Theory Predicate

Up to index of Isabelle/HOL-Main

theory Predicate
imports Relation

(*  Title:      HOL/Predicate.thy
Author: Stefan Berghofer and Lukas Bulwahn and Florian Haftmann, TU Muenchen
*)


header {* Predicates as relations and enumerations *}

theory Predicate
imports Inductive Relation
begin


notation
inf (infixl "\<sqinter>" 70) and
sup (infixl "\<squnion>" 65) and
Inf ("\<Sqinter>_" [900] 900) and
Sup ("\<Squnion>_" [900] 900) and
top ("\<top>") and
bot ("⊥")



subsection {* Predicates as (complete) lattices *}


text {*
Handy introduction and elimination rules for @{text "≤"}
on unary and binary predicates
*}


lemma predicate1I:
assumes PQ: "!!x. P x ==> Q x"
shows "P ≤ Q"

apply (rule le_funI)
apply (rule le_boolI)
apply (rule PQ)
apply assumption
done

lemma predicate1D [Pure.dest?, dest?]:
"P ≤ Q ==> P x ==> Q x"

apply (erule le_funE)
apply (erule le_boolE)
apply assumption+
done

lemma rev_predicate1D:
"P x ==> P <= Q ==> Q x"

by (rule predicate1D)

lemma predicate2I [Pure.intro!, intro!]:
assumes PQ: "!!x y. P x y ==> Q x y"
shows "P ≤ Q"

apply (rule le_funI)+
apply (rule le_boolI)
apply (rule PQ)
apply assumption
done

lemma predicate2D [Pure.dest, dest]:
"P ≤ Q ==> P x y ==> Q x y"

apply (erule le_funE)+
apply (erule le_boolE)
apply assumption+
done

lemma rev_predicate2D:
"P x y ==> P <= Q ==> Q x y"

by (rule predicate2D)


subsubsection {* Equality *}

lemma pred_equals_eq: "((λx. x ∈ R) = (λx. x ∈ S)) = (R = S)"
by (simp add: mem_def)

lemma pred_equals_eq2 [pred_set_conv]: "((λx y. (x, y) ∈ R) = (λx y. (x, y) ∈ S)) = (R = S)"
by (simp add: expand_fun_eq mem_def)


subsubsection {* Order relation *}

lemma pred_subset_eq: "((λx. x ∈ R) <= (λx. x ∈ S)) = (R <= S)"
by (simp add: mem_def)

lemma pred_subset_eq2 [pred_set_conv]: "((λx y. (x, y) ∈ R) <= (λx y. (x, y) ∈ S)) = (R <= S)"
by fast


subsubsection {* Top and bottom elements *}

lemma top1I [intro!]: "top x"
by (simp add: top_fun_eq top_bool_eq)

lemma top2I [intro!]: "top x y"
by (simp add: top_fun_eq top_bool_eq)

lemma bot1E [elim!]: "bot x ==> P"
by (simp add: bot_fun_eq bot_bool_eq)

lemma bot2E [elim!]: "bot x y ==> P"
by (simp add: bot_fun_eq bot_bool_eq)

lemma bot_empty_eq: "bot = (λx. x ∈ {})"
by (auto simp add: expand_fun_eq)

lemma bot_empty_eq2: "bot = (λx y. (x, y) ∈ {})"
by (auto simp add: expand_fun_eq)


subsubsection {* Binary union *}

lemma sup1I1 [elim?]: "A x ==> sup A B x"
by (simp add: sup_fun_eq sup_bool_eq)

lemma sup2I1 [elim?]: "A x y ==> sup A B x y"
by (simp add: sup_fun_eq sup_bool_eq)

lemma sup1I2 [elim?]: "B x ==> sup A B x"
by (simp add: sup_fun_eq sup_bool_eq)

lemma sup2I2 [elim?]: "B x y ==> sup A B x y"
by (simp add: sup_fun_eq sup_bool_eq)

