
 lemma pre_image_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> pre_image(##A, x, y, z) \<longleftrightarrow> sats(A, pre_image_fm(i,j,k), env)"
-by (simp add: sats_pre_image_fm)
+by (simp)
 
 theorem pre_image_reflection:
      "REFLECTS[\<lambda>x. pre_image(L,f(x),g(x),h(x)),
                \<lambda>i x. pre_image(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: Relative.pre_image_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Function Application, Internalized\<close>
 
 (* "fun_apply(M,f,x,y) ==
         (\<exists>xs[M]. \<exists>fxs[M].
          upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))" *)
 definition
   fun_apply_fm :: "[i,i,i]=>i" where
     "fun_apply_fm(f,x,y) ==
        Exists(Exists(And(upair_fm(succ(succ(x)), succ(succ(x)), 1),
                          And(image_fm(succ(succ(f)), 1, 0),
                              big_union_fm(0,succ(succ(y)))))))"
 
 lemma fun_apply_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> fun_apply_fm(x,y,z) \<in> formula"
 by (simp add: fun_apply_fm_def)
 
 lemma sats_fun_apply_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, fun_apply_fm(x,y,z), env) \<longleftrightarrow>
         fun_apply(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: fun_apply_fm_def fun_apply_def)
 
 lemma fun_apply_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> fun_apply(##A, x, y, z) \<longleftrightarrow> sats(A, fun_apply_fm(i,j,k), env)"
 by simp
 
 theorem fun_apply_reflection:
      "REFLECTS[\<lambda>x. fun_apply(L,f(x),g(x),h(x)),
                \<lambda>i x. fun_apply(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: fun_apply_def)
 apply (intro FOL_reflections upair_reflection image_reflection
              big_union_reflection)
 done
 
 
 subsubsection\<open>The Concept of Relation, Internalized\<close>
 
 (* "is_relation(M,r) ==
         (\<forall>z[M]. z\<in>r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))" *)
 definition
   relation_fm :: "i=>i" where
     "relation_fm(r) ==
        Forall(Implies(Member(0,succ(r)), Exists(Exists(pair_fm(1,0,2)))))"
 
 lemma relation_type [TC]:
      "[| x \<in> nat |] ==> relation_fm(x) \<in> formula"
 by (simp add: relation_fm_def)
 
 lemma sats_relation_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, relation_fm(x), env) \<longleftrightarrow> is_relation(##A, nth(x,env))"
 by (simp add: relation_fm_def is_relation_def)
 
 lemma relation_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> is_relation(##A, x) \<longleftrightarrow> sats(A, relation_fm(i), env)"
 by simp
 
 theorem is_relation_reflection:
      "REFLECTS[\<lambda>x. is_relation(L,f(x)),
                \<lambda>i x. is_relation(##Lset(i),f(x))]"
 apply (simp only: is_relation_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>The Concept of Function, Internalized\<close>
 
 (* "is_function(M,r) ==
         \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
            pair(M,x,y,p) \<longrightarrow> pair(M,x,y',p') \<longrightarrow> p\<in>r \<longrightarrow> p'\<in>r \<longrightarrow> y=y'" *)
 definition
   function_fm :: "i=>i" where
     "function_fm(r) ==
        Forall(Forall(Forall(Forall(Forall(
          Implies(pair_fm(4,3,1),
                  Implies(pair_fm(4,2,0),
                          Implies(Member(1,r#+5),
                                  Implies(Member(0,r#+5), Equal(3,2))))))))))"
 
 lemma function_type [TC]:
      "[| x \<in> nat |] ==> function_fm(x) \<in> formula"
 by (simp add: function_fm_def)
 
 lemma sats_function_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, function_fm(x), env) \<longleftrightarrow> is_function(##A, nth(x,env))"
 by (simp add: function_fm_def is_function_def)
 
 lemma is_function_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> is_function(##A, x) \<longleftrightarrow> sats(A, function_fm(i), env)"
 by simp
 
 theorem is_function_reflection:
      "REFLECTS[\<lambda>x. is_function(L,f(x)),
                \<lambda>i x. is_function(##Lset(i),f(x))]"
 apply (simp only: is_function_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Typed Functions, Internalized\<close>
 
 (* "typed_function(M,A,B,r) ==
         is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
         (\<forall>u[M]. u\<in>r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) \<longrightarrow> y\<in>B))" *)
 
 definition
   typed_function_fm :: "[i,i,i]=>i" where
     "typed_function_fm(A,B,r) ==
        And(function_fm(r),
          And(relation_fm(r),
            And(domain_fm(r,A),
              Forall(Implies(Member(0,succ(r)),
                   Forall(Forall(Implies(pair_fm(1,0,2),Member(0,B#+3)))))))))"
 
 lemma typed_function_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> typed_function_fm(x,y,z) \<in> formula"
 by (simp add: typed_function_fm_def)
 
 lemma sats_typed_function_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, typed_function_fm(x,y,z), env) \<longleftrightarrow>
         typed_function(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: typed_function_fm_def typed_function_def)
 
 lemma typed_function_iff_sats:
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
       i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> typed_function(##A, x, y, z) \<longleftrightarrow> sats(A, typed_function_fm(i,j,k), env)"
 by simp
 
 lemmas function_reflections =
         empty_reflection number1_reflection
         upair_reflection pair_reflection union_reflection
         big_union_reflection cons_reflection successor_reflection
         fun_apply_reflection subset_reflection
         transitive_set_reflection membership_reflection
         pred_set_reflection domain_reflection range_reflection field_reflection
         image_reflection pre_image_reflection
         is_relation_reflection is_function_reflection
 
 lemmas function_iff_sats =
         empty_iff_sats number1_iff_sats
         upair_iff_sats pair_iff_sats union_iff_sats
         big_union_iff_sats cons_iff_sats successor_iff_sats
         fun_apply_iff_sats  Memrel_iff_sats
         pred_set_iff_sats domain_iff_sats range_iff_sats field_iff_sats
         image_iff_sats pre_image_iff_sats
         relation_iff_sats is_function_iff_sats
 
 
 theorem typed_function_reflection:
      "REFLECTS[\<lambda>x. typed_function(L,f(x),g(x),h(x)),
                \<lambda>i x. typed_function(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: typed_function_def)
 apply (intro FOL_reflections function_reflections)
 done
 
 
 subsubsection\<open>Composition of Relations, Internalized\<close>
 
 (* "composition(M,r,s,t) ==
         \<forall>p[M]. p \<in> t \<longleftrightarrow>
                (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
                 pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) &
                 xy \<in> s & yz \<in> r)" *)
 definition
   composition_fm :: "[i,i,i]=>i" where
   "composition_fm(r,s,t) ==
      Forall(Iff(Member(0,succ(t)),
              Exists(Exists(Exists(Exists(Exists(
               And(pair_fm(4,2,5),
                And(pair_fm(4,3,1),
                 And(pair_fm(3,2,0),
                  And(Member(1,s#+6), Member(0,r#+6))))))))))))"
 
 lemma composition_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> composition_fm(x,y,z) \<in> formula"
 by (simp add: composition_fm_def)
 
 lemma sats_composition_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, composition_fm(x,y,z), env) \<longleftrightarrow>
         composition(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: composition_fm_def composition_def)
 
 lemma composition_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> composition(##A, x, y, z) \<longleftrightarrow> sats(A, composition_fm(i,j,k), env)"
 by simp
 
 theorem composition_reflection:
      "REFLECTS[\<lambda>x. composition(L,f(x),g(x),h(x)),
                \<lambda>i x. composition(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: composition_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 
 subsubsection\<open>Injections, Internalized\<close>
 
 (* "injection(M,A,B,f) ==
         typed_function(M,A,B,f) &
         (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M].
           pair(M,x,y,p) \<longrightarrow> pair(M,x',y,p') \<longrightarrow> p\<in>f \<longrightarrow> p'\<in>f \<longrightarrow> x=x')" *)
 definition
   injection_fm :: "[i,i,i]=>i" where
   "injection_fm(A,B,f) ==
     And(typed_function_fm(A,B,f),
        Forall(Forall(Forall(Forall(Forall(
          Implies(pair_fm(4,2,1),
                  Implies(pair_fm(3,2,0),
                          Implies(Member(1,f#+5),
                                  Implies(Member(0,f#+5), Equal(4,3)))))))))))"
 
 
 lemma injection_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> injection_fm(x,y,z) \<in> formula"
 by (simp add: injection_fm_def)
 
 lemma sats_injection_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, injection_fm(x,y,z), env) \<longleftrightarrow>
         injection(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: injection_fm_def injection_def)
 
 lemma injection_iff_sats:
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
       i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> injection(##A, x, y, z) \<longleftrightarrow> sats(A, injection_fm(i,j,k), env)"
 by simp
 
 theorem injection_reflection:
      "REFLECTS[\<lambda>x. injection(L,f(x),g(x),h(x)),
                \<lambda>i x. injection(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: injection_def)
 apply (intro FOL_reflections function_reflections typed_function_reflection)
 done
 
 
 subsubsection\<open>Surjections, Internalized\<close>
 
 (*  surjection :: "[i=>o,i,i,i] => o"
     "surjection(M,A,B,f) ==
         typed_function(M,A,B,f) &
         (\<forall>y[M]. y\<in>B \<longrightarrow> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))" *)
 definition
   surjection_fm :: "[i,i,i]=>i" where
   "surjection_fm(A,B,f) ==
     And(typed_function_fm(A,B,f),
        Forall(Implies(Member(0,succ(B)),
                       Exists(And(Member(0,succ(succ(A))),
                                  fun_apply_fm(succ(succ(f)),0,1))))))"
 
 lemma surjection_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> surjection_fm(x,y,z) \<in> formula"
 by (simp add: surjection_fm_def)
 
 lemma sats_surjection_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, surjection_fm(x,y,z), env) \<longleftrightarrow>
         surjection(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: surjection_fm_def surjection_def)
 
 lemma surjection_iff_sats:
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
       i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> surjection(##A, x, y, z) \<longleftrightarrow> sats(A, surjection_fm(i,j,k), env)"
 by simp
 
 theorem surjection_reflection:
      "REFLECTS[\<lambda>x. surjection(L,f(x),g(x),h(x)),
                \<lambda>i x. surjection(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: surjection_def)
 apply (intro FOL_reflections function_reflections typed_function_reflection)
 done
 
 
 
 subsubsection\<open>Bijections, Internalized\<close>
 
 (*   bijection :: "[i=>o,i,i,i] => o"
     "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)" *)
 definition
   bijection_fm :: "[i,i,i]=>i" where
   "bijection_fm(A,B,f) == And(injection_fm(A,B,f), surjection_fm(A,B,f))"
 
 lemma bijection_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> bijection_fm(x,y,z) \<in> formula"
 by (simp add: bijection_fm_def)
 
 lemma sats_bijection_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, bijection_fm(x,y,z), env) \<longleftrightarrow>
         bijection(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: bijection_fm_def bijection_def)
 
 lemma bijection_iff_sats:
   "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
       i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
    ==> bijection(##A, x, y, z) \<longleftrightarrow> sats(A, bijection_fm(i,j,k), env)"
 by simp
 
 theorem bijection_reflection:
      "REFLECTS[\<lambda>x. bijection(L,f(x),g(x),h(x)),
                \<lambda>i x. bijection(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: bijection_def)
 apply (intro And_reflection injection_reflection surjection_reflection)
 done
 
 
 subsubsection\<open>Restriction of a Relation, Internalized\<close>
 
 
 (* "restriction(M,r,A,z) ==
         \<forall>x[M]. x \<in> z \<longleftrightarrow> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))" *)
 definition
   restriction_fm :: "[i,i,i]=>i" where
     "restriction_fm(r,A,z) ==
        Forall(Iff(Member(0,succ(z)),
                   And(Member(0,succ(r)),
                       Exists(And(Member(0,succ(succ(A))),
                                  Exists(pair_fm(1,0,2)))))))"
 
 lemma restriction_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> restriction_fm(x,y,z) \<in> formula"
 by (simp add: restriction_fm_def)
 
 lemma sats_restriction_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, restriction_fm(x,y,z), env) \<longleftrightarrow>
         restriction(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: restriction_fm_def restriction_def)
 
 lemma restriction_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> restriction(##A, x, y, z) \<longleftrightarrow> sats(A, restriction_fm(i,j,k), env)"
 by simp
 
 theorem restriction_reflection:
      "REFLECTS[\<lambda>x. restriction(L,f(x),g(x),h(x)),
                \<lambda>i x. restriction(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: restriction_def)
 apply (intro FOL_reflections pair_reflection)
 done
 
 subsubsection\<open>Order-Isomorphisms, Internalized\<close>
 
 (*  order_isomorphism :: "[i=>o,i,i,i,i,i] => o"
    "order_isomorphism(M,A,r,B,s,f) ==
         bijection(M,A,B,f) &
         (\<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow>
           (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
             pair(M,x,y,p) \<longrightarrow> fun_apply(M,f,x,fx) \<longrightarrow> fun_apply(M,f,y,fy) \<longrightarrow>
             pair(M,fx,fy,q) \<longrightarrow> (p\<in>r \<longleftrightarrow> q\<in>s))))"
   *)
 
 definition
   order_isomorphism_fm :: "[i,i,i,i,i]=>i" where
  "order_isomorphism_fm(A,r,B,s,f) ==
    And(bijection_fm(A,B,f),
      Forall(Implies(Member(0,succ(A)),
        Forall(Implies(Member(0,succ(succ(A))),
          Forall(Forall(Forall(Forall(
            Implies(pair_fm(5,4,3),
              Implies(fun_apply_fm(f#+6,5,2),
                Implies(fun_apply_fm(f#+6,4,1),
                  Implies(pair_fm(2,1,0),
                    Iff(Member(3,r#+6), Member(0,s#+6)))))))))))))))"
 
 lemma order_isomorphism_type [TC]:
      "[| A \<in> nat; r \<in> nat; B \<in> nat; s \<in> nat; f \<in> nat |]
       ==> order_isomorphism_fm(A,r,B,s,f) \<in> formula"
 by (simp add: order_isomorphism_fm_def)
 
 lemma sats_order_isomorphism_fm [simp]:
    "[| U \<in> nat; r \<in> nat; B \<in> nat; s \<in> nat; f \<in> nat; env \<in> list(A)|]
     ==> sats(A, order_isomorphism_fm(U,r,B,s,f), env) \<longleftrightarrow>
         order_isomorphism(##A, nth(U,env), nth(r,env), nth(B,env),
                                nth(s,env), nth(f,env))"
 by (simp add: order_isomorphism_fm_def order_isomorphism_def)
 
 lemma order_isomorphism_iff_sats:
   "[| nth(i,env) = U; nth(j,env) = r; nth(k,env) = B; nth(j',env) = s;
       nth(k',env) = f;
       i \<in> nat; j \<in> nat; k \<in> nat; j' \<in> nat; k' \<in> nat; env \<in> list(A)|]
    ==> order_isomorphism(##A,U,r,B,s,f) \<longleftrightarrow>
        sats(A, order_isomorphism_fm(i,j,k,j',k'), env)"
 by simp
 
 theorem order_isomorphism_reflection:
      "REFLECTS[\<lambda>x. order_isomorphism(L,f(x),g(x),h(x),g'(x),h'(x)),
                \<lambda>i x. order_isomorphism(##Lset(i),f(x),g(x),h(x),g'(x),h'(x))]"
 apply (simp only: order_isomorphism_def)
 apply (intro FOL_reflections function_reflections bijection_reflection)
 done
 
 subsubsection\<open>Limit Ordinals, Internalized\<close>
 
 text\<open>A limit ordinal is a non-empty, successor-closed ordinal\<close>
 
 (* "limit_ordinal(M,a) ==
         ordinal(M,a) & ~ empty(M,a) &
         (\<forall>x[M]. x\<in>a \<longrightarrow> (\<exists>y[M]. y\<in>a & successor(M,x,y)))" *)
 
 definition
   limit_ordinal_fm :: "i=>i" where
     "limit_ordinal_fm(x) ==
         And(ordinal_fm(x),
             And(Neg(empty_fm(x)),
                 Forall(Implies(Member(0,succ(x)),
                                Exists(And(Member(0,succ(succ(x))),
                                           succ_fm(1,0)))))))"
 
 lemma limit_ordinal_type [TC]:
      "x \<in> nat ==> limit_ordinal_fm(x) \<in> formula"
 by (simp add: limit_ordinal_fm_def)
 
 lemma sats_limit_ordinal_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, limit_ordinal_fm(x), env) \<longleftrightarrow> limit_ordinal(##A, nth(x,env))"
 by (simp add: limit_ordinal_fm_def limit_ordinal_def sats_ordinal_fm')
 
 lemma limit_ordinal_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> limit_ordinal(##A, x) \<longleftrightarrow> sats(A, limit_ordinal_fm(i), env)"
 by simp
 
 theorem limit_ordinal_reflection:
      "REFLECTS[\<lambda>x. limit_ordinal(L,f(x)),
                \<lambda>i x. limit_ordinal(##Lset(i),f(x))]"
 apply (simp only: limit_ordinal_def)
 apply (intro FOL_reflections ordinal_reflection
              empty_reflection successor_reflection)
 done
 
 subsubsection\<open>Finite Ordinals: The Predicate ``Is A Natural Number''\<close>
 
 (*     "finite_ordinal(M,a) == 
         ordinal(M,a) & ~ limit_ordinal(M,a) & 
         (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))" *)
 definition
   finite_ordinal_fm :: "i=>i" where
     "finite_ordinal_fm(x) ==
        And(ordinal_fm(x),
           And(Neg(limit_ordinal_fm(x)),
            Forall(Implies(Member(0,succ(x)),
                           Neg(limit_ordinal_fm(0))))))"
 
 lemma finite_ordinal_type [TC]:
      "x \<in> nat ==> finite_ordinal_fm(x) \<in> formula"
 by (simp add: finite_ordinal_fm_def)
 
 lemma sats_finite_ordinal_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, finite_ordinal_fm(x), env) \<longleftrightarrow> finite_ordinal(##A, nth(x,env))"
 by (simp add: finite_ordinal_fm_def sats_ordinal_fm' finite_ordinal_def)
 
 lemma finite_ordinal_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> finite_ordinal(##A, x) \<longleftrightarrow> sats(A, finite_ordinal_fm(i), env)"
 by simp
 
 theorem finite_ordinal_reflection:
      "REFLECTS[\<lambda>x. finite_ordinal(L,f(x)),
                \<lambda>i x. finite_ordinal(##Lset(i),f(x))]"
 apply (simp only: finite_ordinal_def)
 apply (intro FOL_reflections ordinal_reflection limit_ordinal_reflection)
 done
 
 
 subsubsection\<open>Omega: The Set of Natural Numbers\<close>
 
 (* omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x)) *)
 definition
   omega_fm :: "i=>i" where
     "omega_fm(x) ==
        And(limit_ordinal_fm(x),
            Forall(Implies(Member(0,succ(x)),
                           Neg(limit_ordinal_fm(0)))))"
 
 lemma omega_type [TC]:
      "x \<in> nat ==> omega_fm(x) \<in> formula"
 by (simp add: omega_fm_def)
 
 lemma sats_omega_fm [simp]:
    "[| x \<in> nat; env \<in> list(A)|]
     ==> sats(A, omega_fm(x), env) \<longleftrightarrow> omega(##A, nth(x,env))"
 by (simp add: omega_fm_def omega_def)
 
 lemma omega_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; env \<in> list(A)|]
        ==> omega(##A, x) \<longleftrightarrow> sats(A, omega_fm(i), env)"
 by simp
 
 theorem omega_reflection:
      "REFLECTS[\<lambda>x. omega(L,f(x)),
                \<lambda>i x. omega(##Lset(i),f(x))]"
 apply (simp only: omega_def)
 apply (intro FOL_reflections limit_ordinal_reflection)
 done
 
 
 lemmas fun_plus_reflections =
         typed_function_reflection composition_reflection
         injection_reflection surjection_reflection
         bijection_reflection restriction_reflection
         order_isomorphism_reflection finite_ordinal_reflection 
         ordinal_reflection limit_ordinal_reflection omega_reflection
 
 lemmas fun_plus_iff_sats =
         typed_function_iff_sats composition_iff_sats
         injection_iff_sats surjection_iff_sats
         bijection_iff_sats restriction_iff_sats
         order_isomorphism_iff_sats finite_ordinal_iff_sats
         ordinal_iff_sats limit_ordinal_iff_sats omega_iff_sats
 
 end
diff --git a/src/ZF/Constructible/Normal.thy b/src/ZF/Constructible/Normal.thy
--- a/src/ZF/Constructible/Normal.thy
+++ b/src/ZF/Constructible/Normal.thy
@@ -1,500 +1,500 @@
 (*  Title:      ZF/Constructible/Normal.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Closed Unbounded Classes and Normal Functions\<close>
 
 theory Normal imports ZF begin
 
 text\<open>
 One source is the book
 
 Frank R. Drake.
 \emph{Set Theory: An Introduction to Large Cardinals}.
 North-Holland, 1974.
 \<close>
 
 
 subsection \<open>Closed and Unbounded (c.u.) Classes of Ordinals\<close>
 
 definition
   Closed :: "(i=>o) => o" where
     "Closed(P) == \<forall>I. I \<noteq> 0 \<longrightarrow> (\<forall>i\<in>I. Ord(i) \<and> P(i)) \<longrightarrow> P(\<Union>(I))"
 
 definition
   Unbounded :: "(i=>o) => o" where
     "Unbounded(P) == \<forall>i. Ord(i) \<longrightarrow> (\<exists>j. i<j \<and> P(j))"
 
 definition
   Closed_Unbounded :: "(i=>o) => o" where
     "Closed_Unbounded(P) == Closed(P) \<and> Unbounded(P)"
 
 
 subsubsection\<open>Simple facts about c.u. classes\<close>
 
 lemma ClosedI:
      "[| !!I. [| I \<noteq> 0; \<forall>i\<in>I. Ord(i) \<and> P(i) |] ==> P(\<Union>(I)) |] 
       ==> Closed(P)"
 by (simp add: Closed_def)
 
 lemma ClosedD:
      "[| Closed(P); I \<noteq> 0; !!i. i\<in>I ==> Ord(i); !!i. i\<in>I ==> P(i) |] 
       ==> P(\<Union>(I))"
 by (simp add: Closed_def)
 
 lemma UnboundedD:
      "[| Unbounded(P);  Ord(i) |] ==> \<exists>j. i<j \<and> P(j)"
 by (simp add: Unbounded_def)
 
 lemma Closed_Unbounded_imp_Unbounded: "Closed_Unbounded(C) ==> Unbounded(C)"
 by (simp add: Closed_Unbounded_def) 
 
 
 text\<open>The universal class, V, is closed and unbounded.
       A bit odd, since C. U. concerns only ordinals, but it's used below!\<close>
 theorem Closed_Unbounded_V [simp]: "Closed_Unbounded(\<lambda>x. True)"
 by (unfold Closed_Unbounded_def Closed_def Unbounded_def, blast)
 
 text\<open>The class of ordinals, \<^term>\<open>Ord\<close>, is closed and unbounded.\<close>
 theorem Closed_Unbounded_Ord   [simp]: "Closed_Unbounded(Ord)"
 by (unfold Closed_Unbounded_def Closed_def Unbounded_def, blast)
 
 text\<open>The class of limit ordinals, \<^term>\<open>Limit\<close>, is closed and unbounded.\<close>
 theorem Closed_Unbounded_Limit [simp]: "Closed_Unbounded(Limit)"
 apply (simp add: Closed_Unbounded_def Closed_def Unbounded_def Limit_Union, 
        clarify)
 apply (rule_tac x="i++nat" in exI)  
-apply (blast intro: oadd_lt_self oadd_LimitI Limit_nat Limit_has_0) 
+apply (blast intro: oadd_lt_self oadd_LimitI Limit_has_0) 
 done
 
 text\<open>The class of cardinals, \<^term>\<open>Card\<close>, is closed and unbounded.\<close>
 theorem Closed_Unbounded_Card  [simp]: "Closed_Unbounded(Card)"
-apply (simp add: Closed_Unbounded_def Closed_def Unbounded_def Card_Union)
+apply (simp add: Closed_Unbounded_def Closed_def Unbounded_def)
 apply (blast intro: lt_csucc Card_csucc)
 done
 
 
 subsubsection\<open>The intersection of any set-indexed family of c.u. classes is
       c.u.\<close>
 
 text\<open>The constructions below come from Kunen, \emph{Set Theory}, page 78.\<close>
 locale cub_family =
   fixes P and A
   fixes next_greater \<comment> \<open>the next ordinal satisfying class \<^term>\<open>A\<close>\<close>
   fixes sup_greater  \<comment> \<open>sup of those ordinals over all \<^term>\<open>A\<close>\<close>
   assumes closed:    "a\<in>A ==> Closed(P(a))"
       and unbounded: "a\<in>A ==> Unbounded(P(a))"
       and A_non0: "A\<noteq>0"
   defines "next_greater(a,x) == \<mu> y. x<y \<and> P(a,y)"
       and "sup_greater(x) == \<Union>a\<in>A. next_greater(a,x)"
  
 
 text\<open>Trivial that the intersection is closed.\<close>
 lemma (in cub_family) Closed_INT: "Closed(\<lambda>x. \<forall>i\<in>A. P(i,x))"
 by (blast intro: ClosedI ClosedD [OF closed])
 
 text\<open>All remaining effort goes to show that the intersection is unbounded.\<close>
 
 lemma (in cub_family) Ord_sup_greater:
      "Ord(sup_greater(x))"
 by (simp add: sup_greater_def next_greater_def)
 
 lemma (in cub_family) Ord_next_greater:
      "Ord(next_greater(a,x))"
-by (simp add: next_greater_def Ord_Least)
+by (simp add: next_greater_def)
 
 text\<open>\<^term>\<open>next_greater\<close> works as expected: it returns a larger value
 and one that belongs to class \<^term>\<open>P(a)\<close>.\<close>
 lemma (in cub_family) next_greater_lemma:
      "[| Ord(x); a\<in>A |] ==> P(a, next_greater(a,x)) \<and> x < next_greater(a,x)"
 apply (simp add: next_greater_def)
 apply (rule exE [OF UnboundedD [OF unbounded]])
   apply assumption+
 apply (blast intro: LeastI2 lt_Ord2) 
 done
 
 lemma (in cub_family) next_greater_in_P:
      "[| Ord(x); a\<in>A |] ==> P(a, next_greater(a,x))"
 by (blast dest: next_greater_lemma)
 
 lemma (in cub_family) next_greater_gt:
      "[| Ord(x); a\<in>A |] ==> x < next_greater(a,x)"
 by (blast dest: next_greater_lemma)
 
 lemma (in cub_family) sup_greater_gt:
      "Ord(x) ==> x < sup_greater(x)"
 apply (simp add: sup_greater_def)
 apply (insert A_non0)
 apply (blast intro: UN_upper_lt next_greater_gt Ord_next_greater)
 done
 
 lemma (in cub_family) next_greater_le_sup_greater:
      "a\<in>A ==> next_greater(a,x) \<le> sup_greater(x)"
 apply (simp add: sup_greater_def) 
 apply (blast intro: UN_upper_le Ord_next_greater)
 done
 
 lemma (in cub_family) omega_sup_greater_eq_UN:
      "[| Ord(x); a\<in>A |] 
       ==> sup_greater^\<omega> (x) = 
           (\<Union>n\<in>nat. next_greater(a, sup_greater^n (x)))"
 apply (simp add: iterates_omega_def)
 apply (rule le_anti_sym)
 apply (rule le_implies_UN_le_UN) 
 apply (blast intro: leI next_greater_gt Ord_iterates Ord_sup_greater)  
 txt\<open>Opposite bound:
 @{subgoals[display,indent=0,margin=65]}
 \<close>
 apply (rule UN_least_le) 
-apply (blast intro: Ord_UN Ord_iterates Ord_sup_greater)  
+apply (blast intro: Ord_iterates Ord_sup_greater)  
 apply (rule_tac a="succ(n)" in UN_upper_le)
 apply (simp_all add: next_greater_le_sup_greater) 
-apply (blast intro: Ord_UN Ord_iterates Ord_sup_greater)  
+apply (blast intro: Ord_iterates Ord_sup_greater)  
 done
 
 lemma (in cub_family) P_omega_sup_greater:
      "[| Ord(x); a\<in>A |] ==> P(a, sup_greater^\<omega> (x))"
 apply (simp add: omega_sup_greater_eq_UN)
 apply (rule ClosedD [OF closed]) 
 apply (blast intro: ltD, auto)
 apply (blast intro: Ord_iterates Ord_next_greater Ord_sup_greater)
 apply (blast intro: next_greater_in_P Ord_iterates Ord_sup_greater)
 done
 
 lemma (in cub_family) omega_sup_greater_gt:
      "Ord(x) ==> x < sup_greater^\<omega> (x)"
 apply (simp add: iterates_omega_def)
 apply (rule UN_upper_lt [of 1], simp_all) 
  apply (blast intro: sup_greater_gt) 
-apply (blast intro: Ord_UN Ord_iterates Ord_sup_greater)
+apply (blast intro: Ord_iterates Ord_sup_greater)
 done
 
 lemma (in cub_family) Unbounded_INT: "Unbounded(\<lambda>x. \<forall>a\<in>A. P(a,x))"
 apply (unfold Unbounded_def)  
 apply (blast intro!: omega_sup_greater_gt P_omega_sup_greater) 
 done
 
 lemma (in cub_family) Closed_Unbounded_INT: 
      "Closed_Unbounded(\<lambda>x. \<forall>a\<in>A. P(a,x))"
 by (simp add: Closed_Unbounded_def Closed_INT Unbounded_INT)
 
 
 theorem Closed_Unbounded_INT:
     "(!!a. a\<in>A ==> Closed_Unbounded(P(a)))
      ==> Closed_Unbounded(\<lambda>x. \<forall>a\<in>A. P(a, x))"
 apply (case_tac "A=0", simp)
 apply (rule cub_family.Closed_Unbounded_INT [OF cub_family.intro])
 apply (simp_all add: Closed_Unbounded_def)
 done
 
 lemma Int_iff_INT2:
      "P(x) \<and> Q(x)  \<longleftrightarrow>  (\<forall>i\<in>2. (i=0 \<longrightarrow> P(x)) \<and> (i=1 \<longrightarrow> Q(x)))"
 by auto
 
 theorem Closed_Unbounded_Int:
      "[| Closed_Unbounded(P); Closed_Unbounded(Q) |] 
       ==> Closed_Unbounded(\<lambda>x. P(x) \<and> Q(x))"
 apply (simp only: Int_iff_INT2)
 apply (rule Closed_Unbounded_INT, auto) 
 done
 
 
 subsection \<open>Normal Functions\<close> 
 
 definition
   mono_le_subset :: "(i=>i) => o" where
     "mono_le_subset(M) == \<forall>i j. i\<le>j \<longrightarrow> M(i) \<subseteq> M(j)"
 
 definition
   mono_Ord :: "(i=>i) => o" where
     "mono_Ord(F) == \<forall>i j. i<j \<longrightarrow> F(i) < F(j)"
 
 definition
   cont_Ord :: "(i=>i) => o" where
     "cont_Ord(F) == \<forall>l. Limit(l) \<longrightarrow> F(l) = (\<Union>i<l. F(i))"
 
 definition
   Normal :: "(i=>i) => o" where
     "Normal(F) == mono_Ord(F) \<and> cont_Ord(F)"
 
 
 subsubsection\<open>Immediate properties of the definitions\<close>
 
 lemma NormalI:
      "[|!!i j. i<j ==> F(i) < F(j);  !!l. Limit(l) ==> F(l) = (\<Union>i<l. F(i))|]
       ==> Normal(F)"
 by (simp add: Normal_def mono_Ord_def cont_Ord_def)
 
 lemma mono_Ord_imp_Ord: "[| Ord(i); mono_Ord(F) |] ==> Ord(F(i))"
 apply (auto simp add: mono_Ord_def)
 apply (blast intro: lt_Ord) 
 done
 
 lemma mono_Ord_imp_mono: "[| i<j; mono_Ord(F) |] ==> F(i) < F(j)"
 by (simp add: mono_Ord_def)
 
 lemma Normal_imp_Ord [simp]: "[| Normal(F); Ord(i) |] ==> Ord(F(i))"
 by (simp add: Normal_def mono_Ord_imp_Ord) 
 
 lemma Normal_imp_cont: "[| Normal(F); Limit(l) |] ==> F(l) = (\<Union>i<l. F(i))"
 by (simp add: Normal_def cont_Ord_def)
 
 lemma Normal_imp_mono: "[| i<j; Normal(F) |] ==> F(i) < F(j)"
 by (simp add: Normal_def mono_Ord_def)
 
 lemma Normal_increasing:
   assumes i: "Ord(i)" and F: "Normal(F)" shows"i \<le> F(i)"
 using i
 proof (induct i rule: trans_induct3)
   case 0 thus ?case by (simp add: subset_imp_le F)
 next
   case (succ i) 
   hence "F(i) < F(succ(i))" using F
     by (simp add: Normal_def mono_Ord_def)
   thus ?case using succ.hyps
     by (blast intro: lt_trans1)
 next
   case (limit l) 
   hence "l = (\<Union>y<l. y)" 
     by (simp add: Limit_OUN_eq)
   also have "... \<le> (\<Union>y<l. F(y))" using limit
     by (blast intro: ltD le_implies_OUN_le_OUN)
   finally have "l \<le> (\<Union>y<l. F(y))" .
   moreover have "(\<Union>y<l. F(y)) \<le> F(l)" using limit F
     by (simp add: Normal_imp_cont lt_Ord)
   ultimately show ?case
     by (blast intro: le_trans) 
 qed
 
 
 subsubsection\<open>The class of fixedpoints is closed and unbounded\<close>
 
 text\<open>The proof is from Drake, pages 113--114.\<close>
 
 lemma mono_Ord_imp_le_subset: "mono_Ord(F) ==> mono_le_subset(F)"
 apply (simp add: mono_le_subset_def, clarify)
 apply (subgoal_tac "F(i)\<le>F(j)", blast dest: le_imp_subset) 
 apply (simp add: le_iff) 
 apply (blast intro: lt_Ord2 mono_Ord_imp_Ord mono_Ord_imp_mono) 
 done
 
 text\<open>The following equation is taken for granted in any set theory text.\<close>
 lemma cont_Ord_Union:
      "[| cont_Ord(F); mono_le_subset(F); X=0 \<longrightarrow> F(0)=0; \<forall>x\<in>X. Ord(x) |] 
       ==> F(\<Union>(X)) = (\<Union>y\<in>X. F(y))"
 apply (frule Ord_set_cases)
 apply (erule disjE, force) 
 apply (thin_tac "X=0 \<longrightarrow> Q" for Q, auto)
  txt\<open>The trival case of \<^term>\<open>\<Union>X \<in> X\<close>\<close>
  apply (rule equalityI, blast intro: Ord_Union_eq_succD) 
  apply (simp add: mono_le_subset_def UN_subset_iff le_subset_iff) 
  apply (blast elim: equalityE)
 txt\<open>The limit case, \<^term>\<open>Limit(\<Union>X)\<close>:
 @{subgoals[display,indent=0,margin=65]}
 \<close>
 apply (simp add: OUN_Union_eq cont_Ord_def)
 apply (rule equalityI) 
 txt\<open>First inclusion:\<close>
  apply (rule UN_least [OF OUN_least])
  apply (simp add: mono_le_subset_def, blast intro: leI) 
 txt\<open>Second inclusion:\<close>
 apply (rule UN_least) 
-apply (frule Union_upper_le, blast, blast intro: Ord_Union)
+apply (frule Union_upper_le, blast, blast)
 apply (erule leE, drule ltD, elim UnionE)
  apply (simp add: OUnion_def)
  apply blast+
 done
 
 lemma Normal_Union:
      "[| X\<noteq>0; \<forall>x\<in>X. Ord(x); Normal(F) |] ==> F(\<Union>(X)) = (\<Union>y\<in>X. F(y))"
 apply (simp add: Normal_def) 
 apply (blast intro: mono_Ord_imp_le_subset cont_Ord_Union) 
 done
 
 lemma Normal_imp_fp_Closed: "Normal(F) ==> Closed(\<lambda>i. F(i) = i)"
 apply (simp add: Closed_def ball_conj_distrib, clarify)
 apply (frule Ord_set_cases)
 apply (auto simp add: Normal_Union)
 done
 
 
 lemma iterates_Normal_increasing:
      "[| n\<in>nat;  x < F(x);  Normal(F) |] 
       ==> F^n (x) < F^(succ(n)) (x)"  
 apply (induct n rule: nat_induct)
 apply (simp_all add: Normal_imp_mono)
 done
 
 lemma Ord_iterates_Normal:
      "[| n\<in>nat;  Normal(F);  Ord(x) |] ==> Ord(F^n (x))"  
-by (simp add: Ord_iterates) 
+by (simp) 
 
 text\<open>THIS RESULT IS UNUSED\<close>
 lemma iterates_omega_Limit:
      "[| Normal(F);  x < F(x) |] ==> Limit(F^\<omega> (x))"  
 apply (frule lt_Ord) 
 apply (simp add: iterates_omega_def)
 apply (rule increasing_LimitI) 
    \<comment> \<open>this lemma is @{thm increasing_LimitI [no_vars]}\<close>
  apply (blast intro: UN_upper_lt [of "1"]   Normal_imp_Ord
-                     Ord_UN Ord_iterates lt_imp_0_lt
+                     Ord_iterates lt_imp_0_lt
                      iterates_Normal_increasing, clarify)
 apply (rule bexI) 
  apply (blast intro: Ord_in_Ord [OF Ord_iterates_Normal]) 
 apply (rule UN_I, erule nat_succI) 
 apply (blast intro:  iterates_Normal_increasing Ord_iterates_Normal
                      ltD [OF lt_trans1, OF succ_leI, OF ltI]) 
 done
 
 lemma iterates_omega_fixedpoint:
      "[| Normal(F); Ord(a) |] ==> F(F^\<omega> (a)) = F^\<omega> (a)" 
 apply (frule Normal_increasing, assumption)
 apply (erule leE) 
  apply (simp_all add: iterates_omega_triv [OF sym])  (*for subgoal 2*)
 apply (simp add:  iterates_omega_def Normal_Union) 
 apply (rule equalityI, force simp add: nat_succI) 
 txt\<open>Opposite inclusion:
 @{subgoals[display,indent=0,margin=65]}
 \<close>
 apply clarify
 apply (rule UN_I, assumption) 
 apply (frule iterates_Normal_increasing, assumption, assumption, simp)
 apply (blast intro: Ord_trans ltD Ord_iterates_Normal Normal_imp_Ord [of F]) 
 done
 
 lemma iterates_omega_increasing:
      "[| Normal(F); Ord(a) |] ==> a \<le> F^\<omega> (a)"   
 apply (unfold iterates_omega_def)
 apply (rule UN_upper_le [of 0], simp_all)
 done
 
 lemma Normal_imp_fp_Unbounded: "Normal(F) ==> Unbounded(\<lambda>i. F(i) = i)"
 apply (unfold Unbounded_def, clarify)
 apply (rule_tac x="F^\<omega> (succ(i))" in exI)
 apply (simp add: iterates_omega_fixedpoint) 
 apply (blast intro: lt_trans2 [OF _ iterates_omega_increasing])
 done
 
 
 theorem Normal_imp_fp_Closed_Unbounded: 
      "Normal(F) ==> Closed_Unbounded(\<lambda>i. F(i) = i)"
 by (simp add: Closed_Unbounded_def Normal_imp_fp_Closed
               Normal_imp_fp_Unbounded)
 
 
 subsubsection\<open>Function \<open>normalize\<close>\<close>
 
 text\<open>Function \<open>normalize\<close> maps a function \<open>F\<close> to a 
       normal function that bounds it above.  The result is normal if and
       only if \<open>F\<close> is continuous: succ is not bounded above by any 
       normal function, by @{thm [source] Normal_imp_fp_Unbounded}.
 \<close>
 definition
   normalize :: "[i=>i, i] => i" where
     "normalize(F,a) == transrec2(a, F(0), \<lambda>x r. F(succ(x)) \<union> succ(r))"
 
 
 lemma Ord_normalize [simp, intro]:
      "[| Ord(a); !!x. Ord(x) ==> Ord(F(x)) |] ==> Ord(normalize(F, a))"
 apply (induct a rule: trans_induct3)
 apply (simp_all add: ltD def_transrec2 [OF normalize_def])
 done
 