lemma sup1E [elim!]: "sup A B x ==> (A x ==> P) ==> (B x ==> P) ==> P"
by (simp add: sup_fun_eq sup_bool_eq) iprover

lemma sup2E [elim!]: "sup A B x y ==> (A x y ==> P) ==> (B x y ==> P) ==> P"
by (simp add: sup_fun_eq sup_bool_eq) iprover

text {*
\medskip Classical introduction rule: no commitment to @{text A} vs
@{text B}.
*}


lemma sup1CI [intro!]: "(~ B x ==> A x) ==> sup A B x"
by (auto simp add: sup_fun_eq sup_bool_eq)

lemma sup2CI [intro!]: "(~ B x y ==> A x y) ==> sup A B x y"
by (auto simp add: sup_fun_eq sup_bool_eq)

lemma sup_Un_eq: "sup (λx. x ∈ R) (λx. x ∈ S) = (λx. x ∈ R ∪ S)"
by (simp add: sup_fun_eq sup_bool_eq mem_def)

lemma sup_Un_eq2 [pred_set_conv]: "sup (λx y. (x, y) ∈ R) (λx y. (x, y) ∈ S) = (λx y. (x, y) ∈ R ∪ S)"
by (simp add: sup_fun_eq sup_bool_eq mem_def)


subsubsection {* Binary intersection *}

lemma inf1I [intro!]: "A x ==> B x ==> inf A B x"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf2I [intro!]: "A x y ==> B x y ==> inf A B x y"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf1E [elim!]: "inf A B x ==> (A x ==> B x ==> P) ==> P"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf2E [elim!]: "inf A B x y ==> (A x y ==> B x y ==> P) ==> P"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf1D1: "inf A B x ==> A x"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf2D1: "inf A B x y ==> A x y"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf1D2: "inf A B x ==> B x"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf2D2: "inf A B x y ==> B x y"
by (simp add: inf_fun_eq inf_bool_eq)

lemma inf_Int_eq: "inf (λx. x ∈ R) (λx. x ∈ S) = (λx. x ∈ R ∩ S)"
by (simp add: inf_fun_eq inf_bool_eq mem_def)

lemma inf_Int_eq2 [pred_set_conv]: "inf (λx y. (x, y) ∈ R) (λx y. (x, y) ∈ S) = (λx y. (x, y) ∈ R ∩ S)"
by (simp add: inf_fun_eq inf_bool_eq mem_def)


subsubsection {* Unions of families *}

lemma SUP1_iff: "(SUP x:A. B x) b = (EX x:A. B x b)"
by (simp add: SUPR_def Sup_fun_def Sup_bool_def) blast

lemma SUP2_iff: "(SUP x:A. B x) b c = (EX x:A. B x b c)"
by (simp add: SUPR_def Sup_fun_def Sup_bool_def) blast

lemma SUP1_I [intro]: "a : A ==> B a b ==> (SUP x:A. B x) b"
by (auto simp add: SUP1_iff)

lemma SUP2_I [intro]: "a : A ==> B a b c ==> (SUP x:A. B x) b c"
by (auto simp add: SUP2_iff)

lemma SUP1_E [elim!]: "(SUP x:A. B x) b ==> (!!x. x : A ==> B x b ==> R) ==> R"
by (auto simp add: SUP1_iff)

lemma SUP2_E [elim!]: "(SUP x:A. B x) b c ==> (!!x. x : A ==> B x b c ==> R) ==> R"
by (auto simp add: SUP2_iff)

lemma SUP_UN_eq: "(SUP i. (λx. x ∈ r i)) = (λx. x ∈ (UN i. r i))"
by (simp add: SUP1_iff expand_fun_eq)

lemma SUP_UN_eq2: "(SUP i. (λx y. (x, y) ∈ r i)) = (λx y. (x, y) ∈ (UN i. r i))"
by (simp add: SUP2_iff expand_fun_eq)


subsubsection {* Intersections of families *}

lemma INF1_iff: "(INF x:A. B x) b = (ALL x:A. B x b)"
by (simp add: INFI_def Inf_fun_def Inf_bool_def) blast

lemma INF2_iff: "(INF x:A. B x) b c = (ALL x:A. B x b c)"
by (simp add: INFI_def Inf_fun_def Inf_bool_def) blast

lemma INF1_I [intro!]: "(!!x. x : A ==> B x b) ==> (INF x:A. B x) b"
by (auto simp add: INF1_iff)

lemma INF2_I [intro!]: "(!!x. x : A ==> B x b c) ==> (INF x:A. B x) b c"
by (auto simp add: INF2_iff)

lemma INF1_D [elim]: "(INF x:A. B x) b ==> a : A ==> B a b"
by (auto simp add: INF1_iff)

lemma INF2_D [elim]: "(INF x:A. B x) b c ==> a : A ==> B a b c"
by (auto simp add: INF2_iff)

lemma INF1_E [elim]: "(INF x:A. B x) b ==> (B a b ==> R) ==> (a ~: A ==> R) ==> R"
by (auto simp add: INF1_iff)

lemma INF2_E [elim]: "(INF x:A. B x) b c ==> (B a b c ==> R) ==> (a ~: A ==> R) ==> R"
by (auto simp add: INF2_iff)

lemma INF_INT_eq: "(INF i. (λx. x ∈ r i)) = (λx. x ∈ (INT i. r i))"
by (simp add: INF1_iff expand_fun_eq)

lemma INF_INT_eq2: "(INF i. (λx y. (x, y) ∈ r i)) = (λx y. (x, y) ∈ (INT i. r i))"
by (simp add: INF2_iff expand_fun_eq)


subsection {* Predicates as relations *}

subsubsection {* Composition *}

inductive
pred_comp :: "['a => 'b => bool, 'b => 'c => bool] => 'a => 'c => bool"
(infixr "OO" 75)
for r :: "'a => 'b => bool" and s :: "'b => 'c => bool"
where
pred_compI [intro]: "r a b ==> s b c ==> (r OO s) a c"


inductive_cases pred_compE [elim!]: "(r OO s) a c"

lemma pred_comp_rel_comp_eq [pred_set_conv]:
"((λx y. (x, y) ∈ r) OO (λx y. (x, y) ∈ s)) = (λx y. (x, y) ∈ r O s)"

by (auto simp add: expand_fun_eq elim: pred_compE)


subsubsection {* Converse *}

inductive
conversep :: "('a => 'b => bool) => 'b => 'a => bool"
("(_^--1)" [1000] 1000)
for r :: "'a => 'b => bool"
where
conversepI: "r a b ==> r^--1 b a"


notation (xsymbols)
conversep ("(_¯¯)" [1000] 1000)


lemma conversepD:
assumes ab: "r^--1 a b"
shows "r b a"
using ab
by cases simp

lemma conversep_iff [iff]: "r^--1 a b = r b a"
by (iprover intro: conversepI dest: conversepD)

lemma conversep_converse_eq [pred_set_conv]:
"(λx y. (x, y) ∈ r)^--1 = (λx y. (x, y) ∈ r^-1)"

by (auto simp add: expand_fun_eq)

lemma conversep_conversep [simp]: "(r^--1)^--1 = r"
by (iprover intro: order_antisym conversepI dest: conversepD)

lemma converse_pred_comp: "(r OO s)^--1 = s^--1 OO r^--1"
by (iprover intro: order_antisym conversepI pred_compI
elim: pred_compE dest: conversepD)


lemma converse_meet: "(inf r s)^--1 = inf r^--1 s^--1"
by (simp add: inf_fun_eq inf_bool_eq)
(iprover intro: conversepI ext dest: conversepD)