 lemma normalize_increasing:
   assumes ab: "a < b" and F: "!!x. Ord(x) ==> Ord(F(x))"
   shows "normalize(F,a) < normalize(F,b)"
 proof -
   { fix x
     have "Ord(b)" using ab by (blast intro: lt_Ord2) 
     hence "x < b \<Longrightarrow> normalize(F,x) < normalize(F,b)"
     proof (induct b arbitrary: x rule: trans_induct3)
       case 0 thus ?case by simp
     next
       case (succ b)
       thus ?case
         by (auto simp add: le_iff def_transrec2 [OF normalize_def] intro: Un_upper2_lt F)
     next
       case (limit l)
       hence sc: "succ(x) < l" 
         by (blast intro: Limit_has_succ) 
       hence "normalize(F,x) < normalize(F,succ(x))" 
         by (blast intro: limit elim: ltE) 
       hence "normalize(F,x) < (\<Union>j<l. normalize(F,j))"
         by (blast intro: OUN_upper_lt lt_Ord F sc) 
       thus ?case using limit
         by (simp add: def_transrec2 [OF normalize_def])
     qed
   } thus ?thesis using ab .
 qed
 
 theorem Normal_normalize:
      "(!!x. Ord(x) ==> Ord(F(x))) ==> Normal(normalize(F))"
 apply (rule NormalI) 
 apply (blast intro!: normalize_increasing)
 apply (simp add: def_transrec2 [OF normalize_def])
 done
 
 theorem le_normalize:
   assumes a: "Ord(a)" and coF: "cont_Ord(F)" and F: "!!x. Ord(x) ==> Ord(F(x))"
   shows "F(a) \<le> normalize(F,a)"
 using a
 proof (induct a rule: trans_induct3)
   case 0 thus ?case by (simp add: F def_transrec2 [OF normalize_def])
 next
   case (succ a)
   thus ?case
     by (simp add: def_transrec2 [OF normalize_def] Un_upper1_le F )
 next
   case (limit l) 
   thus ?case using F coF [unfolded cont_Ord_def]
     by (simp add: def_transrec2 [OF normalize_def] le_implies_OUN_le_OUN ltD) 
 qed
 
 
 subsection \<open>The Alephs\<close>
 text \<open>This is the well-known transfinite enumeration of the cardinal 
 numbers.\<close>
 
 definition
   Aleph :: "i => i"  (\<open>\<aleph>_\<close> [90] 90) where
     "Aleph(a) == transrec2(a, nat, \<lambda>x r. csucc(r))"
 
 lemma Card_Aleph [simp, intro]:
      "Ord(a) ==> Card(Aleph(a))"
 apply (erule trans_induct3) 
 apply (simp_all add: Card_csucc Card_nat Card_is_Ord
                      def_transrec2 [OF Aleph_def])
 done
 
 lemma Aleph_increasing:
   assumes ab: "a < b" shows "Aleph(a) < Aleph(b)"
 proof -
   { fix x
     have "Ord(b)" using ab by (blast intro: lt_Ord2) 
     hence "x < b \<Longrightarrow> Aleph(x) < Aleph(b)"
     proof (induct b arbitrary: x rule: trans_induct3)
       case 0 thus ?case by simp
     next
       case (succ b)
       thus ?case
         by (force simp add: le_iff def_transrec2 [OF Aleph_def] 
                   intro: lt_trans lt_csucc Card_is_Ord)
     next
       case (limit l)
       hence sc: "succ(x) < l" 
         by (blast intro: Limit_has_succ) 
       hence "\<aleph> x < (\<Union>j<l. \<aleph>j)" using limit
         by (blast intro: OUN_upper_lt Card_is_Ord ltD lt_Ord)
       thus ?case using limit
         by (simp add: def_transrec2 [OF Aleph_def])
     qed
   } thus ?thesis using ab .
 qed
 
 theorem Normal_Aleph: "Normal(Aleph)"
 apply (rule NormalI) 
 apply (blast intro!: Aleph_increasing)
 apply (simp add: def_transrec2 [OF Aleph_def])
 done
 
 end
diff --git a/src/ZF/Constructible/Rank.thy b/src/ZF/Constructible/Rank.thy
--- a/src/ZF/Constructible/Rank.thy
+++ b/src/ZF/Constructible/Rank.thy
@@ -1,944 +1,942 @@
 (*  Title:      ZF/Constructible/Rank.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Absoluteness for Order Types, Rank Functions and Well-Founded 
          Relations\<close>
 
 theory Rank imports WF_absolute begin
 
 subsection \<open>Order Types: A Direct Construction by Replacement\<close>
 
 locale M_ordertype = M_basic +
 assumes well_ord_iso_separation:
      "[| M(A); M(f); M(r) |]
       ==> separation (M, \<lambda>x. x\<in>A \<longrightarrow> (\<exists>y[M]. (\<exists>p[M].
                      fun_apply(M,f,x,y) & pair(M,y,x,p) & p \<in> r)))"
   and obase_separation:
      \<comment> \<open>part of the order type formalization\<close>
      "[| M(A); M(r) |]
       ==> separation(M, \<lambda>a. \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M].
              ordinal(M,x) & membership(M,x,mx) & pred_set(M,A,a,r,par) &
              order_isomorphism(M,par,r,x,mx,g))"
   and obase_equals_separation:
      "[| M(A); M(r) |]
       ==> separation (M, \<lambda>x. x\<in>A \<longrightarrow> ~(\<exists>y[M]. \<exists>g[M].
                               ordinal(M,y) & (\<exists>my[M]. \<exists>pxr[M].
                               membership(M,y,my) & pred_set(M,A,x,r,pxr) &
                               order_isomorphism(M,pxr,r,y,my,g))))"
   and omap_replacement:
      "[| M(A); M(r) |]
       ==> strong_replacement(M,
              \<lambda>a z. \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M].
              ordinal(M,x) & pair(M,a,x,z) & membership(M,x,mx) &
              pred_set(M,A,a,r,par) & order_isomorphism(M,par,r,x,mx,g))"
 
 
 text\<open>Inductive argument for Kunen's Lemma I 6.1, etc.
       Simple proof from Halmos, page 72\<close>
 lemma  (in M_ordertype) wellordered_iso_subset_lemma: 
      "[| wellordered(M,A,r);  f \<in> ord_iso(A,r, A',r);  A'<= A;  y \<in> A;  
        M(A);  M(f);  M(r) |] ==> ~ <f`y, y> \<in> r"
 apply (unfold wellordered_def ord_iso_def)
 apply (elim conjE CollectE) 
 apply (erule wellfounded_on_induct, assumption+)
  apply (insert well_ord_iso_separation [of A f r])
  apply (simp, clarify) 
 apply (drule_tac a = x in bij_is_fun [THEN apply_type], assumption, blast)
 done
 
 
 text\<open>Kunen's Lemma I 6.1, page 14: 
       there's no order-isomorphism to an initial segment of a well-ordering\<close>
 lemma (in M_ordertype) wellordered_iso_predD:
      "[| wellordered(M,A,r);  f \<in> ord_iso(A, r, Order.pred(A,x,r), r);  
        M(A);  M(f);  M(r) |] ==> x \<notin> A"
 apply (rule notI) 
 apply (frule wellordered_iso_subset_lemma, assumption)
 apply (auto elim: predE)  
 (*Now we know  ~ (f`x < x) *)
 apply (drule ord_iso_is_bij [THEN bij_is_fun, THEN apply_type], assumption)
 (*Now we also know f`x  \<in> pred(A,x,r);  contradiction! *)
 apply (simp add: Order.pred_def)
 done
 
 
 lemma (in M_ordertype) wellordered_iso_pred_eq_lemma:
      "[| f \<in> \<langle>Order.pred(A,y,r), r\<rangle> \<cong> \<langle>Order.pred(A,x,r), r\<rangle>;
        wellordered(M,A,r); x\<in>A; y\<in>A; M(A); M(f); M(r) |] ==> <x,y> \<notin> r"
 apply (frule wellordered_is_trans_on, assumption)
 apply (rule notI) 
 apply (drule_tac x2=y and x=x and r2=r in 
          wellordered_subset [OF _ pred_subset, THEN wellordered_iso_predD]) 
 apply (simp add: trans_pred_pred_eq) 
 apply (blast intro: predI dest: transM)+
 done
 
 
 text\<open>Simple consequence of Lemma 6.1\<close>
 lemma (in M_ordertype) wellordered_iso_pred_eq:
      "[| wellordered(M,A,r);
        f \<in> ord_iso(Order.pred(A,a,r), r, Order.pred(A,c,r), r);   
        M(A);  M(f);  M(r);  a\<in>A;  c\<in>A |] ==> a=c"
 apply (frule wellordered_is_trans_on, assumption)
 apply (frule wellordered_is_linear, assumption)
 apply (erule_tac x=a and y=c in linearE, auto) 
 apply (drule ord_iso_sym)
 (*two symmetric cases*)
 apply (blast dest: wellordered_iso_pred_eq_lemma)+ 
 done
 
 
 text\<open>Following Kunen's Theorem I 7.6, page 17.  Note that this material is
 not required elsewhere.\<close>
 
 text\<open>Can't use \<open>well_ord_iso_preserving\<close> because it needs the
 strong premise \<^term>\<open>well_ord(A,r)\<close>\<close>
 lemma (in M_ordertype) ord_iso_pred_imp_lt:
      "[| f \<in> ord_iso(Order.pred(A,x,r), r, i, Memrel(i));
          g \<in> ord_iso(Order.pred(A,y,r), r, j, Memrel(j));
          wellordered(M,A,r);  x \<in> A;  y \<in> A; M(A); M(r); M(f); M(g); M(j);
          Ord(i); Ord(j); \<langle>x,y\<rangle> \<in> r |]
       ==> i < j"
 apply (frule wellordered_is_trans_on, assumption)
 apply (frule_tac y=y in transM, assumption) 
 apply (rule_tac i=i and j=j in Ord_linear_lt, auto)  
 txt\<open>case \<^term>\<open>i=j\<close> yields a contradiction\<close>
  apply (rule_tac x1=x and A1="Order.pred(A,y,r)" in 
           wellordered_iso_predD [THEN notE]) 
    apply (blast intro: wellordered_subset [OF _ pred_subset]) 
   apply (simp add: trans_pred_pred_eq)
   apply (blast intro: Ord_iso_implies_eq ord_iso_sym ord_iso_trans) 
- apply (simp_all add: pred_iff pred_closed converse_closed comp_closed)
+ apply (simp_all add: pred_iff)
 txt\<open>case \<^term>\<open>j<i\<close> also yields a contradiction\<close>
 apply (frule restrict_ord_iso2, assumption+) 
 apply (frule ord_iso_sym [THEN ord_iso_is_bij, THEN bij_is_fun]) 
 apply (frule apply_type, blast intro: ltD) 
   \<comment> \<open>thus \<^term>\<open>converse(f)`j \<in> Order.pred(A,x,r)\<close>\<close>
 apply (simp add: pred_iff) 
 apply (subgoal_tac
        "\<exists>h[M]. h \<in> ord_iso(Order.pred(A,y,r), r, 
                                Order.pred(A, converse(f)`j, r), r)")
  apply (clarify, frule wellordered_iso_pred_eq, assumption+)
  apply (blast dest: wellordered_asym)  
 apply (intro rexI)
  apply (blast intro: Ord_iso_implies_eq ord_iso_sym ord_iso_trans)+
 done
 
 
 lemma ord_iso_converse1:
      "[| f: ord_iso(A,r,B,s);  <b, f`a>: s;  a:A;  b:B |] 
       ==> <converse(f) ` b, a> \<in> r"
 apply (frule ord_iso_converse, assumption+) 
 apply (blast intro: ord_iso_is_bij [THEN bij_is_fun, THEN apply_funtype]) 
 apply (simp add: left_inverse_bij [OF ord_iso_is_bij])
 done
 
 
 definition  
   obase :: "[i=>o,i,i] => i" where
        \<comment> \<open>the domain of \<open>om\<close>, eventually shown to equal \<open>A\<close>\<close>
    "obase(M,A,r) == {a\<in>A. \<exists>x[M]. \<exists>g[M]. Ord(x) & 
                           g \<in> ord_iso(Order.pred(A,a,r),r,x,Memrel(x))}"
 
 definition
   omap :: "[i=>o,i,i,i] => o" where
     \<comment> \<open>the function that maps wosets to order types\<close>
    "omap(M,A,r,f) == 
         \<forall>z[M].
          z \<in> f \<longleftrightarrow> (\<exists>a\<in>A. \<exists>x[M]. \<exists>g[M]. z = <a,x> & Ord(x) & 
                         g \<in> ord_iso(Order.pred(A,a,r),r,x,Memrel(x)))"
 
 definition
   otype :: "[i=>o,i,i,i] => o" where \<comment> \<open>the order types themselves\<close>
    "otype(M,A,r,i) == \<exists>f[M]. omap(M,A,r,f) & is_range(M,f,i)"
 
 
 text\<open>Can also be proved with the premise \<^term>\<open>M(z)\<close> instead of
       \<^term>\<open>M(f)\<close>, but that version is less useful.  This lemma
       is also more useful than the definition, \<open>omap_def\<close>.\<close>
 lemma (in M_ordertype) omap_iff:
      "[| omap(M,A,r,f); M(A); M(f) |] 
       ==> z \<in> f \<longleftrightarrow>
           (\<exists>a\<in>A. \<exists>x[M]. \<exists>g[M]. z = <a,x> & Ord(x) & 
                                 g \<in> ord_iso(Order.pred(A,a,r),r,x,Memrel(x)))"
-apply (simp add: omap_def Memrel_closed pred_closed) 
+apply (simp add: omap_def) 
 apply (rule iffI)
  apply (drule_tac [2] x=z in rspec)
  apply (drule_tac x=z in rspec)
  apply (blast dest: transM)+
 done
 
 lemma (in M_ordertype) omap_unique:
      "[| omap(M,A,r,f); omap(M,A,r,f'); M(A); M(r); M(f); M(f') |] ==> f' = f" 
 apply (rule equality_iffI) 
 apply (simp add: omap_iff) 
 done
 
 lemma (in M_ordertype) omap_yields_Ord:
      "[| omap(M,A,r,f); \<langle>a,x\<rangle> \<in> f; M(a); M(x) |]  ==> Ord(x)"
   by (simp add: omap_def)
 
 lemma (in M_ordertype) otype_iff:
      "[| otype(M,A,r,i); M(A); M(r); M(i) |] 
       ==> x \<in> i \<longleftrightarrow> 
           (M(x) & Ord(x) & 
            (\<exists>a\<in>A. \<exists>g[M]. g \<in> ord_iso(Order.pred(A,a,r),r,x,Memrel(x))))"
 apply (auto simp add: omap_iff otype_def)
  apply (blast intro: transM) 
 apply (rule rangeI) 
 apply (frule transM, assumption)
 apply (simp add: omap_iff, blast)
 done
 
 lemma (in M_ordertype) otype_eq_range:
      "[| omap(M,A,r,f); otype(M,A,r,i); M(A); M(r); M(f); M(i) |] 
       ==> i = range(f)"
 apply (auto simp add: otype_def omap_iff)
 apply (blast dest: omap_unique) 
 done
 
 
 lemma (in M_ordertype) Ord_otype:
      "[| otype(M,A,r,i); trans[A](r); M(A); M(r); M(i) |] ==> Ord(i)"
 apply (rule OrdI) 
 prefer 2 
     apply (simp add: Ord_def otype_def omap_def) 
     apply clarify 
     apply (frule pair_components_in_M, assumption) 
     apply blast 
 apply (auto simp add: Transset_def otype_iff) 
   apply (blast intro: transM)
  apply (blast intro: Ord_in_Ord) 
 apply (rename_tac y a g)
 apply (frule ord_iso_sym [THEN ord_iso_is_bij, THEN bij_is_fun, 
                           THEN apply_funtype],  assumption)  
 apply (rule_tac x="converse(g)`y" in bexI)
  apply (frule_tac a="converse(g) ` y" in ord_iso_restrict_pred, assumption) 
 apply (safe elim!: predE) 
 apply (blast intro: restrict_ord_iso ord_iso_sym ltI dest: transM)
 done
 
 lemma (in M_ordertype) domain_omap:
      "[| omap(M,A,r,f);  M(A); M(r); M(B); M(f) |] 
       ==> domain(f) = obase(M,A,r)"
-apply (simp add: domain_closed obase_def) 
+apply (simp add: obase_def) 
 apply (rule equality_iffI) 
 apply (simp add: domain_iff omap_iff, blast) 
 done
 
 lemma (in M_ordertype) omap_subset: 
      "[| omap(M,A,r,f); otype(M,A,r,i); 
        M(A); M(r); M(f); M(B); M(i) |] ==> f \<subseteq> obase(M,A,r) * i"
 apply clarify 
 apply (simp add: omap_iff obase_def) 
 apply (force simp add: otype_iff) 
 done
 
 lemma (in M_ordertype) omap_funtype: 
      "[| omap(M,A,r,f); otype(M,A,r,i); 
          M(A); M(r); M(f); M(i) |] ==> f \<in> obase(M,A,r) -> i"
 apply (simp add: domain_omap omap_subset Pi_iff function_def omap_iff) 
 apply (blast intro: Ord_iso_implies_eq ord_iso_sym ord_iso_trans) 
 done
 
 
 lemma (in M_ordertype) wellordered_omap_bij:
      "[| wellordered(M,A,r); omap(M,A,r,f); otype(M,A,r,i); 
        M(A); M(r); M(f); M(i) |] ==> f \<in> bij(obase(M,A,r),i)"
 apply (insert omap_funtype [of A r f i]) 
 apply (auto simp add: bij_def inj_def) 
 prefer 2  apply (blast intro: fun_is_surj dest: otype_eq_range) 
 apply (frule_tac a=w in apply_Pair, assumption) 
 apply (frule_tac a=x in apply_Pair, assumption) 
 apply (simp add: omap_iff) 
 apply (blast intro: wellordered_iso_pred_eq ord_iso_sym ord_iso_trans) 
 done
 
 
 text\<open>This is not the final result: we must show \<^term>\<open>oB(A,r) = A\<close>\<close>
 lemma (in M_ordertype) omap_ord_iso:
      "[| wellordered(M,A,r); omap(M,A,r,f); otype(M,A,r,i); 
        M(A); M(r); M(f); M(i) |] ==> f \<in> ord_iso(obase(M,A,r),r,i,Memrel(i))"
 apply (rule ord_isoI)
  apply (erule wellordered_omap_bij, assumption+) 
 apply (insert omap_funtype [of A r f i], simp) 
 apply (frule_tac a=x in apply_Pair, assumption) 
 apply (frule_tac a=y in apply_Pair, assumption) 
 apply (auto simp add: omap_iff)
  txt\<open>direction 1: assuming \<^term>\<open>\<langle>x,y\<rangle> \<in> r\<close>\<close>
  apply (blast intro: ltD ord_iso_pred_imp_lt)
  txt\<open>direction 2: proving \<^term>\<open>\<langle>x,y\<rangle> \<in> r\<close> using linearity of \<^term>\<open>r\<close>\<close>
 apply (rename_tac x y g ga) 
 apply (frule wellordered_is_linear, assumption, 
        erule_tac x=x and y=y in linearE, assumption+) 
 txt\<open>the case \<^term>\<open>x=y\<close> leads to immediate contradiction\<close> 
 apply (blast elim: mem_irrefl) 
 txt\<open>the case \<^term>\<open>\<langle>y,x\<rangle> \<in> r\<close>: handle like the opposite direction\<close>
 apply (blast dest: ord_iso_pred_imp_lt ltD elim: mem_asym) 
 done
 
 lemma (in M_ordertype) Ord_omap_image_pred:
      "[| wellordered(M,A,r); omap(M,A,r,f); otype(M,A,r,i); 
        M(A); M(r); M(f); M(i); b \<in> A |] ==> Ord(f `` Order.pred(A,b,r))"
 apply (frule wellordered_is_trans_on, assumption)
 apply (rule OrdI) 
         prefer 2 apply (simp add: image_iff omap_iff Ord_def, blast) 
 txt\<open>Hard part is to show that the image is a transitive set.\<close>
 apply (simp add: Transset_def, clarify) 
 apply (simp add: image_iff pred_iff apply_iff [OF omap_funtype [of A r f i]])
 apply (rename_tac c j, clarify)
 apply (frule omap_funtype [of A r f, THEN apply_funtype], assumption+)
 apply (subgoal_tac "j \<in> i") 
         prefer 2 apply (blast intro: Ord_trans Ord_otype)
 apply (subgoal_tac "converse(f) ` j \<in> obase(M,A,r)") 
         prefer 2 
         apply (blast dest: wellordered_omap_bij [THEN bij_converse_bij, 
                                       THEN bij_is_fun, THEN apply_funtype])
 apply (rule_tac x="converse(f) ` j" in bexI) 
  apply (simp add: right_inverse_bij [OF wellordered_omap_bij]) 
 apply (intro predI conjI)
  apply (erule_tac b=c in trans_onD) 
  apply (rule ord_iso_converse1 [OF omap_ord_iso [of A r f i]])
 apply (auto simp add: obase_def)
 done
 
 lemma (in M_ordertype) restrict_omap_ord_iso:
      "[| wellordered(M,A,r); omap(M,A,r,f); otype(M,A,r,i); 
        D \<subseteq> obase(M,A,r); M(A); M(r); M(f); M(i) |] 
       ==> restrict(f,D) \<in> (\<langle>D,r\<rangle> \<cong> \<langle>f``D, Memrel(f``D)\<rangle>)"
 apply (frule ord_iso_restrict_image [OF omap_ord_iso [of A r f i]], 
        assumption+)
 apply (drule ord_iso_sym [THEN subset_ord_iso_Memrel]) 
 apply (blast dest: subsetD [OF omap_subset]) 
 apply (drule ord_iso_sym, simp) 
 done
 
 lemma (in M_ordertype) obase_equals: 
      "[| wellordered(M,A,r); omap(M,A,r,f); otype(M,A,r,i);
        M(A); M(r); M(f); M(i) |] ==> obase(M,A,r) = A"
 apply (rule equalityI, force simp add: obase_def, clarify) 
 apply (unfold obase_def, simp) 
 apply (frule wellordered_is_wellfounded_on, assumption)
 apply (erule wellfounded_on_induct, assumption+)
  apply (frule obase_equals_separation [of A r], assumption) 
  apply (simp, clarify) 
 apply (rename_tac b) 
 apply (subgoal_tac "Order.pred(A,b,r) \<subseteq> obase(M,A,r)") 
  apply (blast intro!: restrict_omap_ord_iso Ord_omap_image_pred)
 apply (force simp add: pred_iff obase_def)  
 done
 
 
 
 text\<open>Main result: \<^term>\<open>om\<close> gives the order-isomorphism 
       \<^term>\<open>\<langle>A,r\<rangle> \<cong> \<langle>i, Memrel(i)\<rangle>\<close>\<close>
 theorem (in M_ordertype) omap_ord_iso_otype:
      "[| wellordered(M,A,r); omap(M,A,r,f); otype(M,A,r,i);
        M(A); M(r); M(f); M(i) |] ==> f \<in> ord_iso(A, r, i, Memrel(i))"
 apply (frule omap_ord_iso, assumption+)
 apply (simp add: obase_equals)  
 done 
 
 lemma (in M_ordertype) obase_exists:
      "[| M(A); M(r) |] ==> M(obase(M,A,r))"
 apply (simp add: obase_def) 
 apply (insert obase_separation [of A r])
 apply (simp add: separation_def)  
 done
 
 lemma (in M_ordertype) omap_exists:
      "[| M(A); M(r) |] ==> \<exists>z[M]. omap(M,A,r,z)"
 apply (simp add: omap_def) 
 apply (insert omap_replacement [of A r])
 apply (simp add: strong_replacement_def) 
 apply (drule_tac x="obase(M,A,r)" in rspec) 
  apply (simp add: obase_exists) 
-apply (simp add: Memrel_closed pred_closed obase_def)
+apply (simp add: obase_def)
 apply (erule impE) 
  apply (clarsimp simp add: univalent_def)
  apply (blast intro: Ord_iso_implies_eq ord_iso_sym ord_iso_trans, clarify)  
 apply (rule_tac x=Y in rexI) 
-apply (simp add: Memrel_closed pred_closed obase_def, blast, assumption)
+apply (simp add: obase_def, blast, assumption)
 done
 
-declare rall_simps [simp] rex_simps [simp]
-
 lemma (in M_ordertype) otype_exists:
      "[| wellordered(M,A,r); M(A); M(r) |] ==> \<exists>i[M]. otype(M,A,r,i)"
 apply (insert omap_exists [of A r])  
 apply (simp add: otype_def, safe)
 apply (rule_tac x="range(x)" in rexI) 
 apply blast+
 done
 
 lemma (in M_ordertype) ordertype_exists:
      "[| wellordered(M,A,r); M(A); M(r) |]
       ==> \<exists>f[M]. (\<exists>i[M]. Ord(i) & f \<in> ord_iso(A, r, i, Memrel(i)))"
 apply (insert obase_exists [of A r] omap_exists [of A r] otype_exists [of A r], simp, clarify)
 apply (rename_tac i) 
 apply (subgoal_tac "Ord(i)", blast intro: omap_ord_iso_otype)
 apply (rule Ord_otype) 
-    apply (force simp add: otype_def range_closed) 
+    apply (force simp add: otype_def) 
    apply (simp_all add: wellordered_is_trans_on) 
 done
 
 
 lemma (in M_ordertype) relativized_imp_well_ord: 
      "[| wellordered(M,A,r); M(A); M(r) |] ==> well_ord(A,r)" 
 apply (insert ordertype_exists [of A r], simp)
 apply (blast intro: well_ord_ord_iso well_ord_Memrel)  
 done
 
 subsection \<open>Kunen's theorem 5.4, page 127\<close>
 
 text\<open>(a) The notion of Wellordering is absolute\<close>
 theorem (in M_ordertype) well_ord_abs [simp]: 
      "[| M(A); M(r) |] ==> wellordered(M,A,r) \<longleftrightarrow> well_ord(A,r)" 
 by (blast intro: well_ord_imp_relativized relativized_imp_well_ord)  
 
 
 text\<open>(b) Order types are absolute\<close>
 theorem (in M_ordertype) 
      "[| wellordered(M,A,r); f \<in> ord_iso(A, r, i, Memrel(i));
        M(A); M(r); M(f); M(i); Ord(i) |] ==> i = ordertype(A,r)"
 by (blast intro: Ord_ordertype relativized_imp_well_ord ordertype_ord_iso
                  Ord_iso_implies_eq ord_iso_sym ord_iso_trans)
 
 
 subsection\<open>Ordinal Arithmetic: Two Examples of Recursion\<close>
 
 text\<open>Note: the remainder of this theory is not needed elsewhere.\<close>
 
 subsubsection\<open>Ordinal Addition\<close>
 
 (*FIXME: update to use new techniques!!*)
  (*This expresses ordinal addition in the language of ZF.  It also 
    provides an abbreviation that can be used in the instance of strong
    replacement below.  Here j is used to define the relation, namely
    Memrel(succ(j)), while x determines the domain of f.*)
 definition
   is_oadd_fun :: "[i=>o,i,i,i,i] => o" where
     "is_oadd_fun(M,i,j,x,f) == 
        (\<forall>sj msj. M(sj) \<longrightarrow> M(msj) \<longrightarrow> 
                  successor(M,j,sj) \<longrightarrow> membership(M,sj,msj) \<longrightarrow> 
                  M_is_recfun(M, 
                      %x g y. \<exists>gx[M]. image(M,g,x,gx) & union(M,i,gx,y),
                      msj, x, f))"
 
 definition
   is_oadd :: "[i=>o,i,i,i] => o" where
     "is_oadd(M,i,j,k) == 
         (~ ordinal(M,i) & ~ ordinal(M,j) & k=0) |
         (~ ordinal(M,i) & ordinal(M,j) & k=j) |
         (ordinal(M,i) & ~ ordinal(M,j) & k=i) |
         (ordinal(M,i) & ordinal(M,j) & 
          (\<exists>f fj sj. M(f) & M(fj) & M(sj) & 
                     successor(M,j,sj) & is_oadd_fun(M,i,sj,sj,f) & 
                     fun_apply(M,f,j,fj) & fj = k))"
 
 definition
  (*NEEDS RELATIVIZATION*)
   omult_eqns :: "[i,i,i,i] => o" where
     "omult_eqns(i,x,g,z) ==
             Ord(x) & 
             (x=0 \<longrightarrow> z=0) &
             (\<forall>j. x = succ(j) \<longrightarrow> z = g`j ++ i) &
             (Limit(x) \<longrightarrow> z = \<Union>(g``x))"
 
 definition
   is_omult_fun :: "[i=>o,i,i,i] => o" where
     "is_omult_fun(M,i,j,f) == 
             (\<exists>df. M(df) & is_function(M,f) & 
                   is_domain(M,f,df) & subset(M, j, df)) & 
             (\<forall>x\<in>j. omult_eqns(i,x,f,f`x))"
 
 definition
   is_omult :: "[i=>o,i,i,i] => o" where
     "is_omult(M,i,j,k) == 
         \<exists>f fj sj. M(f) & M(fj) & M(sj) & 
                   successor(M,j,sj) & is_omult_fun(M,i,sj,f) & 
                   fun_apply(M,f,j,fj) & fj = k"
 
 
 locale M_ord_arith = M_ordertype +
   assumes oadd_strong_replacement:
    "[| M(i); M(j) |] ==>
     strong_replacement(M, 
          \<lambda>x z. \<exists>y[M]. pair(M,x,y,z) & 
                   (\<exists>f[M]. \<exists>fx[M]. is_oadd_fun(M,i,j,x,f) & 
                            image(M,f,x,fx) & y = i \<union> fx))"
 
  and omult_strong_replacement':
    "[| M(i); M(j) |] ==>
     strong_replacement(M, 
          \<lambda>x z. \<exists>y[M]. z = <x,y> &
              (\<exists>g[M]. is_recfun(Memrel(succ(j)),x,%x g. THE z. omult_eqns(i,x,g,z),g) & 
              y = (THE z. omult_eqns(i, x, g, z))))" 
 
 
 
 text\<open>\<open>is_oadd_fun\<close>: Relating the pure "language of set theory" to Isabelle/ZF\<close>
 lemma (in M_ord_arith) is_oadd_fun_iff:
    "[| a\<le>j; M(i); M(j); M(a); M(f) |] 
     ==> is_oadd_fun(M,i,j,a,f) \<longleftrightarrow>
         f \<in> a \<rightarrow> range(f) & (\<forall>x. M(x) \<longrightarrow> x < a \<longrightarrow> f`x = i \<union> f``x)"
 apply (frule lt_Ord) 
-apply (simp add: is_oadd_fun_def Memrel_closed Un_closed 
+apply (simp add: is_oadd_fun_def  
              relation2_def is_recfun_abs [of "%x g. i \<union> g``x"]
-             image_closed is_recfun_iff_equation  
+             is_recfun_iff_equation  
              Ball_def lt_trans [OF ltI, of _ a] lt_Memrel)
 apply (simp add: lt_def) 
 apply (blast dest: transM) 
 done
 
 
 lemma (in M_ord_arith) oadd_strong_replacement':
     "[| M(i); M(j) |] ==>
      strong_replacement(M, 
             \<lambda>x z. \<exists>y[M]. z = <x,y> &
                   (\<exists>g[M]. is_recfun(Memrel(succ(j)),x,%x g. i \<union> g``x,g) & 
                   y = i \<union> g``x))" 
 apply (insert oadd_strong_replacement [of i j]) 
 apply (simp add: is_oadd_fun_def relation2_def
                  is_recfun_abs [of "%x g. i \<union> g``x"])  
 done
 
 
 lemma (in M_ord_arith) exists_oadd:
     "[| Ord(j);  M(i);  M(j) |]
      ==> \<exists>f[M]. is_recfun(Memrel(succ(j)), j, %x g. i \<union> g``x, f)"
 apply (rule wf_exists_is_recfun [OF wf_Memrel trans_Memrel])
     apply (simp_all add: Memrel_type oadd_strong_replacement') 
 done 
 
 lemma (in M_ord_arith) exists_oadd_fun:
     "[| Ord(j);  M(i);  M(j) |] ==> \<exists>f[M]. is_oadd_fun(M,i,succ(j),succ(j),f)"
 apply (rule exists_oadd [THEN rexE])
 apply (erule Ord_succ, assumption, simp) 
 apply (rename_tac f) 
 apply (frule is_recfun_type)
 apply (rule_tac x=f in rexI) 
  apply (simp add: fun_is_function domain_of_fun lt_Memrel apply_recfun lt_def
                   is_oadd_fun_iff Ord_trans [OF _ succI1], assumption)
 done
 
 lemma (in M_ord_arith) is_oadd_fun_apply:
     "[| x < j; M(i); M(j); M(f); is_oadd_fun(M,i,j,j,f) |] 
      ==> f`x = i \<union> (\<Union>k\<in>x. {f ` k})"
 apply (simp add: is_oadd_fun_iff lt_Ord2, clarify) 
 apply (frule lt_closed, simp)
 apply (frule leI [THEN le_imp_subset])  
 apply (simp add: image_fun, blast) 
 done
 
 lemma (in M_ord_arith) is_oadd_fun_iff_oadd [rule_format]:
     "[| is_oadd_fun(M,i,J,J,f); M(i); M(J); M(f); Ord(i); Ord(j) |] 
      ==> j<J \<longrightarrow> f`j = i++j"
 apply (erule_tac i=j in trans_induct, clarify) 
 apply (subgoal_tac "\<forall>k\<in>x. k<J")
  apply (simp (no_asm_simp) add: is_oadd_def oadd_unfold is_oadd_fun_apply)
 apply (blast intro: lt_trans ltI lt_Ord) 
 done
 
 lemma (in M_ord_arith) Ord_oadd_abs:
     "[| M(i); M(j); M(k); Ord(i); Ord(j) |] ==> is_oadd(M,i,j,k) \<longleftrightarrow> k = i++j"
 apply (simp add: is_oadd_def is_oadd_fun_iff_oadd)
 apply (frule exists_oadd_fun [of j i], blast+)
 done
 
 lemma (in M_ord_arith) oadd_abs:
     "[| M(i); M(j); M(k) |] ==> is_oadd(M,i,j,k) \<longleftrightarrow> k = i++j"
 apply (case_tac "Ord(i) & Ord(j)")
  apply (simp add: Ord_oadd_abs)
 apply (auto simp add: is_oadd_def oadd_eq_if_raw_oadd)
 done
 
 lemma (in M_ord_arith) oadd_closed [intro,simp]:
     "[| M(i); M(j) |] ==> M(i++j)"
 apply (simp add: oadd_eq_if_raw_oadd, clarify) 
 apply (simp add: raw_oadd_eq_oadd) 
 apply (frule exists_oadd_fun [of j i], auto)
-apply (simp add: apply_closed is_oadd_fun_iff_oadd [symmetric]) 
+apply (simp add: is_oadd_fun_iff_oadd [symmetric]) 
 done
 
 
 subsubsection\<open>Ordinal Multiplication\<close>
 
 lemma omult_eqns_unique:
      "[| omult_eqns(i,x,g,z); omult_eqns(i,x,g,z') |] ==> z=z'"
 apply (simp add: omult_eqns_def, clarify) 
 apply (erule Ord_cases, simp_all) 
 done
 
 lemma omult_eqns_0: "omult_eqns(i,0,g,z) \<longleftrightarrow> z=0"
 by (simp add: omult_eqns_def)
 
 lemma the_omult_eqns_0: "(THE z. omult_eqns(i,0,g,z)) = 0"
 by (simp add: omult_eqns_0)
 
 lemma omult_eqns_succ: "omult_eqns(i,succ(j),g,z) \<longleftrightarrow> Ord(j) & z = g`j ++ i"
 by (simp add: omult_eqns_def)
 
 lemma the_omult_eqns_succ:
      "Ord(j) ==> (THE z. omult_eqns(i,succ(j),g,z)) = g`j ++ i"
 by (simp add: omult_eqns_succ) 
 
 lemma omult_eqns_Limit:
      "Limit(x) ==> omult_eqns(i,x,g,z) \<longleftrightarrow> z = \<Union>(g``x)"
 apply (simp add: omult_eqns_def) 
 apply (blast intro: Limit_is_Ord) 
 done
 
 lemma the_omult_eqns_Limit:
      "Limit(x) ==> (THE z. omult_eqns(i,x,g,z)) = \<Union>(g``x)"
 by (simp add: omult_eqns_Limit)
 
 lemma omult_eqns_Not: "~ Ord(x) ==> ~ omult_eqns(i,x,g,z)"
 by (simp add: omult_eqns_def)
 
 
 lemma (in M_ord_arith) the_omult_eqns_closed:
     "[| M(i); M(x); M(g); function(g) |] 
      ==> M(THE z. omult_eqns(i, x, g, z))"
 apply (case_tac "Ord(x)")
  prefer 2 apply (simp add: omult_eqns_Not) \<comment> \<open>trivial, non-Ord case\<close>
 apply (erule Ord_cases) 
   apply (simp add: omult_eqns_0)
- apply (simp add: omult_eqns_succ apply_closed oadd_closed) 
+ apply (simp add: omult_eqns_succ) 
 apply (simp add: omult_eqns_Limit) 
 done
 
 lemma (in M_ord_arith) exists_omult:
     "[| Ord(j);  M(i);  M(j) |]
      ==> \<exists>f[M]. is_recfun(Memrel(succ(j)), j, %x g. THE z. omult_eqns(i,x,g,z), f)"
 apply (rule wf_exists_is_recfun [OF wf_Memrel trans_Memrel])
     apply (simp_all add: Memrel_type omult_strong_replacement') 
 apply (blast intro: the_omult_eqns_closed) 
 done
 
 lemma (in M_ord_arith) exists_omult_fun:
     "[| Ord(j);  M(i);  M(j) |] ==> \<exists>f[M]. is_omult_fun(M,i,succ(j),f)"
 apply (rule exists_omult [THEN rexE])
 apply (erule Ord_succ, assumption, simp) 
 apply (rename_tac f) 
 apply (frule is_recfun_type)
 apply (rule_tac x=f in rexI) 
 apply (simp add: fun_is_function domain_of_fun lt_Memrel apply_recfun lt_def
                  is_omult_fun_def Ord_trans [OF _ succI1])
  apply (force dest: Ord_in_Ord' 
               simp add: omult_eqns_def the_omult_eqns_0 the_omult_eqns_succ
                         the_omult_eqns_Limit, assumption)
 done
 
 lemma (in M_ord_arith) is_omult_fun_apply_0:
     "[| 0 < j; is_omult_fun(M,i,j,f) |] ==> f`0 = 0"
 by (simp add: is_omult_fun_def omult_eqns_def lt_def ball_conj_distrib)
 
 lemma (in M_ord_arith) is_omult_fun_apply_succ:
     "[| succ(x) < j; is_omult_fun(M,i,j,f) |] ==> f`succ(x) = f`x ++ i"
 by (simp add: is_omult_fun_def omult_eqns_def lt_def, blast) 
 
 lemma (in M_ord_arith) is_omult_fun_apply_Limit:
     "[| x < j; Limit(x); M(j); M(f); is_omult_fun(M,i,j,f) |] 
      ==> f ` x = (\<Union>y\<in>x. f`y)"
-apply (simp add: is_omult_fun_def omult_eqns_def domain_closed lt_def, clarify)
+apply (simp add: is_omult_fun_def omult_eqns_def lt_def, clarify)
 apply (drule subset_trans [OF OrdmemD], assumption+)  
 apply (simp add: ball_conj_distrib omult_Limit image_function)
 done
 
 lemma (in M_ord_arith) is_omult_fun_eq_omult:
     "[| is_omult_fun(M,i,J,f); M(J); M(f); Ord(i); Ord(j) |] 
      ==> j<J \<longrightarrow> f`j = i**j"
 apply (erule_tac i=j in trans_induct3)
 apply (safe del: impCE)
   apply (simp add: is_omult_fun_apply_0) 
  apply (subgoal_tac "x<J") 
   apply (simp add: is_omult_fun_apply_succ omult_succ)  
  apply (blast intro: lt_trans) 
 apply (subgoal_tac "\<forall>k\<in>x. k<J")
  apply (simp add: is_omult_fun_apply_Limit omult_Limit) 
 apply (blast intro: lt_trans ltI lt_Ord) 
 done
 
 lemma (in M_ord_arith) omult_abs:
     "[| M(i); M(j); M(k); Ord(i); Ord(j) |] ==> is_omult(M,i,j,k) \<longleftrightarrow> k = i**j"
 apply (simp add: is_omult_def is_omult_fun_eq_omult)
 apply (frule exists_omult_fun [of j i], blast+)
 done
 