lemma converse_join: "(sup r s)^--1 = sup r^--1 s^--1"
by (simp add: sup_fun_eq sup_bool_eq)
(iprover intro: conversepI ext dest: conversepD)


lemma conversep_noteq [simp]: "(op ~=)^--1 = op ~="
by (auto simp add: expand_fun_eq)

lemma conversep_eq [simp]: "(op =)^--1 = op ="
by (auto simp add: expand_fun_eq)


subsubsection {* Domain *}

inductive
DomainP :: "('a => 'b => bool) => 'a => bool"
for r :: "'a => 'b => bool"
where
DomainPI [intro]: "r a b ==> DomainP r a"


inductive_cases DomainPE [elim!]: "DomainP r a"

lemma DomainP_Domain_eq [pred_set_conv]: "DomainP (λx y. (x, y) ∈ r) = (λx. x ∈ Domain r)"
by (blast intro!: Orderings.order_antisym predicate1I)


subsubsection {* Range *}

inductive
RangeP :: "('a => 'b => bool) => 'b => bool"
for r :: "'a => 'b => bool"
where
RangePI [intro]: "r a b ==> RangeP r b"


inductive_cases RangePE [elim!]: "RangeP r b"

lemma RangeP_Range_eq [pred_set_conv]: "RangeP (λx y. (x, y) ∈ r) = (λx. x ∈ Range r)"
by (blast intro!: Orderings.order_antisym predicate1I)


subsubsection {* Inverse image *}

definition
inv_imagep :: "('b => 'b => bool) => ('a => 'b) => 'a => 'a => bool" where
"inv_imagep r f == %x y. r (f x) (f y)"


lemma [pred_set_conv]: "inv_imagep (λx y. (x, y) ∈ r) f = (λx y. (x, y) ∈ inv_image r f)"
by (simp add: inv_image_def inv_imagep_def)

lemma in_inv_imagep [simp]: "inv_imagep r f x y = r (f x) (f y)"
by (simp add: inv_imagep_def)


subsubsection {* Powerset *}

definition Powp :: "('a => bool) => 'a set => bool" where
"Powp A == λB. ∀x ∈ B. A x"


lemma Powp_Pow_eq [pred_set_conv]: "Powp (λx. x ∈ A) = (λx. x ∈ Pow A)"
by (auto simp add: Powp_def expand_fun_eq)

lemmas Powp_mono [mono] = Pow_mono [to_pred pred_subset_eq]


subsubsection {* Properties of relations *}

abbreviation antisymP :: "('a => 'a => bool) => bool" where
"antisymP r == antisym {(x, y). r x y}"


abbreviation transP :: "('a => 'a => bool) => bool" where
"transP r == trans {(x, y). r x y}"


abbreviation single_valuedP :: "('a => 'b => bool) => bool" where
"single_valuedP r == single_valued {(x, y). r x y}"



subsection {* Predicates as enumerations *}

subsubsection {* The type of predicate enumerations (a monad) *}

datatype 'a pred = Pred "'a => bool"

primrec eval :: "'a pred => 'a => bool" where
eval_pred: "eval (Pred f) = f"


lemma Pred_eval [simp]:
"Pred (eval x) = x"

by (cases x) simp

lemma eval_inject: "eval x = eval y <-> x = y"
by (cases x) auto

definition single :: "'a => 'a pred" where
"single x = Pred ((op =) x)"


definition bind :: "'a pred => ('a => 'b pred) => 'b pred" (infixl "»=" 70) where
"P »= f = Pred (λx. (∃y. eval P y ∧ eval (f y) x))"


instantiation pred :: (type) "{complete_lattice, boolean_algebra}"
begin


definition
"P ≤ Q <-> eval P ≤ eval Q"


definition
"P < Q <-> eval P < eval Q"


definition
"⊥ = Pred ⊥"


definition
"\<top> = Pred \<top>"


definition
"P \<sqinter> Q = Pred (eval P \<sqinter> eval Q)"


definition
"P \<squnion> Q = Pred (eval P \<squnion> eval Q)"


definition
[code del]: "\<Sqinter>A = Pred (INFI A eval)"


definition
[code del]: "\<Squnion>A = Pred (SUPR A eval)"


definition
"- P = Pred (- eval P)"


definition
"P - Q = Pred (eval P - eval Q)"


instance proof
qed (auto simp add: less_eq_pred_def less_pred_def
inf_pred_def sup_pred_def bot_pred_def top_pred_def
Inf_pred_def Sup_pred_def uminus_pred_def minus_pred_def fun_Compl_def bool_Compl_def,
auto simp add: le_fun_def less_fun_def le_bool_def less_bool_def
eval_inject mem_def)


end

lemma bind_bind:
"(P »= Q) »= R = P »= (λx. Q x »= R)"

by (auto simp add: bind_def expand_fun_eq)

lemma bind_single:
"P »= single = P"

by (simp add: bind_def single_def)

lemma single_bind:
"single x »= P = P x"

by (simp add: bind_def single_def)

lemma bottom_bind:
"⊥ »= P = ⊥"

by (auto simp add: bot_pred_def bind_def expand_fun_eq)

lemma sup_bind:
"(P \<squnion> Q) »= R = P »= R \<squnion> Q »= R"

by (auto simp add: bind_def sup_pred_def expand_fun_eq)

lemma Sup_bind: "(\<Squnion>A »= f) = \<Squnion>((λx. x »= f) ` A)"
by (auto simp add: bind_def Sup_pred_def SUP1_iff expand_fun_eq)

lemma pred_iffI:
assumes "!!x. eval A x ==> eval B x"
and "!!x. eval B x ==> eval A x"
shows "A = B"

proof -
from assms have "!!x. eval A x <-> eval B x" by blast
then show ?thesis by (cases A, cases B) (simp add: expand_fun_eq)
qed

lemma singleI: "eval (single x) x"
unfolding single_def by simp

lemma singleI_unit: "eval (single ()) x"
by simp (rule singleI)

lemma singleE: "eval (single x) y ==> (y = x ==> P) ==> P"
unfolding single_def by simp

lemma singleE': "eval (single x) y ==> (x = y ==> P) ==> P"
by (erule singleE) simp

lemma bindI: "eval P x ==> eval (Q x) y ==> eval (P »= Q) y"
unfolding bind_def by auto

lemma bindE: "eval (R »= Q) y ==> (!!x. eval R x ==> eval (Q x) y ==> P) ==> P"
unfolding bind_def by auto

lemma botE: "eval ⊥ x ==> P"
unfolding bot_pred_def by auto

lemma supI1: "eval A x ==> eval (A \<squnion> B) x"
unfolding sup_pred_def by (simp add: sup_fun_eq sup_bool_eq)

lemma supI2: "eval B x ==> eval (A \<squnion> B) x"
unfolding sup_pred_def by (simp add: sup_fun_eq sup_bool_eq)

lemma supE: "eval (A \<squnion> B) x ==> (eval A x ==> P) ==> (eval B x ==> P) ==> P"
unfolding sup_pred_def by auto

lemma single_not_bot [simp]:
"single x ≠ ⊥"

by (auto simp add: single_def bot_pred_def expand_fun_eq)

lemma not_bot:
assumes "A ≠ ⊥"
obtains x where "eval A x"

using assms by (cases A)
(auto simp add: bot_pred_def, auto simp add: mem_def)



subsubsection {* Emptiness check and definite choice *}

definition is_empty :: "'a pred => bool" where
"is_empty A <-> A = ⊥"


lemma is_empty_bot:
"is_empty ⊥"

by (simp add: is_empty_def)

lemma not_is_empty_single:
"¬ is_empty (single x)"

by (auto simp add: is_empty_def single_def bot_pred_def expand_fun_eq)