 
 
 subsection \<open>Absoluteness of Well-Founded Relations\<close>
 
 text\<open>Relativized to \<^term>\<open>M\<close>: Every well-founded relation is a subset of some
 inverse image of an ordinal.  Key step is the construction (in \<^term>\<open>M\<close>) of a
 rank function.\<close>
 
 locale M_wfrank = M_trancl +
   assumes wfrank_separation:
      "M(r) ==>
       separation (M, \<lambda>x. 
          \<forall>rplus[M]. tran_closure(M,r,rplus) \<longrightarrow>
          ~ (\<exists>f[M]. M_is_recfun(M, %x f y. is_range(M,f,y), rplus, x, f)))"
  and wfrank_strong_replacement:
      "M(r) ==>
       strong_replacement(M, \<lambda>x z. 
          \<forall>rplus[M]. tran_closure(M,r,rplus) \<longrightarrow>
          (\<exists>y[M]. \<exists>f[M]. pair(M,x,y,z)  & 
                         M_is_recfun(M, %x f y. is_range(M,f,y), rplus, x, f) &
                         is_range(M,f,y)))"
  and Ord_wfrank_separation:
      "M(r) ==>
       separation (M, \<lambda>x.
          \<forall>rplus[M]. tran_closure(M,r,rplus) \<longrightarrow> 
           ~ (\<forall>f[M]. \<forall>rangef[M]. 
              is_range(M,f,rangef) \<longrightarrow>
              M_is_recfun(M, \<lambda>x f y. is_range(M,f,y), rplus, x, f) \<longrightarrow>
              ordinal(M,rangef)))" 
 
 
 text\<open>Proving that the relativized instances of Separation or Replacement
 agree with the "real" ones.\<close>
 
 lemma (in M_wfrank) wfrank_separation':
      "M(r) ==>
       separation
            (M, \<lambda>x. ~ (\<exists>f[M]. is_recfun(r^+, x, %x f. range(f), f)))"
 apply (insert wfrank_separation [of r])
 apply (simp add: relation2_def is_recfun_abs [of "%x. range"])
 done
 
 lemma (in M_wfrank) wfrank_strong_replacement':
      "M(r) ==>
       strong_replacement(M, \<lambda>x z. \<exists>y[M]. \<exists>f[M]. 
                   pair(M,x,y,z) & is_recfun(r^+, x, %x f. range(f), f) &
                   y = range(f))"
 apply (insert wfrank_strong_replacement [of r])
 apply (simp add: relation2_def is_recfun_abs [of "%x. range"])
 done
 
 lemma (in M_wfrank) Ord_wfrank_separation':
      "M(r) ==>
       separation (M, \<lambda>x. 
          ~ (\<forall>f[M]. is_recfun(r^+, x, \<lambda>x. range, f) \<longrightarrow> Ord(range(f))))" 
 apply (insert Ord_wfrank_separation [of r])
 apply (simp add: relation2_def is_recfun_abs [of "%x. range"])
 done
 
 text\<open>This function, defined using replacement, is a rank function for
 well-founded relations within the class M.\<close>
 definition
   wellfoundedrank :: "[i=>o,i,i] => i" where
     "wellfoundedrank(M,r,A) ==
         {p. x\<in>A, \<exists>y[M]. \<exists>f[M]. 
                        p = <x,y> & is_recfun(r^+, x, %x f. range(f), f) &
                        y = range(f)}"
 
 lemma (in M_wfrank) exists_wfrank:
     "[| wellfounded(M,r); M(a); M(r) |]
      ==> \<exists>f[M]. is_recfun(r^+, a, %x f. range(f), f)"
 apply (rule wellfounded_exists_is_recfun)
       apply (blast intro: wellfounded_trancl)
      apply (rule trans_trancl)
     apply (erule wfrank_separation')
    apply (erule wfrank_strong_replacement')
 apply (simp_all add: trancl_subset_times)
 done
 
 lemma (in M_wfrank) M_wellfoundedrank:
     "[| wellfounded(M,r); M(r); M(A) |] ==> M(wellfoundedrank(M,r,A))"
 apply (insert wfrank_strong_replacement' [of r])
 apply (simp add: wellfoundedrank_def)
 apply (rule strong_replacement_closed)
    apply assumption+
  apply (rule univalent_is_recfun)
    apply (blast intro: wellfounded_trancl)
   apply (rule trans_trancl)
  apply (simp add: trancl_subset_times) 
 apply (blast dest: transM) 
 done
 
 lemma (in M_wfrank) Ord_wfrank_range [rule_format]:
     "[| wellfounded(M,r); a\<in>A; M(r); M(A) |]
      ==> \<forall>f[M]. is_recfun(r^+, a, %x f. range(f), f) \<longrightarrow> Ord(range(f))"
 apply (drule wellfounded_trancl, assumption)
 apply (rule wellfounded_induct, assumption, erule (1) transM)
   apply simp
  apply (blast intro: Ord_wfrank_separation', clarify)
 txt\<open>The reasoning in both cases is that we get \<^term>\<open>y\<close> such that
    \<^term>\<open>\<langle>y, x\<rangle> \<in> r^+\<close>.  We find that
    \<^term>\<open>f`y = restrict(f, r^+ -`` {y})\<close>.\<close>
 apply (rule OrdI [OF _ Ord_is_Transset])
  txt\<open>An ordinal is a transitive set...\<close>
  apply (simp add: Transset_def)
  apply clarify
  apply (frule apply_recfun2, assumption)
  apply (force simp add: restrict_iff)
 txt\<open>...of ordinals.  This second case requires the induction hyp.\<close>
 apply clarify
 apply (rename_tac i y)
 apply (frule apply_recfun2, assumption)
 apply (frule is_recfun_imp_in_r, assumption)
 apply (frule is_recfun_restrict)
     (*simp_all won't work*)
     apply (simp add: trans_trancl trancl_subset_times)+
 apply (drule spec [THEN mp], assumption)
 apply (subgoal_tac "M(restrict(f, r^+ -`` {y}))")
  apply (drule_tac x="restrict(f, r^+ -`` {y})" in rspec)
 apply assumption
  apply (simp add: function_apply_equality [OF _ is_recfun_imp_function])
 apply (blast dest: pair_components_in_M)
 done
 
 lemma (in M_wfrank) Ord_range_wellfoundedrank:
     "[| wellfounded(M,r); r \<subseteq> A*A;  M(r); M(A) |]
      ==> Ord (range(wellfoundedrank(M,r,A)))"
 apply (frule wellfounded_trancl, assumption)
 apply (frule trancl_subset_times)
 apply (simp add: wellfoundedrank_def)
 apply (rule OrdI [OF _ Ord_is_Transset])
  prefer 2
  txt\<open>by our previous result the range consists of ordinals.\<close>
  apply (blast intro: Ord_wfrank_range)
 txt\<open>We still must show that the range is a transitive set.\<close>
 apply (simp add: Transset_def, clarify, simp)
 apply (rename_tac x i f u)
 apply (frule is_recfun_imp_in_r, assumption)
 apply (subgoal_tac "M(u) & M(i) & M(x)")
  prefer 2 apply (blast dest: transM, clarify)
 apply (rule_tac a=u in rangeI)
 apply (rule_tac x=u in ReplaceI)
   apply simp 
   apply (rule_tac x="restrict(f, r^+ -`` {u})" in rexI)
    apply (blast intro: is_recfun_restrict trans_trancl dest: apply_recfun2)
   apply simp 
 apply blast 
 txt\<open>Unicity requirement of Replacement\<close>
 apply clarify
 apply (frule apply_recfun2, assumption)
 apply (simp add: trans_trancl is_recfun_cut)
 done
 
 lemma (in M_wfrank) function_wellfoundedrank:
     "[| wellfounded(M,r); M(r); M(A)|]
      ==> function(wellfoundedrank(M,r,A))"
 apply (simp add: wellfoundedrank_def function_def, clarify)
 txt\<open>Uniqueness: repeated below!\<close>
 apply (drule is_recfun_functional, assumption)
      apply (blast intro: wellfounded_trancl)
     apply (simp_all add: trancl_subset_times trans_trancl)
 done
 
 lemma (in M_wfrank) domain_wellfoundedrank:
     "[| wellfounded(M,r); M(r); M(A)|]
      ==> domain(wellfoundedrank(M,r,A)) = A"
 apply (simp add: wellfoundedrank_def function_def)
 apply (rule equalityI, auto)
 apply (frule transM, assumption)
 apply (frule_tac a=x in exists_wfrank, assumption+, clarify)
 apply (rule_tac b="range(f)" in domainI)
 apply (rule_tac x=x in ReplaceI)
   apply simp 
   apply (rule_tac x=f in rexI, blast, simp_all)
 txt\<open>Uniqueness (for Replacement): repeated above!\<close>
 apply clarify
 apply (drule is_recfun_functional, assumption)
     apply (blast intro: wellfounded_trancl)
     apply (simp_all add: trancl_subset_times trans_trancl)
 done
 
 lemma (in M_wfrank) wellfoundedrank_type:
     "[| wellfounded(M,r);  M(r); M(A)|]
      ==> wellfoundedrank(M,r,A) \<in> A -> range(wellfoundedrank(M,r,A))"
 apply (frule function_wellfoundedrank [of r A], assumption+)
 apply (frule function_imp_Pi)
  apply (simp add: wellfoundedrank_def relation_def)
  apply blast
 apply (simp add: domain_wellfoundedrank)
 done
 
 lemma (in M_wfrank) Ord_wellfoundedrank:
     "[| wellfounded(M,r); a \<in> A; r \<subseteq> A*A;  M(r); M(A) |]
      ==> Ord(wellfoundedrank(M,r,A) ` a)"
 by (blast intro: apply_funtype [OF wellfoundedrank_type]
                  Ord_in_Ord [OF Ord_range_wellfoundedrank])
 
 lemma (in M_wfrank) wellfoundedrank_eq:
      "[| is_recfun(r^+, a, %x. range, f);
          wellfounded(M,r);  a \<in> A; M(f); M(r); M(A)|]
       ==> wellfoundedrank(M,r,A) ` a = range(f)"
 apply (rule apply_equality)
  prefer 2 apply (blast intro: wellfoundedrank_type)
 apply (simp add: wellfoundedrank_def)
 apply (rule ReplaceI)
   apply (rule_tac x="range(f)" in rexI) 
   apply blast
  apply simp_all
 txt\<open>Unicity requirement of Replacement\<close>
 apply clarify
 apply (drule is_recfun_functional, assumption)
     apply (blast intro: wellfounded_trancl)
     apply (simp_all add: trancl_subset_times trans_trancl)
 done
 
 
 lemma (in M_wfrank) wellfoundedrank_lt:
      "[| <a,b> \<in> r;
          wellfounded(M,r); r \<subseteq> A*A;  M(r); M(A)|]
       ==> wellfoundedrank(M,r,A) ` a < wellfoundedrank(M,r,A) ` b"
 apply (frule wellfounded_trancl, assumption)
 apply (subgoal_tac "a\<in>A & b\<in>A")
  prefer 2 apply blast
 apply (simp add: lt_def Ord_wellfoundedrank, clarify)
 apply (frule exists_wfrank [of concl: _ b], erule (1) transM, assumption)
 apply clarify
 apply (rename_tac fb)
 apply (frule is_recfun_restrict [of concl: "r^+" a])
     apply (rule trans_trancl, assumption)
    apply (simp_all add: r_into_trancl trancl_subset_times)
 txt\<open>Still the same goal, but with new \<open>is_recfun\<close> assumptions.\<close>
 apply (simp add: wellfoundedrank_eq)
 apply (frule_tac a=a in wellfoundedrank_eq, assumption+)
    apply (simp_all add: transM [of a])
 txt\<open>We have used equations for wellfoundedrank and now must use some
     for  \<open>is_recfun\<close>.\<close>
 apply (rule_tac a=a in rangeI)
 apply (simp add: is_recfun_type [THEN apply_iff] vimage_singleton_iff
-                 r_into_trancl apply_recfun r_into_trancl)
+                 r_into_trancl apply_recfun)
 done
 
 
 lemma (in M_wfrank) wellfounded_imp_subset_rvimage:
      "[|wellfounded(M,r); r \<subseteq> A*A; M(r); M(A)|]
       ==> \<exists>i f. Ord(i) & r \<subseteq> rvimage(A, f, Memrel(i))"
 apply (rule_tac x="range(wellfoundedrank(M,r,A))" in exI)
 apply (rule_tac x="wellfoundedrank(M,r,A)" in exI)
 apply (simp add: Ord_range_wellfoundedrank, clarify)
 apply (frule subsetD, assumption, clarify)
 apply (simp add: rvimage_iff wellfoundedrank_lt [THEN ltD])
 apply (blast intro: apply_rangeI wellfoundedrank_type)
 done
 
 lemma (in M_wfrank) wellfounded_imp_wf:
      "[|wellfounded(M,r); relation(r); M(r)|] ==> wf(r)"
 by (blast dest!: relation_field_times_field wellfounded_imp_subset_rvimage
           intro: wf_rvimage_Ord [THEN wf_subset])
 
 lemma (in M_wfrank) wellfounded_on_imp_wf_on:
      "[|wellfounded_on(M,A,r); relation(r); M(r); M(A)|] ==> wf[A](r)"
 apply (simp add: wellfounded_on_iff_wellfounded wf_on_def)
 apply (rule wellfounded_imp_wf)
 apply (simp_all add: relation_def)
 done
 
 
 theorem (in M_wfrank) wf_abs:
      "[|relation(r); M(r)|] ==> wellfounded(M,r) \<longleftrightarrow> wf(r)"
 by (blast intro: wellfounded_imp_wf wf_imp_relativized)
 
 theorem (in M_wfrank) wf_on_abs:
      "[|relation(r); M(r); M(A)|] ==> wellfounded_on(M,A,r) \<longleftrightarrow> wf[A](r)"
 by (blast intro: wellfounded_on_imp_wf_on wf_on_imp_relativized)
 
 end
diff --git a/src/ZF/Constructible/Rank_Separation.thy b/src/ZF/Constructible/Rank_Separation.thy
--- a/src/ZF/Constructible/Rank_Separation.thy
+++ b/src/ZF/Constructible/Rank_Separation.thy
@@ -1,246 +1,246 @@
 (*  Title:      ZF/Constructible/Rank_Separation.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Separation for Facts About Order Types, Rank Functions and 
       Well-Founded Relations\<close>
 
 theory Rank_Separation imports Rank Rec_Separation begin
 
 
 text\<open>This theory proves all instances needed for locales
  \<open>M_ordertype\<close> and  \<open>M_wfrank\<close>.  But the material is not
  needed for proving the relative consistency of AC.\<close>
 
 subsection\<open>The Locale \<open>M_ordertype\<close>\<close>
 
 subsubsection\<open>Separation for Order-Isomorphisms\<close>
 
 lemma well_ord_iso_Reflects:
   "REFLECTS[\<lambda>x. x\<in>A \<longrightarrow>
                 (\<exists>y[L]. \<exists>p[L]. fun_apply(L,f,x,y) & pair(L,y,x,p) & p \<in> r),
         \<lambda>i x. x\<in>A \<longrightarrow> (\<exists>y \<in> Lset(i). \<exists>p \<in> Lset(i).
                 fun_apply(##Lset(i),f,x,y) & pair(##Lset(i),y,x,p) & p \<in> r)]"
 by (intro FOL_reflections function_reflections)
 
 lemma well_ord_iso_separation:
      "[| L(A); L(f); L(r) |]
       ==> separation (L, \<lambda>x. x\<in>A \<longrightarrow> (\<exists>y[L]. (\<exists>p[L].
                      fun_apply(L,f,x,y) & pair(L,y,x,p) & p \<in> r)))"
 apply (rule gen_separation_multi [OF well_ord_iso_Reflects, of "{A,f,r}"], 
        auto)
 apply (rule_tac env="[A,f,r]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsubsection\<open>Separation for \<^term>\<open>obase\<close>\<close>
 
 lemma obase_reflects:
   "REFLECTS[\<lambda>a. \<exists>x[L]. \<exists>g[L]. \<exists>mx[L]. \<exists>par[L].
              ordinal(L,x) & membership(L,x,mx) & pred_set(L,A,a,r,par) &
              order_isomorphism(L,par,r,x,mx,g),
         \<lambda>i a. \<exists>x \<in> Lset(i). \<exists>g \<in> Lset(i). \<exists>mx \<in> Lset(i). \<exists>par \<in> Lset(i).
              ordinal(##Lset(i),x) & membership(##Lset(i),x,mx) & pred_set(##Lset(i),A,a,r,par) &
              order_isomorphism(##Lset(i),par,r,x,mx,g)]"
 by (intro FOL_reflections function_reflections fun_plus_reflections)
 
 lemma obase_separation:
      \<comment> \<open>part of the order type formalization\<close>
      "[| L(A); L(r) |]
       ==> separation(L, \<lambda>a. \<exists>x[L]. \<exists>g[L]. \<exists>mx[L]. \<exists>par[L].
              ordinal(L,x) & membership(L,x,mx) & pred_set(L,A,a,r,par) &
              order_isomorphism(L,par,r,x,mx,g))"
 apply (rule gen_separation_multi [OF obase_reflects, of "{A,r}"], auto)
 apply (rule_tac env="[A,r]" in DPow_LsetI)
 apply (rule ordinal_iff_sats sep_rules | simp)+
 done
 
 
 subsubsection\<open>Separation for a Theorem about \<^term>\<open>obase\<close>\<close>
 
 lemma obase_equals_reflects:
   "REFLECTS[\<lambda>x. x\<in>A \<longrightarrow> ~(\<exists>y[L]. \<exists>g[L].
                 ordinal(L,y) & (\<exists>my[L]. \<exists>pxr[L].
                 membership(L,y,my) & pred_set(L,A,x,r,pxr) &
                 order_isomorphism(L,pxr,r,y,my,g))),
         \<lambda>i x. x\<in>A \<longrightarrow> ~(\<exists>y \<in> Lset(i). \<exists>g \<in> Lset(i).
                 ordinal(##Lset(i),y) & (\<exists>my \<in> Lset(i). \<exists>pxr \<in> Lset(i).
                 membership(##Lset(i),y,my) & pred_set(##Lset(i),A,x,r,pxr) &
                 order_isomorphism(##Lset(i),pxr,r,y,my,g)))]"
 by (intro FOL_reflections function_reflections fun_plus_reflections)
 
 lemma obase_equals_separation:
      "[| L(A); L(r) |]
       ==> separation (L, \<lambda>x. x\<in>A \<longrightarrow> ~(\<exists>y[L]. \<exists>g[L].
                               ordinal(L,y) & (\<exists>my[L]. \<exists>pxr[L].
                               membership(L,y,my) & pred_set(L,A,x,r,pxr) &
                               order_isomorphism(L,pxr,r,y,my,g))))"
 apply (rule gen_separation_multi [OF obase_equals_reflects, of "{A,r}"], auto)
 apply (rule_tac env="[A,r]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsubsection\<open>Replacement for \<^term>\<open>omap\<close>\<close>
 
 lemma omap_reflects:
  "REFLECTS[\<lambda>z. \<exists>a[L]. a\<in>B & (\<exists>x[L]. \<exists>g[L]. \<exists>mx[L]. \<exists>par[L].
      ordinal(L,x) & pair(L,a,x,z) & membership(L,x,mx) &
      pred_set(L,A,a,r,par) & order_isomorphism(L,par,r,x,mx,g)),
  \<lambda>i z. \<exists>a \<in> Lset(i). a\<in>B & (\<exists>x \<in> Lset(i). \<exists>g \<in> Lset(i). \<exists>mx \<in> Lset(i).
         \<exists>par \<in> Lset(i).
          ordinal(##Lset(i),x) & pair(##Lset(i),a,x,z) &
          membership(##Lset(i),x,mx) & pred_set(##Lset(i),A,a,r,par) &
          order_isomorphism(##Lset(i),par,r,x,mx,g))]"
 by (intro FOL_reflections function_reflections fun_plus_reflections)
 
 lemma omap_replacement:
      "[| L(A); L(r) |]
       ==> strong_replacement(L,
              \<lambda>a z. \<exists>x[L]. \<exists>g[L]. \<exists>mx[L]. \<exists>par[L].
              ordinal(L,x) & pair(L,a,x,z) & membership(L,x,mx) &
              pred_set(L,A,a,r,par) & order_isomorphism(L,par,r,x,mx,g))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{A,r,B}" in gen_separation_multi [OF omap_reflects], auto)
 apply (rule_tac env="[A,B,r]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 
 subsection\<open>Instantiating the locale \<open>M_ordertype\<close>\<close>
 text\<open>Separation (and Strong Replacement) for basic set-theoretic constructions
 such as intersection, Cartesian Product and image.\<close>
 
 lemma M_ordertype_axioms_L: "M_ordertype_axioms(L)"
   apply (rule M_ordertype_axioms.intro)
        apply (assumption | rule well_ord_iso_separation
          obase_separation obase_equals_separation
          omap_replacement)+
   done
 
-theorem M_ordertype_L: "PROP M_ordertype(L)"
+theorem M_ordertype_L: "M_ordertype(L)"
   apply (rule M_ordertype.intro)
    apply (rule M_basic_L)
   apply (rule M_ordertype_axioms_L) 
   done
 
 
 subsection\<open>The Locale \<open>M_wfrank\<close>\<close>
 
 subsubsection\<open>Separation for \<^term>\<open>wfrank\<close>\<close>
 
 lemma wfrank_Reflects:
  "REFLECTS[\<lambda>x. \<forall>rplus[L]. tran_closure(L,r,rplus) \<longrightarrow>
               ~ (\<exists>f[L]. M_is_recfun(L, %x f y. is_range(L,f,y), rplus, x, f)),
       \<lambda>i x. \<forall>rplus \<in> Lset(i). tran_closure(##Lset(i),r,rplus) \<longrightarrow>
          ~ (\<exists>f \<in> Lset(i).
             M_is_recfun(##Lset(i), %x f y. is_range(##Lset(i),f,y),
                         rplus, x, f))]"
 by (intro FOL_reflections function_reflections is_recfun_reflection tran_closure_reflection)
 
 lemma wfrank_separation:
      "L(r) ==>
       separation (L, \<lambda>x. \<forall>rplus[L]. tran_closure(L,r,rplus) \<longrightarrow>
          ~ (\<exists>f[L]. M_is_recfun(L, %x f y. is_range(L,f,y), rplus, x, f)))"
 apply (rule gen_separation [OF wfrank_Reflects], simp)
 apply (rule_tac env="[r]" in DPow_LsetI)
 apply (rule sep_rules tran_closure_iff_sats is_recfun_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Replacement for \<^term>\<open>wfrank\<close>\<close>
 
 lemma wfrank_replacement_Reflects:
  "REFLECTS[\<lambda>z. \<exists>x[L]. x \<in> A &
         (\<forall>rplus[L]. tran_closure(L,r,rplus) \<longrightarrow>
          (\<exists>y[L]. \<exists>f[L]. pair(L,x,y,z)  &
                         M_is_recfun(L, %x f y. is_range(L,f,y), rplus, x, f) &
                         is_range(L,f,y))),
  \<lambda>i z. \<exists>x \<in> Lset(i). x \<in> A &
       (\<forall>rplus \<in> Lset(i). tran_closure(##Lset(i),r,rplus) \<longrightarrow>
        (\<exists>y \<in> Lset(i). \<exists>f \<in> Lset(i). pair(##Lset(i),x,y,z)  &
          M_is_recfun(##Lset(i), %x f y. is_range(##Lset(i),f,y), rplus, x, f) &
          is_range(##Lset(i),f,y)))]"
 by (intro FOL_reflections function_reflections fun_plus_reflections
              is_recfun_reflection tran_closure_reflection)
 
 lemma wfrank_strong_replacement:
      "L(r) ==>
       strong_replacement(L, \<lambda>x z.
          \<forall>rplus[L]. tran_closure(L,r,rplus) \<longrightarrow>
          (\<exists>y[L]. \<exists>f[L]. pair(L,x,y,z)  &
                         M_is_recfun(L, %x f y. is_range(L,f,y), rplus, x, f) &
                         is_range(L,f,y)))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{r,B}" 
          in gen_separation_multi [OF wfrank_replacement_Reflects], 
        auto)
 apply (rule_tac env="[r,B]" in DPow_LsetI)
 apply (rule sep_rules tran_closure_iff_sats is_recfun_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Separation for Proving \<open>Ord_wfrank_range\<close>\<close>
 
 lemma Ord_wfrank_Reflects:
  "REFLECTS[\<lambda>x. \<forall>rplus[L]. tran_closure(L,r,rplus) \<longrightarrow>
           ~ (\<forall>f[L]. \<forall>rangef[L].
              is_range(L,f,rangef) \<longrightarrow>
              M_is_recfun(L, \<lambda>x f y. is_range(L,f,y), rplus, x, f) \<longrightarrow>
              ordinal(L,rangef)),
       \<lambda>i x. \<forall>rplus \<in> Lset(i). tran_closure(##Lset(i),r,rplus) \<longrightarrow>
           ~ (\<forall>f \<in> Lset(i). \<forall>rangef \<in> Lset(i).
              is_range(##Lset(i),f,rangef) \<longrightarrow>
              M_is_recfun(##Lset(i), \<lambda>x f y. is_range(##Lset(i),f,y),
                          rplus, x, f) \<longrightarrow>
              ordinal(##Lset(i),rangef))]"
 by (intro FOL_reflections function_reflections is_recfun_reflection
           tran_closure_reflection ordinal_reflection)
 
 lemma  Ord_wfrank_separation:
      "L(r) ==>
       separation (L, \<lambda>x.
          \<forall>rplus[L]. tran_closure(L,r,rplus) \<longrightarrow>
           ~ (\<forall>f[L]. \<forall>rangef[L].
              is_range(L,f,rangef) \<longrightarrow>
              M_is_recfun(L, \<lambda>x f y. is_range(L,f,y), rplus, x, f) \<longrightarrow>
              ordinal(L,rangef)))"
 apply (rule gen_separation [OF Ord_wfrank_Reflects], simp)
 apply (rule_tac env="[r]" in DPow_LsetI)
 apply (rule sep_rules tran_closure_iff_sats is_recfun_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Instantiating the locale \<open>M_wfrank\<close>\<close>
 
 lemma M_wfrank_axioms_L: "M_wfrank_axioms(L)"
   apply (rule M_wfrank_axioms.intro)
    apply (assumption | rule
      wfrank_separation wfrank_strong_replacement Ord_wfrank_separation)+
   done
 
-theorem M_wfrank_L: "PROP M_wfrank(L)"
+theorem M_wfrank_L: "M_wfrank(L)"
   apply (rule M_wfrank.intro)
    apply (rule M_trancl_L)
   apply (rule M_wfrank_axioms_L) 
   done
 
 lemmas exists_wfrank = M_wfrank.exists_wfrank [OF M_wfrank_L]
   and M_wellfoundedrank = M_wfrank.M_wellfoundedrank [OF M_wfrank_L]
   and Ord_wfrank_range = M_wfrank.Ord_wfrank_range [OF M_wfrank_L]
   and Ord_range_wellfoundedrank = M_wfrank.Ord_range_wellfoundedrank [OF M_wfrank_L]
   and function_wellfoundedrank = M_wfrank.function_wellfoundedrank [OF M_wfrank_L]
   and domain_wellfoundedrank = M_wfrank.domain_wellfoundedrank [OF M_wfrank_L]
   and wellfoundedrank_type = M_wfrank.wellfoundedrank_type [OF M_wfrank_L]
   and Ord_wellfoundedrank = M_wfrank.Ord_wellfoundedrank [OF M_wfrank_L]
   and wellfoundedrank_eq = M_wfrank.wellfoundedrank_eq [OF M_wfrank_L]
   and wellfoundedrank_lt = M_wfrank.wellfoundedrank_lt [OF M_wfrank_L]
   and wellfounded_imp_subset_rvimage = M_wfrank.wellfounded_imp_subset_rvimage [OF M_wfrank_L]
   and wellfounded_imp_wf = M_wfrank.wellfounded_imp_wf [OF M_wfrank_L]
   and wellfounded_on_imp_wf_on = M_wfrank.wellfounded_on_imp_wf_on [OF M_wfrank_L]
   and wf_abs = M_wfrank.wf_abs [OF M_wfrank_L]
   and wf_on_abs = M_wfrank.wf_on_abs [OF M_wfrank_L]
 
 end
diff --git a/src/ZF/Constructible/Rec_Separation.thy b/src/ZF/Constructible/Rec_Separation.thy
--- a/src/ZF/Constructible/Rec_Separation.thy
+++ b/src/ZF/Constructible/Rec_Separation.thy
@@ -1,440 +1,440 @@
 (*  Title:      ZF/Constructible/Rec_Separation.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Separation for Facts About Recursion\<close>
 
 theory Rec_Separation imports Separation Internalize begin
 
 text\<open>This theory proves all instances needed for locales \<open>M_trancl\<close> and \<open>M_datatypes\<close>\<close>
 
 lemma eq_succ_imp_lt: "[|i = succ(j); Ord(i)|] ==> j<i"
 by simp
 
 
 subsection\<open>The Locale \<open>M_trancl\<close>\<close>
 
 subsubsection\<open>Separation for Reflexive/Transitive Closure\<close>
 
 text\<open>First, The Defining Formula\<close>
 
 (* "rtran_closure_mem(M,A,r,p) ==
       \<exists>nnat[M]. \<exists>n[M]. \<exists>n'[M].
        omega(M,nnat) & n\<in>nnat & successor(M,n,n') &
        (\<exists>f[M]. typed_function(M,n',A,f) &
         (\<exists>x[M]. \<exists>y[M]. \<exists>zero[M]. pair(M,x,y,p) & empty(M,zero) &
           fun_apply(M,f,zero,x) & fun_apply(M,f,n,y)) &
         (\<forall>j[M]. j\<in>n \<longrightarrow>
           (\<exists>fj[M]. \<exists>sj[M]. \<exists>fsj[M]. \<exists>ffp[M].
             fun_apply(M,f,j,fj) & successor(M,j,sj) &
             fun_apply(M,f,sj,fsj) & pair(M,fj,fsj,ffp) & ffp \<in> r)))"*)
 definition
   rtran_closure_mem_fm :: "[i,i,i]=>i" where
  "rtran_closure_mem_fm(A,r,p) ==
    Exists(Exists(Exists(
     And(omega_fm(2),
      And(Member(1,2),
       And(succ_fm(1,0),
        Exists(And(typed_function_fm(1, A#+4, 0),
         And(Exists(Exists(Exists(
               And(pair_fm(2,1,p#+7),
                And(empty_fm(0),
                 And(fun_apply_fm(3,0,2), fun_apply_fm(3,5,1))))))),
             Forall(Implies(Member(0,3),
              Exists(Exists(Exists(Exists(
               And(fun_apply_fm(5,4,3),
                And(succ_fm(4,2),
                 And(fun_apply_fm(5,2,1),
                  And(pair_fm(3,1,0), Member(0,r#+9))))))))))))))))))))"
 
 
 lemma rtran_closure_mem_type [TC]:
  "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> rtran_closure_mem_fm(x,y,z) \<in> formula"
 by (simp add: rtran_closure_mem_fm_def)
 
 lemma sats_rtran_closure_mem_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, rtran_closure_mem_fm(x,y,z), env) \<longleftrightarrow>
         rtran_closure_mem(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: rtran_closure_mem_fm_def rtran_closure_mem_def)
 
 lemma rtran_closure_mem_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> rtran_closure_mem(##A, x, y, z) \<longleftrightarrow> sats(A, rtran_closure_mem_fm(i,j,k), env)"
-by (simp add: sats_rtran_closure_mem_fm)
+by (simp)
 
 lemma rtran_closure_mem_reflection:
      "REFLECTS[\<lambda>x. rtran_closure_mem(L,f(x),g(x),h(x)),
                \<lambda>i x. rtran_closure_mem(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: rtran_closure_mem_def)
 apply (intro FOL_reflections function_reflections fun_plus_reflections)
 done
 
 text\<open>Separation for \<^term>\<open>rtrancl(r)\<close>.\<close>
 lemma rtrancl_separation:
      "[| L(r); L(A) |] ==> separation (L, rtran_closure_mem(L,A,r))"
 apply (rule gen_separation_multi [OF rtran_closure_mem_reflection, of "{r,A}"],
        auto)
 apply (rule_tac env="[r,A]" in DPow_LsetI)
 apply (rule rtran_closure_mem_iff_sats sep_rules | simp)+
 done
 
 
 subsubsection\<open>Reflexive/Transitive Closure, Internalized\<close>
 
 (*  "rtran_closure(M,r,s) ==
         \<forall>A[M]. is_field(M,r,A) \<longrightarrow>
          (\<forall>p[M]. p \<in> s \<longleftrightarrow> rtran_closure_mem(M,A,r,p))" *)
 definition
   rtran_closure_fm :: "[i,i]=>i" where
   "rtran_closure_fm(r,s) ==
    Forall(Implies(field_fm(succ(r),0),
                   Forall(Iff(Member(0,succ(succ(s))),
                              rtran_closure_mem_fm(1,succ(succ(r)),0)))))"
 
 lemma rtran_closure_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> rtran_closure_fm(x,y) \<in> formula"
 by (simp add: rtran_closure_fm_def)
 
 lemma sats_rtran_closure_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, rtran_closure_fm(x,y), env) \<longleftrightarrow>
         rtran_closure(##A, nth(x,env), nth(y,env))"
 by (simp add: rtran_closure_fm_def rtran_closure_def)
 
 lemma rtran_closure_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> rtran_closure(##A, x, y) \<longleftrightarrow> sats(A, rtran_closure_fm(i,j), env)"
 by simp
 
 theorem rtran_closure_reflection:
      "REFLECTS[\<lambda>x. rtran_closure(L,f(x),g(x)),
                \<lambda>i x. rtran_closure(##Lset(i),f(x),g(x))]"
 apply (simp only: rtran_closure_def)
 apply (intro FOL_reflections function_reflections rtran_closure_mem_reflection)
 done
 
 
 subsubsection\<open>Transitive Closure of a Relation, Internalized\<close>
 
 (*  "tran_closure(M,r,t) ==
          \<exists>s[M]. rtran_closure(M,r,s) & composition(M,r,s,t)" *)
 definition
   tran_closure_fm :: "[i,i]=>i" where
   "tran_closure_fm(r,s) ==
    Exists(And(rtran_closure_fm(succ(r),0), composition_fm(succ(r),0,succ(s))))"
 
 lemma tran_closure_type [TC]:
      "[| x \<in> nat; y \<in> nat |] ==> tran_closure_fm(x,y) \<in> formula"
 by (simp add: tran_closure_fm_def)
 
 lemma sats_tran_closure_fm [simp]:
    "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
     ==> sats(A, tran_closure_fm(x,y), env) \<longleftrightarrow>
         tran_closure(##A, nth(x,env), nth(y,env))"
 by (simp add: tran_closure_fm_def tran_closure_def)
 
 lemma tran_closure_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y;
           i \<in> nat; j \<in> nat; env \<in> list(A)|]
        ==> tran_closure(##A, x, y) \<longleftrightarrow> sats(A, tran_closure_fm(i,j), env)"
 by simp
 
 theorem tran_closure_reflection:
      "REFLECTS[\<lambda>x. tran_closure(L,f(x),g(x)),
                \<lambda>i x. tran_closure(##Lset(i),f(x),g(x))]"
 apply (simp only: tran_closure_def)
 apply (intro FOL_reflections function_reflections
              rtran_closure_reflection composition_reflection)
 done
 
 
 subsubsection\<open>Separation for the Proof of \<open>wellfounded_on_trancl\<close>\<close>
 
 lemma wellfounded_trancl_reflects:
   "REFLECTS[\<lambda>x. \<exists>w[L]. \<exists>wx[L]. \<exists>rp[L].
                  w \<in> Z & pair(L,w,x,wx) & tran_closure(L,r,rp) & wx \<in> rp,
    \<lambda>i x. \<exists>w \<in> Lset(i). \<exists>wx \<in> Lset(i). \<exists>rp \<in> Lset(i).
        w \<in> Z & pair(##Lset(i),w,x,wx) & tran_closure(##Lset(i),r,rp) &
        wx \<in> rp]"
 by (intro FOL_reflections function_reflections fun_plus_reflections
           tran_closure_reflection)
 
 lemma wellfounded_trancl_separation:
          "[| L(r); L(Z) |] ==>
           separation (L, \<lambda>x.
               \<exists>w[L]. \<exists>wx[L]. \<exists>rp[L].
                w \<in> Z & pair(L,w,x,wx) & tran_closure(L,r,rp) & wx \<in> rp)"
 apply (rule gen_separation_multi [OF wellfounded_trancl_reflects, of "{r,Z}"],
        auto)
 apply (rule_tac env="[r,Z]" in DPow_LsetI)
 apply (rule sep_rules tran_closure_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Instantiating the locale \<open>M_trancl\<close>\<close>
 
 lemma M_trancl_axioms_L: "M_trancl_axioms(L)"
   apply (rule M_trancl_axioms.intro)
-   apply (assumption | rule rtrancl_separation wellfounded_trancl_separation)+
+   apply (assumption | rule rtrancl_separation wellfounded_trancl_separation L_nat)+
   done
 
-theorem M_trancl_L: "PROP M_trancl(L)"
+theorem M_trancl_L: "M_trancl(L)"
 by (rule M_trancl.intro [OF M_basic_L M_trancl_axioms_L])
 
 interpretation L?: M_trancl L by (rule M_trancl_L)
 
 
 subsection\<open>\<^term>\<open>L\<close> is Closed Under the Operator \<^term>\<open>list\<close>\<close>
 
 subsubsection\<open>Instances of Replacement for Lists\<close>
 
 lemma list_replacement1_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B \<and> (\<exists>y[L]. pair(L,u,y,x) \<and>
          is_wfrec(L, iterates_MH(L, is_list_functor(L,A), 0), memsn, u, y)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and> (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) \<and>
          is_wfrec(##Lset(i),
                   iterates_MH(##Lset(i),
                           is_list_functor(##Lset(i), A), 0), memsn, u, y))]"
 by (intro FOL_reflections function_reflections is_wfrec_reflection
           iterates_MH_reflection list_functor_reflection)
 
 
 lemma list_replacement1:
    "L(A) ==> iterates_replacement(L, is_list_functor(L,A), 0)"
 apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,A,n,0,Memrel(succ(n))}" 
          in gen_separation_multi [OF list_replacement1_Reflects], 
-       auto simp add: nonempty)
+       auto)
 apply (rule_tac env="[B,A,n,0,Memrel(succ(n))]" in DPow_LsetI)
 apply (rule sep_rules is_nat_case_iff_sats list_functor_iff_sats
             is_wfrec_iff_sats iterates_MH_iff_sats quasinat_iff_sats | simp)+
 done
 
 
 lemma list_replacement2_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B & u \<in> nat &
                 is_iterates(L, is_list_functor(L, A), 0, u, x),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & u \<in> nat &
                is_iterates(##Lset(i), is_list_functor(##Lset(i), A), 0, u, x)]"
 by (intro FOL_reflections 
           is_iterates_reflection list_functor_reflection)
 
 lemma list_replacement2:
    "L(A) ==> strong_replacement(L,
          \<lambda>n y. n\<in>nat & is_iterates(L, is_list_functor(L,A), 0, n, y))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{A,B,0,nat}" 
          in gen_separation_multi [OF list_replacement2_Reflects], 
-       auto simp add: L_nat nonempty)
+       auto)
 apply (rule_tac env="[A,B,0,nat]" in DPow_LsetI)
 apply (rule sep_rules list_functor_iff_sats is_iterates_iff_sats | simp)+
 done
 
 
 subsection\<open>\<^term>\<open>L\<close> is Closed Under the Operator \<^term>\<open>formula\<close>\<close>
 
 subsubsection\<open>Instances of Replacement for Formulas\<close>
 
 (*FIXME: could prove a lemma iterates_replacementI to eliminate the 
 need to expand iterates_replacement and wfrec_replacement*)
 lemma formula_replacement1_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B & (\<exists>y[L]. pair(L,u,y,x) &
          is_wfrec(L, iterates_MH(L, is_formula_functor(L), 0), memsn, u, y)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) &
          is_wfrec(##Lset(i),
                   iterates_MH(##Lset(i),
                           is_formula_functor(##Lset(i)), 0), memsn, u, y))]"
 by (intro FOL_reflections function_reflections is_wfrec_reflection
           iterates_MH_reflection formula_functor_reflection)
 
 lemma formula_replacement1:
    "iterates_replacement(L, is_formula_functor(L), 0)"
 apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,n,0,Memrel(succ(n))}" 
          in gen_separation_multi [OF formula_replacement1_Reflects], 
-       auto simp add: nonempty)
+       auto)
 apply (rule_tac env="[n,B,0,Memrel(succ(n))]" in DPow_LsetI)
 apply (rule sep_rules is_nat_case_iff_sats formula_functor_iff_sats
             is_wfrec_iff_sats iterates_MH_iff_sats quasinat_iff_sats | simp)+
 done
 
 lemma formula_replacement2_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B & u \<in> nat &
                 is_iterates(L, is_formula_functor(L), 0, u, x),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & u \<in> nat &
                is_iterates(##Lset(i), is_formula_functor(##Lset(i)), 0, u, x)]"
 by (intro FOL_reflections 
           is_iterates_reflection formula_functor_reflection)
 
 lemma formula_replacement2:
    "strong_replacement(L,
          \<lambda>n y. n\<in>nat & is_iterates(L, is_formula_functor(L), 0, n, y))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,0,nat}" 
          in gen_separation_multi [OF formula_replacement2_Reflects], 
-       auto simp add: nonempty L_nat)
+       auto)
 apply (rule_tac env="[B,0,nat]" in DPow_LsetI)
 apply (rule sep_rules formula_functor_iff_sats is_iterates_iff_sats | simp)+
 done
 
 text\<open>NB The proofs for type \<^term>\<open>formula\<close> are virtually identical to those
 for \<^term>\<open>list(A)\<close>.  It was a cut-and-paste job!\<close>
 
 
 subsubsection\<open>The Formula \<^term>\<open>is_nth\<close>, Internalized\<close>
 