lemma is_empty_sup:
"is_empty (A \<squnion> B) <-> is_empty A ∧ is_empty B"

by (auto simp add: is_empty_def)

definition singleton :: "(unit => 'a) => 'a pred => 'a" where
"singleton dfault A = (if ∃!x. eval A x then THE x. eval A x else dfault ())"


lemma singleton_eqI:
"∃!x. eval A x ==> eval A x ==> singleton dfault A = x"

by (auto simp add: singleton_def)

lemma eval_singletonI:
"∃!x. eval A x ==> eval A (singleton dfault A)"

proof -
assume assm: "∃!x. eval A x"
then obtain x where "eval A x" ..
moreover with assm have "singleton dfault A = x" by (rule singleton_eqI)
ultimately show ?thesis by simp
qed

lemma single_singleton:
"∃!x. eval A x ==> single (singleton dfault A) = A"

proof -
assume assm: "∃!x. eval A x"
then have "eval A (singleton dfault A)"
by (rule eval_singletonI)
moreover from assm have "!!x. eval A x ==> singleton dfault A = x"
by (rule singleton_eqI)
ultimately have "eval (single (singleton dfault A)) = eval A"
by (simp (no_asm_use) add: single_def expand_fun_eq) blast
then show ?thesis by (simp add: eval_inject)
qed

lemma singleton_undefinedI:
"¬ (∃!x. eval A x) ==> singleton dfault A = dfault ()"

by (simp add: singleton_def)

lemma singleton_bot:
"singleton dfault ⊥ = dfault ()"

by (auto simp add: bot_pred_def intro: singleton_undefinedI)

lemma singleton_single:
"singleton dfault (single x) = x"

by (auto simp add: intro: singleton_eqI singleI elim: singleE)

lemma singleton_sup_single_single:
"singleton dfault (single x \<squnion> single y) = (if x = y then x else dfault ())"

proof (cases "x = y")
case True then show ?thesis by (simp add: singleton_single)
next
case False
have "eval (single x \<squnion> single y) x"
and "eval (single x \<squnion> single y) y"

by (auto intro: supI1 supI2 singleI)
with False have "¬ (∃!z. eval (single x \<squnion> single y) z)"
by blast
then have "singleton dfault (single x \<squnion> single y) = dfault ()"
by (rule singleton_undefinedI)
with False show ?thesis by simp
qed

lemma singleton_sup_aux:
"singleton dfault (A \<squnion> B) = (if A = ⊥ then singleton dfault B
else if B = ⊥ then singleton dfault A
else singleton dfault
(single (singleton dfault A) \<squnion> single (singleton dfault B)))"

proof (cases "(∃!x. eval A x) ∧ (∃!y. eval B y)")
case True then show ?thesis by (simp add: single_singleton)
next
case False
from False have A_or_B:
"singleton dfault A = dfault () ∨ singleton dfault B = dfault ()"

by (auto intro!: singleton_undefinedI)
then have rhs: "singleton dfault
(single (singleton dfault A) \<squnion> single (singleton dfault B)) = dfault ()"

by (auto simp add: singleton_sup_single_single singleton_single)
from False have not_unique:
"¬ (∃!x. eval A x) ∨ ¬ (∃!y. eval B y)"
by simp
show ?thesis proof (cases "A ≠ ⊥ ∧ B ≠ ⊥")
case True
then obtain a b where a: "eval A a" and b: "eval B b"
by (blast elim: not_bot)
with True not_unique have "¬ (∃!x. eval (A \<squnion> B) x)"
by (auto simp add: sup_pred_def bot_pred_def)
then have "singleton dfault (A \<squnion> B) = dfault ()" by (rule singleton_undefinedI)
with True rhs show ?thesis by simp
next
case False then show ?thesis by auto
qed
qed

lemma singleton_sup:
"singleton dfault (A \<squnion> B) = (if A = ⊥ then singleton dfault B
else if B = ⊥ then singleton dfault A
else if singleton dfault A = singleton dfault B then singleton dfault A else dfault ())"