 (* "is_nth(M,n,l,Z) ==
       \<exists>X[M]. is_iterates(M, is_tl(M), l, n, X) & is_hd(M,X,Z)" *)
 definition
   nth_fm :: "[i,i,i]=>i" where
     "nth_fm(n,l,Z) == 
        Exists(And(is_iterates_fm(tl_fm(1,0), succ(l), succ(n), 0), 
               hd_fm(0,succ(Z))))"
 
 lemma nth_fm_type [TC]:
  "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> nth_fm(x,y,z) \<in> formula"
 by (simp add: nth_fm_def)
 
 lemma sats_nth_fm [simp]:
    "[| x < length(env); y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, nth_fm(x,y,z), env) \<longleftrightarrow>
         is_nth(##A, nth(x,env), nth(y,env), nth(z,env))"
 apply (frule lt_length_in_nat, assumption)  
 apply (simp add: nth_fm_def is_nth_def sats_is_iterates_fm) 
 done
 
 lemma nth_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
           i < length(env); j \<in> nat; k \<in> nat; env \<in> list(A)|]
        ==> is_nth(##A, x, y, z) \<longleftrightarrow> sats(A, nth_fm(i,j,k), env)"
-by (simp add: sats_nth_fm)
+by (simp)
 
 theorem nth_reflection:
      "REFLECTS[\<lambda>x. is_nth(L, f(x), g(x), h(x)),  
                \<lambda>i x. is_nth(##Lset(i), f(x), g(x), h(x))]"
 apply (simp only: is_nth_def)
 apply (intro FOL_reflections is_iterates_reflection
              hd_reflection tl_reflection) 
 done
 
 
 subsubsection\<open>An Instance of Replacement for \<^term>\<open>nth\<close>\<close>
 
 (*FIXME: could prove a lemma iterates_replacementI to eliminate the 
 need to expand iterates_replacement and wfrec_replacement*)
 lemma nth_replacement_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B & (\<exists>y[L]. pair(L,u,y,x) &
          is_wfrec(L, iterates_MH(L, is_tl(L), z), memsn, u, y)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) &
          is_wfrec(##Lset(i),
                   iterates_MH(##Lset(i),
                           is_tl(##Lset(i)), z), memsn, u, y))]"
 by (intro FOL_reflections function_reflections is_wfrec_reflection
           iterates_MH_reflection tl_reflection)
 
 lemma nth_replacement:
    "L(w) ==> iterates_replacement(L, is_tl(L), w)"
 apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,w,Memrel(succ(n))}" 
          in gen_separation_multi [OF nth_replacement_Reflects], 
        auto)
 apply (rule_tac env="[B,w,Memrel(succ(n))]" in DPow_LsetI)
 apply (rule sep_rules is_nat_case_iff_sats tl_iff_sats
             is_wfrec_iff_sats iterates_MH_iff_sats quasinat_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Instantiating the locale \<open>M_datatypes\<close>\<close>
 
 lemma M_datatypes_axioms_L: "M_datatypes_axioms(L)"
   apply (rule M_datatypes_axioms.intro)
       apply (assumption | rule
         list_replacement1 list_replacement2
         formula_replacement1 formula_replacement2
         nth_replacement)+
   done
 
-theorem M_datatypes_L: "PROP M_datatypes(L)"
+theorem M_datatypes_L: "M_datatypes(L)"
   apply (rule M_datatypes.intro)
    apply (rule M_trancl_L)
   apply (rule M_datatypes_axioms_L) 
   done
 
 interpretation L?: M_datatypes L by (rule M_datatypes_L)
 
 
 subsection\<open>\<^term>\<open>L\<close> is Closed Under the Operator \<^term>\<open>eclose\<close>\<close>
 
 subsubsection\<open>Instances of Replacement for \<^term>\<open>eclose\<close>\<close>
 
 lemma eclose_replacement1_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B & (\<exists>y[L]. pair(L,u,y,x) &
          is_wfrec(L, iterates_MH(L, big_union(L), A), memsn, u, y)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) &
          is_wfrec(##Lset(i),
                   iterates_MH(##Lset(i), big_union(##Lset(i)), A),
                   memsn, u, y))]"
 by (intro FOL_reflections function_reflections is_wfrec_reflection
           iterates_MH_reflection)
 
 lemma eclose_replacement1:
    "L(A) ==> iterates_replacement(L, big_union(L), A)"
 apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,A,n,Memrel(succ(n))}" 
          in gen_separation_multi [OF eclose_replacement1_Reflects], auto)
 apply (rule_tac env="[B,A,n,Memrel(succ(n))]" in DPow_LsetI)
 apply (rule sep_rules iterates_MH_iff_sats is_nat_case_iff_sats
              is_wfrec_iff_sats big_union_iff_sats quasinat_iff_sats | simp)+
 done
 
 
 lemma eclose_replacement2_Reflects:
  "REFLECTS
    [\<lambda>x. \<exists>u[L]. u \<in> B & u \<in> nat &
                 is_iterates(L, big_union(L), A, u, x),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & u \<in> nat &
                is_iterates(##Lset(i), big_union(##Lset(i)), A, u, x)]"
 by (intro FOL_reflections function_reflections is_iterates_reflection)
 
 lemma eclose_replacement2:
    "L(A) ==> strong_replacement(L,
          \<lambda>n y. n\<in>nat & is_iterates(L, big_union(L), A, n, y))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{A,B,nat}" 
          in gen_separation_multi [OF eclose_replacement2_Reflects],
-       auto simp add: L_nat)
+       auto)
 apply (rule_tac env="[A,B,nat]" in DPow_LsetI)
 apply (rule sep_rules is_iterates_iff_sats big_union_iff_sats | simp)+
 done
 
 
 subsubsection\<open>Instantiating the locale \<open>M_eclose\<close>\<close>
 
 lemma M_eclose_axioms_L: "M_eclose_axioms(L)"
   apply (rule M_eclose_axioms.intro)
    apply (assumption | rule eclose_replacement1 eclose_replacement2)+
   done
 
-theorem M_eclose_L: "PROP M_eclose(L)"
+theorem M_eclose_L: "M_eclose(L)"
   apply (rule M_eclose.intro)
    apply (rule M_datatypes_L)
   apply (rule M_eclose_axioms_L)
   done
 
 interpretation L?: M_eclose L by (rule M_eclose_L)
 
 
 end
diff --git a/src/ZF/Constructible/Reflection.thy b/src/ZF/Constructible/Reflection.thy
--- a/src/ZF/Constructible/Reflection.thy
+++ b/src/ZF/Constructible/Reflection.thy
@@ -1,361 +1,361 @@
 (*  Title:      ZF/Constructible/Reflection.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>The Reflection Theorem\<close>
 
 theory Reflection imports Normal begin
 
 lemma all_iff_not_ex_not: "(\<forall>x. P(x)) \<longleftrightarrow> (~ (\<exists>x. ~ P(x)))"
 by blast
 
 lemma ball_iff_not_bex_not: "(\<forall>x\<in>A. P(x)) \<longleftrightarrow> (~ (\<exists>x\<in>A. ~ P(x)))"
 by blast
 
 text\<open>From the notes of A. S. Kechris, page 6, and from
       Andrzej Mostowski, \emph{Constructible Sets with Applications},
       North-Holland, 1969, page 23.\<close>
 
 
 subsection\<open>Basic Definitions\<close>
 
 text\<open>First part: the cumulative hierarchy defining the class \<open>M\<close>.
 To avoid handling multiple arguments, we assume that \<open>Mset(l)\<close> is
 closed under ordered pairing provided \<open>l\<close> is limit.  Possibly this
 could be avoided: the induction hypothesis \<^term>\<open>Cl_reflects\<close>
 (in locale \<open>ex_reflection\<close>) could be weakened to
 \<^term>\<open>\<forall>y\<in>Mset(a). \<forall>z\<in>Mset(a). P(<y,z>) \<longleftrightarrow> Q(a,<y,z>)\<close>, removing most
 uses of \<^term>\<open>Pair_in_Mset\<close>.  But there isn't much point in doing so, since
 ultimately the \<open>ex_reflection\<close> proof is packaged up using the
 predicate \<open>Reflects\<close>.
 \<close>
 locale reflection =
   fixes Mset and M and Reflects
   assumes Mset_mono_le : "mono_le_subset(Mset)"
       and Mset_cont    : "cont_Ord(Mset)"
       and Pair_in_Mset : "[| x \<in> Mset(a); y \<in> Mset(a); Limit(a) |]
                           ==> <x,y> \<in> Mset(a)"
   defines "M(x) == \<exists>a. Ord(a) & x \<in> Mset(a)"
       and "Reflects(Cl,P,Q) == Closed_Unbounded(Cl) &
                               (\<forall>a. Cl(a) \<longrightarrow> (\<forall>x\<in>Mset(a). P(x) \<longleftrightarrow> Q(a,x)))"
   fixes F0 \<comment> \<open>ordinal for a specific value \<^term>\<open>y\<close>\<close>
   fixes FF \<comment> \<open>sup over the whole level, \<^term>\<open>y\<in>Mset(a)\<close>\<close>
   fixes ClEx \<comment> \<open>Reflecting ordinals for the formula \<^term>\<open>\<exists>z. P\<close>\<close>
   defines "F0(P,y) == \<mu> b. (\<exists>z. M(z) & P(<y,z>)) \<longrightarrow>
                                (\<exists>z\<in>Mset(b). P(<y,z>))"
       and "FF(P)   == \<lambda>a. \<Union>y\<in>Mset(a). F0(P,y)"
       and "ClEx(P,a) == Limit(a) & normalize(FF(P),a) = a"
 
 lemma (in reflection) Mset_mono: "i\<le>j ==> Mset(i) \<subseteq> Mset(j)"
 apply (insert Mset_mono_le)
 apply (simp add: mono_le_subset_def leI)
 done
 
 text\<open>Awkward: we need a version of \<open>ClEx_def\<close> as an equality
       at the level of classes, which do not really exist\<close>
 lemma (in reflection) ClEx_eq:
      "ClEx(P) == \<lambda>a. Limit(a) & normalize(FF(P),a) = a"
 by (simp add: ClEx_def [symmetric])
 
 
 subsection\<open>Easy Cases of the Reflection Theorem\<close>
 
 theorem (in reflection) Triv_reflection [intro]:
      "Reflects(Ord, P, \<lambda>a x. P(x))"
 by (simp add: Reflects_def)
 
 theorem (in reflection) Not_reflection [intro]:
      "Reflects(Cl,P,Q) ==> Reflects(Cl, \<lambda>x. ~P(x), \<lambda>a x. ~Q(a,x))"
 by (simp add: Reflects_def)
 
 theorem (in reflection) And_reflection [intro]:
      "[| Reflects(Cl,P,Q); Reflects(C',P',Q') |]
       ==> Reflects(\<lambda>a. Cl(a) & C'(a), \<lambda>x. P(x) & P'(x),
                                       \<lambda>a x. Q(a,x) & Q'(a,x))"
 by (simp add: Reflects_def Closed_Unbounded_Int, blast)
 
 theorem (in reflection) Or_reflection [intro]:
      "[| Reflects(Cl,P,Q); Reflects(C',P',Q') |]
       ==> Reflects(\<lambda>a. Cl(a) & C'(a), \<lambda>x. P(x) | P'(x),
                                       \<lambda>a x. Q(a,x) | Q'(a,x))"
 by (simp add: Reflects_def Closed_Unbounded_Int, blast)
 
 theorem (in reflection) Imp_reflection [intro]:
      "[| Reflects(Cl,P,Q); Reflects(C',P',Q') |]
       ==> Reflects(\<lambda>a. Cl(a) & C'(a),
                    \<lambda>x. P(x) \<longrightarrow> P'(x),
                    \<lambda>a x. Q(a,x) \<longrightarrow> Q'(a,x))"
 by (simp add: Reflects_def Closed_Unbounded_Int, blast)
 
 theorem (in reflection) Iff_reflection [intro]:
      "[| Reflects(Cl,P,Q); Reflects(C',P',Q') |]
       ==> Reflects(\<lambda>a. Cl(a) & C'(a),
                    \<lambda>x. P(x) \<longleftrightarrow> P'(x),
                    \<lambda>a x. Q(a,x) \<longleftrightarrow> Q'(a,x))"
 by (simp add: Reflects_def Closed_Unbounded_Int, blast)
 
 subsection\<open>Reflection for Existential Quantifiers\<close>
 
 lemma (in reflection) F0_works:
      "[| y\<in>Mset(a); Ord(a); M(z); P(<y,z>) |] ==> \<exists>z\<in>Mset(F0(P,y)). P(<y,z>)"
 apply (unfold F0_def M_def, clarify)
 apply (rule LeastI2)
   apply (blast intro: Mset_mono [THEN subsetD])
  apply (blast intro: lt_Ord2, blast)
 done
 
 lemma (in reflection) Ord_F0 [intro,simp]: "Ord(F0(P,y))"
 by (simp add: F0_def)
 
 lemma (in reflection) Ord_FF [intro,simp]: "Ord(FF(P,y))"
 by (simp add: FF_def)
 
 lemma (in reflection) cont_Ord_FF: "cont_Ord(FF(P))"
 apply (insert Mset_cont)
 apply (simp add: cont_Ord_def FF_def, blast)
 done
 
 text\<open>Recall that \<^term>\<open>F0\<close> depends upon \<^term>\<open>y\<in>Mset(a)\<close>,
 while \<^term>\<open>FF\<close> depends only upon \<^term>\<open>a\<close>.\<close>
 lemma (in reflection) FF_works:
      "[| M(z); y\<in>Mset(a); P(<y,z>); Ord(a) |] ==> \<exists>z\<in>Mset(FF(P,a)). P(<y,z>)"
 apply (simp add: FF_def)
 apply (simp_all add: cont_Ord_Union [of concl: Mset]
-                     Mset_cont Mset_mono_le not_emptyI Ord_F0)
+                     Mset_cont Mset_mono_le not_emptyI)
 apply (blast intro: F0_works)
 done
 
 lemma (in reflection) FFN_works:
      "[| M(z); y\<in>Mset(a); P(<y,z>); Ord(a) |]
       ==> \<exists>z\<in>Mset(normalize(FF(P),a)). P(<y,z>)"
 apply (drule FF_works [of concl: P], assumption+)
 apply (blast intro: cont_Ord_FF le_normalize [THEN Mset_mono, THEN subsetD])
 done
 
 
 text\<open>Locale for the induction hypothesis\<close>
 
 locale ex_reflection = reflection +
   fixes P  \<comment> \<open>the original formula\<close>
   fixes Q  \<comment> \<open>the reflected formula\<close>
   fixes Cl \<comment> \<open>the class of reflecting ordinals\<close>
   assumes Cl_reflects: "[| Cl(a); Ord(a) |] ==> \<forall>x\<in>Mset(a). P(x) \<longleftrightarrow> Q(a,x)"
 
 lemma (in ex_reflection) ClEx_downward:
      "[| M(z); y\<in>Mset(a); P(<y,z>); Cl(a); ClEx(P,a) |]
       ==> \<exists>z\<in>Mset(a). Q(a,<y,z>)"
 apply (simp add: ClEx_def, clarify)
 apply (frule Limit_is_Ord)
 apply (frule FFN_works [of concl: P], assumption+)
 apply (drule Cl_reflects, assumption+)
 apply (auto simp add: Limit_is_Ord Pair_in_Mset)
 done
 
 lemma (in ex_reflection) ClEx_upward:
      "[| z\<in>Mset(a); y\<in>Mset(a); Q(a,<y,z>); Cl(a); ClEx(P,a) |]
       ==> \<exists>z. M(z) & P(<y,z>)"
 apply (simp add: ClEx_def M_def)
 apply (blast dest: Cl_reflects
              intro: Limit_is_Ord Pair_in_Mset)
 done
 
 text\<open>Class \<open>ClEx\<close> indeed consists of reflecting ordinals...\<close>
 lemma (in ex_reflection) ZF_ClEx_iff:
      "[| y\<in>Mset(a); Cl(a); ClEx(P,a) |]
       ==> (\<exists>z. M(z) & P(<y,z>)) \<longleftrightarrow> (\<exists>z\<in>Mset(a). Q(a,<y,z>))"
 by (blast intro: dest: ClEx_downward ClEx_upward)
 
 text\<open>...and it is closed and unbounded\<close>
 lemma (in ex_reflection) ZF_Closed_Unbounded_ClEx:
      "Closed_Unbounded(ClEx(P))"
 apply (simp add: ClEx_eq)
 apply (fast intro: Closed_Unbounded_Int Normal_imp_fp_Closed_Unbounded
                    Closed_Unbounded_Limit Normal_normalize)
 done
 
 text\<open>The same two theorems, exported to locale \<open>reflection\<close>.\<close>
 
 text\<open>Class \<open>ClEx\<close> indeed consists of reflecting ordinals...\<close>
 lemma (in reflection) ClEx_iff:
      "[| y\<in>Mset(a); Cl(a); ClEx(P,a);
         !!a. [| Cl(a); Ord(a) |] ==> \<forall>x\<in>Mset(a). P(x) \<longleftrightarrow> Q(a,x) |]
       ==> (\<exists>z. M(z) & P(<y,z>)) \<longleftrightarrow> (\<exists>z\<in>Mset(a). Q(a,<y,z>))"
 apply (unfold ClEx_def FF_def F0_def M_def)
 apply (rule ex_reflection.ZF_ClEx_iff
   [OF ex_reflection.intro, OF reflection.intro ex_reflection_axioms.intro,
     of Mset Cl])
 apply (simp_all add: Mset_mono_le Mset_cont Pair_in_Mset)
 done
 
 (*Alternative proof, less unfolding:
 apply (rule Reflection.ZF_ClEx_iff [of Mset _ _ Cl, folded M_def])
 apply (fold ClEx_def FF_def F0_def)
 apply (rule ex_reflection.intro, assumption)
 apply (simp add: ex_reflection_axioms.intro, assumption+)
 *)
 
 lemma (in reflection) Closed_Unbounded_ClEx:
      "(!!a. [| Cl(a); Ord(a) |] ==> \<forall>x\<in>Mset(a). P(x) \<longleftrightarrow> Q(a,x))
       ==> Closed_Unbounded(ClEx(P))"
 apply (unfold ClEx_eq FF_def F0_def M_def)
 apply (rule ex_reflection.ZF_Closed_Unbounded_ClEx [of Mset _ _ Cl])
 apply (rule ex_reflection.intro, rule reflection_axioms)
 apply (blast intro: ex_reflection_axioms.intro)
 done
 
 subsection\<open>Packaging the Quantifier Reflection Rules\<close>
 
 lemma (in reflection) Ex_reflection_0:
      "Reflects(Cl,P0,Q0)
       ==> Reflects(\<lambda>a. Cl(a) & ClEx(P0,a),
                    \<lambda>x. \<exists>z. M(z) & P0(<x,z>),
                    \<lambda>a x. \<exists>z\<in>Mset(a). Q0(a,<x,z>))"
 apply (simp add: Reflects_def)
 apply (intro conjI Closed_Unbounded_Int)
   apply blast
  apply (rule Closed_Unbounded_ClEx [of Cl P0 Q0], blast, clarify)
 apply (rule_tac Cl=Cl in  ClEx_iff, assumption+, blast)
 done
 
 lemma (in reflection) All_reflection_0:
      "Reflects(Cl,P0,Q0)
       ==> Reflects(\<lambda>a. Cl(a) & ClEx(\<lambda>x.~P0(x), a),
                    \<lambda>x. \<forall>z. M(z) \<longrightarrow> P0(<x,z>),
                    \<lambda>a x. \<forall>z\<in>Mset(a). Q0(a,<x,z>))"
 apply (simp only: all_iff_not_ex_not ball_iff_not_bex_not)
 apply (rule Not_reflection, drule Not_reflection, simp)
 apply (erule Ex_reflection_0)
 done
 
 theorem (in reflection) Ex_reflection [intro]:
      "Reflects(Cl, \<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x)))
       ==> Reflects(\<lambda>a. Cl(a) & ClEx(\<lambda>x. P(fst(x),snd(x)), a),
                    \<lambda>x. \<exists>z. M(z) & P(x,z),
                    \<lambda>a x. \<exists>z\<in>Mset(a). Q(a,x,z))"
 by (rule Ex_reflection_0 [of _ " \<lambda>x. P(fst(x),snd(x))"
                                "\<lambda>a x. Q(a,fst(x),snd(x))", simplified])
 
 theorem (in reflection) All_reflection [intro]:
      "Reflects(Cl,  \<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x)))
       ==> Reflects(\<lambda>a. Cl(a) & ClEx(\<lambda>x. ~P(fst(x),snd(x)), a),
                    \<lambda>x. \<forall>z. M(z) \<longrightarrow> P(x,z),
                    \<lambda>a x. \<forall>z\<in>Mset(a). Q(a,x,z))"
 by (rule All_reflection_0 [of _ "\<lambda>x. P(fst(x),snd(x))"
                                 "\<lambda>a x. Q(a,fst(x),snd(x))", simplified])
 
 text\<open>And again, this time using class-bounded quantifiers\<close>
 
 theorem (in reflection) Rex_reflection [intro]:
      "Reflects(Cl, \<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x)))
       ==> Reflects(\<lambda>a. Cl(a) & ClEx(\<lambda>x. P(fst(x),snd(x)), a),
                    \<lambda>x. \<exists>z[M]. P(x,z),
                    \<lambda>a x. \<exists>z\<in>Mset(a). Q(a,x,z))"
 by (unfold rex_def, blast)
 
 theorem (in reflection) Rall_reflection [intro]:
      "Reflects(Cl,  \<lambda>x. P(fst(x),snd(x)), \<lambda>a x. Q(a,fst(x),snd(x)))
       ==> Reflects(\<lambda>a. Cl(a) & ClEx(\<lambda>x. ~P(fst(x),snd(x)), a),
                    \<lambda>x. \<forall>z[M]. P(x,z),
                    \<lambda>a x. \<forall>z\<in>Mset(a). Q(a,x,z))"
 by (unfold rall_def, blast)
 
 
 text\<open>No point considering bounded quantifiers, where reflection is trivial.\<close>
 
 
 subsection\<open>Simple Examples of Reflection\<close>
 
 text\<open>Example 1: reflecting a simple formula.  The reflecting class is first
 given as the variable \<open>?Cl\<close> and later retrieved from the final
 proof state.\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>x. \<exists>y. M(y) & x \<in> y,
                \<lambda>a x. \<exists>y\<in>Mset(a). x \<in> y)"
 by fast
 
 text\<open>Problem here: there needs to be a conjunction (class intersection)
 in the class of reflecting ordinals.  The \<^term>\<open>Ord(a)\<close> is redundant,
 though harmless.\<close>
 lemma (in reflection)
      "Reflects(\<lambda>a. Ord(a) & ClEx(\<lambda>x. fst(x) \<in> snd(x), a),
                \<lambda>x. \<exists>y. M(y) & x \<in> y,
                \<lambda>a x. \<exists>y\<in>Mset(a). x \<in> y)"
 by fast
 
 
 text\<open>Example 2\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>x. \<exists>y. M(y) & (\<forall>z. M(z) \<longrightarrow> z \<subseteq> x \<longrightarrow> z \<in> y),
                \<lambda>a x. \<exists>y\<in>Mset(a). \<forall>z\<in>Mset(a). z \<subseteq> x \<longrightarrow> z \<in> y)"
 by fast
 
 text\<open>Example 2'.  We give the reflecting class explicitly.\<close>
 lemma (in reflection)
   "Reflects
     (\<lambda>a. (Ord(a) &
           ClEx(\<lambda>x. ~ (snd(x) \<subseteq> fst(fst(x)) \<longrightarrow> snd(x) \<in> snd(fst(x))), a)) &
           ClEx(\<lambda>x. \<forall>z. M(z) \<longrightarrow> z \<subseteq> fst(x) \<longrightarrow> z \<in> snd(x), a),
             \<lambda>x. \<exists>y. M(y) & (\<forall>z. M(z) \<longrightarrow> z \<subseteq> x \<longrightarrow> z \<in> y),
             \<lambda>a x. \<exists>y\<in>Mset(a). \<forall>z\<in>Mset(a). z \<subseteq> x \<longrightarrow> z \<in> y)"
 by fast
 
 text\<open>Example 2''.  We expand the subset relation.\<close>
 schematic_goal (in reflection)
   "Reflects(?Cl,
         \<lambda>x. \<exists>y. M(y) & (\<forall>z. M(z) \<longrightarrow> (\<forall>w. M(w) \<longrightarrow> w\<in>z \<longrightarrow> w\<in>x) \<longrightarrow> z\<in>y),
         \<lambda>a x. \<exists>y\<in>Mset(a). \<forall>z\<in>Mset(a). (\<forall>w\<in>Mset(a). w\<in>z \<longrightarrow> w\<in>x) \<longrightarrow> z\<in>y)"
 by fast
 
 text\<open>Example 2'''.  Single-step version, to reveal the reflecting class.\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>x. \<exists>y. M(y) & (\<forall>z. M(z) \<longrightarrow> z \<subseteq> x \<longrightarrow> z \<in> y),
                \<lambda>a x. \<exists>y\<in>Mset(a). \<forall>z\<in>Mset(a). z \<subseteq> x \<longrightarrow> z \<in> y)"
 apply (rule Ex_reflection)
 txt\<open>
 @{goals[display,indent=0,margin=60]}
 \<close>
 apply (rule All_reflection)
 txt\<open>
 @{goals[display,indent=0,margin=60]}
 \<close>
 apply (rule Triv_reflection)
 txt\<open>
 @{goals[display,indent=0,margin=60]}
 \<close>
 done
 
 text\<open>Example 3.  Warning: the following examples make sense only
 if \<^term>\<open>P\<close> is quantifier-free, since it is not being relativized.\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>x. \<exists>y. M(y) & (\<forall>z. M(z) \<longrightarrow> z \<in> y \<longleftrightarrow> z \<in> x & P(z)),
                \<lambda>a x. \<exists>y\<in>Mset(a). \<forall>z\<in>Mset(a). z \<in> y \<longleftrightarrow> z \<in> x & P(z))"
 by fast
 
 text\<open>Example 3'\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>x. \<exists>y. M(y) & y = Collect(x,P),
                \<lambda>a x. \<exists>y\<in>Mset(a). y = Collect(x,P))"
 by fast
 
 text\<open>Example 3''\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>x. \<exists>y. M(y) & y = Replace(x,P),
                \<lambda>a x. \<exists>y\<in>Mset(a). y = Replace(x,P))"
 by fast
 
 text\<open>Example 4: Axiom of Choice.  Possibly wrong, since \<open>\<Pi>\<close> needs
 to be relativized.\<close>
 schematic_goal (in reflection)
      "Reflects(?Cl,
                \<lambda>A. 0\<notin>A \<longrightarrow> (\<exists>f. M(f) & f \<in> (\<Prod>X \<in> A. X)),
                \<lambda>a A. 0\<notin>A \<longrightarrow> (\<exists>f\<in>Mset(a). f \<in> (\<Prod>X \<in> A. X)))"
 by fast
 
 end
 
diff --git a/src/ZF/Constructible/Relative.thy b/src/ZF/Constructible/Relative.thy
--- a/src/ZF/Constructible/Relative.thy
+++ b/src/ZF/Constructible/Relative.thy
@@ -1,1613 +1,1671 @@
 (*  Title:      ZF/Constructible/Relative.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+                With modifications by E. Gunther, M. Pagano, 
+                and P. Sánchez Terraf
 *)
 
 section \<open>Relativization and Absoluteness\<close>
 
 theory Relative imports ZF begin
 
 subsection\<open>Relativized versions of standard set-theoretic concepts\<close>
 
 definition
   empty :: "[i=>o,i] => o" where
     "empty(M,z) == \<forall>x[M]. x \<notin> z"
 
 definition
   subset :: "[i=>o,i,i] => o" where
     "subset(M,A,B) == \<forall>x[M]. x\<in>A \<longrightarrow> x \<in> B"
 
 definition
   upair :: "[i=>o,i,i,i] => o" where
     "upair(M,a,b,z) == a \<in> z & b \<in> z & (\<forall>x[M]. x\<in>z \<longrightarrow> x = a | x = b)"
 
 definition
   pair :: "[i=>o,i,i,i] => o" where
     "pair(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) &
                      (\<exists>y[M]. upair(M,a,b,y) & upair(M,x,y,z))"
 
 
 definition
   union :: "[i=>o,i,i,i] => o" where
     "union(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a | x \<in> b"
 
 definition
   is_cons :: "[i=>o,i,i,i] => o" where
     "is_cons(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & union(M,x,b,z)"
 
 definition
   successor :: "[i=>o,i,i] => o" where
     "successor(M,a,z) == is_cons(M,a,a,z)"
 
 definition
   number1 :: "[i=>o,i] => o" where
     "number1(M,a) == \<exists>x[M]. empty(M,x) & successor(M,x,a)"
 
 definition
   number2 :: "[i=>o,i] => o" where
     "number2(M,a) == \<exists>x[M]. number1(M,x) & successor(M,x,a)"
 
 definition
   number3 :: "[i=>o,i] => o" where
     "number3(M,a) == \<exists>x[M]. number2(M,x) & successor(M,x,a)"
 
 definition
   powerset :: "[i=>o,i,i] => o" where
     "powerset(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> subset(M,x,A)"
 
 definition
   is_Collect :: "[i=>o,i,i=>o,i] => o" where
     "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> A & P(x)"
 
 definition
   is_Replace :: "[i=>o,i,[i,i]=>o,i] => o" where
     "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,u))"
 
 definition
   inter :: "[i=>o,i,i,i] => o" where
     "inter(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a & x \<in> b"
 
 definition
   setdiff :: "[i=>o,i,i,i] => o" where
     "setdiff(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a & x \<notin> b"
 
 definition
   big_union :: "[i=>o,i,i] => o" where
     "big_union(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y\<in>A & x \<in> y)"
 
 definition
   big_inter :: "[i=>o,i,i] => o" where
     "big_inter(M,A,z) ==
              (A=0 \<longrightarrow> z=0) &
              (A\<noteq>0 \<longrightarrow> (\<forall>x[M]. x \<in> z \<longleftrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow> x \<in> y)))"
 
 definition
   cartprod :: "[i=>o,i,i,i] => o" where
     "cartprod(M,A,B,z) ==
         \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))"
 
 definition
   is_sum :: "[i=>o,i,i,i] => o" where
     "is_sum(M,A,B,Z) ==
        \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M].
        number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
        cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"
 
 definition
   is_Inl :: "[i=>o,i,i] => o" where
     "is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z)"
 
 definition
   is_Inr :: "[i=>o,i,i] => o" where
     "is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z)"
 
 definition
   is_converse :: "[i=>o,i,i] => o" where
     "is_converse(M,r,z) ==
         \<forall>x[M]. x \<in> z \<longleftrightarrow>
              (\<exists>w[M]. w\<in>r & (\<exists>u[M]. \<exists>v[M]. pair(M,u,v,w) & pair(M,v,u,x)))"
 
 definition
   pre_image :: "[i=>o,i,i,i] => o" where
     "pre_image(M,r,A,z) ==
         \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))"
 
 definition
   is_domain :: "[i=>o,i,i] => o" where
     "is_domain(M,r,z) ==
         \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w)))"
 
 definition
   image :: "[i=>o,i,i,i] => o" where
     "image(M,r,A,z) ==
         \<forall>y[M]. y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w)))"
 
 definition
   is_range :: "[i=>o,i,i] => o" where
     \<comment> \<open>the cleaner
       \<^term>\<open>\<exists>r'[M]. is_converse(M,r,r') & is_domain(M,r',z)\<close>
       unfortunately needs an instance of separation in order to prove
         \<^term>\<open>M(converse(r))\<close>.\<close>
     "is_range(M,r,z) ==
         \<forall>y[M]. y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w)))"
 
 definition
   is_field :: "[i=>o,i,i] => o" where
     "is_field(M,r,z) ==
         \<exists>dr[M]. \<exists>rr[M]. is_domain(M,r,dr) & is_range(M,r,rr) &
                         union(M,dr,rr,z)"
 
 definition
   is_relation :: "[i=>o,i] => o" where
     "is_relation(M,r) ==
         (\<forall>z[M]. z\<in>r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))"
 
 definition
   is_function :: "[i=>o,i] => o" where
     "is_function(M,r) ==
         \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
            pair(M,x,y,p) \<longrightarrow> pair(M,x,y',p') \<longrightarrow> p\<in>r \<longrightarrow> p'\<in>r \<longrightarrow> y=y'"
 
 definition
   fun_apply :: "[i=>o,i,i,i] => o" where
     "fun_apply(M,f,x,y) ==
         (\<exists>xs[M]. \<exists>fxs[M].
          upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))"
 
 definition
   typed_function :: "[i=>o,i,i,i] => o" where
     "typed_function(M,A,B,r) ==
         is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
         (\<forall>u[M]. u\<in>r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) \<longrightarrow> y\<in>B))"
 
 definition
   is_funspace :: "[i=>o,i,i,i] => o" where
     "is_funspace(M,A,B,F) ==
         \<forall>f[M]. f \<in> F \<longleftrightarrow> typed_function(M,A,B,f)"
 
 definition
   composition :: "[i=>o,i,i,i] => o" where
     "composition(M,r,s,t) ==
         \<forall>p[M]. p \<in> t \<longleftrightarrow>
                (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
                 pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) &
                 xy \<in> s & yz \<in> r)"
 
 definition
   injection :: "[i=>o,i,i,i] => o" where
     "injection(M,A,B,f) ==
         typed_function(M,A,B,f) &
         (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M].
           pair(M,x,y,p) \<longrightarrow> pair(M,x',y,p') \<longrightarrow> p\<in>f \<longrightarrow> p'\<in>f \<longrightarrow> x=x')"
 
 definition
   surjection :: "[i=>o,i,i,i] => o" where
     "surjection(M,A,B,f) ==
         typed_function(M,A,B,f) &
         (\<forall>y[M]. y\<in>B \<longrightarrow> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))"
 
 definition
   bijection :: "[i=>o,i,i,i] => o" where
     "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)"
 
 definition
   restriction :: "[i=>o,i,i,i] => o" where
     "restriction(M,r,A,z) ==
         \<forall>x[M]. x \<in> z \<longleftrightarrow> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))"
 
 definition
   transitive_set :: "[i=>o,i] => o" where
     "transitive_set(M,a) == \<forall>x[M]. x\<in>a \<longrightarrow> subset(M,x,a)"
 
 definition
   ordinal :: "[i=>o,i] => o" where
      \<comment> \<open>an ordinal is a transitive set of transitive sets\<close>
     "ordinal(M,a) == transitive_set(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> transitive_set(M,x))"
 
 definition
   limit_ordinal :: "[i=>o,i] => o" where
     \<comment> \<open>a limit ordinal is a non-empty, successor-closed ordinal\<close>
     "limit_ordinal(M,a) ==
         ordinal(M,a) & ~ empty(M,a) &
         (\<forall>x[M]. x\<in>a \<longrightarrow> (\<exists>y[M]. y\<in>a & successor(M,x,y)))"
 
 definition
   successor_ordinal :: "[i=>o,i] => o" where
     \<comment> \<open>a successor ordinal is any ordinal that is neither empty nor limit\<close>
     "successor_ordinal(M,a) ==
         ordinal(M,a) & ~ empty(M,a) & ~ limit_ordinal(M,a)"
 
 definition
   finite_ordinal :: "[i=>o,i] => o" where
     \<comment> \<open>an ordinal is finite if neither it nor any of its elements are limit\<close>
     "finite_ordinal(M,a) ==
         ordinal(M,a) & ~ limit_ordinal(M,a) &
         (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))"
 
 definition
   omega :: "[i=>o,i] => o" where
     \<comment> \<open>omega is a limit ordinal none of whose elements are limit\<close>
     "omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))"
 
 definition
   is_quasinat :: "[i=>o,i] => o" where
     "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))"
 
 definition
   is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o" where
     "is_nat_case(M, a, is_b, k, z) ==
        (empty(M,k) \<longrightarrow> z=a) &
        (\<forall>m[M]. successor(M,m,k) \<longrightarrow> is_b(m,z)) &
        (is_quasinat(M,k) | empty(M,z))"
 
 definition
   relation1 :: "[i=>o, [i,i]=>o, i=>i] => o" where
     "relation1(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. is_f(x,y) \<longleftrightarrow> y = f(x)"
 
 definition
   Relation1 :: "[i=>o, i, [i,i]=>o, i=>i] => o" where
     \<comment> \<open>as above, but typed\<close>
     "Relation1(M,A,is_f,f) ==
         \<forall>x[M]. \<forall>y[M]. x\<in>A \<longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)"
 
 definition
   relation2 :: "[i=>o, [i,i,i]=>o, [i,i]=>i] => o" where
     "relation2(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. is_f(x,y,z) \<longleftrightarrow> z = f(x,y)"
 
 definition
   Relation2 :: "[i=>o, i, i, [i,i,i]=>o, [i,i]=>i] => o" where
     "Relation2(M,A,B,is_f,f) ==
         \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. x\<in>A \<longrightarrow> y\<in>B \<longrightarrow> is_f(x,y,z) \<longleftrightarrow> z = f(x,y)"
 
 definition
   relation3 :: "[i=>o, [i,i,i,i]=>o, [i,i,i]=>i] => o" where
     "relation3(M,is_f,f) ==
        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. is_f(x,y,z,u) \<longleftrightarrow> u = f(x,y,z)"
 
 definition
   Relation3 :: "[i=>o, i, i, i, [i,i,i,i]=>o, [i,i,i]=>i] => o" where
     "Relation3(M,A,B,C,is_f,f) ==
        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M].
          x\<in>A \<longrightarrow> y\<in>B \<longrightarrow> z\<in>C \<longrightarrow> is_f(x,y,z,u) \<longleftrightarrow> u = f(x,y,z)"
 
 definition
   relation4 :: "[i=>o, [i,i,i,i,i]=>o, [i,i,i,i]=>i] => o" where
     "relation4(M,is_f,f) ==
        \<forall>u[M]. \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>a[M]. is_f(u,x,y,z,a) \<longleftrightarrow> a = f(u,x,y,z)"
 
 
 text\<open>Useful when absoluteness reasoning has replaced the predicates by terms\<close>
 lemma triv_Relation1:
      "Relation1(M, A, \<lambda>x y. y = f(x), f)"
 by (simp add: Relation1_def)
 
 lemma triv_Relation2:
      "Relation2(M, A, B, \<lambda>x y a. a = f(x,y), f)"
 by (simp add: Relation2_def)
 
 
 subsection \<open>The relativized ZF axioms\<close>
 
 definition
   extensionality :: "(i=>o) => o" where
     "extensionality(M) ==
         \<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x \<longleftrightarrow> z \<in> y) \<longrightarrow> x=y"
 
 definition
   separation :: "[i=>o, i=>o] => o" where
     \<comment> \<open>The formula \<open>P\<close> should only involve parameters
         belonging to \<open>M\<close> and all its quantifiers must be relativized
         to \<open>M\<close>.  We do not have separation as a scheme; every instance
         that we need must be assumed (and later proved) separately.\<close>
     "separation(M,P) ==
         \<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z & P(x)"
 
 definition
   upair_ax :: "(i=>o) => o" where
     "upair_ax(M) == \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M,x,y,z)"
 
 definition
   Union_ax :: "(i=>o) => o" where
     "Union_ax(M) == \<forall>x[M]. \<exists>z[M]. big_union(M,x,z)"
 
 definition
   power_ax :: "(i=>o) => o" where
     "power_ax(M) == \<forall>x[M]. \<exists>z[M]. powerset(M,x,z)"
 
 definition
   univalent :: "[i=>o, i, [i,i]=>o] => o" where
     "univalent(M,A,P) ==
         \<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. \<forall>z[M]. P(x,y) & P(x,z) \<longrightarrow> y=z)"
 
 definition
   replacement :: "[i=>o, [i,i]=>o] => o" where
     "replacement(M,P) ==
       \<forall>A[M]. univalent(M,A,P) \<longrightarrow>
       (\<exists>Y[M]. \<forall>b[M]. (\<exists>x[M]. x\<in>A & P(x,b)) \<longrightarrow> b \<in> Y)"
 
 definition
   strong_replacement :: "[i=>o, [i,i]=>o] => o" where
     "strong_replacement(M,P) ==
       \<forall>A[M]. univalent(M,A,P) \<longrightarrow>
       (\<exists>Y[M]. \<forall>b[M]. b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,b)))"
 
 definition
   foundation_ax :: "(i=>o) => o" where
     "foundation_ax(M) ==
         \<forall>x[M]. (\<exists>y[M]. y\<in>x) \<longrightarrow> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & z \<in> y))"
 