using singleton_sup_aux [of dfault A B] by (simp only: singleton_sup_single_single)


subsubsection {* Derived operations *}

definition if_pred :: "bool => unit pred" where
if_pred_eq: "if_pred b = (if b then single () else ⊥)"


definition holds :: "unit pred => bool" where
holds_eq: "holds P = eval P ()"


definition not_pred :: "unit pred => unit pred" where
not_pred_eq: "not_pred P = (if eval P () then ⊥ else single ())"


lemma if_predI: "P ==> eval (if_pred P) ()"
unfolding if_pred_eq by (auto intro: singleI)

lemma if_predE: "eval (if_pred b) x ==> (b ==> x = () ==> P) ==> P"
unfolding if_pred_eq by (cases b) (auto elim: botE)

lemma not_predI: "¬ P ==> eval (not_pred (Pred (λu. P))) ()"
unfolding not_pred_eq eval_pred by (auto intro: singleI)

lemma not_predI': "¬ eval P () ==> eval (not_pred P) ()"
unfolding not_pred_eq by (auto intro: singleI)

lemma not_predE: "eval (not_pred (Pred (λu. P))) x ==> (¬ P ==> thesis) ==> thesis"
unfolding not_pred_eq
by (auto split: split_if_asm elim: botE)

lemma not_predE': "eval (not_pred P) x ==> (¬ eval P x ==> thesis) ==> thesis"
unfolding not_pred_eq
by (auto split: split_if_asm elim: botE)
lemma "f () = False ∨ f () = True"
by simp

lemma closure_of_bool_cases:
assumes "(f :: unit => bool) = (%u. False) ==> P f"
assumes "f = (%u. True) ==> P f"
shows "P f"

proof -
have "f = (%u. False) ∨ f = (%u. True)"
apply (cases "f ()")
apply (rule disjI2)
apply (rule ext)
apply (simp add: unit_eq)
apply (rule disjI1)
apply (rule ext)
apply (simp add: unit_eq)
done
from this prems show ?thesis by blast
qed

lemma unit_pred_cases:
assumes "P ⊥"
assumes "P (single ())"
shows "P Q"

using assms
unfolding bot_pred_def Collect_def empty_def single_def
apply (cases Q)
apply simp
apply (rule_tac f="fun" in closure_of_bool_cases)
apply auto
apply (subgoal_tac "(%x. () = x) = (%x. True)")
apply auto
done

lemma holds_if_pred:
"holds (if_pred b) = b"

unfolding if_pred_eq holds_eq
by (cases b) (auto intro: singleI elim: botE)

lemma if_pred_holds:
"if_pred (holds P) = P"

unfolding if_pred_eq holds_eq
by (rule unit_pred_cases) (auto intro: singleI elim: botE)

lemma is_empty_holds:
"is_empty P <-> ¬ holds P"

unfolding is_empty_def holds_eq
by (rule unit_pred_cases) (auto elim: botE intro: singleI)

subsubsection {* Implementation *}

datatype 'a seq = Empty | Insert "'a" "'a pred" | Join "'a pred" "'a seq"

primrec pred_of_seq :: "'a seq => 'a pred" where
"pred_of_seq Empty = ⊥"
| "pred_of_seq (Insert x P) = single x \<squnion> P"
| "pred_of_seq (Join P xq) = P \<squnion> pred_of_seq xq"


definition Seq :: "(unit => 'a seq) => 'a pred" where
"Seq f = pred_of_seq (f ())"


code_datatype Seq

primrec member :: "'a seq => 'a => bool" where
"member Empty x <-> False"
| "member (Insert y P) x <-> x = y ∨ eval P x"
| "member (Join P xq) x <-> eval P x ∨ member xq x"


lemma eval_member:
"member xq = eval (pred_of_seq xq)"