 
 subsection\<open>A trivial consistency proof for $V_\omega$\<close>
 
 text\<open>We prove that $V_\omega$
       (or \<open>univ\<close> in Isabelle) satisfies some ZF axioms.
      Kunen, Theorem IV 3.13, page 123.\<close>
 
 lemma univ0_downwards_mem: "[| y \<in> x; x \<in> univ(0) |] ==> y \<in> univ(0)"
 apply (insert Transset_univ [OF Transset_0])
 apply (simp add: Transset_def, blast)
 done
 
 lemma univ0_Ball_abs [simp]:
      "A \<in> univ(0) ==> (\<forall>x\<in>A. x \<in> univ(0) \<longrightarrow> P(x)) \<longleftrightarrow> (\<forall>x\<in>A. P(x))"
 by (blast intro: univ0_downwards_mem)
 
 lemma univ0_Bex_abs [simp]:
      "A \<in> univ(0) ==> (\<exists>x\<in>A. x \<in> univ(0) & P(x)) \<longleftrightarrow> (\<exists>x\<in>A. P(x))"
 by (blast intro: univ0_downwards_mem)
 
 text\<open>Congruence rule for separation: can assume the variable is in \<open>M\<close>\<close>
 lemma separation_cong [cong]:
      "(!!x. M(x) ==> P(x) \<longleftrightarrow> P'(x))
       ==> separation(M, %x. P(x)) \<longleftrightarrow> separation(M, %x. P'(x))"
 by (simp add: separation_def)
 
 lemma univalent_cong [cong]:
      "[| A=A'; !!x y. [| x\<in>A; M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y) |]
       ==> univalent(M, A, %x y. P(x,y)) \<longleftrightarrow> univalent(M, A', %x y. P'(x,y))"
 by (simp add: univalent_def)
 
 lemma univalent_triv [intro,simp]:
      "univalent(M, A, \<lambda>x y. y = f(x))"
 by (simp add: univalent_def)
 
 lemma univalent_conjI2 [intro,simp]:
      "univalent(M,A,Q) ==> univalent(M, A, \<lambda>x y. P(x,y) & Q(x,y))"
 by (simp add: univalent_def, blast)
 
 text\<open>Congruence rule for replacement\<close>
 lemma strong_replacement_cong [cong]:
      "[| !!x y. [| M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y) |]
       ==> strong_replacement(M, %x y. P(x,y)) \<longleftrightarrow>
           strong_replacement(M, %x y. P'(x,y))"
 by (simp add: strong_replacement_def)
 
 text\<open>The extensionality axiom\<close>
 lemma "extensionality(\<lambda>x. x \<in> univ(0))"
 apply (simp add: extensionality_def)
 apply (blast intro: univ0_downwards_mem)
 done
 
 text\<open>The separation axiom requires some lemmas\<close>
 lemma Collect_in_Vfrom:
      "[| X \<in> Vfrom(A,j);  Transset(A) |] ==> Collect(X,P) \<in> Vfrom(A, succ(j))"
 apply (drule Transset_Vfrom)
 apply (rule subset_mem_Vfrom)
 apply (unfold Transset_def, blast)
 done
 
 lemma Collect_in_VLimit:
      "[| X \<in> Vfrom(A,i);  Limit(i);  Transset(A) |]
       ==> Collect(X,P) \<in> Vfrom(A,i)"
 apply (rule Limit_VfromE, assumption+)
 apply (blast intro: Limit_has_succ VfromI Collect_in_Vfrom)
 done
 
 lemma Collect_in_univ:
      "[| X \<in> univ(A);  Transset(A) |] ==> Collect(X,P) \<in> univ(A)"
-by (simp add: univ_def Collect_in_VLimit Limit_nat)
+by (simp add: univ_def Collect_in_VLimit)
 
 lemma "separation(\<lambda>x. x \<in> univ(0), P)"
 apply (simp add: separation_def, clarify)
 apply (rule_tac x = "Collect(z,P)" in bexI)
 apply (blast intro: Collect_in_univ Transset_0)+
 done
 
 text\<open>Unordered pairing axiom\<close>
 lemma "upair_ax(\<lambda>x. x \<in> univ(0))"
 apply (simp add: upair_ax_def upair_def)
 apply (blast intro: doubleton_in_univ)
 done
 
 text\<open>Union axiom\<close>
 lemma "Union_ax(\<lambda>x. x \<in> univ(0))"
 apply (simp add: Union_ax_def big_union_def, clarify)
 apply (rule_tac x="\<Union>x" in bexI)
  apply (blast intro: univ0_downwards_mem)
 apply (blast intro: Union_in_univ Transset_0)
 done
 
 text\<open>Powerset axiom\<close>
 
 lemma Pow_in_univ:
      "[| X \<in> univ(A);  Transset(A) |] ==> Pow(X) \<in> univ(A)"
-apply (simp add: univ_def Pow_in_VLimit Limit_nat)
+apply (simp add: univ_def Pow_in_VLimit)
 done
 
 lemma "power_ax(\<lambda>x. x \<in> univ(0))"
 apply (simp add: power_ax_def powerset_def subset_def, clarify)
 apply (rule_tac x="Pow(x)" in bexI)
  apply (blast intro: univ0_downwards_mem)
 apply (blast intro: Pow_in_univ Transset_0)
 done
 
 text\<open>Foundation axiom\<close>
 lemma "foundation_ax(\<lambda>x. x \<in> univ(0))"
 apply (simp add: foundation_ax_def, clarify)
 apply (cut_tac A=x in foundation)
 apply (blast intro: univ0_downwards_mem)
 done
 
 lemma "replacement(\<lambda>x. x \<in> univ(0), P)"
 apply (simp add: replacement_def, clarify)
 oops
 text\<open>no idea: maybe prove by induction on the rank of A?\<close>
 
 text\<open>Still missing: Replacement, Choice\<close>
 
 subsection\<open>Lemmas Needed to Reduce Some Set Constructions to Instances
       of Separation\<close>
 
 lemma image_iff_Collect: "r `` A = {y \<in> \<Union>(\<Union>(r)). \<exists>p\<in>r. \<exists>x\<in>A. p=<x,y>}"
 apply (rule equalityI, auto)
 apply (simp add: Pair_def, blast)
 done
 
 lemma vimage_iff_Collect:
      "r -`` A = {x \<in> \<Union>(\<Union>(r)). \<exists>p\<in>r. \<exists>y\<in>A. p=<x,y>}"
 apply (rule equalityI, auto)
 apply (simp add: Pair_def, blast)
 done
 
 text\<open>These two lemmas lets us prove \<open>domain_closed\<close> and
       \<open>range_closed\<close> without new instances of separation\<close>
 
 lemma domain_eq_vimage: "domain(r) = r -`` Union(Union(r))"
 apply (rule equalityI, auto)
 apply (rule vimageI, assumption)
 apply (simp add: Pair_def, blast)
 done
 
 lemma range_eq_image: "range(r) = r `` Union(Union(r))"
 apply (rule equalityI, auto)
 apply (rule imageI, assumption)
 apply (simp add: Pair_def, blast)
 done
 
 lemma replacementD:
     "[| replacement(M,P); M(A);  univalent(M,A,P) |]
      ==> \<exists>Y[M]. (\<forall>b[M]. ((\<exists>x[M]. x\<in>A & P(x,b)) \<longrightarrow> b \<in> Y))"
 by (simp add: replacement_def)
 
 lemma strong_replacementD:
     "[| strong_replacement(M,P); M(A);  univalent(M,A,P) |]
      ==> \<exists>Y[M]. (\<forall>b[M]. (b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,b))))"
 by (simp add: strong_replacement_def)
 
 lemma separationD:
     "[| separation(M,P); M(z) |] ==> \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z & P(x)"
 by (simp add: separation_def)
 
 
 text\<open>More constants, for order types\<close>
 
 definition
   order_isomorphism :: "[i=>o,i,i,i,i,i] => o" where
     "order_isomorphism(M,A,r,B,s,f) ==
         bijection(M,A,B,f) &
         (\<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow>
           (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
             pair(M,x,y,p) \<longrightarrow> fun_apply(M,f,x,fx) \<longrightarrow> fun_apply(M,f,y,fy) \<longrightarrow>
             pair(M,fx,fy,q) \<longrightarrow> (p\<in>r \<longleftrightarrow> q\<in>s))))"
 
 definition
   pred_set :: "[i=>o,i,i,i,i] => o" where
     "pred_set(M,A,x,r,B) ==
         \<forall>y[M]. y \<in> B \<longleftrightarrow> (\<exists>p[M]. p\<in>r & y \<in> A & pair(M,y,x,p))"
 
 definition
   membership :: "[i=>o,i,i] => o" where \<comment> \<open>membership relation\<close>
     "membership(M,A,r) ==
         \<forall>p[M]. p \<in> r \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>A & x\<in>y & pair(M,x,y,p)))"
 
 
 subsection\<open>Introducing a Transitive Class Model\<close>
 
+text\<open>The class M is assumed to be transitive and inhabited\<close>
+locale M_trans =
+  fixes M
+  assumes transM:   "[| y\<in>x; M(x) |] ==> M(y)"
+    and M_inhabited: "\<exists>x . M(x)"
+
+lemma (in M_trans) nonempty [simp]:  "M(0)"
+proof -
+  have "M(x) \<longrightarrow> M(0)" for x
+  proof (rule_tac P="\<lambda>w. M(w) \<longrightarrow> M(0)" in eps_induct)
+    {
+    fix x
+    assume "\<forall>y\<in>x. M(y) \<longrightarrow> M(0)" "M(x)"
+    consider (a) "\<exists>y. y\<in>x" | (b) "x=0" by auto
+    then 
+    have "M(x) \<longrightarrow> M(0)" 
+    proof cases
+      case a
+      then show ?thesis using \<open>\<forall>y\<in>x._\<close> \<open>M(x)\<close> transM by auto
+    next
+      case b
+      then show ?thesis by simp
+    qed
+  }
+  then show "M(x) \<longrightarrow> M(0)" if "\<forall>y\<in>x. M(y) \<longrightarrow> M(0)" for x
+    using that by auto
+  qed
+  with M_inhabited
+  show "M(0)" using M_inhabited by blast
+qed
+
 text\<open>The class M is assumed to be transitive and to satisfy some
       relativized ZF axioms\<close>
-locale M_trivial =
-  fixes M
-  assumes transM:           "[| y\<in>x; M(x) |] ==> M(y)"
-      and upair_ax:         "upair_ax(M)"
+locale M_trivial = M_trans +
+  assumes upair_ax:         "upair_ax(M)"
       and Union_ax:         "Union_ax(M)"
-      and power_ax:         "power_ax(M)"
-      and replacement:      "replacement(M,P)"
-      and M_nat [iff]:      "M(nat)"           (*i.e. the axiom of infinity*)
-
 
-text\<open>Automatically discovers the proof using \<open>transM\<close>, \<open>nat_0I\<close>
-and \<open>M_nat\<close>.\<close>
-lemma (in M_trivial) nonempty [simp]: "M(0)"
-by (blast intro: transM)
-
-lemma (in M_trivial) rall_abs [simp]:
+lemma (in M_trans) rall_abs [simp]:
      "M(A) ==> (\<forall>x[M]. x\<in>A \<longrightarrow> P(x)) \<longleftrightarrow> (\<forall>x\<in>A. P(x))"
 by (blast intro: transM)
 
-lemma (in M_trivial) rex_abs [simp]:
+lemma (in M_trans) rex_abs [simp]:
      "M(A) ==> (\<exists>x[M]. x\<in>A & P(x)) \<longleftrightarrow> (\<exists>x\<in>A. P(x))"
 by (blast intro: transM)
 
-lemma (in M_trivial) ball_iff_equiv:
+lemma (in M_trans) ball_iff_equiv:
      "M(A) ==> (\<forall>x[M]. (x\<in>A \<longleftrightarrow> P(x))) \<longleftrightarrow>
                (\<forall>x\<in>A. P(x)) & (\<forall>x. P(x) \<longrightarrow> M(x) \<longrightarrow> x\<in>A)"
 by (blast intro: transM)
 
 text\<open>Simplifies proofs of equalities when there's an iff-equality
       available for rewriting, universally quantified over M.
       But it's not the only way to prove such equalities: its
       premises \<^term>\<open>M(A)\<close> and  \<^term>\<open>M(B)\<close> can be too strong.\<close>
-lemma (in M_trivial) M_equalityI:
+lemma (in M_trans) M_equalityI:
      "[| !!x. M(x) ==> x\<in>A \<longleftrightarrow> x\<in>B; M(A); M(B) |] ==> A=B"
-by (blast intro!: equalityI dest: transM)
+by (blast dest: transM)
 
 
 subsubsection\<open>Trivial Absoluteness Proofs: Empty Set, Pairs, etc.\<close>
 
-lemma (in M_trivial) empty_abs [simp]:
+lemma (in M_trans) empty_abs [simp]:
      "M(z) ==> empty(M,z) \<longleftrightarrow> z=0"
 apply (simp add: empty_def)
 apply (blast intro: transM)
 done
 
-lemma (in M_trivial) subset_abs [simp]:
+lemma (in M_trans) subset_abs [simp]:
      "M(A) ==> subset(M,A,B) \<longleftrightarrow> A \<subseteq> B"
 apply (simp add: subset_def)
 apply (blast intro: transM)
 done
 
-lemma (in M_trivial) upair_abs [simp]:
+lemma (in M_trans) upair_abs [simp]:
      "M(z) ==> upair(M,a,b,z) \<longleftrightarrow> z={a,b}"
 apply (simp add: upair_def)
 apply (blast intro: transM)
 done
 
-lemma (in M_trivial) upair_in_M_iff [iff]:
-     "M({a,b}) \<longleftrightarrow> M(a) & M(b)"
-apply (insert upair_ax, simp add: upair_ax_def)
-apply (blast intro: transM)
-done
+lemma (in M_trivial) upair_in_MI [intro!]:
+     " M(a) & M(b) \<Longrightarrow> M({a,b})"
+by (insert upair_ax, simp add: upair_ax_def)
 
-lemma (in M_trivial) singleton_in_M_iff [iff]:
+lemma (in M_trans) upair_in_MD [dest!]:
+     "M({a,b}) \<Longrightarrow> M(a) & M(b)"
+  by (blast intro: transM)
+
+lemma (in M_trivial) upair_in_M_iff [simp]:
+  "M({a,b}) \<longleftrightarrow> M(a) & M(b)"
+  by blast
+
+lemma (in M_trivial) singleton_in_MI [intro!]:
+     "M(a) \<Longrightarrow> M({a})"
+  by (insert upair_in_M_iff [of a a], simp)
+
+lemma (in M_trans) singleton_in_MD [dest!]:
+     "M({a}) \<Longrightarrow> M(a)"
+  by (insert upair_in_MD [of a a], simp)
+
+lemma (in M_trivial) singleton_in_M_iff [simp]:
      "M({a}) \<longleftrightarrow> M(a)"
-by (insert upair_in_M_iff [of a a], simp)
+  by blast
 
-lemma (in M_trivial) pair_abs [simp]:
+lemma (in M_trans) pair_abs [simp]:
      "M(z) ==> pair(M,a,b,z) \<longleftrightarrow> z=<a,b>"
 apply (simp add: pair_def Pair_def)
 apply (blast intro: transM)
 done
 
-lemma (in M_trivial) pair_in_M_iff [iff]:
-     "M(<a,b>) \<longleftrightarrow> M(a) & M(b)"
-by (simp add: Pair_def)
+lemma (in M_trans) pair_in_MD [dest!]:
+     "M(<a,b>) \<Longrightarrow> M(a) & M(b)"
+  by (simp add: Pair_def, blast intro: transM)
 
-lemma (in M_trivial) pair_components_in_M:
+lemma (in M_trivial) pair_in_MI [intro!]:
+     "M(a) & M(b) \<Longrightarrow> M(<a,b>)"
+  by (simp add: Pair_def)
+
+lemma (in M_trivial) pair_in_M_iff [simp]:
+     "M(<a,b>) \<longleftrightarrow> M(a) & M(b)"
+  by blast
+
+lemma (in M_trans) pair_components_in_M:
      "[| <x,y> \<in> A; M(A) |] ==> M(x) & M(y)"
-apply (simp add: Pair_def)
-apply (blast dest: transM)
-done
+  by (blast dest: transM)
 
 lemma (in M_trivial) cartprod_abs [simp]:
      "[| M(A); M(B); M(z) |] ==> cartprod(M,A,B,z) \<longleftrightarrow> z = A*B"
 apply (simp add: cartprod_def)
 apply (rule iffI)
  apply (blast intro!: equalityI intro: transM dest!: rspec)
 apply (blast dest: transM)
 done
 
 subsubsection\<open>Absoluteness for Unions and Intersections\<close>
 
-lemma (in M_trivial) union_abs [simp]:
+lemma (in M_trans) union_abs [simp]:
      "[| M(a); M(b); M(z) |] ==> union(M,a,b,z) \<longleftrightarrow> z = a \<union> b"
-apply (simp add: union_def)
-apply (blast intro: transM)
-done
+  unfolding union_def
+  by (blast intro: transM )
 
-lemma (in M_trivial) inter_abs [simp]:
+lemma (in M_trans) inter_abs [simp]:
      "[| M(a); M(b); M(z) |] ==> inter(M,a,b,z) \<longleftrightarrow> z = a \<inter> b"
-apply (simp add: inter_def)
-apply (blast intro: transM)
-done
+  unfolding inter_def
+  by (blast intro: transM)
 
-lemma (in M_trivial) setdiff_abs [simp]:
+lemma (in M_trans) setdiff_abs [simp]:
      "[| M(a); M(b); M(z) |] ==> setdiff(M,a,b,z) \<longleftrightarrow> z = a-b"
-apply (simp add: setdiff_def)
-apply (blast intro: transM)
-done
+  unfolding setdiff_def
+  by (blast intro: transM)
 
-lemma (in M_trivial) Union_abs [simp]:
+lemma (in M_trans) Union_abs [simp]:
      "[| M(A); M(z) |] ==> big_union(M,A,z) \<longleftrightarrow> z = \<Union>(A)"
-apply (simp add: big_union_def)
-apply (blast intro!: equalityI dest: transM)
-done
+  unfolding big_union_def
+  by (blast  dest: transM)
 
 lemma (in M_trivial) Union_closed [intro,simp]:
      "M(A) ==> M(\<Union>(A))"
 by (insert Union_ax, simp add: Union_ax_def)
 
 lemma (in M_trivial) Un_closed [intro,simp]:
      "[| M(A); M(B) |] ==> M(A \<union> B)"
 by (simp only: Un_eq_Union, blast)
 
 lemma (in M_trivial) cons_closed [intro,simp]:
      "[| M(a); M(A) |] ==> M(cons(a,A))"
 by (subst cons_eq [symmetric], blast)
 
 lemma (in M_trivial) cons_abs [simp]:
      "[| M(b); M(z) |] ==> is_cons(M,a,b,z) \<longleftrightarrow> z = cons(a,b)"
 by (simp add: is_cons_def, blast intro: transM)
 
 lemma (in M_trivial) successor_abs [simp]:
      "[| M(a); M(z) |] ==> successor(M,a,z) \<longleftrightarrow> z = succ(a)"
 by (simp add: successor_def, blast)
 
-lemma (in M_trivial) succ_in_M_iff [iff]:
+lemma (in M_trans) succ_in_MD [dest!]:
+     "M(succ(a)) \<Longrightarrow> M(a)"
+  unfolding succ_def
+  by (blast intro: transM)
+
+lemma (in M_trivial) succ_in_MI [intro!]:
+     "M(a) \<Longrightarrow> M(succ(a))"
+  unfolding succ_def
+  by (blast intro: transM)
+
+lemma (in M_trivial) succ_in_M_iff [simp]:
      "M(succ(a)) \<longleftrightarrow> M(a)"
-apply (simp add: succ_def)
-apply (blast intro: transM)
-done
+  by blast
 
 subsubsection\<open>Absoluteness for Separation and Replacement\<close>
 
-lemma (in M_trivial) separation_closed [intro,simp]:
+lemma (in M_trans) separation_closed [intro,simp]:
      "[| separation(M,P); M(A) |] ==> M(Collect(A,P))"
 apply (insert separation, simp add: separation_def)
 apply (drule rspec, assumption, clarify)
 apply (subgoal_tac "y = Collect(A,P)", blast)
 apply (blast dest: transM)
 done
 
 lemma separation_iff:
      "separation(M,P) \<longleftrightarrow> (\<forall>z[M]. \<exists>y[M]. is_Collect(M,z,P,y))"
 by (simp add: separation_def is_Collect_def)
 
-lemma (in M_trivial) Collect_abs [simp]:
+lemma (in M_trans) Collect_abs [simp]:
      "[| M(A); M(z) |] ==> is_Collect(M,A,P,z) \<longleftrightarrow> z = Collect(A,P)"
-apply (simp add: is_Collect_def)
-apply (blast intro!: equalityI dest: transM)
-done
-
-text\<open>Probably the premise and conclusion are equivalent\<close>
-lemma (in M_trivial) strong_replacementI [rule_format]:
-    "[| \<forall>B[M]. separation(M, %u. \<exists>x[M]. x\<in>B & P(x,u)) |]
-     ==> strong_replacement(M,P)"
-apply (simp add: strong_replacement_def, clarify)
-apply (frule replacementD [OF replacement], assumption, clarify)
-apply (drule_tac x=A in rspec, clarify)
-apply (drule_tac z=Y in separationD, assumption, clarify)
-apply (rule_tac x=y in rexI, force, assumption)
-done
+  unfolding is_Collect_def
+  by (blast dest: transM)
 
 subsubsection\<open>The Operator \<^term>\<open>is_Replace\<close>\<close>
 
 
 lemma is_Replace_cong [cong]:
      "[| A=A';
          !!x y. [| M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y);
          z=z' |]
       ==> is_Replace(M, A, %x y. P(x,y), z) \<longleftrightarrow>
           is_Replace(M, A', %x y. P'(x,y), z')"
 by (simp add: is_Replace_def)
 
-lemma (in M_trivial) univalent_Replace_iff:
+lemma (in M_trans) univalent_Replace_iff:
      "[| M(A); univalent(M,A,P);
          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |]
       ==> u \<in> Replace(A,P) \<longleftrightarrow> (\<exists>x. x\<in>A & P(x,u))"
-apply (simp add: Replace_iff univalent_def)
-apply (blast dest: transM)
-done
+  unfolding Replace_iff univalent_def
+  by (blast dest: transM)
 
 (*The last premise expresses that P takes M to M*)
-lemma (in M_trivial) strong_replacement_closed [intro,simp]:
+lemma (in M_trans) strong_replacement_closed [intro,simp]:
      "[| strong_replacement(M,P); M(A); univalent(M,A,P);
          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] ==> M(Replace(A,P))"
 apply (simp add: strong_replacement_def)
 apply (drule_tac x=A in rspec, safe)
 apply (subgoal_tac "Replace(A,P) = Y")
  apply simp
 apply (rule equality_iffI)
 apply (simp add: univalent_Replace_iff)
 apply (blast dest: transM)
 done
 
-lemma (in M_trivial) Replace_abs:
+lemma (in M_trans) Replace_abs:
      "[| M(A); M(z); univalent(M,A,P);
          !!x y. [| x\<in>A; P(x,y) |] ==> M(y)  |]
       ==> is_Replace(M,A,P,z) \<longleftrightarrow> z = Replace(A,P)"
 apply (simp add: is_Replace_def)
 apply (rule iffI)
  apply (rule equality_iffI)
  apply (simp_all add: univalent_Replace_iff)
  apply (blast dest: transM)+
 done
 
 
 (*The first premise can't simply be assumed as a schema.
   It is essential to take care when asserting instances of Replacement.
   Let K be a nonconstructible subset of nat and define
   f(x) = x if x \<in> K and f(x)=0 otherwise.  Then RepFun(nat,f) = cons(0,K), a
   nonconstructible set.  So we cannot assume that M(X) implies M(RepFun(X,f))
   even for f \<in> M -> M.
 *)
-lemma (in M_trivial) RepFun_closed:
+lemma (in M_trans) RepFun_closed:
      "[| strong_replacement(M, \<lambda>x y. y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
       ==> M(RepFun(A,f))"
 apply (simp add: RepFun_def)
 done
 
 lemma Replace_conj_eq: "{y . x \<in> A, x\<in>A & y=f(x)} = {y . x\<in>A, y=f(x)}"
 by simp
 
 text\<open>Better than \<open>RepFun_closed\<close> when having the formula \<^term>\<open>x\<in>A\<close>
       makes relativization easier.\<close>
-lemma (in M_trivial) RepFun_closed2:
+lemma (in M_trans) RepFun_closed2:
      "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
       ==> M(RepFun(A, %x. f(x)))"
 apply (simp add: RepFun_def)
 apply (frule strong_replacement_closed, assumption)
 apply (auto dest: transM  simp add: Replace_conj_eq univalent_def)
 done
 
 subsubsection \<open>Absoluteness for \<^term>\<open>Lambda\<close>\<close>
 
 definition
  is_lambda :: "[i=>o, i, [i,i]=>o, i] => o" where
     "is_lambda(M, A, is_b, z) ==
        \<forall>p[M]. p \<in> z \<longleftrightarrow>
         (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))"
 
 lemma (in M_trivial) lam_closed:
      "[| strong_replacement(M, \<lambda>x y. y = <x,b(x)>); M(A); \<forall>x\<in>A. M(b(x)) |]
       ==> M(\<lambda>x\<in>A. b(x))"
 by (simp add: lam_def, blast intro: RepFun_closed dest: transM)
 
 text\<open>Better than \<open>lam_closed\<close>: has the formula \<^term>\<open>x\<in>A\<close>\<close>
 lemma (in M_trivial) lam_closed2:
   "[|strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
      M(A); \<forall>m[M]. m\<in>A \<longrightarrow> M(b(m))|] ==> M(Lambda(A,b))"
 apply (simp add: lam_def)
 apply (blast intro: RepFun_closed2 dest: transM)
 done
 
 lemma (in M_trivial) lambda_abs2:
      "[| Relation1(M,A,is_b,b); M(A); \<forall>m[M]. m\<in>A \<longrightarrow> M(b(m)); M(z) |]
       ==> is_lambda(M,A,is_b,z) \<longleftrightarrow> z = Lambda(A,b)"
 apply (simp add: Relation1_def is_lambda_def)
 apply (rule iffI)
  prefer 2 apply (simp add: lam_def)
 apply (rule equality_iffI)
 apply (simp add: lam_def)
 apply (rule iffI)
  apply (blast dest: transM)
 apply (auto simp add: transM [of _ A])
 done
 
 lemma is_lambda_cong [cong]:
      "[| A=A';  z=z';
          !!x y. [| x\<in>A; M(x); M(y) |] ==> is_b(x,y) \<longleftrightarrow> is_b'(x,y) |]
       ==> is_lambda(M, A, %x y. is_b(x,y), z) \<longleftrightarrow>
           is_lambda(M, A', %x y. is_b'(x,y), z')"
 by (simp add: is_lambda_def)
 
-lemma (in M_trivial) image_abs [simp]:
+lemma (in M_trans) image_abs [simp]:
      "[| M(r); M(A); M(z) |] ==> image(M,r,A,z) \<longleftrightarrow> z = r``A"
 apply (simp add: image_def)
 apply (rule iffI)
  apply (blast intro!: equalityI dest: transM, blast)
 done
 
+subsubsection\<open>Relativization of Powerset\<close>
+
 text\<open>What about \<open>Pow_abs\<close>?  Powerset is NOT absolute!
       This result is one direction of absoluteness.\<close>
 
-lemma (in M_trivial) powerset_Pow:
+lemma (in M_trans) powerset_Pow:
      "powerset(M, x, Pow(x))"
 by (simp add: powerset_def)
 
 text\<open>But we can't prove that the powerset in \<open>M\<close> includes the
       real powerset.\<close>
-lemma (in M_trivial) powerset_imp_subset_Pow:
+
+lemma (in M_trans) powerset_imp_subset_Pow:
      "[| powerset(M,x,y); M(y) |] ==> y \<subseteq> Pow(x)"
 apply (simp add: powerset_def)
 apply (blast dest: transM)
 done
 
+lemma (in M_trans) powerset_abs:
+  assumes
+     "M(y)"
+  shows
+    "powerset(M,x,y) \<longleftrightarrow> y = {a\<in>Pow(x) . M(a)}"
+proof (intro iffI equalityI)
+  (* First show the converse implication by double inclusion *)
+  assume "powerset(M,x,y)"
+  with \<open>M(y)\<close>  
+  show "y \<subseteq> {a\<in>Pow(x) . M(a)}"
+    using powerset_imp_subset_Pow transM by blast
+  from \<open>powerset(M,x,y)\<close>
+  show "{a\<in>Pow(x) . M(a)} \<subseteq> y"
+    using transM unfolding powerset_def by auto
+next (* we show the direct implication *)
+  assume
+    "y = {a \<in> Pow(x) . M(a)}"
+  then
+  show "powerset(M, x, y)"
+    unfolding powerset_def subset_def using transM by blast
+qed
+
 subsubsection\<open>Absoluteness for the Natural Numbers\<close>
 
 lemma (in M_trivial) nat_into_M [intro]:
      "n \<in> nat ==> M(n)"
 by (induct n rule: nat_induct, simp_all)
 
-lemma (in M_trivial) nat_case_closed [intro,simp]:
+lemma (in M_trans) nat_case_closed [intro,simp]:
   "[|M(k); M(a); \<forall>m[M]. M(b(m))|] ==> M(nat_case(a,b,k))"
 apply (case_tac "k=0", simp)
 apply (case_tac "\<exists>m. k = succ(m)", force)
 apply (simp add: nat_case_def)
 done
 
 lemma (in M_trivial) quasinat_abs [simp]:
      "M(z) ==> is_quasinat(M,z) \<longleftrightarrow> quasinat(z)"
 by (auto simp add: is_quasinat_def quasinat_def)
 
 lemma (in M_trivial) nat_case_abs [simp]:
      "[| relation1(M,is_b,b); M(k); M(z) |]
       ==> is_nat_case(M,a,is_b,k,z) \<longleftrightarrow> z = nat_case(a,b,k)"
 apply (case_tac "quasinat(k)")
  prefer 2
  apply (simp add: is_nat_case_def non_nat_case)
  apply (force simp add: quasinat_def)
 apply (simp add: quasinat_def is_nat_case_def)
 apply (elim disjE exE)
  apply (simp_all add: relation1_def)
 done
 
 (*NOT for the simplifier.  The assumption M(z') is apparently necessary, but
   causes the error "Failed congruence proof!"  It may be better to replace
   is_nat_case by nat_case before attempting congruence reasoning.*)
 lemma is_nat_case_cong:
      "[| a = a'; k = k';  z = z';  M(z');
        !!x y. [| M(x); M(y) |] ==> is_b(x,y) \<longleftrightarrow> is_b'(x,y) |]
       ==> is_nat_case(M, a, is_b, k, z) \<longleftrightarrow> is_nat_case(M, a', is_b', k', z')"
 by (simp add: is_nat_case_def)
 
 
 subsection\<open>Absoluteness for Ordinals\<close>
 text\<open>These results constitute Theorem IV 5.1 of Kunen (page 126).\<close>
 
-lemma (in M_trivial) lt_closed:
+lemma (in M_trans) lt_closed:
      "[| j<i; M(i) |] ==> M(j)"
 by (blast dest: ltD intro: transM)
 
-lemma (in M_trivial) transitive_set_abs [simp]:
+lemma (in M_trans) transitive_set_abs [simp]:
      "M(a) ==> transitive_set(M,a) \<longleftrightarrow> Transset(a)"
 by (simp add: transitive_set_def Transset_def)
 
-lemma (in M_trivial) ordinal_abs [simp]:
+lemma (in M_trans) ordinal_abs [simp]:
      "M(a) ==> ordinal(M,a) \<longleftrightarrow> Ord(a)"
 by (simp add: ordinal_def Ord_def)
 
 lemma (in M_trivial) limit_ordinal_abs [simp]:
      "M(a) ==> limit_ordinal(M,a) \<longleftrightarrow> Limit(a)"
 apply (unfold Limit_def limit_ordinal_def)
 apply (simp add: Ord_0_lt_iff)
 apply (simp add: lt_def, blast)
 done
 
 lemma (in M_trivial) successor_ordinal_abs [simp]:
      "M(a) ==> successor_ordinal(M,a) \<longleftrightarrow> Ord(a) & (\<exists>b[M]. a = succ(b))"
 apply (simp add: successor_ordinal_def, safe)
 apply (drule Ord_cases_disj, auto)
 done
 
 lemma finite_Ord_is_nat:
       "[| Ord(a); ~ Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a \<in> nat"
 by (induct a rule: trans_induct3, simp_all)
 
 lemma (in M_trivial) finite_ordinal_abs [simp]:
      "M(a) ==> finite_ordinal(M,a) \<longleftrightarrow> a \<in> nat"
 apply (simp add: finite_ordinal_def)
 apply (blast intro: finite_Ord_is_nat intro: nat_into_Ord
              dest: Ord_trans naturals_not_limit)
 done
 
 lemma Limit_non_Limit_implies_nat:
      "[| Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a = nat"
 apply (rule le_anti_sym)
 apply (rule all_lt_imp_le, blast, blast intro: Limit_is_Ord)
  apply (simp add: lt_def)
  apply (blast intro: Ord_in_Ord Ord_trans finite_Ord_is_nat)
 apply (erule nat_le_Limit)
 done
 
 lemma (in M_trivial) omega_abs [simp]:
      "M(a) ==> omega(M,a) \<longleftrightarrow> a = nat"
 apply (simp add: omega_def)
 apply (blast intro: Limit_non_Limit_implies_nat dest: naturals_not_limit)
 done
 
 lemma (in M_trivial) number1_abs [simp]:
      "M(a) ==> number1(M,a) \<longleftrightarrow> a = 1"
 by (simp add: number1_def)
 
 lemma (in M_trivial) number2_abs [simp]:
      "M(a) ==> number2(M,a) \<longleftrightarrow> a = succ(1)"
 by (simp add: number2_def)
 
 lemma (in M_trivial) number3_abs [simp]:
      "M(a) ==> number3(M,a) \<longleftrightarrow> a = succ(succ(1))"
 by (simp add: number3_def)
 
 text\<open>Kunen continued to 20...\<close>
 
 (*Could not get this to work.  The \<lambda>x\<in>nat is essential because everything
   but the recursion variable must stay unchanged.  But then the recursion
   equations only hold for x\<in>nat (or in some other set) and not for the
   whole of the class M.
   consts
     natnumber_aux :: "[i=>o,i] => i"
 
   primrec
       "natnumber_aux(M,0) = (\<lambda>x\<in>nat. if empty(M,x) then 1 else 0)"
       "natnumber_aux(M,succ(n)) =
            (\<lambda>x\<in>nat. if (\<exists>y[M]. natnumber_aux(M,n)`y=1 & successor(M,y,x))
                      then 1 else 0)"
 
   definition
     natnumber :: "[i=>o,i,i] => o"
       "natnumber(M,n,x) == natnumber_aux(M,n)`x = 1"
 
   lemma (in M_trivial) [simp]:
        "natnumber(M,0,x) == x=0"
 *)
 
 subsection\<open>Some instances of separation and strong replacement\<close>
 
 locale M_basic = M_trivial +
 assumes Inter_separation:
      "M(A) ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>A \<longrightarrow> x\<in>y)"
   and Diff_separation:
      "M(B) ==> separation(M, \<lambda>x. x \<notin> B)"
   and cartprod_separation:
      "[| M(A); M(B) |]
       ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,z)))"
   and image_separation:
      "[| M(A); M(r) |]
       ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,p)))"
   and converse_separation:
      "M(r) ==> separation(M,
          \<lambda>z. \<exists>p[M]. p\<in>r & (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))"
   and restrict_separation:
      "M(A) ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. pair(M,x,y,z)))"
   and comp_separation:
      "[| M(r); M(s) |]
       ==> separation(M, \<lambda>xz. \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
                   pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) &
                   xy\<in>s & yz\<in>r)"
   and pred_separation:
      "[| M(r); M(x) |] ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & pair(M,y,x,p))"
   and Memrel_separation:
      "separation(M, \<lambda>z. \<exists>x[M]. \<exists>y[M]. pair(M,x,y,z) & x \<in> y)"
   and funspace_succ_replacement:
      "M(n) ==>
       strong_replacement(M, \<lambda>p z. \<exists>f[M]. \<exists>b[M]. \<exists>nb[M]. \<exists>cnbf[M].
                 pair(M,f,b,p) & pair(M,n,b,nb) & is_cons(M,nb,f,cnbf) &
                 upair(M,cnbf,cnbf,z))"
   and is_recfun_separation:
      \<comment> \<open>for well-founded recursion: used to prove \<open>is_recfun_equal\<close>\<close>
      "[| M(r); M(f); M(g); M(a); M(b) |]
      ==> separation(M,
             \<lambda>x. \<exists>xa[M]. \<exists>xb[M].
                 pair(M,x,a,xa) & xa \<in> r & pair(M,x,b,xb) & xb \<in> r &
                 (\<exists>fx[M]. \<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) &
                                    fx \<noteq> gx))"
+     and power_ax:         "power_ax(M)"
 
-lemma (in M_basic) cartprod_iff_lemma:
+lemma (in M_trivial) cartprod_iff_lemma:
      "[| M(C);  \<forall>u[M]. u \<in> C \<longleftrightarrow> (\<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}});
          powerset(M, A \<union> B, p1); powerset(M, p1, p2);  M(p2) |]
        ==> C = {u \<in> p2 . \<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}}"
 apply (simp add: powerset_def)
 apply (rule equalityI, clarify, simp)
  apply (frule transM, assumption)
  apply (frule transM, assumption, simp (no_asm_simp))
  apply blast
 apply clarify
 apply (frule transM, assumption, force)
 done
 
 lemma (in M_basic) cartprod_iff:
      "[| M(A); M(B); M(C) |]
       ==> cartprod(M,A,B,C) \<longleftrightarrow>
           (\<exists>p1[M]. \<exists>p2[M]. powerset(M,A \<union> B,p1) & powerset(M,p1,p2) &
                    C = {z \<in> p2. \<exists>x\<in>A. \<exists>y\<in>B. z = <x,y>})"
 apply (simp add: Pair_def cartprod_def, safe)
 defer 1
   apply (simp add: powerset_def)
  apply blast
 txt\<open>Final, difficult case: the left-to-right direction of the theorem.\<close>
 apply (insert power_ax, simp add: power_ax_def)
 apply (frule_tac x="A \<union> B" and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
 apply (blast, clarify)
 apply (drule_tac x=z and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
 apply assumption
 apply (blast intro: cartprod_iff_lemma)
 done
 
 lemma (in M_basic) cartprod_closed_lemma:
      "[| M(A); M(B) |] ==> \<exists>C[M]. cartprod(M,A,B,C)"
 apply (simp del: cartprod_abs add: cartprod_iff)
 apply (insert power_ax, simp add: power_ax_def)
 apply (frule_tac x="A \<union> B" and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
 apply (blast, clarify)
 apply (drule_tac x=z and P="\<lambda>x. rex(M,Q(x))" for Q in rspec, auto)
 apply (intro rexI conjI, simp+)
 apply (insert cartprod_separation [of A B], simp)
 done
 
 text\<open>All the lemmas above are necessary because Powerset is not absolute.
       I should have used Replacement instead!\<close>
 lemma (in M_basic) cartprod_closed [intro,simp]:
      "[| M(A); M(B) |] ==> M(A*B)"
 by (frule cartprod_closed_lemma, assumption, force)
 
 lemma (in M_basic) sum_closed [intro,simp]:
      "[| M(A); M(B) |] ==> M(A+B)"
 by (simp add: sum_def)
 
 lemma (in M_basic) sum_abs [simp]:
      "[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) \<longleftrightarrow> (Z = A+B)"
 by (simp add: is_sum_def sum_def singleton_0 nat_into_M)
 
 lemma (in M_trivial) Inl_in_M_iff [iff]:
      "M(Inl(a)) \<longleftrightarrow> M(a)"
 by (simp add: Inl_def)
 
 lemma (in M_trivial) Inl_abs [simp]:
      "M(Z) ==> is_Inl(M,a,Z) \<longleftrightarrow> (Z = Inl(a))"
 by (simp add: is_Inl_def Inl_def)
 
 lemma (in M_trivial) Inr_in_M_iff [iff]:
      "M(Inr(a)) \<longleftrightarrow> M(a)"
 by (simp add: Inr_def)
 
 lemma (in M_trivial) Inr_abs [simp]:
      "M(Z) ==> is_Inr(M,a,Z) \<longleftrightarrow> (Z = Inr(a))"
 by (simp add: is_Inr_def Inr_def)
 
 
 subsubsection \<open>converse of a relation\<close>
 
 lemma (in M_basic) M_converse_iff:
      "M(r) ==>
       converse(r) =
       {z \<in> \<Union>(\<Union>(r)) * \<Union>(\<Union>(r)).
        \<exists>p\<in>r. \<exists>x[M]. \<exists>y[M]. p = \<langle>x,y\<rangle> & z = \<langle>y,x\<rangle>}"
 apply (rule equalityI)
  prefer 2 apply (blast dest: transM, clarify, simp)
 apply (simp add: Pair_def)
 apply (blast dest: transM)
 done
 
 lemma (in M_basic) converse_closed [intro,simp]:
      "M(r) ==> M(converse(r))"
 apply (simp add: M_converse_iff)
 apply (insert converse_separation [of r], simp)
 done
 
 lemma (in M_basic) converse_abs [simp]:
      "[| M(r); M(z) |] ==> is_converse(M,r,z) \<longleftrightarrow> z = converse(r)"
 apply (simp add: is_converse_def)
 apply (rule iffI)
  prefer 2 apply blast
 apply (rule M_equalityI)
   apply simp
   apply (blast dest: transM)+
 done
 
 
 subsubsection \<open>image, preimage, domain, range\<close>
 
 lemma (in M_basic) image_closed [intro,simp]:
      "[| M(A); M(r) |] ==> M(r``A)"
 apply (simp add: image_iff_Collect)
 apply (insert image_separation [of A r], simp)
 done
 
 lemma (in M_basic) vimage_abs [simp]:
      "[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) \<longleftrightarrow> z = r-``A"
 apply (simp add: pre_image_def)
 apply (rule iffI)
  apply (blast intro!: equalityI dest: transM, blast)
 done
 
 lemma (in M_basic) vimage_closed [intro,simp]:
      "[| M(A); M(r) |] ==> M(r-``A)"
 by (simp add: vimage_def)
 
 
 subsubsection\<open>Domain, range and field\<close>
 
-lemma (in M_basic) domain_abs [simp]:
+lemma (in M_trans) domain_abs [simp]:
      "[| M(r); M(z) |] ==> is_domain(M,r,z) \<longleftrightarrow> z = domain(r)"
 apply (simp add: is_domain_def)
 apply (blast intro!: equalityI dest: transM)
 done
 
 lemma (in M_basic) domain_closed [intro,simp]:
      "M(r) ==> M(domain(r))"
 apply (simp add: domain_eq_vimage)
 done
 
-lemma (in M_basic) range_abs [simp]:
+lemma (in M_trans) range_abs [simp]:
      "[| M(r); M(z) |] ==> is_range(M,r,z) \<longleftrightarrow> z = range(r)"
 apply (simp add: is_range_def)
 apply (blast intro!: equalityI dest: transM)
 done
 
 lemma (in M_basic) range_closed [intro,simp]:
      "M(r) ==> M(range(r))"
 apply (simp add: range_eq_image)
 done
 
 lemma (in M_basic) field_abs [simp]:
      "[| M(r); M(z) |] ==> is_field(M,r,z) \<longleftrightarrow> z = field(r)"
-by (simp add: domain_closed range_closed is_field_def field_def)
+by (simp add: is_field_def field_def)
 
 lemma (in M_basic) field_closed [intro,simp]:
      "M(r) ==> M(field(r))"
-by (simp add: domain_closed range_closed Un_closed field_def)
+by (simp add: field_def)
 
 
 subsubsection\<open>Relations, functions and application\<close>
 
-lemma (in M_basic) relation_abs [simp]:
+lemma (in M_trans) relation_abs [simp]:
      "M(r) ==> is_relation(M,r) \<longleftrightarrow> relation(r)"
 apply (simp add: is_relation_def relation_def)
 apply (blast dest!: bspec dest: pair_components_in_M)+
 done
 
-lemma (in M_basic) function_abs [simp]:
+lemma (in M_trivial) function_abs [simp]:
      "M(r) ==> is_function(M,r) \<longleftrightarrow> function(r)"
 apply (simp add: is_function_def function_def, safe)
    apply (frule transM, assumption)
   apply (blast dest: pair_components_in_M)+
 done
 
 lemma (in M_basic) apply_closed [intro,simp]:
      "[|M(f); M(a)|] ==> M(f`a)"
 by (simp add: apply_def)
 
 lemma (in M_basic) apply_abs [simp]:
      "[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) \<longleftrightarrow> f`x = y"
 apply (simp add: fun_apply_def apply_def, blast)
 done
 
-lemma (in M_basic) typed_function_abs [simp]:
+lemma (in M_trivial) typed_function_abs [simp]:
      "[| M(A); M(f) |] ==> typed_function(M,A,B,f) \<longleftrightarrow> f \<in> A -> B"
 apply (auto simp add: typed_function_def relation_def Pi_iff)
 apply (blast dest: pair_components_in_M)+
 done
 
 lemma (in M_basic) injection_abs [simp]:
      "[| M(A); M(f) |] ==> injection(M,A,B,f) \<longleftrightarrow> f \<in> inj(A,B)"
-apply (simp add: injection_def apply_iff inj_def apply_closed)
+apply (simp add: injection_def apply_iff inj_def)
 apply (blast dest: transM [of _ A])
 done
 
 lemma (in M_basic) surjection_abs [simp]:
      "[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) \<longleftrightarrow> f \<in> surj(A,B)"
 by (simp add: surjection_def surj_def)
 
 lemma (in M_basic) bijection_abs [simp]:
      "[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) \<longleftrightarrow> f \<in> bij(A,B)"
 by (simp add: bijection_def bij_def)
 
 
 subsubsection\<open>Composition of relations\<close>
 
 lemma (in M_basic) M_comp_iff:
      "[| M(r); M(s) |]
       ==> r O s =
           {xz \<in> domain(s) * range(r).
             \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. xz = \<langle>x,z\<rangle> & \<langle>x,y\<rangle> \<in> s & \<langle>y,z\<rangle> \<in> r}"
 apply (simp add: comp_def)
 apply (rule equalityI)
  apply clarify
  apply simp
  apply  (blast dest:  transM)+
 done
 
 lemma (in M_basic) comp_closed [intro,simp]:
      "[| M(r); M(s) |] ==> M(r O s)"
 apply (simp add: M_comp_iff)
 apply (insert comp_separation [of r s], simp)
 done
 
 lemma (in M_basic) composition_abs [simp]:
      "[| M(r); M(s); M(t) |] ==> composition(M,r,s,t) \<longleftrightarrow> t = r O s"
 apply safe
  txt\<open>Proving \<^term>\<open>composition(M, r, s, r O s)\<close>\<close>
  prefer 2
  apply (simp add: composition_def comp_def)
  apply (blast dest: transM)
 txt\<open>Opposite implication\<close>
 apply (rule M_equalityI)
   apply (simp add: composition_def comp_def)
   apply (blast del: allE dest: transM)+
 done
 
 text\<open>no longer needed\<close>
 lemma (in M_basic) restriction_is_function:
      "[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |]
       ==> function(z)"
 apply (simp add: restriction_def ball_iff_equiv)
 apply (unfold function_def, blast)
 done
 
-lemma (in M_basic) restriction_abs [simp]:
+lemma (in M_trans) restriction_abs [simp]:
      "[| M(f); M(A); M(z) |]
       ==> restriction(M,f,A,z) \<longleftrightarrow> z = restrict(f,A)"
 apply (simp add: ball_iff_equiv restriction_def restrict_def)
 apply (blast intro!: equalityI dest: transM)
 done
 
 
-lemma (in M_basic) M_restrict_iff:
+lemma (in M_trans) M_restrict_iff:
      "M(r) ==> restrict(r,A) = {z \<in> r . \<exists>x\<in>A. \<exists>y[M]. z = \<langle>x, y\<rangle>}"
 by (simp add: restrict_def, blast dest: transM)
 
 lemma (in M_basic) restrict_closed [intro,simp]:
      "[| M(A); M(r) |] ==> M(restrict(r,A))"
 apply (simp add: M_restrict_iff)
 apply (insert restrict_separation [of A], simp)
 done
 
-lemma (in M_basic) Inter_abs [simp]:
+lemma (in M_trans) Inter_abs [simp]:
      "[| M(A); M(z) |] ==> big_inter(M,A,z) \<longleftrightarrow> z = \<Inter>(A)"
 apply (simp add: big_inter_def Inter_def)
 apply (blast intro!: equalityI dest: transM)
 done
 
 lemma (in M_basic) Inter_closed [intro,simp]:
      "M(A) ==> M(\<Inter>(A))"
 by (insert Inter_separation, simp add: Inter_def)
 
 lemma (in M_basic) Int_closed [intro,simp]:
      "[| M(A); M(B) |] ==> M(A \<inter> B)"
 apply (subgoal_tac "M({A,B})")
 apply (frule Inter_closed, force+)
 done
 
 lemma (in M_basic) Diff_closed [intro,simp]:
      "[|M(A); M(B)|] ==> M(A-B)"
 by (insert Diff_separation, simp add: Diff_def)
 
 subsubsection\<open>Some Facts About Separation Axioms\<close>
 
 lemma (in M_basic) separation_conj:
      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) & Q(z))"
 by (simp del: separation_closed
          add: separation_iff Collect_Int_Collect_eq [symmetric])
 
 (*???equalities*)
 lemma Collect_Un_Collect_eq:
      "Collect(A,P) \<union> Collect(A,Q) = Collect(A, %x. P(x) | Q(x))"
 by blast
 
 lemma Diff_Collect_eq:
      "A - Collect(A,P) = Collect(A, %x. ~ P(x))"
 by blast
 
-lemma (in M_trivial) Collect_rall_eq:
+lemma (in M_trans) Collect_rall_eq:
      "M(Y) ==> Collect(A, %x. \<forall>y[M]. y\<in>Y \<longrightarrow> P(x,y)) =
                (if Y=0 then A else (\<Inter>y \<in> Y. {x \<in> A. P(x,y)}))"
-apply simp
-apply (blast intro!: equalityI dest: transM)
-done
+  by (simp,blast dest: transM)
+
 
 lemma (in M_basic) separation_disj:
      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) | Q(z))"
 by (simp del: separation_closed
          add: separation_iff Collect_Un_Collect_eq [symmetric])
 
 lemma (in M_basic) separation_neg:
      "separation(M,P) ==> separation(M, \<lambda>z. ~P(z))"
 by (simp del: separation_closed
          add: separation_iff Diff_Collect_eq [symmetric])
 
 lemma (in M_basic) separation_imp:
      "[|separation(M,P); separation(M,Q)|]
       ==> separation(M, \<lambda>z. P(z) \<longrightarrow> Q(z))"
 by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric])
 
 text\<open>This result is a hint of how little can be done without the Reflection
   Theorem.  The quantifier has to be bounded by a set.  We also need another
   instance of Separation!\<close>
 lemma (in M_basic) separation_rall:
      "[|M(Y); \<forall>y[M]. separation(M, \<lambda>x. P(x,y));
         \<forall>z[M]. strong_replacement(M, \<lambda>x y. y = {u \<in> z . P(u,x)})|]
       ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>Y \<longrightarrow> P(x,y))"
 apply (simp del: separation_closed rall_abs
          add: separation_iff Collect_rall_eq)
-apply (blast intro!: Inter_closed RepFun_closed dest: transM)
+apply (blast intro!:  RepFun_closed dest: transM)
 done
 
 
 subsubsection\<open>Functions and function space\<close>
 
 text\<open>The assumption \<^term>\<open>M(A->B)\<close> is unusual, but essential: in
 all but trivial cases, A->B cannot be expected to belong to \<^term>\<open>M\<close>.\<close>
-lemma (in M_basic) is_funspace_abs [simp]:
+lemma (in M_trivial) is_funspace_abs [simp]:
      "[|M(A); M(B); M(F); M(A->B)|] ==> is_funspace(M,A,B,F) \<longleftrightarrow> F = A->B"
 apply (simp add: is_funspace_def)
 apply (rule iffI)
  prefer 2 apply blast
 apply (rule M_equalityI)
   apply simp_all
 done
 
 lemma (in M_basic) succ_fun_eq2:
      "[|M(B); M(n->B)|] ==>
       succ(n) -> B =
       \<Union>{z. p \<in> (n->B)*B, \<exists>f[M]. \<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}"
 apply (simp add: succ_fun_eq)
 apply (blast dest: transM)
 done
 
 lemma (in M_basic) funspace_succ:
      "[|M(n); M(B); M(n->B) |] ==> M(succ(n) -> B)"
 apply (insert funspace_succ_replacement [of n], simp)
 apply (force simp add: succ_fun_eq2 univalent_def)
 done
 
 text\<open>\<^term>\<open>M\<close> contains all finite function spaces.  Needed to prove the
 absoluteness of transitive closure.  See the definition of
 \<open>rtrancl_alt\<close> in in \<open>WF_absolute.thy\<close>.\<close>
 lemma (in M_basic) finite_funspace_closed [intro,simp]:
      "[|n\<in>nat; M(B)|] ==> M(n->B)"
 apply (induct_tac n, simp)
 apply (simp add: funspace_succ nat_into_M)
 done
 
 
 subsection\<open>Relativization and Absoluteness for Boolean Operators\<close>
 
 definition
   is_bool_of_o :: "[i=>o, o, i] => o" where
    "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))"
 
 definition
   is_not :: "[i=>o, i, i] => o" where
    "is_not(M,a,z) == (number1(M,a)  & empty(M,z)) |
                      (~number1(M,a) & number1(M,z))"
 
 definition
   is_and :: "[i=>o, i, i, i] => o" where
    "is_and(M,a,b,z) == (number1(M,a)  & z=b) |
                        (~number1(M,a) & empty(M,z))"
 
 definition
   is_or :: "[i=>o, i, i, i] => o" where
    "is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) |
                       (~number1(M,a) & z=b)"
 
 lemma (in M_trivial) bool_of_o_abs [simp]:
      "M(z) ==> is_bool_of_o(M,P,z) \<longleftrightarrow> z = bool_of_o(P)"
 by (simp add: is_bool_of_o_def bool_of_o_def)
 
 
 lemma (in M_trivial) not_abs [simp]:
      "[| M(a); M(z)|] ==> is_not(M,a,z) \<longleftrightarrow> z = not(a)"
 by (simp add: Bool.not_def cond_def is_not_def)
 
 lemma (in M_trivial) and_abs [simp]:
      "[| M(a); M(b); M(z)|] ==> is_and(M,a,b,z) \<longleftrightarrow> z = a and b"
 by (simp add: Bool.and_def cond_def is_and_def)
 
 lemma (in M_trivial) or_abs [simp]:
      "[| M(a); M(b); M(z)|] ==> is_or(M,a,b,z) \<longleftrightarrow> z = a or b"
 by (simp add: Bool.or_def cond_def is_or_def)
 
 
 lemma (in M_trivial) bool_of_o_closed [intro,simp]:
      "M(bool_of_o(P))"
 by (simp add: bool_of_o_def)
 
 lemma (in M_trivial) and_closed [intro,simp]:
      "[| M(p); M(q) |] ==> M(p and q)"
 by (simp add: and_def cond_def)
 
 lemma (in M_trivial) or_closed [intro,simp]:
      "[| M(p); M(q) |] ==> M(p or q)"
 by (simp add: or_def cond_def)
 
 lemma (in M_trivial) not_closed [intro,simp]:
      "M(p) ==> M(not(p))"
 by (simp add: Bool.not_def cond_def)
 
 
 subsection\<open>Relativization and Absoluteness for List Operators\<close>
 
 definition
   is_Nil :: "[i=>o, i] => o" where
      \<comment> \<open>because \<^prop>\<open>[] \<equiv> Inl(0)\<close>\<close>
     "is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs)"
 
 definition
   is_Cons :: "[i=>o,i,i,i] => o" where
      \<comment> \<open>because \<^prop>\<open>Cons(a, l) \<equiv> Inr(\<langle>a,l\<rangle>)\<close>\<close>
     "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)"
 
 
 lemma (in M_trivial) Nil_in_M [intro,simp]: "M(Nil)"
 by (simp add: Nil_def)
 
 lemma (in M_trivial) Nil_abs [simp]: "M(Z) ==> is_Nil(M,Z) \<longleftrightarrow> (Z = Nil)"
 by (simp add: is_Nil_def Nil_def)
 
 lemma (in M_trivial) Cons_in_M_iff [iff]: "M(Cons(a,l)) \<longleftrightarrow> M(a) & M(l)"
 by (simp add: Cons_def)
 
 lemma (in M_trivial) Cons_abs [simp]:
      "[|M(a); M(l); M(Z)|] ==> is_Cons(M,a,l,Z) \<longleftrightarrow> (Z = Cons(a,l))"
 by (simp add: is_Cons_def Cons_def)
 
 
 definition
   quasilist :: "i => o" where
     "quasilist(xs) == xs=Nil | (\<exists>x l. xs = Cons(x,l))"
 
 definition
   is_quasilist :: "[i=>o,i] => o" where
     "is_quasilist(M,z) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))"
 
 definition
   list_case' :: "[i, [i,i]=>i, i] => i" where
     \<comment> \<open>A version of \<^term>\<open>list_case\<close> that's always defined.\<close>
     "list_case'(a,b,xs) ==
        if quasilist(xs) then list_case(a,b,xs) else 0"
 
 definition
   is_list_case :: "[i=>o, i, [i,i,i]=>o, i, i] => o" where
     \<comment> \<open>Returns 0 for non-lists\<close>
     "is_list_case(M, a, is_b, xs, z) ==
        (is_Nil(M,xs) \<longrightarrow> z=a) &
        (\<forall>x[M]. \<forall>l[M]. is_Cons(M,x,l,xs) \<longrightarrow> is_b(x,l,z)) &
        (is_quasilist(M,xs) | empty(M,z))"
 
 definition
   hd' :: "i => i" where
     \<comment> \<open>A version of \<^term>\<open>hd\<close> that's always defined.\<close>
     "hd'(xs) == if quasilist(xs) then hd(xs) else 0"
 
 definition
   tl' :: "i => i" where
     \<comment> \<open>A version of \<^term>\<open>tl\<close> that's always defined.\<close>
     "tl'(xs) == if quasilist(xs) then tl(xs) else 0"
 
 definition
   is_hd :: "[i=>o,i,i] => o" where
      \<comment> \<open>\<^term>\<open>hd([]) = 0\<close> no constraints if not a list.
           Avoiding implication prevents the simplifier's looping.\<close>
     "is_hd(M,xs,H) ==
        (is_Nil(M,xs) \<longrightarrow> empty(M,H)) &
        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
        (is_quasilist(M,xs) | empty(M,H))"
 
 definition
   is_tl :: "[i=>o,i,i] => o" where
      \<comment> \<open>\<^term>\<open>tl([]) = []\<close>; see comments about \<^term>\<open>is_hd\<close>\<close>
     "is_tl(M,xs,T) ==
        (is_Nil(M,xs) \<longrightarrow> T=xs) &
        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
        (is_quasilist(M,xs) | empty(M,T))"
 
 subsubsection\<open>\<^term>\<open>quasilist\<close>: For Case-Splitting with \<^term>\<open>list_case'\<close>\<close>
 
 lemma [iff]: "quasilist(Nil)"
 by (simp add: quasilist_def)
 
 lemma [iff]: "quasilist(Cons(x,l))"
 by (simp add: quasilist_def)
 
 lemma list_imp_quasilist: "l \<in> list(A) ==> quasilist(l)"
 by (erule list.cases, simp_all)
 
 subsubsection\<open>\<^term>\<open>list_case'\<close>, the Modified Version of \<^term>\<open>list_case\<close>\<close>
 
 lemma list_case'_Nil [simp]: "list_case'(a,b,Nil) = a"
 by (simp add: list_case'_def quasilist_def)
 
 lemma list_case'_Cons [simp]: "list_case'(a,b,Cons(x,l)) = b(x,l)"
 by (simp add: list_case'_def quasilist_def)
 
 lemma non_list_case: "~ quasilist(x) ==> list_case'(a,b,x) = 0"
 by (simp add: quasilist_def list_case'_def)
 
 lemma list_case'_eq_list_case [simp]:
      "xs \<in> list(A) ==>list_case'(a,b,xs) = list_case(a,b,xs)"
 by (erule list.cases, simp_all)
 
 lemma (in M_basic) list_case'_closed [intro,simp]:
   "[|M(k); M(a); \<forall>x[M]. \<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))"
 apply (case_tac "quasilist(k)")
  apply (simp add: quasilist_def, force)
 apply (simp add: non_list_case)
 done
 
 lemma (in M_trivial) quasilist_abs [simp]:
      "M(z) ==> is_quasilist(M,z) \<longleftrightarrow> quasilist(z)"
 by (auto simp add: is_quasilist_def quasilist_def)
 
 lemma (in M_trivial) list_case_abs [simp]:
      "[| relation2(M,is_b,b); M(k); M(z) |]
       ==> is_list_case(M,a,is_b,k,z) \<longleftrightarrow> z = list_case'(a,b,k)"
 apply (case_tac "quasilist(k)")
  prefer 2
  apply (simp add: is_list_case_def non_list_case)
  apply (force simp add: quasilist_def)
 apply (simp add: quasilist_def is_list_case_def)
 apply (elim disjE exE)
  apply (simp_all add: relation2_def)
 done
 
 
 subsubsection\<open>The Modified Operators \<^term>\<open>hd'\<close> and \<^term>\<open>tl'\<close>\<close>
 
 lemma (in M_trivial) is_hd_Nil: "is_hd(M,[],Z) \<longleftrightarrow> empty(M,Z)"
 by (simp add: is_hd_def)
 
 lemma (in M_trivial) is_hd_Cons:
      "[|M(a); M(l)|] ==> is_hd(M,Cons(a,l),Z) \<longleftrightarrow> Z = a"
 by (force simp add: is_hd_def)
 
 lemma (in M_trivial) hd_abs [simp]:
      "[|M(x); M(y)|] ==> is_hd(M,x,y) \<longleftrightarrow> y = hd'(x)"
 apply (simp add: hd'_def)
 apply (intro impI conjI)
  prefer 2 apply (force simp add: is_hd_def)
 apply (simp add: quasilist_def is_hd_def)
 apply (elim disjE exE, auto)
 done
 
 lemma (in M_trivial) is_tl_Nil: "is_tl(M,[],Z) \<longleftrightarrow> Z = []"
 by (simp add: is_tl_def)
 
 lemma (in M_trivial) is_tl_Cons:
      "[|M(a); M(l)|] ==> is_tl(M,Cons(a,l),Z) \<longleftrightarrow> Z = l"
 by (force simp add: is_tl_def)
 
 lemma (in M_trivial) tl_abs [simp]:
      "[|M(x); M(y)|] ==> is_tl(M,x,y) \<longleftrightarrow> y = tl'(x)"
 apply (simp add: tl'_def)
 apply (intro impI conjI)
  prefer 2 apply (force simp add: is_tl_def)
 apply (simp add: quasilist_def is_tl_def)
 apply (elim disjE exE, auto)
 done
 
 lemma (in M_trivial) relation1_tl: "relation1(M, is_tl(M), tl')"
 by (simp add: relation1_def)
 
 lemma hd'_Nil: "hd'([]) = 0"
 by (simp add: hd'_def)
 
 lemma hd'_Cons: "hd'(Cons(a,l)) = a"
 by (simp add: hd'_def)
 
 lemma tl'_Nil: "tl'([]) = []"
 by (simp add: tl'_def)
 
 lemma tl'_Cons: "tl'(Cons(a,l)) = l"
 by (simp add: tl'_def)
 
 lemma iterates_tl_Nil: "n \<in> nat ==> tl'^n ([]) = []"
 apply (induct_tac n)
 apply (simp_all add: tl'_Nil)
 done
 
 lemma (in M_basic) tl'_closed: "M(x) ==> M(tl'(x))"
 apply (simp add: tl'_def)
 apply (force simp add: quasilist_def)
 done
 
 
 end
diff --git a/src/ZF/Constructible/Satisfies_absolute.thy b/src/ZF/Constructible/Satisfies_absolute.thy
--- a/src/ZF/Constructible/Satisfies_absolute.thy
+++ b/src/ZF/Constructible/Satisfies_absolute.thy
@@ -1,1039 +1,1039 @@
 (*  Title:      ZF/Constructible/Satisfies_absolute.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Absoluteness for the Satisfies Relation on Formulas\<close>
 
 theory Satisfies_absolute imports Datatype_absolute Rec_Separation begin 
 
 
 subsection \<open>More Internalization\<close>
 
 subsubsection\<open>The Formula \<^term>\<open>is_depth\<close>, Internalized\<close>
 
 (*    "is_depth(M,p,n) == 
        \<exists>sn[M]. \<exists>formula_n[M]. \<exists>formula_sn[M]. 
          2          1                0
         is_formula_N(M,n,formula_n) & p \<notin> formula_n &
         successor(M,n,sn) & is_formula_N(M,sn,formula_sn) & p \<in> formula_sn" *)
 definition
   depth_fm :: "[i,i]=>i" where
   "depth_fm(p,n) == 
      Exists(Exists(Exists(
        And(formula_N_fm(n#+3,1),
          And(Neg(Member(p#+3,1)),
           And(succ_fm(n#+3,2),
            And(formula_N_fm(2,0), Member(p#+3,0))))))))"
 
 lemma depth_fm_type [TC]:
  "[| x \<in> nat; y \<in> nat |] ==> depth_fm(x,y) \<in> formula"
 by (simp add: depth_fm_def)
 
 lemma sats_depth_fm [simp]:
    "[| x \<in> nat; y < length(env); env \<in> list(A)|]
     ==> sats(A, depth_fm(x,y), env) \<longleftrightarrow>
         is_depth(##A, nth(x,env), nth(y,env))"
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (simp add: depth_fm_def is_depth_def) 
 done
 
 lemma depth_iff_sats:
       "[| nth(i,env) = x; nth(j,env) = y; 
           i \<in> nat; j < length(env); env \<in> list(A)|]
        ==> is_depth(##A, x, y) \<longleftrightarrow> sats(A, depth_fm(i,j), env)"
-by (simp add: sats_depth_fm)
+by (simp)
 
 theorem depth_reflection:
      "REFLECTS[\<lambda>x. is_depth(L, f(x), g(x)),  
                \<lambda>i x. is_depth(##Lset(i), f(x), g(x))]"
 apply (simp only: is_depth_def)
 apply (intro FOL_reflections function_reflections formula_N_reflection) 
 done
 
 
 
 subsubsection\<open>The Operator \<^term>\<open>is_formula_case\<close>\<close>
 
 text\<open>The arguments of \<^term>\<open>is_a\<close> are always 2, 1, 0, and the formula
       will be enclosed by three quantifiers.\<close>
 
 (* is_formula_case :: 
     "[i=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i]=>o, i, i] => o"
   "is_formula_case(M, is_a, is_b, is_c, is_d, v, z) == 
       (\<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> is_Member(M,x,y,v) \<longrightarrow> is_a(x,y,z)) &
       (\<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> is_Equal(M,x,y,v) \<longrightarrow> is_b(x,y,z)) &
       (\<forall>x[M]. \<forall>y[M]. x\<in>formula \<longrightarrow> y\<in>formula \<longrightarrow> 
                      is_Nand(M,x,y,v) \<longrightarrow> is_c(x,y,z)) &
       (\<forall>x[M]. x\<in>formula \<longrightarrow> is_Forall(M,x,v) \<longrightarrow> is_d(x,z))" *)
 
 definition
   formula_case_fm :: "[i, i, i, i, i, i]=>i" where
   "formula_case_fm(is_a, is_b, is_c, is_d, v, z) == 
         And(Forall(Forall(Implies(finite_ordinal_fm(1), 
                            Implies(finite_ordinal_fm(0), 
                             Implies(Member_fm(1,0,v#+2), 
                              Forall(Implies(Equal(0,z#+3), is_a))))))),
         And(Forall(Forall(Implies(finite_ordinal_fm(1), 
                            Implies(finite_ordinal_fm(0), 
                             Implies(Equal_fm(1,0,v#+2), 
                              Forall(Implies(Equal(0,z#+3), is_b))))))),
         And(Forall(Forall(Implies(mem_formula_fm(1), 
                            Implies(mem_formula_fm(0), 
                             Implies(Nand_fm(1,0,v#+2), 
                              Forall(Implies(Equal(0,z#+3), is_c))))))),
         Forall(Implies(mem_formula_fm(0), 
                        Implies(Forall_fm(0,succ(v)), 
                              Forall(Implies(Equal(0,z#+2), is_d))))))))"
 
 
 lemma is_formula_case_type [TC]:
      "[| is_a \<in> formula;  is_b \<in> formula;  is_c \<in> formula;  is_d \<in> formula;  
          x \<in> nat; y \<in> nat |] 
       ==> formula_case_fm(is_a, is_b, is_c, is_d, x, y) \<in> formula"
 by (simp add: formula_case_fm_def)
 
 lemma sats_formula_case_fm:
   assumes is_a_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|]  
         ==> ISA(a2, a1, a0) \<longleftrightarrow> sats(A, is_a, Cons(a0,Cons(a1,Cons(a2,env))))"
   and is_b_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|]  
         ==> ISB(a2, a1, a0) \<longleftrightarrow> sats(A, is_b, Cons(a0,Cons(a1,Cons(a2,env))))"
   and is_c_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|]  
         ==> ISC(a2, a1, a0) \<longleftrightarrow> sats(A, is_c, Cons(a0,Cons(a1,Cons(a2,env))))"
   and is_d_iff_sats: 
       "!!a0 a1. 
         [|a0\<in>A; a1\<in>A|]  
         ==> ISD(a1, a0) \<longleftrightarrow> sats(A, is_d, Cons(a0,Cons(a1,env)))"
   shows 
       "[|x \<in> nat; y < length(env); env \<in> list(A)|]
        ==> sats(A, formula_case_fm(is_a,is_b,is_c,is_d,x,y), env) \<longleftrightarrow>
            is_formula_case(##A, ISA, ISB, ISC, ISD, nth(x,env), nth(y,env))"
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (simp add: formula_case_fm_def is_formula_case_def 
                  is_a_iff_sats [THEN iff_sym] is_b_iff_sats [THEN iff_sym]
                  is_c_iff_sats [THEN iff_sym] is_d_iff_sats [THEN iff_sym])
 done
 
 lemma formula_case_iff_sats:
   assumes is_a_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|]  
         ==> ISA(a2, a1, a0) \<longleftrightarrow> sats(A, is_a, Cons(a0,Cons(a1,Cons(a2,env))))"
   and is_b_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|]  
         ==> ISB(a2, a1, a0) \<longleftrightarrow> sats(A, is_b, Cons(a0,Cons(a1,Cons(a2,env))))"
   and is_c_iff_sats: 
       "!!a0 a1 a2. 
         [|a0\<in>A; a1\<in>A; a2\<in>A|]  
         ==> ISC(a2, a1, a0) \<longleftrightarrow> sats(A, is_c, Cons(a0,Cons(a1,Cons(a2,env))))"
   and is_d_iff_sats: 
       "!!a0 a1. 
         [|a0\<in>A; a1\<in>A|]  
         ==> ISD(a1, a0) \<longleftrightarrow> sats(A, is_d, Cons(a0,Cons(a1,env)))"
   shows 
       "[|nth(i,env) = x; nth(j,env) = y; 
       i \<in> nat; j < length(env); env \<in> list(A)|]
        ==> is_formula_case(##A, ISA, ISB, ISC, ISD, x, y) \<longleftrightarrow>
            sats(A, formula_case_fm(is_a,is_b,is_c,is_d,i,j), env)"
 by (simp add: sats_formula_case_fm [OF is_a_iff_sats is_b_iff_sats 
                                        is_c_iff_sats is_d_iff_sats])
 
 
 text\<open>The second argument of \<^term>\<open>is_a\<close> gives it direct access to \<^term>\<open>x\<close>,
   which is essential for handling free variable references.  Treatment is
   based on that of \<open>is_nat_case_reflection\<close>.\<close>
 theorem is_formula_case_reflection:
   assumes is_a_reflection:
     "!!h f g g'. REFLECTS[\<lambda>x. is_a(L, h(x), f(x), g(x), g'(x)),
                      \<lambda>i x. is_a(##Lset(i), h(x), f(x), g(x), g'(x))]"
   and is_b_reflection:
     "!!h f g g'. REFLECTS[\<lambda>x. is_b(L, h(x), f(x), g(x), g'(x)),
                      \<lambda>i x. is_b(##Lset(i), h(x), f(x), g(x), g'(x))]"
   and is_c_reflection:
     "!!h f g g'. REFLECTS[\<lambda>x. is_c(L, h(x), f(x), g(x), g'(x)),
                      \<lambda>i x. is_c(##Lset(i), h(x), f(x), g(x), g'(x))]"
   and is_d_reflection:
     "!!h f g g'. REFLECTS[\<lambda>x. is_d(L, h(x), f(x), g(x)),
                      \<lambda>i x. is_d(##Lset(i), h(x), f(x), g(x))]"
   shows "REFLECTS[\<lambda>x. is_formula_case(L, is_a(L,x), is_b(L,x), is_c(L,x), is_d(L,x), g(x), h(x)),
                \<lambda>i x. is_formula_case(##Lset(i), is_a(##Lset(i), x), is_b(##Lset(i), x), is_c(##Lset(i), x), is_d(##Lset(i), x), g(x), h(x))]"
 apply (simp (no_asm_use) only: is_formula_case_def)
 apply (intro FOL_reflections function_reflections finite_ordinal_reflection
          mem_formula_reflection
          Member_reflection Equal_reflection Nand_reflection Forall_reflection
          is_a_reflection is_b_reflection is_c_reflection is_d_reflection)
 done
 
 
 
 subsection \<open>Absoluteness for the Function \<^term>\<open>satisfies\<close>\<close>
 
 definition
   is_depth_apply :: "[i=>o,i,i,i] => o" where
    \<comment> \<open>Merely a useful abbreviation for the sequel.\<close>
   "is_depth_apply(M,h,p,z) ==
     \<exists>dp[M]. \<exists>sdp[M]. \<exists>hsdp[M]. 
         finite_ordinal(M,dp) & is_depth(M,p,dp) & successor(M,dp,sdp) &
         fun_apply(M,h,sdp,hsdp) & fun_apply(M,hsdp,p,z)"
 
 lemma (in M_datatypes) is_depth_apply_abs [simp]:
      "[|M(h); p \<in> formula; M(z)|] 
       ==> is_depth_apply(M,h,p,z) \<longleftrightarrow> z = h ` succ(depth(p)) ` p"
 by (simp add: is_depth_apply_def formula_into_M depth_type eq_commute)
 
 
 
 text\<open>There is at present some redundancy between the relativizations in
  e.g. \<open>satisfies_is_a\<close> and those in e.g. \<open>Member_replacement\<close>.\<close>
 
 text\<open>These constants let us instantiate the parameters \<^term>\<open>a\<close>, \<^term>\<open>b\<close>,
       \<^term>\<open>c\<close>, \<^term>\<open>d\<close>, etc., of the locale \<open>Formula_Rec\<close>.\<close>
 definition
   satisfies_a :: "[i,i,i]=>i" where
    "satisfies_a(A) == 
     \<lambda>x y. \<lambda>env \<in> list(A). bool_of_o (nth(x,env) \<in> nth(y,env))"
 
 definition
   satisfies_is_a :: "[i=>o,i,i,i,i]=>o" where
    "satisfies_is_a(M,A) == 
     \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, 
                 \<lambda>env z. is_bool_of_o(M, 
                       \<exists>nx[M]. \<exists>ny[M]. 
                        is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & nx \<in> ny, z),
                 zz)"
 
 definition
   satisfies_b :: "[i,i,i]=>i" where
    "satisfies_b(A) ==
     \<lambda>x y. \<lambda>env \<in> list(A). bool_of_o (nth(x,env) = nth(y,env))"
 
 definition
   satisfies_is_b :: "[i=>o,i,i,i,i]=>o" where
    \<comment> \<open>We simplify the formula to have just \<^term>\<open>nx\<close> rather than 
        introducing \<^term>\<open>ny\<close> with  \<^term>\<open>nx=ny\<close>\<close>
   "satisfies_is_b(M,A) == 
     \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, 
                 \<lambda>env z. is_bool_of_o(M, 
                       \<exists>nx[M]. is_nth(M,x,env,nx) & is_nth(M,y,env,nx), z),
                 zz)"
 
 definition 
   satisfies_c :: "[i,i,i,i,i]=>i" where
    "satisfies_c(A) == \<lambda>p q rp rq. \<lambda>env \<in> list(A). not(rp ` env and rq ` env)"
 
 definition
   satisfies_is_c :: "[i=>o,i,i,i,i,i]=>o" where
    "satisfies_is_c(M,A,h) == 
     \<lambda>p q zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, \<lambda>env z. \<exists>hp[M]. \<exists>hq[M]. 
                  (\<exists>rp[M]. is_depth_apply(M,h,p,rp) & fun_apply(M,rp,env,hp)) & 
                  (\<exists>rq[M]. is_depth_apply(M,h,q,rq) & fun_apply(M,rq,env,hq)) & 
                  (\<exists>pq[M]. is_and(M,hp,hq,pq) & is_not(M,pq,z)),
                 zz)"
 
 definition
   satisfies_d :: "[i,i,i]=>i" where
    "satisfies_d(A) 
     == \<lambda>p rp. \<lambda>env \<in> list(A). bool_of_o (\<forall>x\<in>A. rp ` (Cons(x,env)) = 1)"
 
 definition
   satisfies_is_d :: "[i=>o,i,i,i,i]=>o" where
    "satisfies_is_d(M,A,h) == 
     \<lambda>p zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, 
                 \<lambda>env z. \<exists>rp[M]. is_depth_apply(M,h,p,rp) & 
                     is_bool_of_o(M, 
                            \<forall>x[M]. \<forall>xenv[M]. \<forall>hp[M]. 
                               x\<in>A \<longrightarrow> is_Cons(M,x,env,xenv) \<longrightarrow> 
                               fun_apply(M,rp,xenv,hp) \<longrightarrow> number1(M,hp),
                   z),
                zz)"
 
 definition
   satisfies_MH :: "[i=>o,i,i,i,i]=>o" where
     \<comment> \<open>The variable \<^term>\<open>u\<close> is unused, but gives \<^term>\<open>satisfies_MH\<close> 
         the correct arity.\<close>
   "satisfies_MH == 
     \<lambda>M A u f z. 
          \<forall>fml[M]. is_formula(M,fml) \<longrightarrow>
              is_lambda (M, fml, 
                is_formula_case (M, satisfies_is_a(M,A), 
                                 satisfies_is_b(M,A), 
                                 satisfies_is_c(M,A,f), satisfies_is_d(M,A,f)),
                z)"
 
 definition
   is_satisfies :: "[i=>o,i,i,i]=>o" where
   "is_satisfies(M,A) == is_formula_rec (M, satisfies_MH(M,A))"
 
 
 text\<open>This lemma relates the fragments defined above to the original primitive
       recursion in \<^term>\<open>satisfies\<close>.
       Induction is not required: the definitions are directly equal!\<close>
 lemma satisfies_eq:
   "satisfies(A,p) = 
    formula_rec (satisfies_a(A), satisfies_b(A), 
                 satisfies_c(A), satisfies_d(A), p)"
 by (simp add: satisfies_formula_def satisfies_a_def satisfies_b_def 
               satisfies_c_def satisfies_d_def) 
 
 text\<open>Further constraints on the class \<^term>\<open>M\<close> in order to prove
       absoluteness for the constants defined above.  The ultimate goal
       is the absoluteness of the function \<^term>\<open>satisfies\<close>.\<close>
 locale M_satisfies = M_eclose +
  assumes 
    Member_replacement:
     "[|M(A); x \<in> nat; y \<in> nat|]
      ==> strong_replacement
          (M, \<lambda>env z. \<exists>bo[M]. \<exists>nx[M]. \<exists>ny[M]. 
               env \<in> list(A) & is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & 
               is_bool_of_o(M, nx \<in> ny, bo) &
               pair(M, env, bo, z))"
  and
    Equal_replacement:
     "[|M(A); x \<in> nat; y \<in> nat|]
      ==> strong_replacement
          (M, \<lambda>env z. \<exists>bo[M]. \<exists>nx[M]. \<exists>ny[M]. 
               env \<in> list(A) & is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & 
               is_bool_of_o(M, nx = ny, bo) &
               pair(M, env, bo, z))"
  and
    Nand_replacement:
     "[|M(A); M(rp); M(rq)|]
      ==> strong_replacement
          (M, \<lambda>env z. \<exists>rpe[M]. \<exists>rqe[M]. \<exists>andpq[M]. \<exists>notpq[M]. 
                fun_apply(M,rp,env,rpe) & fun_apply(M,rq,env,rqe) & 
                is_and(M,rpe,rqe,andpq) & is_not(M,andpq,notpq) & 
                env \<in> list(A) & pair(M, env, notpq, z))"
  and
   Forall_replacement:
    "[|M(A); M(rp)|]
     ==> strong_replacement
         (M, \<lambda>env z. \<exists>bo[M]. 
               env \<in> list(A) & 
               is_bool_of_o (M, 
                             \<forall>a[M]. \<forall>co[M]. \<forall>rpco[M]. 
                                a\<in>A \<longrightarrow> is_Cons(M,a,env,co) \<longrightarrow>
                                fun_apply(M,rp,co,rpco) \<longrightarrow> number1(M, rpco), 
                             bo) &
               pair(M,env,bo,z))"
  and
   formula_rec_replacement: 
       \<comment> \<open>For the \<^term>\<open>transrec\<close>\<close>
    "[|n \<in> nat; M(A)|] ==> transrec_replacement(M, satisfies_MH(M,A), n)"
  and
   formula_rec_lambda_replacement:  
       \<comment> \<open>For the \<open>\<lambda>-abstraction\<close> in the \<^term>\<open>transrec\<close> body\<close>
    "[|M(g); M(A)|] ==>
     strong_replacement (M, 
        \<lambda>x y. mem_formula(M,x) &
              (\<exists>c[M]. is_formula_case(M, satisfies_is_a(M,A),
                                   satisfies_is_b(M,A),
                                   satisfies_is_c(M,A,g),
                                   satisfies_is_d(M,A,g), x, c) &
              pair(M, x, c, y)))"
 
 
 lemma (in M_satisfies) Member_replacement':
     "[|M(A); x \<in> nat; y \<in> nat|]
      ==> strong_replacement
          (M, \<lambda>env z. env \<in> list(A) &
                      z = \<langle>env, bool_of_o(nth(x, env) \<in> nth(y, env))\<rangle>)"
 by (insert Member_replacement, simp) 
 
 lemma (in M_satisfies) Equal_replacement':
     "[|M(A); x \<in> nat; y \<in> nat|]
      ==> strong_replacement
          (M, \<lambda>env z. env \<in> list(A) &
                      z = \<langle>env, bool_of_o(nth(x, env) = nth(y, env))\<rangle>)"
 by (insert Equal_replacement, simp) 
 
 lemma (in M_satisfies) Nand_replacement':
     "[|M(A); M(rp); M(rq)|]
      ==> strong_replacement
          (M, \<lambda>env z. env \<in> list(A) & z = \<langle>env, not(rp`env and rq`env)\<rangle>)"
 by (insert Nand_replacement, simp) 
 
 lemma (in M_satisfies) Forall_replacement':
    "[|M(A); M(rp)|]
     ==> strong_replacement
         (M, \<lambda>env z.
                env \<in> list(A) &
                z = \<langle>env, bool_of_o (\<forall>a\<in>A. rp ` Cons(a,env) = 1)\<rangle>)"
 by (insert Forall_replacement, simp) 
 
 lemma (in M_satisfies) a_closed:
      "[|M(A); x\<in>nat; y\<in>nat|] ==> M(satisfies_a(A,x,y))"
 apply (simp add: satisfies_a_def) 
 apply (blast intro: lam_closed2 Member_replacement') 
 done
 
 lemma (in M_satisfies) a_rel:
      "M(A) ==> Relation2(M, nat, nat, satisfies_is_a(M,A), satisfies_a(A))"
 apply (simp add: Relation2_def satisfies_is_a_def satisfies_a_def)
 apply (auto del: iffI intro!: lambda_abs2 simp add: Relation1_def) 
 done
 
 lemma (in M_satisfies) b_closed:
      "[|M(A); x\<in>nat; y\<in>nat|] ==> M(satisfies_b(A,x,y))"
 apply (simp add: satisfies_b_def) 
 apply (blast intro: lam_closed2 Equal_replacement') 
 done
 
 lemma (in M_satisfies) b_rel:
      "M(A) ==> Relation2(M, nat, nat, satisfies_is_b(M,A), satisfies_b(A))"
 apply (simp add: Relation2_def satisfies_is_b_def satisfies_b_def)
 apply (auto del: iffI intro!: lambda_abs2 simp add: Relation1_def) 
 done
 
 lemma (in M_satisfies) c_closed:
      "[|M(A); x \<in> formula; y \<in> formula; M(rx); M(ry)|] 
       ==> M(satisfies_c(A,x,y,rx,ry))"
 apply (simp add: satisfies_c_def) 
 apply (rule lam_closed2) 
 apply (rule Nand_replacement') 
 apply (simp_all add: formula_into_M list_into_M [of _ A])
 done
 
 lemma (in M_satisfies) c_rel:
  "[|M(A); M(f)|] ==> 
   Relation2 (M, formula, formula, 
                satisfies_is_c(M,A,f),
                \<lambda>u v. satisfies_c(A, u, v, f ` succ(depth(u)) ` u, 
                                           f ` succ(depth(v)) ` v))"
 apply (simp add: Relation2_def satisfies_is_c_def satisfies_c_def)
 apply (auto del: iffI intro!: lambda_abs2 
             simp add: Relation1_def formula_into_M) 
 done
 
 lemma (in M_satisfies) d_closed:
      "[|M(A); x \<in> formula; M(rx)|] ==> M(satisfies_d(A,x,rx))"
 apply (simp add: satisfies_d_def) 
 apply (rule lam_closed2) 
 apply (rule Forall_replacement') 
 apply (simp_all add: formula_into_M list_into_M [of _ A])
 done
 
 lemma (in M_satisfies) d_rel:
  "[|M(A); M(f)|] ==> 
   Relation1(M, formula, satisfies_is_d(M,A,f), 
      \<lambda>u. satisfies_d(A, u, f ` succ(depth(u)) ` u))"
 apply (simp del: rall_abs 
             add: Relation1_def satisfies_is_d_def satisfies_d_def)
 apply (auto del: iffI intro!: lambda_abs2 simp add: Relation1_def) 
 done
 
 
 lemma (in M_satisfies) fr_replace:
       "[|n \<in> nat; M(A)|] ==> transrec_replacement(M,satisfies_MH(M,A),n)" 
 by (blast intro: formula_rec_replacement) 
 
 lemma (in M_satisfies) formula_case_satisfies_closed:
  "[|M(g); M(A); x \<in> formula|] ==>
   M(formula_case (satisfies_a(A), satisfies_b(A),
        \<lambda>u v. satisfies_c(A, u, v, 
                          g ` succ(depth(u)) ` u, g ` succ(depth(v)) ` v),
        \<lambda>u. satisfies_d (A, u, g ` succ(depth(u)) ` u),
        x))"
-by (blast intro: formula_case_closed a_closed b_closed c_closed d_closed) 
+by (blast intro: a_closed b_closed c_closed d_closed) 
 
 lemma (in M_satisfies) fr_lam_replace:
    "[|M(g); M(A)|] ==>
     strong_replacement (M, \<lambda>x y. x \<in> formula &
             y = \<langle>x, 
                  formula_rec_case(satisfies_a(A),
                                   satisfies_b(A),
                                   satisfies_c(A),
                                   satisfies_d(A), g, x)\<rangle>)"
 apply (insert formula_rec_lambda_replacement) 
 apply (simp add: formula_rec_case_def formula_case_satisfies_closed
                  formula_case_abs [OF a_rel b_rel c_rel d_rel]) 
 done
 
 
 
 text\<open>Instantiate locale \<open>Formula_Rec\<close> for the 
       Function \<^term>\<open>satisfies\<close>\<close>
 
 lemma (in M_satisfies) Formula_Rec_axioms_M:
    "M(A) ==>
     Formula_Rec_axioms(M, satisfies_a(A), satisfies_is_a(M,A), 
                           satisfies_b(A), satisfies_is_b(M,A), 
                           satisfies_c(A), satisfies_is_c(M,A), 
                           satisfies_d(A), satisfies_is_d(M,A))"
 apply (rule Formula_Rec_axioms.intro)
 apply (assumption | 
        rule a_closed a_rel b_closed b_rel c_closed c_rel d_closed d_rel
        fr_replace [unfolded satisfies_MH_def]
        fr_lam_replace) +
 done
 
 
 theorem (in M_satisfies) Formula_Rec_M: 
     "M(A) ==>
-     PROP Formula_Rec(M, satisfies_a(A), satisfies_is_a(M,A), 
+     Formula_Rec(M, satisfies_a(A), satisfies_is_a(M,A), 
                          satisfies_b(A), satisfies_is_b(M,A), 
                          satisfies_c(A), satisfies_is_c(M,A), 
                          satisfies_d(A), satisfies_is_d(M,A))"
   apply (rule Formula_Rec.intro)
    apply (rule M_satisfies.axioms, rule M_satisfies_axioms)
   apply (erule Formula_Rec_axioms_M) 
   done
 
 lemmas (in M_satisfies) 
     satisfies_closed' = Formula_Rec.formula_rec_closed [OF Formula_Rec_M]
 and satisfies_abs'    = Formula_Rec.formula_rec_abs [OF Formula_Rec_M]
 
 
 lemma (in M_satisfies) satisfies_closed:
   "[|M(A); p \<in> formula|] ==> M(satisfies(A,p))"
 by (simp add: Formula_Rec.formula_rec_closed [OF Formula_Rec_M]  
               satisfies_eq) 
 
 lemma (in M_satisfies) satisfies_abs:
   "[|M(A); M(z); p \<in> formula|] 
    ==> is_satisfies(M,A,p,z) \<longleftrightarrow> z = satisfies(A,p)"
 by (simp only: Formula_Rec.formula_rec_abs [OF Formula_Rec_M]  
                satisfies_eq is_satisfies_def satisfies_MH_def)
 
 
 subsection\<open>Internalizations Needed to Instantiate \<open>M_satisfies\<close>\<close>
 
 subsubsection\<open>The Operator \<^term>\<open>is_depth_apply\<close>, Internalized\<close>
 
 (* is_depth_apply(M,h,p,z) ==
     \<exists>dp[M]. \<exists>sdp[M]. \<exists>hsdp[M]. 
       2        1         0
         finite_ordinal(M,dp) & is_depth(M,p,dp) & successor(M,dp,sdp) &
         fun_apply(M,h,sdp,hsdp) & fun_apply(M,hsdp,p,z) *)
 definition
   depth_apply_fm :: "[i,i,i]=>i" where
     "depth_apply_fm(h,p,z) ==
        Exists(Exists(Exists(
         And(finite_ordinal_fm(2),
          And(depth_fm(p#+3,2),
           And(succ_fm(2,1),
            And(fun_apply_fm(h#+3,1,0), fun_apply_fm(0,p#+3,z#+3))))))))"
 
 lemma depth_apply_type [TC]:
      "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> depth_apply_fm(x,y,z) \<in> formula"
 by (simp add: depth_apply_fm_def)
 
 lemma sats_depth_apply_fm [simp]:
    "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, depth_apply_fm(x,y,z), env) \<longleftrightarrow>
         is_depth_apply(##A, nth(x,env), nth(y,env), nth(z,env))"
 by (simp add: depth_apply_fm_def is_depth_apply_def)
 
 lemma depth_apply_iff_sats:
     "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
         i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
      ==> is_depth_apply(##A, x, y, z) \<longleftrightarrow> sats(A, depth_apply_fm(i,j,k), env)"
 by simp
 
 lemma depth_apply_reflection:
      "REFLECTS[\<lambda>x. is_depth_apply(L,f(x),g(x),h(x)),
                \<lambda>i x. is_depth_apply(##Lset(i),f(x),g(x),h(x))]"
 apply (simp only: is_depth_apply_def)
 apply (intro FOL_reflections function_reflections depth_reflection 
              finite_ordinal_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>satisfies_is_a\<close>, Internalized\<close>
 
 (* satisfies_is_a(M,A) == 
     \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, 
                 \<lambda>env z. is_bool_of_o(M, 
                       \<exists>nx[M]. \<exists>ny[M]. 
                        is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & nx \<in> ny, z),
                 zz)  *)
 
 definition
   satisfies_is_a_fm :: "[i,i,i,i]=>i" where
   "satisfies_is_a_fm(A,x,y,z) ==
    Forall(
      Implies(is_list_fm(succ(A),0),
        lambda_fm(
          bool_of_o_fm(Exists(
                        Exists(And(nth_fm(x#+6,3,1), 
                                And(nth_fm(y#+6,3,0), 
                                    Member(1,0))))), 0), 
          0, succ(z))))"
 
 lemma satisfies_is_a_type [TC]:
      "[| A \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
       ==> satisfies_is_a_fm(A,x,y,z) \<in> formula"
 by (simp add: satisfies_is_a_fm_def)
 
 lemma sats_satisfies_is_a_fm [simp]:
    "[| u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
     ==> sats(A, satisfies_is_a_fm(u,x,y,z), env) \<longleftrightarrow>
         satisfies_is_a(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"
 apply (frule_tac x=x in lt_length_in_nat, assumption)  
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (simp add: satisfies_is_a_fm_def satisfies_is_a_def sats_lambda_fm 
                  sats_bool_of_o_fm)
 done
 
 lemma satisfies_is_a_iff_sats:
   "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
       u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
    ==> satisfies_is_a(##A,nu,nx,ny,nz) \<longleftrightarrow>
        sats(A, satisfies_is_a_fm(u,x,y,z), env)"
 by simp
 
 theorem satisfies_is_a_reflection:
      "REFLECTS[\<lambda>x. satisfies_is_a(L,f(x),g(x),h(x),g'(x)),
                \<lambda>i x. satisfies_is_a(##Lset(i),f(x),g(x),h(x),g'(x))]"
 apply (unfold satisfies_is_a_def) 
 apply (intro FOL_reflections is_lambda_reflection bool_of_o_reflection 
              nth_reflection is_list_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>satisfies_is_b\<close>, Internalized\<close>
 
 (* satisfies_is_b(M,A) == 
     \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, 
                 \<lambda>env z. is_bool_of_o(M, 
                       \<exists>nx[M]. is_nth(M,x,env,nx) & is_nth(M,y,env,nx), z),
                 zz) *)
 
 definition
   satisfies_is_b_fm :: "[i,i,i,i]=>i" where
  "satisfies_is_b_fm(A,x,y,z) ==
    Forall(
      Implies(is_list_fm(succ(A),0),
        lambda_fm(
          bool_of_o_fm(Exists(And(nth_fm(x#+5,2,0), nth_fm(y#+5,2,0))), 0), 
          0, succ(z))))"
 
 lemma satisfies_is_b_type [TC]:
      "[| A \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
       ==> satisfies_is_b_fm(A,x,y,z) \<in> formula"
 by (simp add: satisfies_is_b_fm_def)
 
 lemma sats_satisfies_is_b_fm [simp]:
    "[| u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
     ==> sats(A, satisfies_is_b_fm(u,x,y,z), env) \<longleftrightarrow>
         satisfies_is_b(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"
 apply (frule_tac x=x in lt_length_in_nat, assumption)  
 apply (frule_tac x=y in lt_length_in_nat, assumption)  
 apply (simp add: satisfies_is_b_fm_def satisfies_is_b_def sats_lambda_fm 
                  sats_bool_of_o_fm)
 done
 
 lemma satisfies_is_b_iff_sats:
   "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
       u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
    ==> satisfies_is_b(##A,nu,nx,ny,nz) \<longleftrightarrow>
        sats(A, satisfies_is_b_fm(u,x,y,z), env)"
 by simp
 
 theorem satisfies_is_b_reflection:
      "REFLECTS[\<lambda>x. satisfies_is_b(L,f(x),g(x),h(x),g'(x)),
                \<lambda>i x. satisfies_is_b(##Lset(i),f(x),g(x),h(x),g'(x))]"
 apply (unfold satisfies_is_b_def) 
 apply (intro FOL_reflections is_lambda_reflection bool_of_o_reflection 
              nth_reflection is_list_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>satisfies_is_c\<close>, Internalized\<close>
 
 (* satisfies_is_c(M,A,h) == 
     \<lambda>p q zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, \<lambda>env z. \<exists>hp[M]. \<exists>hq[M]. 
                  (\<exists>rp[M]. is_depth_apply(M,h,p,rp) & fun_apply(M,rp,env,hp)) & 
                  (\<exists>rq[M]. is_depth_apply(M,h,q,rq) & fun_apply(M,rq,env,hq)) & 
                  (\<exists>pq[M]. is_and(M,hp,hq,pq) & is_not(M,pq,z)),
                 zz) *)
 
 definition
   satisfies_is_c_fm :: "[i,i,i,i,i]=>i" where
  "satisfies_is_c_fm(A,h,p,q,zz) ==
    Forall(
      Implies(is_list_fm(succ(A),0),
        lambda_fm(
          Exists(Exists(
           And(Exists(And(depth_apply_fm(h#+7,p#+7,0), fun_apply_fm(0,4,2))),
           And(Exists(And(depth_apply_fm(h#+7,q#+7,0), fun_apply_fm(0,4,1))),
               Exists(And(and_fm(2,1,0), not_fm(0,3))))))),
          0, succ(zz))))"
 
 lemma satisfies_is_c_type [TC]:
      "[| A \<in> nat; h \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
       ==> satisfies_is_c_fm(A,h,x,y,z) \<in> formula"
 by (simp add: satisfies_is_c_fm_def)
 
 lemma sats_satisfies_is_c_fm [simp]:
    "[| u \<in> nat; v \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, satisfies_is_c_fm(u,v,x,y,z), env) \<longleftrightarrow>
         satisfies_is_c(##A, nth(u,env), nth(v,env), nth(x,env), 
                             nth(y,env), nth(z,env))"  
 by (simp add: satisfies_is_c_fm_def satisfies_is_c_def sats_lambda_fm)
 
 lemma satisfies_is_c_iff_sats:
   "[| nth(u,env) = nu; nth(v,env) = nv; nth(x,env) = nx; nth(y,env) = ny; 
       nth(z,env) = nz;
       u \<in> nat; v \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
    ==> satisfies_is_c(##A,nu,nv,nx,ny,nz) \<longleftrightarrow>
        sats(A, satisfies_is_c_fm(u,v,x,y,z), env)"
 by simp
 
 theorem satisfies_is_c_reflection:
      "REFLECTS[\<lambda>x. satisfies_is_c(L,f(x),g(x),h(x),g'(x),h'(x)),
                \<lambda>i x. satisfies_is_c(##Lset(i),f(x),g(x),h(x),g'(x),h'(x))]"
 apply (unfold satisfies_is_c_def) 
 apply (intro FOL_reflections function_reflections is_lambda_reflection
              extra_reflections nth_reflection depth_apply_reflection 
              is_list_reflection)
 done
 
 subsubsection\<open>The Operator \<^term>\<open>satisfies_is_d\<close>, Internalized\<close>
 
 (* satisfies_is_d(M,A,h) == 
     \<lambda>p zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
              is_lambda(M, lA, 
                 \<lambda>env z. \<exists>rp[M]. is_depth_apply(M,h,p,rp) & 
                     is_bool_of_o(M, 
                            \<forall>x[M]. \<forall>xenv[M]. \<forall>hp[M]. 
                               x\<in>A \<longrightarrow> is_Cons(M,x,env,xenv) \<longrightarrow> 
                               fun_apply(M,rp,xenv,hp) \<longrightarrow> number1(M,hp),
                   z),
                zz) *)
 
 definition
   satisfies_is_d_fm :: "[i,i,i,i]=>i" where
  "satisfies_is_d_fm(A,h,p,zz) ==
    Forall(
      Implies(is_list_fm(succ(A),0),
        lambda_fm(
          Exists(
            And(depth_apply_fm(h#+5,p#+5,0),
                bool_of_o_fm(
                 Forall(Forall(Forall(
                  Implies(Member(2,A#+8),
                   Implies(Cons_fm(2,5,1),
                    Implies(fun_apply_fm(3,1,0), number1_fm(0))))))), 1))),
          0, succ(zz))))"
 
 lemma satisfies_is_d_type [TC]:
      "[| A \<in> nat; h \<in> nat; x \<in> nat; z \<in> nat |]
       ==> satisfies_is_d_fm(A,h,x,z) \<in> formula"
 by (simp add: satisfies_is_d_fm_def)
 
 lemma sats_satisfies_is_d_fm [simp]:
    "[| u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, satisfies_is_d_fm(u,x,y,z), env) \<longleftrightarrow>
         satisfies_is_d(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"  
 by (simp add: satisfies_is_d_fm_def satisfies_is_d_def sats_lambda_fm
               sats_bool_of_o_fm)
 
 lemma satisfies_is_d_iff_sats:
   "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
       u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
    ==> satisfies_is_d(##A,nu,nx,ny,nz) \<longleftrightarrow>
        sats(A, satisfies_is_d_fm(u,x,y,z), env)"
 by simp
 
 theorem satisfies_is_d_reflection:
      "REFLECTS[\<lambda>x. satisfies_is_d(L,f(x),g(x),h(x),g'(x)),
                \<lambda>i x. satisfies_is_d(##Lset(i),f(x),g(x),h(x),g'(x))]"
 apply (unfold satisfies_is_d_def) 
 apply (intro FOL_reflections function_reflections is_lambda_reflection
              extra_reflections nth_reflection depth_apply_reflection 
              is_list_reflection)
 done
 
 
 subsubsection\<open>The Operator \<^term>\<open>satisfies_MH\<close>, Internalized\<close>
 
 (* satisfies_MH == 
     \<lambda>M A u f zz. 
          \<forall>fml[M]. is_formula(M,fml) \<longrightarrow>
              is_lambda (M, fml, 
                is_formula_case (M, satisfies_is_a(M,A), 
                                 satisfies_is_b(M,A), 
                                 satisfies_is_c(M,A,f), satisfies_is_d(M,A,f)),
                zz) *)
 
 definition
   satisfies_MH_fm :: "[i,i,i,i]=>i" where
  "satisfies_MH_fm(A,u,f,zz) ==
    Forall(
      Implies(is_formula_fm(0),
        lambda_fm(
          formula_case_fm(satisfies_is_a_fm(A#+7,2,1,0), 
                          satisfies_is_b_fm(A#+7,2,1,0), 
                          satisfies_is_c_fm(A#+7,f#+7,2,1,0), 
                          satisfies_is_d_fm(A#+6,f#+6,1,0), 
                          1, 0),
          0, succ(zz))))"
 
 lemma satisfies_MH_type [TC]:
      "[| A \<in> nat; u \<in> nat; x \<in> nat; z \<in> nat |]
       ==> satisfies_MH_fm(A,u,x,z) \<in> formula"
 by (simp add: satisfies_MH_fm_def)
 
 lemma sats_satisfies_MH_fm [simp]:
    "[| u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
     ==> sats(A, satisfies_MH_fm(u,x,y,z), env) \<longleftrightarrow>
         satisfies_MH(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"  
 by (simp add: satisfies_MH_fm_def satisfies_MH_def sats_lambda_fm
               sats_formula_case_fm)
 
 lemma satisfies_MH_iff_sats:
   "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
       u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
    ==> satisfies_MH(##A,nu,nx,ny,nz) \<longleftrightarrow>
        sats(A, satisfies_MH_fm(u,x,y,z), env)"
 by simp 
 
 lemmas satisfies_reflections =
        is_lambda_reflection is_formula_reflection 
        is_formula_case_reflection
        satisfies_is_a_reflection satisfies_is_b_reflection 
        satisfies_is_c_reflection satisfies_is_d_reflection
 
 theorem satisfies_MH_reflection:
      "REFLECTS[\<lambda>x. satisfies_MH(L,f(x),g(x),h(x),g'(x)),
                \<lambda>i x. satisfies_MH(##Lset(i),f(x),g(x),h(x),g'(x))]"
 apply (unfold satisfies_MH_def) 
 apply (intro FOL_reflections satisfies_reflections)
 done
 
 
 subsection\<open>Lemmas for Instantiating the Locale \<open>M_satisfies\<close>\<close>
 
 
 subsubsection\<open>The \<^term>\<open>Member\<close> Case\<close>
 
 lemma Member_Reflects:
  "REFLECTS[\<lambda>u. \<exists>v[L]. v \<in> B \<and> (\<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L].
           v \<in> lstA \<and> is_nth(L,x,v,nx) \<and> is_nth(L,y,v,ny) \<and>
           is_bool_of_o(L, nx \<in> ny, bo) \<and> pair(L,v,bo,u)),
    \<lambda>i u. \<exists>v \<in> Lset(i). v \<in> B \<and> (\<exists>bo \<in> Lset(i). \<exists>nx \<in> Lset(i). \<exists>ny \<in> Lset(i).
              v \<in> lstA \<and> is_nth(##Lset(i), x, v, nx) \<and> 
              is_nth(##Lset(i), y, v, ny) \<and>
           is_bool_of_o(##Lset(i), nx \<in> ny, bo) \<and> pair(##Lset(i), v, bo, u))]"
 by (intro FOL_reflections function_reflections nth_reflection 
           bool_of_o_reflection)
 
 
 lemma Member_replacement:
     "[|L(A); x \<in> nat; y \<in> nat|]
      ==> strong_replacement
          (L, \<lambda>env z. \<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L]. 
               env \<in> list(A) & is_nth(L,x,env,nx) & is_nth(L,y,env,ny) & 
               is_bool_of_o(L, nx \<in> ny, bo) &
               pair(L, env, bo, z))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{list(A),B,x,y}" 
          in gen_separation_multi [OF Member_Reflects], 
-       auto simp add: nat_into_M list_closed)
+       auto)
 apply (rule_tac env="[list(A),B,x,y]" in DPow_LsetI)
 apply (rule sep_rules nth_iff_sats is_bool_of_o_iff_sats | simp)+
 done
 
 
 subsubsection\<open>The \<^term>\<open>Equal\<close> Case\<close>
 
 lemma Equal_Reflects:
  "REFLECTS[\<lambda>u. \<exists>v[L]. v \<in> B \<and> (\<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L].
           v \<in> lstA \<and> is_nth(L, x, v, nx) \<and> is_nth(L, y, v, ny) \<and>
           is_bool_of_o(L, nx = ny, bo) \<and> pair(L, v, bo, u)),
    \<lambda>i u. \<exists>v \<in> Lset(i). v \<in> B \<and> (\<exists>bo \<in> Lset(i). \<exists>nx \<in> Lset(i). \<exists>ny \<in> Lset(i).
              v \<in> lstA \<and> is_nth(##Lset(i), x, v, nx) \<and> 
              is_nth(##Lset(i), y, v, ny) \<and>
           is_bool_of_o(##Lset(i), nx = ny, bo) \<and> pair(##Lset(i), v, bo, u))]"
 by (intro FOL_reflections function_reflections nth_reflection 
           bool_of_o_reflection)
 
 
 lemma Equal_replacement:
     "[|L(A); x \<in> nat; y \<in> nat|]
      ==> strong_replacement
          (L, \<lambda>env z. \<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L]. 
               env \<in> list(A) & is_nth(L,x,env,nx) & is_nth(L,y,env,ny) & 
               is_bool_of_o(L, nx = ny, bo) &
               pair(L, env, bo, z))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{list(A),B,x,y}" 
          in gen_separation_multi [OF Equal_Reflects], 
-       auto simp add: nat_into_M list_closed)
+       auto)
 apply (rule_tac env="[list(A),B,x,y]" in DPow_LsetI)
 apply (rule sep_rules nth_iff_sats is_bool_of_o_iff_sats | simp)+
 done
 
 subsubsection\<open>The \<^term>\<open>Nand\<close> Case\<close>
 
 lemma Nand_Reflects:
     "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B \<and>
                (\<exists>rpe[L]. \<exists>rqe[L]. \<exists>andpq[L]. \<exists>notpq[L].
                  fun_apply(L, rp, u, rpe) \<and> fun_apply(L, rq, u, rqe) \<and>
                  is_and(L, rpe, rqe, andpq) \<and> is_not(L, andpq, notpq) \<and>
                  u \<in> list(A) \<and> pair(L, u, notpq, x)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and>
      (\<exists>rpe \<in> Lset(i). \<exists>rqe \<in> Lset(i). \<exists>andpq \<in> Lset(i). \<exists>notpq \<in> Lset(i).
        fun_apply(##Lset(i), rp, u, rpe) \<and> fun_apply(##Lset(i), rq, u, rqe) \<and>
        is_and(##Lset(i), rpe, rqe, andpq) \<and> is_not(##Lset(i), andpq, notpq) \<and>
        u \<in> list(A) \<and> pair(##Lset(i), u, notpq, x))]"
 apply (unfold is_and_def is_not_def) 
 apply (intro FOL_reflections function_reflections)
 done
 
 lemma Nand_replacement:
     "[|L(A); L(rp); L(rq)|]
      ==> strong_replacement
          (L, \<lambda>env z. \<exists>rpe[L]. \<exists>rqe[L]. \<exists>andpq[L]. \<exists>notpq[L]. 
                fun_apply(L,rp,env,rpe) & fun_apply(L,rq,env,rqe) & 
                is_and(L,rpe,rqe,andpq) & is_not(L,andpq,notpq) & 
                env \<in> list(A) & pair(L, env, notpq, z))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{list(A),B,rp,rq}" 
          in gen_separation_multi [OF Nand_Reflects],
-       auto simp add: list_closed)
+       auto)
 apply (rule_tac env="[list(A),B,rp,rq]" in DPow_LsetI)
 apply (rule sep_rules is_and_iff_sats is_not_iff_sats | simp)+
 done
 
 
 subsubsection\<open>The \<^term>\<open>Forall\<close> Case\<close>
 
 lemma Forall_Reflects:
  "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B \<and> (\<exists>bo[L]. u \<in> list(A) \<and>
                  is_bool_of_o (L,
      \<forall>a[L]. \<forall>co[L]. \<forall>rpco[L]. a \<in> A \<longrightarrow>
                 is_Cons(L,a,u,co) \<longrightarrow> fun_apply(L,rp,co,rpco) \<longrightarrow> 
                 number1(L,rpco),
                            bo) \<and> pair(L,u,bo,x)),
  \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and> (\<exists>bo \<in> Lset(i). u \<in> list(A) \<and>
         is_bool_of_o (##Lset(i),
  \<forall>a \<in> Lset(i). \<forall>co \<in> Lset(i). \<forall>rpco \<in> Lset(i). a \<in> A \<longrightarrow>
             is_Cons(##Lset(i),a,u,co) \<longrightarrow> fun_apply(##Lset(i),rp,co,rpco) \<longrightarrow> 
             number1(##Lset(i),rpco),
                        bo) \<and> pair(##Lset(i),u,bo,x))]"
 apply (unfold is_bool_of_o_def) 
 apply (intro FOL_reflections function_reflections Cons_reflection)
 done
 
 lemma Forall_replacement:
    "[|L(A); L(rp)|]
     ==> strong_replacement
         (L, \<lambda>env z. \<exists>bo[L]. 
               env \<in> list(A) & 
               is_bool_of_o (L, 
                             \<forall>a[L]. \<forall>co[L]. \<forall>rpco[L]. 
                                a\<in>A \<longrightarrow> is_Cons(L,a,env,co) \<longrightarrow>
                                fun_apply(L,rp,co,rpco) \<longrightarrow> number1(L, rpco), 
                             bo) &
               pair(L,env,bo,z))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{A,list(A),B,rp}" 
          in gen_separation_multi [OF Forall_Reflects],
-       auto simp add: list_closed)
+       auto)
 apply (rule_tac env="[A,list(A),B,rp]" in DPow_LsetI)
 apply (rule sep_rules is_bool_of_o_iff_sats Cons_iff_sats | simp)+
 done
 
 subsubsection\<open>The \<^term>\<open>transrec_replacement\<close> Case\<close>
 
 lemma formula_rec_replacement_Reflects:
  "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B \<and> (\<exists>y[L]. pair(L, u, y, x) \<and>
              is_wfrec (L, satisfies_MH(L,A), mesa, u, y)),
     \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and> (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) \<and>
              is_wfrec (##Lset(i), satisfies_MH(##Lset(i),A), mesa, u, y))]"
 by (intro FOL_reflections function_reflections satisfies_MH_reflection 
           is_wfrec_reflection) 
 
 lemma formula_rec_replacement: 
       \<comment> \<open>For the \<^term>\<open>transrec\<close>\<close>
    "[|n \<in> nat; L(A)|] ==> transrec_replacement(L, satisfies_MH(L,A), n)"
 apply (rule transrec_replacementI, simp add: nat_into_M) 
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,A,n,Memrel(eclose({n}))}"
          in gen_separation_multi [OF formula_rec_replacement_Reflects],
        auto simp add: nat_into_M)
 apply (rule_tac env="[B,A,n,Memrel(eclose({n}))]" in DPow_LsetI)
 apply (rule sep_rules satisfies_MH_iff_sats is_wfrec_iff_sats | simp)+
 done
 
 
 subsubsection\<open>The Lambda Replacement Case\<close>
 
 lemma formula_rec_lambda_replacement_Reflects:
  "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B &
      mem_formula(L,u) &
      (\<exists>c[L].
          is_formula_case
           (L, satisfies_is_a(L,A), satisfies_is_b(L,A),
            satisfies_is_c(L,A,g), satisfies_is_d(L,A,g),
            u, c) &
          pair(L,u,c,x)),
   \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & mem_formula(##Lset(i),u) &
      (\<exists>c \<in> Lset(i).
          is_formula_case
           (##Lset(i), satisfies_is_a(##Lset(i),A), satisfies_is_b(##Lset(i),A),
            satisfies_is_c(##Lset(i),A,g), satisfies_is_d(##Lset(i),A,g),
            u, c) &
          pair(##Lset(i),u,c,x))]"
 by (intro FOL_reflections function_reflections mem_formula_reflection
           is_formula_case_reflection satisfies_is_a_reflection
           satisfies_is_b_reflection satisfies_is_c_reflection
           satisfies_is_d_reflection)  
 
 lemma formula_rec_lambda_replacement: 
       \<comment> \<open>For the \<^term>\<open>transrec\<close>\<close>
    "[|L(g); L(A)|] ==>
     strong_replacement (L, 
        \<lambda>x y. mem_formula(L,x) &
              (\<exists>c[L]. is_formula_case(L, satisfies_is_a(L,A),
                                   satisfies_is_b(L,A),
                                   satisfies_is_c(L,A,g),
                                   satisfies_is_d(L,A,g), x, c) &
              pair(L, x, c, y)))" 
 apply (rule strong_replacementI)
 apply (rule_tac u="{B,A,g}"
          in gen_separation_multi [OF formula_rec_lambda_replacement_Reflects], 
        auto)
 apply (rule_tac env="[A,g,B]" in DPow_LsetI)
 apply (rule sep_rules mem_formula_iff_sats
           formula_case_iff_sats satisfies_is_a_iff_sats
           satisfies_is_b_iff_sats satisfies_is_c_iff_sats
           satisfies_is_d_iff_sats | simp)+
 done
 
 
 subsection\<open>Instantiating \<open>M_satisfies\<close>\<close>
 
 lemma M_satisfies_axioms_L: "M_satisfies_axioms(L)"
   apply (rule M_satisfies_axioms.intro)
        apply (assumption | rule
          Member_replacement Equal_replacement 
          Nand_replacement Forall_replacement
          formula_rec_replacement formula_rec_lambda_replacement)+
   done
 
-theorem M_satisfies_L: "PROP M_satisfies(L)"
+theorem M_satisfies_L: "M_satisfies(L)"
   apply (rule M_satisfies.intro)
    apply (rule M_eclose_L)
   apply (rule M_satisfies_axioms_L)
   done
 
 text\<open>Finally: the point of the whole theory!\<close>
 lemmas satisfies_closed = M_satisfies.satisfies_closed [OF M_satisfies_L]
    and satisfies_abs = M_satisfies.satisfies_abs [OF M_satisfies_L]
 
 end
diff --git a/src/ZF/Constructible/Separation.thy b/src/ZF/Constructible/Separation.thy
--- a/src/ZF/Constructible/Separation.thy
+++ b/src/ZF/Constructible/Separation.thy
@@ -1,310 +1,310 @@
 (*  Title:      ZF/Constructible/Separation.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section\<open>Early Instances of Separation and Strong Replacement\<close>
 
 theory Separation imports L_axioms WF_absolute begin
 
 text\<open>This theory proves all instances needed for locale \<open>M_basic\<close>\<close>
 
 text\<open>Helps us solve for de Bruijn indices!\<close>
 lemma nth_ConsI: "[|nth(n,l) = x; n \<in> nat|] ==> nth(succ(n), Cons(a,l)) = x"
 by simp
 
 lemmas nth_rules = nth_0 nth_ConsI nat_0I nat_succI
 lemmas sep_rules = nth_0 nth_ConsI FOL_iff_sats function_iff_sats
                    fun_plus_iff_sats
 
 lemma Collect_conj_in_DPow:
      "[| {x\<in>A. P(x)} \<in> DPow(A);  {x\<in>A. Q(x)} \<in> DPow(A) |]
       ==> {x\<in>A. P(x) & Q(x)} \<in> DPow(A)"
 by (simp add: Int_in_DPow Collect_Int_Collect_eq [symmetric])
 
 lemma Collect_conj_in_DPow_Lset:
      "[|z \<in> Lset(j); {x \<in> Lset(j). P(x)} \<in> DPow(Lset(j))|]
       ==> {x \<in> Lset(j). x \<in> z & P(x)} \<in> DPow(Lset(j))"
 apply (frule mem_Lset_imp_subset_Lset)
 apply (simp add: Collect_conj_in_DPow Collect_mem_eq
                  subset_Int_iff2 elem_subset_in_DPow)
 done
 
 lemma separation_CollectI:
      "(\<And>z. L(z) ==> L({x \<in> z . P(x)})) ==> separation(L, \<lambda>x. P(x))"
 apply (unfold separation_def, clarify)
 apply (rule_tac x="{x\<in>z. P(x)}" in rexI)
 apply simp_all
 done
 
 text\<open>Reduces the original comprehension to the reflected one\<close>
 lemma reflection_imp_L_separation:
       "[| \<forall>x\<in>Lset(j). P(x) \<longleftrightarrow> Q(x);
           {x \<in> Lset(j) . Q(x)} \<in> DPow(Lset(j));
           Ord(j);  z \<in> Lset(j)|] ==> L({x \<in> z . P(x)})"
 apply (rule_tac i = "succ(j)" in L_I)
  prefer 2 apply simp
 apply (subgoal_tac "{x \<in> z. P(x)} = {x \<in> Lset(j). x \<in> z & (Q(x))}")
  prefer 2
  apply (blast dest: mem_Lset_imp_subset_Lset)
 apply (simp add: Lset_succ Collect_conj_in_DPow_Lset)
 done
 
 text\<open>Encapsulates the standard proof script for proving instances of 
       Separation.\<close>
 lemma gen_separation:
  assumes reflection: "REFLECTS [P,Q]"
      and Lu:         "L(u)"
      and collI: "!!j. u \<in> Lset(j)
                 \<Longrightarrow> Collect(Lset(j), Q(j)) \<in> DPow(Lset(j))"
  shows "separation(L,P)"
 apply (rule separation_CollectI)
 apply (rule_tac A="{u,z}" in subset_LsetE, blast intro: Lu)
 apply (rule ReflectsE [OF reflection], assumption)
 apply (drule subset_Lset_ltD, assumption)
 apply (erule reflection_imp_L_separation)
   apply (simp_all add: lt_Ord2, clarify)
 apply (rule collI, assumption)
 done
 
 text\<open>As above, but typically \<^term>\<open>u\<close> is a finite enumeration such as
   \<^term>\<open>{a,b}\<close>; thus the new subgoal gets the assumption
   \<^term>\<open>{a,b} \<subseteq> Lset(i)\<close>, which is logically equivalent to 
   \<^term>\<open>a \<in> Lset(i)\<close> and \<^term>\<open>b \<in> Lset(i)\<close>.\<close>
 lemma gen_separation_multi:
  assumes reflection: "REFLECTS [P,Q]"
      and Lu:         "L(u)"
      and collI: "!!j. u \<subseteq> Lset(j)
                 \<Longrightarrow> Collect(Lset(j), Q(j)) \<in> DPow(Lset(j))"
  shows "separation(L,P)"
 apply (rule gen_separation [OF reflection Lu])
 apply (drule mem_Lset_imp_subset_Lset)
 apply (erule collI) 
 done
 
 
 subsection\<open>Separation for Intersection\<close>
 
 lemma Inter_Reflects:
      "REFLECTS[\<lambda>x. \<forall>y[L]. y\<in>A \<longrightarrow> x \<in> y,
                \<lambda>i x. \<forall>y\<in>Lset(i). y\<in>A \<longrightarrow> x \<in> y]"
 by (intro FOL_reflections)
 
 lemma Inter_separation:
      "L(A) ==> separation(L, \<lambda>x. \<forall>y[L]. y\<in>A \<longrightarrow> x\<in>y)"
 apply (rule gen_separation [OF Inter_Reflects], simp)
 apply (rule DPow_LsetI)
  txt\<open>I leave this one example of a manual proof.  The tedium of manually
       instantiating \<^term>\<open>i\<close>, \<^term>\<open>j\<close> and \<^term>\<open>env\<close> is obvious.\<close>
 apply (rule ball_iff_sats)
 apply (rule imp_iff_sats)
 apply (rule_tac [2] i=1 and j=0 and env="[y,x,A]" in mem_iff_sats)
 apply (rule_tac i=0 and j=2 in mem_iff_sats)
 apply (simp_all add: succ_Un_distrib [symmetric])
 done
 
 subsection\<open>Separation for Set Difference\<close>
 
 lemma Diff_Reflects:
      "REFLECTS[\<lambda>x. x \<notin> B, \<lambda>i x. x \<notin> B]"
 by (intro FOL_reflections)  
 
 lemma Diff_separation:
      "L(B) ==> separation(L, \<lambda>x. x \<notin> B)"
 apply (rule gen_separation [OF Diff_Reflects], simp)
 apply (rule_tac env="[B]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 subsection\<open>Separation for Cartesian Product\<close>
 
 lemma cartprod_Reflects:
      "REFLECTS[\<lambda>z. \<exists>x[L]. x\<in>A & (\<exists>y[L]. y\<in>B & pair(L,x,y,z)),
                 \<lambda>i z. \<exists>x\<in>Lset(i). x\<in>A & (\<exists>y\<in>Lset(i). y\<in>B &
                                    pair(##Lset(i),x,y,z))]"
 by (intro FOL_reflections function_reflections)
 
 lemma cartprod_separation:
      "[| L(A); L(B) |]
       ==> separation(L, \<lambda>z. \<exists>x[L]. x\<in>A & (\<exists>y[L]. y\<in>B & pair(L,x,y,z)))"
 apply (rule gen_separation_multi [OF cartprod_Reflects, of "{A,B}"], auto)
 apply (rule_tac env="[A,B]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 subsection\<open>Separation for Image\<close>
 
 lemma image_Reflects:
      "REFLECTS[\<lambda>y. \<exists>p[L]. p\<in>r & (\<exists>x[L]. x\<in>A & pair(L,x,y,p)),
            \<lambda>i y. \<exists>p\<in>Lset(i). p\<in>r & (\<exists>x\<in>Lset(i). x\<in>A & pair(##Lset(i),x,y,p))]"
 by (intro FOL_reflections function_reflections)
 
 lemma image_separation:
      "[| L(A); L(r) |]
       ==> separation(L, \<lambda>y. \<exists>p[L]. p\<in>r & (\<exists>x[L]. x\<in>A & pair(L,x,y,p)))"
 apply (rule gen_separation_multi [OF image_Reflects, of "{A,r}"], auto)
 apply (rule_tac env="[A,r]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Separation for Converse\<close>
 
 lemma converse_Reflects:
   "REFLECTS[\<lambda>z. \<exists>p[L]. p\<in>r & (\<exists>x[L]. \<exists>y[L]. pair(L,x,y,p) & pair(L,y,x,z)),
      \<lambda>i z. \<exists>p\<in>Lset(i). p\<in>r & (\<exists>x\<in>Lset(i). \<exists>y\<in>Lset(i).
                      pair(##Lset(i),x,y,p) & pair(##Lset(i),y,x,z))]"
 by (intro FOL_reflections function_reflections)
 
 lemma converse_separation:
      "L(r) ==> separation(L,
          \<lambda>z. \<exists>p[L]. p\<in>r & (\<exists>x[L]. \<exists>y[L]. pair(L,x,y,p) & pair(L,y,x,z)))"
 apply (rule gen_separation [OF converse_Reflects], simp)
 apply (rule_tac env="[r]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Separation for Restriction\<close>
 
 lemma restrict_Reflects:
      "REFLECTS[\<lambda>z. \<exists>x[L]. x\<in>A & (\<exists>y[L]. pair(L,x,y,z)),
         \<lambda>i z. \<exists>x\<in>Lset(i). x\<in>A & (\<exists>y\<in>Lset(i). pair(##Lset(i),x,y,z))]"
 by (intro FOL_reflections function_reflections)
 
 lemma restrict_separation:
    "L(A) ==> separation(L, \<lambda>z. \<exists>x[L]. x\<in>A & (\<exists>y[L]. pair(L,x,y,z)))"
 apply (rule gen_separation [OF restrict_Reflects], simp)
 apply (rule_tac env="[A]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Separation for Composition\<close>
 
 lemma comp_Reflects:
      "REFLECTS[\<lambda>xz. \<exists>x[L]. \<exists>y[L]. \<exists>z[L]. \<exists>xy[L]. \<exists>yz[L].
                   pair(L,x,z,xz) & pair(L,x,y,xy) & pair(L,y,z,yz) &
                   xy\<in>s & yz\<in>r,
         \<lambda>i xz. \<exists>x\<in>Lset(i). \<exists>y\<in>Lset(i). \<exists>z\<in>Lset(i). \<exists>xy\<in>Lset(i). \<exists>yz\<in>Lset(i).
                   pair(##Lset(i),x,z,xz) & pair(##Lset(i),x,y,xy) &
                   pair(##Lset(i),y,z,yz) & xy\<in>s & yz\<in>r]"
 by (intro FOL_reflections function_reflections)
 
 lemma comp_separation:
      "[| L(r); L(s) |]
       ==> separation(L, \<lambda>xz. \<exists>x[L]. \<exists>y[L]. \<exists>z[L]. \<exists>xy[L]. \<exists>yz[L].
                   pair(L,x,z,xz) & pair(L,x,y,xy) & pair(L,y,z,yz) &
                   xy\<in>s & yz\<in>r)"
 apply (rule gen_separation_multi [OF comp_Reflects, of "{r,s}"], auto)
 txt\<open>Subgoals after applying general ``separation'' rule:
      @{subgoals[display,indent=0,margin=65]}\<close>
 apply (rule_tac env="[r,s]" in DPow_LsetI)
 txt\<open>Subgoals ready for automatic synthesis of a formula:
      @{subgoals[display,indent=0,margin=65]}\<close>
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Separation for Predecessors in an Order\<close>
 
 lemma pred_Reflects:
      "REFLECTS[\<lambda>y. \<exists>p[L]. p\<in>r & pair(L,y,x,p),
                     \<lambda>i y. \<exists>p \<in> Lset(i). p\<in>r & pair(##Lset(i),y,x,p)]"
 by (intro FOL_reflections function_reflections)
 
 lemma pred_separation:
      "[| L(r); L(x) |] ==> separation(L, \<lambda>y. \<exists>p[L]. p\<in>r & pair(L,y,x,p))"
 apply (rule gen_separation_multi [OF pred_Reflects, of "{r,x}"], auto)
 apply (rule_tac env="[r,x]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Separation for the Membership Relation\<close>
 
 lemma Memrel_Reflects:
      "REFLECTS[\<lambda>z. \<exists>x[L]. \<exists>y[L]. pair(L,x,y,z) & x \<in> y,
             \<lambda>i z. \<exists>x \<in> Lset(i). \<exists>y \<in> Lset(i). pair(##Lset(i),x,y,z) & x \<in> y]"
 by (intro FOL_reflections function_reflections)
 
 lemma Memrel_separation:
      "separation(L, \<lambda>z. \<exists>x[L]. \<exists>y[L]. pair(L,x,y,z) & x \<in> y)"
 apply (rule gen_separation [OF Memrel_Reflects nonempty])
 apply (rule_tac env="[]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Replacement for FunSpace\<close>
 
 lemma funspace_succ_Reflects:
  "REFLECTS[\<lambda>z. \<exists>p[L]. p\<in>A & (\<exists>f[L]. \<exists>b[L]. \<exists>nb[L]. \<exists>cnbf[L].
             pair(L,f,b,p) & pair(L,n,b,nb) & is_cons(L,nb,f,cnbf) &
             upair(L,cnbf,cnbf,z)),
         \<lambda>i z. \<exists>p \<in> Lset(i). p\<in>A & (\<exists>f \<in> Lset(i). \<exists>b \<in> Lset(i).
               \<exists>nb \<in> Lset(i). \<exists>cnbf \<in> Lset(i).
                 pair(##Lset(i),f,b,p) & pair(##Lset(i),n,b,nb) &
                 is_cons(##Lset(i),nb,f,cnbf) & upair(##Lset(i),cnbf,cnbf,z))]"
 by (intro FOL_reflections function_reflections)
 
 lemma funspace_succ_replacement:
      "L(n) ==>
       strong_replacement(L, \<lambda>p z. \<exists>f[L]. \<exists>b[L]. \<exists>nb[L]. \<exists>cnbf[L].
                 pair(L,f,b,p) & pair(L,n,b,nb) & is_cons(L,nb,f,cnbf) &
                 upair(L,cnbf,cnbf,z))"
 apply (rule strong_replacementI)
 apply (rule_tac u="{n,B}" in gen_separation_multi [OF funspace_succ_Reflects], 
        auto)
 apply (rule_tac env="[n,B]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Separation for a Theorem about \<^term>\<open>is_recfun\<close>\<close>
 
 lemma is_recfun_reflects:
   "REFLECTS[\<lambda>x. \<exists>xa[L]. \<exists>xb[L].
                 pair(L,x,a,xa) & xa \<in> r & pair(L,x,b,xb) & xb \<in> r &
                 (\<exists>fx[L]. \<exists>gx[L]. fun_apply(L,f,x,fx) & fun_apply(L,g,x,gx) &
                                    fx \<noteq> gx),
    \<lambda>i x. \<exists>xa \<in> Lset(i). \<exists>xb \<in> Lset(i).
           pair(##Lset(i),x,a,xa) & xa \<in> r & pair(##Lset(i),x,b,xb) & xb \<in> r &
                 (\<exists>fx \<in> Lset(i). \<exists>gx \<in> Lset(i). fun_apply(##Lset(i),f,x,fx) &
                   fun_apply(##Lset(i),g,x,gx) & fx \<noteq> gx)]"
 by (intro FOL_reflections function_reflections fun_plus_reflections)
 
 lemma is_recfun_separation:
      \<comment> \<open>for well-founded recursion\<close>
      "[| L(r); L(f); L(g); L(a); L(b) |]
      ==> separation(L,
             \<lambda>x. \<exists>xa[L]. \<exists>xb[L].
                 pair(L,x,a,xa) & xa \<in> r & pair(L,x,b,xb) & xb \<in> r &
                 (\<exists>fx[L]. \<exists>gx[L]. fun_apply(L,f,x,fx) & fun_apply(L,g,x,gx) &
                                    fx \<noteq> gx))"
 apply (rule gen_separation_multi [OF is_recfun_reflects, of "{r,f,g,a,b}"], 
             auto)
 apply (rule_tac env="[r,f,g,a,b]" in DPow_LsetI)
 apply (rule sep_rules | simp)+
 done
 
 
 subsection\<open>Instantiating the locale \<open>M_basic\<close>\<close>
 text\<open>Separation (and Strong Replacement) for basic set-theoretic constructions
 such as intersection, Cartesian Product and image.\<close>
 
 lemma M_basic_axioms_L: "M_basic_axioms(L)"
   apply (rule M_basic_axioms.intro)
        apply (assumption | rule
          Inter_separation Diff_separation cartprod_separation image_separation
          converse_separation restrict_separation
          comp_separation pred_separation Memrel_separation
-         funspace_succ_replacement is_recfun_separation)+
+         funspace_succ_replacement is_recfun_separation power_ax)+
   done
 
-theorem M_basic_L: "PROP M_basic(L)"
+theorem M_basic_L: " M_basic(L)"
 by (rule M_basic.intro [OF M_trivial_L M_basic_axioms_L])
 
 interpretation L?: M_basic L by (rule M_basic_L)
 
 
 end
diff --git a/src/ZF/Constructible/WF_absolute.thy b/src/ZF/Constructible/WF_absolute.thy
--- a/src/ZF/Constructible/WF_absolute.thy
+++ b/src/ZF/Constructible/WF_absolute.thy
@@ -1,310 +1,310 @@
 (*  Title:      ZF/Constructible/WF_absolute.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Absoluteness of Well-Founded Recursion\<close>
 
 theory WF_absolute imports WFrec begin
 
 subsection\<open>Transitive closure without fixedpoints\<close>
 
 definition
   rtrancl_alt :: "[i,i]=>i" where
     "rtrancl_alt(A,r) ==
        {p \<in> A*A. \<exists>n\<in>nat. \<exists>f \<in> succ(n) -> A.
                  (\<exists>x y. p = <x,y> &  f`0 = x & f`n = y) &
                        (\<forall>i\<in>n. <f`i, f`succ(i)> \<in> r)}"
 
 lemma alt_rtrancl_lemma1 [rule_format]:
     "n \<in> nat
      ==> \<forall>f \<in> succ(n) -> field(r).
          (\<forall>i\<in>n. \<langle>f`i, f ` succ(i)\<rangle> \<in> r) \<longrightarrow> \<langle>f`0, f`n\<rangle> \<in> r^*"
 apply (induct_tac n)
 apply (simp_all add: apply_funtype rtrancl_refl, clarify)
 apply (rename_tac n f)
 apply (rule rtrancl_into_rtrancl)
  prefer 2 apply assumption
 apply (drule_tac x="restrict(f,succ(n))" in bspec)
  apply (blast intro: restrict_type2)
 apply (simp add: Ord_succ_mem_iff nat_0_le [THEN ltD] leI [THEN ltD] ltI)
 done
 
 lemma rtrancl_alt_subset_rtrancl: "rtrancl_alt(field(r),r) \<subseteq> r^*"
 apply (simp add: rtrancl_alt_def)
 apply (blast intro: alt_rtrancl_lemma1)
 done
 
 lemma rtrancl_subset_rtrancl_alt: "r^* \<subseteq> rtrancl_alt(field(r),r)"
 apply (simp add: rtrancl_alt_def, clarify)
 apply (frule rtrancl_type [THEN subsetD], clarify, simp)
 apply (erule rtrancl_induct)
  txt\<open>Base case, trivial\<close>
  apply (rule_tac x=0 in bexI)
   apply (rule_tac x="\<lambda>x\<in>1. xa" in bexI)
    apply simp_all
 txt\<open>Inductive step\<close>
 apply clarify
 apply (rename_tac n f)
 apply (rule_tac x="succ(n)" in bexI)
  apply (rule_tac x="\<lambda>i\<in>succ(succ(n)). if i=succ(n) then z else f`i" in bexI)
   apply (simp add: Ord_succ_mem_iff nat_0_le [THEN ltD] leI [THEN ltD] ltI)
   apply (blast intro: mem_asym)
  apply typecheck
  apply auto
 done
 
 lemma rtrancl_alt_eq_rtrancl: "rtrancl_alt(field(r),r) = r^*"
 by (blast del: subsetI
           intro: rtrancl_alt_subset_rtrancl rtrancl_subset_rtrancl_alt)
 
 
 definition
   rtran_closure_mem :: "[i=>o,i,i,i] => o" where
     \<comment> \<open>The property of belonging to \<open>rtran_closure(r)\<close>\<close>
     "rtran_closure_mem(M,A,r,p) ==
               \<exists>nnat[M]. \<exists>n[M]. \<exists>n'[M]. 
                omega(M,nnat) & n\<in>nnat & successor(M,n,n') &
                (\<exists>f[M]. typed_function(M,n',A,f) &
                 (\<exists>x[M]. \<exists>y[M]. \<exists>zero[M]. pair(M,x,y,p) & empty(M,zero) &
                   fun_apply(M,f,zero,x) & fun_apply(M,f,n,y)) &
                   (\<forall>j[M]. j\<in>n \<longrightarrow> 
                     (\<exists>fj[M]. \<exists>sj[M]. \<exists>fsj[M]. \<exists>ffp[M]. 
                       fun_apply(M,f,j,fj) & successor(M,j,sj) &
                       fun_apply(M,f,sj,fsj) & pair(M,fj,fsj,ffp) & ffp \<in> r)))"
 
 definition
   rtran_closure :: "[i=>o,i,i] => o" where
     "rtran_closure(M,r,s) == 
         \<forall>A[M]. is_field(M,r,A) \<longrightarrow>
          (\<forall>p[M]. p \<in> s \<longleftrightarrow> rtran_closure_mem(M,A,r,p))"
 
 definition
   tran_closure :: "[i=>o,i,i] => o" where
     "tran_closure(M,r,t) ==
          \<exists>s[M]. rtran_closure(M,r,s) & composition(M,r,s,t)"
-
-lemma (in M_basic) rtran_closure_mem_iff:
-     "[|M(A); M(r); M(p)|]
-      ==> rtran_closure_mem(M,A,r,p) \<longleftrightarrow>
-          (\<exists>n[M]. n\<in>nat & 
-           (\<exists>f[M]. f \<in> succ(n) -> A &
-            (\<exists>x[M]. \<exists>y[M]. p = <x,y> & f`0 = x & f`n = y) &
-                           (\<forall>i\<in>n. <f`i, f`succ(i)> \<in> r)))"
-by (simp add: rtran_closure_mem_def Ord_succ_mem_iff nat_0_le [THEN ltD]) 
-
-
+    
 locale M_trancl = M_basic +
   assumes rtrancl_separation:
          "[| M(r); M(A) |] ==> separation (M, rtran_closure_mem(M,A,r))"
       and wellfounded_trancl_separation:
          "[| M(r); M(Z) |] ==> 
           separation (M, \<lambda>x. 
               \<exists>w[M]. \<exists>wx[M]. \<exists>rp[M]. 
                w \<in> Z & pair(M,w,x,wx) & tran_closure(M,r,rp) & wx \<in> rp)"
+      and M_nat [iff] : "M(nat)"
 
+lemma (in M_trancl) rtran_closure_mem_iff:
+     "[|M(A); M(r); M(p)|]
+      ==> rtran_closure_mem(M,A,r,p) \<longleftrightarrow>
+          (\<exists>n[M]. n\<in>nat & 
+           (\<exists>f[M]. f \<in> succ(n) -> A &
+            (\<exists>x[M]. \<exists>y[M]. p = <x,y> & f`0 = x & f`n = y) &
+                           (\<forall>i\<in>n. <f`i, f`succ(i)> \<in> r)))"
+  apply (simp add: rtran_closure_mem_def Ord_succ_mem_iff nat_0_le [THEN ltD]) 
+done
 
 lemma (in M_trancl) rtran_closure_rtrancl:
      "M(r) ==> rtran_closure(M,r,rtrancl(r))"
 apply (simp add: rtran_closure_def rtran_closure_mem_iff 
                  rtrancl_alt_eq_rtrancl [symmetric] rtrancl_alt_def)
 apply (auto simp add: nat_0_le [THEN ltD] apply_funtype) 
 done
 
 lemma (in M_trancl) rtrancl_closed [intro,simp]:
      "M(r) ==> M(rtrancl(r))"
 apply (insert rtrancl_separation [of r "field(r)"])
 apply (simp add: rtrancl_alt_eq_rtrancl [symmetric]
                  rtrancl_alt_def rtran_closure_mem_iff)
 done
 
 lemma (in M_trancl) rtrancl_abs [simp]:
      "[| M(r); M(z) |] ==> rtran_closure(M,r,z) \<longleftrightarrow> z = rtrancl(r)"
 apply (rule iffI)
  txt\<open>Proving the right-to-left implication\<close>
  prefer 2 apply (blast intro: rtran_closure_rtrancl)
 apply (rule M_equalityI)
 apply (simp add: rtran_closure_def rtrancl_alt_eq_rtrancl [symmetric]
                  rtrancl_alt_def rtran_closure_mem_iff)
 apply (auto simp add: nat_0_le [THEN ltD] apply_funtype) 
 done
 
 lemma (in M_trancl) trancl_closed [intro,simp]:
      "M(r) ==> M(trancl(r))"
-by (simp add: trancl_def comp_closed rtrancl_closed)
+by (simp add: trancl_def)
 
 lemma (in M_trancl) trancl_abs [simp]:
      "[| M(r); M(z) |] ==> tran_closure(M,r,z) \<longleftrightarrow> z = trancl(r)"
 by (simp add: tran_closure_def trancl_def)
 
 lemma (in M_trancl) wellfounded_trancl_separation':
      "[| M(r); M(Z) |] ==> separation (M, \<lambda>x. \<exists>w[M]. w \<in> Z & <w,x> \<in> r^+)"
 by (insert wellfounded_trancl_separation [of r Z], simp) 
 
 text\<open>Alternative proof of \<open>wf_on_trancl\<close>; inspiration for the
       relativized version.  Original version is on theory WF.\<close>
 lemma "[| wf[A](r);  r-``A \<subseteq> A |] ==> wf[A](r^+)"
 apply (simp add: wf_on_def wf_def)
-apply (safe intro!: equalityI)
+apply (safe)
 apply (drule_tac x = "{x\<in>A. \<exists>w. \<langle>w,x\<rangle> \<in> r^+ & w \<in> Z}" in spec)
 apply (blast elim: tranclE)
 done
 
 lemma (in M_trancl) wellfounded_on_trancl:
      "[| wellfounded_on(M,A,r);  r-``A \<subseteq> A; M(r); M(A) |]
       ==> wellfounded_on(M,A,r^+)"
 apply (simp add: wellfounded_on_def)
 apply (safe intro!: equalityI)
 apply (rename_tac Z x)
 apply (subgoal_tac "M({x\<in>A. \<exists>w[M]. w \<in> Z & \<langle>w,x\<rangle> \<in> r^+})")
  prefer 2
  apply (blast intro: wellfounded_trancl_separation') 
 apply (drule_tac x = "{x\<in>A. \<exists>w[M]. w \<in> Z & \<langle>w,x\<rangle> \<in> r^+}" in rspec, safe)
 apply (blast dest: transM, simp)
 apply (rename_tac y w)
 apply (drule_tac x=w in bspec, assumption, clarify)
 apply (erule tranclE)
   apply (blast dest: transM)   (*transM is needed to prove M(xa)*)
  apply blast
 done
 
 lemma (in M_trancl) wellfounded_trancl:
      "[|wellfounded(M,r); M(r)|] ==> wellfounded(M,r^+)"
 apply (simp add: wellfounded_iff_wellfounded_on_field)
 apply (rule wellfounded_on_subset_A, erule wellfounded_on_trancl)
    apply blast
   apply (simp_all add: trancl_type [THEN field_rel_subset])
 done
 
 
 text\<open>Absoluteness for wfrec-defined functions.\<close>
 
 (*first use is_recfun, then M_is_recfun*)
 
 lemma (in M_trancl) wfrec_relativize:
   "[|wf(r); M(a); M(r);  
      strong_replacement(M, \<lambda>x z. \<exists>y[M]. \<exists>g[M].
           pair(M,x,y,z) & 
           is_recfun(r^+, x, \<lambda>x f. H(x, restrict(f, r -`` {x})), g) & 
           y = H(x, restrict(g, r -`` {x}))); 
      \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|] 
    ==> wfrec(r,a,H) = z \<longleftrightarrow> 
        (\<exists>f[M]. is_recfun(r^+, a, \<lambda>x f. H(x, restrict(f, r -`` {x})), f) & 
             z = H(a,restrict(f,r-``{a})))"
 apply (frule wf_trancl) 
 apply (simp add: wftrec_def wfrec_def, safe)
  apply (frule wf_exists_is_recfun 
               [of concl: "r^+" a "\<lambda>x f. H(x, restrict(f, r -`` {x}))"]) 
       apply (simp_all add: trans_trancl function_restrictI trancl_subset_times)
  apply (clarify, rule_tac x=x in rexI) 
  apply (simp_all add: the_recfun_eq trans_trancl trancl_subset_times)
 done
 
 
 text\<open>Assuming \<^term>\<open>r\<close> is transitive simplifies the occurrences of \<open>H\<close>.
       The premise \<^term>\<open>relation(r)\<close> is necessary 
       before we can replace \<^term>\<open>r^+\<close> by \<^term>\<open>r\<close>.\<close>
 theorem (in M_trancl) trans_wfrec_relativize:
   "[|wf(r);  trans(r);  relation(r);  M(r);  M(a);
      wfrec_replacement(M,MH,r);  relation2(M,MH,H);
      \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|] 
    ==> wfrec(r,a,H) = z \<longleftrightarrow> (\<exists>f[M]. is_recfun(r,a,H,f) & z = H(a,f))" 
 apply (frule wfrec_replacement', assumption+) 
 apply (simp cong: is_recfun_cong
            add: wfrec_relativize trancl_eq_r
                 is_recfun_restrict_idem domain_restrict_idem)
 done
 
 theorem (in M_trancl) trans_wfrec_abs:
   "[|wf(r);  trans(r);  relation(r);  M(r);  M(a);  M(z);
      wfrec_replacement(M,MH,r);  relation2(M,MH,H);
      \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|] 
    ==> is_wfrec(M,MH,r,a,z) \<longleftrightarrow> z=wfrec(r,a,H)" 
 by (simp add: trans_wfrec_relativize [THEN iff_sym] is_wfrec_abs, blast) 
 
 
 lemma (in M_trancl) trans_eq_pair_wfrec_iff:
   "[|wf(r);  trans(r); relation(r); M(r);  M(y); 
      wfrec_replacement(M,MH,r);  relation2(M,MH,H);
      \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|] 
    ==> y = <x, wfrec(r, x, H)> \<longleftrightarrow> 
        (\<exists>f[M]. is_recfun(r,x,H,f) & y = <x, H(x,f)>)"
 apply safe 
  apply (simp add: trans_wfrec_relativize [THEN iff_sym, of concl: _ x]) 
 txt\<open>converse direction\<close>
 apply (rule sym)
 apply (simp add: trans_wfrec_relativize, blast) 
 done
 
 
 subsection\<open>M is closed under well-founded recursion\<close>
 
 text\<open>Lemma with the awkward premise mentioning \<open>wfrec\<close>.\<close>
 lemma (in M_trancl) wfrec_closed_lemma [rule_format]:
      "[|wf(r); M(r); 
         strong_replacement(M, \<lambda>x y. y = \<langle>x, wfrec(r, x, H)\<rangle>);
         \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g)) |] 
       ==> M(a) \<longrightarrow> M(wfrec(r,a,H))"
 apply (rule_tac a=a in wf_induct, assumption+)
 apply (subst wfrec, assumption, clarify)
 apply (drule_tac x1=x and x="\<lambda>x\<in>r -`` {x}. wfrec(r, x, H)" 
        in rspec [THEN rspec]) 
 apply (simp_all add: function_lam) 
 apply (blast intro: lam_closed dest: pair_components_in_M) 
 done
 
 text\<open>Eliminates one instance of replacement.\<close>
 lemma (in M_trancl) wfrec_replacement_iff:
      "strong_replacement(M, \<lambda>x z. 
           \<exists>y[M]. pair(M,x,y,z) & (\<exists>g[M]. is_recfun(r,x,H,g) & y = H(x,g))) \<longleftrightarrow>
       strong_replacement(M, 
            \<lambda>x y. \<exists>f[M]. is_recfun(r,x,H,f) & y = <x, H(x,f)>)"
 apply simp 
 apply (rule strong_replacement_cong, blast) 
 done
 
 text\<open>Useful version for transitive relations\<close>
 theorem (in M_trancl) trans_wfrec_closed:
      "[|wf(r); trans(r); relation(r); M(r); M(a);
        wfrec_replacement(M,MH,r);  relation2(M,MH,H);
         \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g)) |] 
       ==> M(wfrec(r,a,H))"
 apply (frule wfrec_replacement', assumption+) 
 apply (frule wfrec_replacement_iff [THEN iffD1]) 
 apply (rule wfrec_closed_lemma, assumption+) 
 apply (simp_all add: wfrec_replacement_iff trans_eq_pair_wfrec_iff) 
 done
 
 subsection\<open>Absoluteness without assuming transitivity\<close>
 lemma (in M_trancl) eq_pair_wfrec_iff:
   "[|wf(r);  M(r);  M(y); 
      strong_replacement(M, \<lambda>x z. \<exists>y[M]. \<exists>g[M].
           pair(M,x,y,z) & 
           is_recfun(r^+, x, \<lambda>x f. H(x, restrict(f, r -`` {x})), g) & 
           y = H(x, restrict(g, r -`` {x}))); 
      \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|] 
    ==> y = <x, wfrec(r, x, H)> \<longleftrightarrow> 
        (\<exists>f[M]. is_recfun(r^+, x, \<lambda>x f. H(x, restrict(f, r -`` {x})), f) & 
             y = <x, H(x,restrict(f,r-``{x}))>)"
 apply safe  
  apply (simp add: wfrec_relativize [THEN iff_sym, of concl: _ x]) 
 txt\<open>converse direction\<close>
 apply (rule sym)
 apply (simp add: wfrec_relativize, blast) 
 done
 
 text\<open>Full version not assuming transitivity, but maybe not very useful.\<close>
 theorem (in M_trancl) wfrec_closed:
      "[|wf(r); M(r); M(a);
         wfrec_replacement(M,MH,r^+);  
         relation2(M,MH, \<lambda>x f. H(x, restrict(f, r -`` {x})));
         \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g)) |] 
       ==> M(wfrec(r,a,H))"
 apply (frule wfrec_replacement' 
                [of MH "r^+" "\<lambda>x f. H(x, restrict(f, r -`` {x}))"])
    prefer 4
    apply (frule wfrec_replacement_iff [THEN iffD1]) 
    apply (rule wfrec_closed_lemma, assumption+) 
      apply (simp_all add: eq_pair_wfrec_iff func.function_restrictI) 
 done
 
 end
diff --git a/src/ZF/Constructible/Wellorderings.thy b/src/ZF/Constructible/Wellorderings.thy
--- a/src/ZF/Constructible/Wellorderings.thy
+++ b/src/ZF/Constructible/Wellorderings.thy
@@ -1,240 +1,240 @@
 (*  Title:      ZF/Constructible/Wellorderings.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
 *)
 
 section \<open>Relativized Wellorderings\<close>
 
 theory Wellorderings imports Relative begin
 
 text\<open>We define functions analogous to \<^term>\<open>ordermap\<close> \<^term>\<open>ordertype\<close> 
       but without using recursion.  Instead, there is a direct appeal
       to Replacement.  This will be the basis for a version relativized
       to some class \<open>M\<close>.  The main result is Theorem I 7.6 in Kunen,
       page 17.\<close>
 
 
 subsection\<open>Wellorderings\<close>
 
 definition
   irreflexive :: "[i=>o,i,i]=>o" where
     "irreflexive(M,A,r) == \<forall>x[M]. x\<in>A \<longrightarrow> <x,x> \<notin> r"
   
 definition
   transitive_rel :: "[i=>o,i,i]=>o" where
     "transitive_rel(M,A,r) == 
         \<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow> (\<forall>z[M]. z\<in>A \<longrightarrow> 
                           <x,y>\<in>r \<longrightarrow> <y,z>\<in>r \<longrightarrow> <x,z>\<in>r))"
 
 definition
   linear_rel :: "[i=>o,i,i]=>o" where
     "linear_rel(M,A,r) == 
         \<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow> <x,y>\<in>r | x=y | <y,x>\<in>r)"
 
 definition
   wellfounded :: "[i=>o,i]=>o" where
     \<comment> \<open>EVERY non-empty set has an \<open>r\<close>-minimal element\<close>
     "wellfounded(M,r) == 
         \<forall>x[M]. x\<noteq>0 \<longrightarrow> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & <z,y> \<in> r))"
 definition
   wellfounded_on :: "[i=>o,i,i]=>o" where
     \<comment> \<open>every non-empty SUBSET OF \<open>A\<close> has an \<open>r\<close>-minimal element\<close>
     "wellfounded_on(M,A,r) == 
         \<forall>x[M]. x\<noteq>0 \<longrightarrow> x\<subseteq>A \<longrightarrow> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & <z,y> \<in> r))"
 
 definition
   wellordered :: "[i=>o,i,i]=>o" where
     \<comment> \<open>linear and wellfounded on \<open>A\<close>\<close>
     "wellordered(M,A,r) == 
         transitive_rel(M,A,r) & linear_rel(M,A,r) & wellfounded_on(M,A,r)"
 
 
 subsubsection \<open>Trivial absoluteness proofs\<close>
 
 lemma (in M_basic) irreflexive_abs [simp]: 
      "M(A) ==> irreflexive(M,A,r) \<longleftrightarrow> irrefl(A,r)"
 by (simp add: irreflexive_def irrefl_def)
 
 lemma (in M_basic) transitive_rel_abs [simp]: 
      "M(A) ==> transitive_rel(M,A,r) \<longleftrightarrow> trans[A](r)"
 by (simp add: transitive_rel_def trans_on_def)
 
 lemma (in M_basic) linear_rel_abs [simp]: 
      "M(A) ==> linear_rel(M,A,r) \<longleftrightarrow> linear(A,r)"
 by (simp add: linear_rel_def linear_def)
 
 lemma (in M_basic) wellordered_is_trans_on: 
     "[| wellordered(M,A,r); M(A) |] ==> trans[A](r)"
 by (auto simp add: wellordered_def)
 
 lemma (in M_basic) wellordered_is_linear: 
     "[| wellordered(M,A,r); M(A) |] ==> linear(A,r)"
 by (auto simp add: wellordered_def)
 
 lemma (in M_basic) wellordered_is_wellfounded_on: 
     "[| wellordered(M,A,r); M(A) |] ==> wellfounded_on(M,A,r)"
 by (auto simp add: wellordered_def)
 
 lemma (in M_basic) wellfounded_imp_wellfounded_on: 
     "[| wellfounded(M,r); M(A) |] ==> wellfounded_on(M,A,r)"
 by (auto simp add: wellfounded_def wellfounded_on_def)
 
 lemma (in M_basic) wellfounded_on_subset_A:
      "[| wellfounded_on(M,A,r);  B<=A |] ==> wellfounded_on(M,B,r)"
 by (simp add: wellfounded_on_def, blast)
 
 
 subsubsection \<open>Well-founded relations\<close>
 
 lemma  (in M_basic) wellfounded_on_iff_wellfounded:
      "wellfounded_on(M,A,r) \<longleftrightarrow> wellfounded(M, r \<inter> A*A)"
 apply (simp add: wellfounded_on_def wellfounded_def, safe)
  apply force
 apply (drule_tac x=x in rspec, assumption, blast) 
 done
 
 lemma (in M_basic) wellfounded_on_imp_wellfounded:
      "[|wellfounded_on(M,A,r); r \<subseteq> A*A|] ==> wellfounded(M,r)"
 by (simp add: wellfounded_on_iff_wellfounded subset_Int_iff)
 
 lemma (in M_basic) wellfounded_on_field_imp_wellfounded:
      "wellfounded_on(M, field(r), r) ==> wellfounded(M,r)"
 by (simp add: wellfounded_def wellfounded_on_iff_wellfounded, fast)
 
 lemma (in M_basic) wellfounded_iff_wellfounded_on_field:
      "M(r) ==> wellfounded(M,r) \<longleftrightarrow> wellfounded_on(M, field(r), r)"
 by (blast intro: wellfounded_imp_wellfounded_on
                  wellfounded_on_field_imp_wellfounded)
 
 (*Consider the least z in domain(r) such that P(z) does not hold...*)
 lemma (in M_basic) wellfounded_induct: 
      "[| wellfounded(M,r); M(a); M(r); separation(M, \<lambda>x. ~P(x));  
          \<forall>x. M(x) & (\<forall>y. <y,x> \<in> r \<longrightarrow> P(y)) \<longrightarrow> P(x) |]
       ==> P(a)"
 apply (simp (no_asm_use) add: wellfounded_def)
 apply (drule_tac x="{z \<in> domain(r). ~P(z)}" in rspec)
 apply (blast dest: transM)+
 done
 
 lemma (in M_basic) wellfounded_on_induct: 
      "[| a\<in>A;  wellfounded_on(M,A,r);  M(A);  
        separation(M, \<lambda>x. x\<in>A \<longrightarrow> ~P(x));  
        \<forall>x\<in>A. M(x) & (\<forall>y\<in>A. <y,x> \<in> r \<longrightarrow> P(y)) \<longrightarrow> P(x) |]
       ==> P(a)"
 apply (simp (no_asm_use) add: wellfounded_on_def)
 apply (drule_tac x="{z\<in>A. z\<in>A \<longrightarrow> ~P(z)}" in rspec)
 apply (blast intro: transM)+
 done
 
 
 subsubsection \<open>Kunen's lemma IV 3.14, page 123\<close>
 
 lemma (in M_basic) linear_imp_relativized: 
      "linear(A,r) ==> linear_rel(M,A,r)" 
 by (simp add: linear_def linear_rel_def) 
 
 lemma (in M_basic) trans_on_imp_relativized: 
      "trans[A](r) ==> transitive_rel(M,A,r)" 
 by (unfold transitive_rel_def trans_on_def, blast) 
 
 lemma (in M_basic) wf_on_imp_relativized: 
      "wf[A](r) ==> wellfounded_on(M,A,r)" 
 apply (simp add: wellfounded_on_def wf_def wf_on_def, clarify) 
 apply (drule_tac x=x in spec, blast) 
 done
 
 lemma (in M_basic) wf_imp_relativized: 
      "wf(r) ==> wellfounded(M,r)" 
 apply (simp add: wellfounded_def wf_def, clarify) 
 apply (drule_tac x=x in spec, blast) 
 done
 
 lemma (in M_basic) well_ord_imp_relativized: 
      "well_ord(A,r) ==> wellordered(M,A,r)" 
 by (simp add: wellordered_def well_ord_def tot_ord_def part_ord_def
        linear_imp_relativized trans_on_imp_relativized wf_on_imp_relativized)
 
 text\<open>The property being well founded (and hence of being well ordered) is not absolute: 
 the set that doesn't contain a minimal element may not exist in the class M. 
 However, every set that is well founded in a transitive model M is well founded (page 124).\<close>
 
 subsection\<open>Relativized versions of order-isomorphisms and order types\<close>
 
 lemma (in M_basic) order_isomorphism_abs [simp]: 
      "[| M(A); M(B); M(f) |] 
       ==> order_isomorphism(M,A,r,B,s,f) \<longleftrightarrow> f \<in> ord_iso(A,r,B,s)"
-by (simp add: apply_closed order_isomorphism_def ord_iso_def)
+by (simp add: order_isomorphism_def ord_iso_def)
 
 lemma (in M_basic) pred_set_abs [simp]: 
      "[| M(r); M(B) |] ==> pred_set(M,A,x,r,B) \<longleftrightarrow> B = Order.pred(A,x,r)"
 apply (simp add: pred_set_def Order.pred_def)
 apply (blast dest: transM) 
 done
 
 lemma (in M_basic) pred_closed [intro,simp]: 
      "[| M(A); M(r); M(x) |] ==> M(Order.pred(A,x,r))"
 apply (simp add: Order.pred_def) 
 apply (insert pred_separation [of r x], simp) 
 done
 
 lemma (in M_basic) membership_abs [simp]: 
      "[| M(r); M(A) |] ==> membership(M,A,r) \<longleftrightarrow> r = Memrel(A)"
 apply (simp add: membership_def Memrel_def, safe)
   apply (rule equalityI) 
    apply clarify 
    apply (frule transM, assumption)
    apply blast
   apply clarify 
   apply (subgoal_tac "M(<xb,ya>)", blast) 
   apply (blast dest: transM) 
  apply auto 
 done
 
 lemma (in M_basic) M_Memrel_iff:
      "M(A) ==> 
       Memrel(A) = {z \<in> A*A. \<exists>x[M]. \<exists>y[M]. z = \<langle>x,y\<rangle> & x \<in> y}"
 apply (simp add: Memrel_def) 
 apply (blast dest: transM)
 done 
 
 lemma (in M_basic) Memrel_closed [intro,simp]: 
      "M(A) ==> M(Memrel(A))"
 apply (simp add: M_Memrel_iff) 
 apply (insert Memrel_separation, simp)
 done
 
 
 subsection \<open>Main results of Kunen, Chapter 1 section 6\<close>
 
 text\<open>Subset properties-- proved outside the locale\<close>
 
 lemma linear_rel_subset: 
     "[| linear_rel(M,A,r);  B<=A |] ==> linear_rel(M,B,r)"
 by (unfold linear_rel_def, blast)
 
 lemma transitive_rel_subset: 
     "[| transitive_rel(M,A,r);  B<=A |] ==> transitive_rel(M,B,r)"
 by (unfold transitive_rel_def, blast)
 
 lemma wellfounded_on_subset: 
     "[| wellfounded_on(M,A,r);  B<=A |] ==> wellfounded_on(M,B,r)"
 by (unfold wellfounded_on_def subset_def, blast)
 
 lemma wellordered_subset: 
     "[| wellordered(M,A,r);  B<=A |] ==> wellordered(M,B,r)"
 apply (unfold wellordered_def)
 apply (blast intro: linear_rel_subset transitive_rel_subset 
                     wellfounded_on_subset)
 done
 
 lemma (in M_basic) wellfounded_on_asym:
      "[| wellfounded_on(M,A,r);  <a,x>\<in>r;  a\<in>A; x\<in>A;  M(A) |] ==> <x,a>\<notin>r"
 apply (simp add: wellfounded_on_def) 
 apply (drule_tac x="{x,a}" in rspec) 
 apply (blast dest: transM)+
 done
 
 lemma (in M_basic) wellordered_asym:
      "[| wellordered(M,A,r);  <a,x>\<in>r;  a\<in>A; x\<in>A;  M(A) |] ==> <x,a>\<notin>r"
 by (simp add: wellordered_def, blast dest: wellfounded_on_asym)
 
 end