proof (induct xq)
case Empty show ?case
by (auto simp add: expand_fun_eq elim: botE)
next
case Insert show ?case
by (auto simp add: expand_fun_eq elim: supE singleE intro: supI1 supI2 singleI)
next
case Join then show ?case
by (auto simp add: expand_fun_eq elim: supE intro: supI1 supI2)
qed

lemma eval_code [code]: "eval (Seq f) = member (f ())"
unfolding Seq_def by (rule sym, rule eval_member)

lemma single_code [code]:
"single x = Seq (λu. Insert x ⊥)"

unfolding Seq_def by simp

primrec "apply" :: "('a => 'b Predicate.pred) => 'a seq => 'b seq" where
"apply f Empty = Empty"
| "apply f (Insert x P) = Join (f x) (Join (P »= f) Empty)"
| "apply f (Join P xq) = Join (P »= f) (apply f xq)"


lemma apply_bind:
"pred_of_seq (apply f xq) = pred_of_seq xq »= f"

proof (induct xq)
case Empty show ?case
by (simp add: bottom_bind)
next
case Insert show ?case
by (simp add: single_bind sup_bind)
next
case Join then show ?case
by (simp add: sup_bind)
qed

lemma bind_code [code]:
"Seq g »= f = Seq (λu. apply f (g ()))"

unfolding Seq_def by (rule sym, rule apply_bind)

lemma bot_set_code [code]:
"⊥ = Seq (λu. Empty)"

unfolding Seq_def by simp

primrec adjunct :: "'a pred => 'a seq => 'a seq" where
"adjunct P Empty = Join P Empty"
| "adjunct P (Insert x Q) = Insert x (Q \<squnion> P)"
| "adjunct P (Join Q xq) = Join Q (adjunct P xq)"


lemma adjunct_sup:
"pred_of_seq (adjunct P xq) = P \<squnion> pred_of_seq xq"

by (induct xq) (simp_all add: sup_assoc sup_commute sup_left_commute)

lemma sup_code [code]:
"Seq f \<squnion> Seq g = Seq (λu. case f ()
of Empty => g ()
| Insert x P => Insert x (P \<squnion> Seq g)
| Join P xq => adjunct (Seq g) (Join P xq))"

proof (cases "f ()")
case Empty
thus ?thesis
unfolding Seq_def by (simp add: sup_commute [of "⊥"])
next
case Insert
thus ?thesis
unfolding Seq_def by (simp add: sup_assoc)
next
case Join
thus ?thesis
unfolding Seq_def
by (simp add: adjunct_sup sup_assoc sup_commute sup_left_commute)
qed

primrec contained :: "'a seq => 'a pred => bool" where
"contained Empty Q <-> True"
| "contained (Insert x P) Q <-> eval Q x ∧ P ≤ Q"
| "contained (Join P xq) Q <-> P ≤ Q ∧ contained xq Q"


lemma single_less_eq_eval:
"single x ≤ P <-> eval P x"

by (auto simp add: single_def less_eq_pred_def mem_def)

lemma contained_less_eq:
"contained xq Q <-> pred_of_seq xq ≤ Q"

by (induct xq) (simp_all add: single_less_eq_eval)

lemma less_eq_pred_code [code]:
"Seq f ≤ Q = (case f ()
of Empty => True
| Insert x P => eval Q x ∧ P ≤ Q
| Join P xq => P ≤ Q ∧ contained xq Q)"

by (cases "f ()")
(simp_all add: Seq_def single_less_eq_eval contained_less_eq)


lemma eq_pred_code [code]:
fixes P Q :: "'a pred"
shows "eq_class.eq P Q <-> P ≤ Q ∧ Q ≤ P"

unfolding eq by auto

lemma [code]:
"pred_case f P = f (eval P)"

by (cases P) simp

lemma [code]:
"pred_rec f P = f (eval P)"

by (cases P) simp

inductive eq :: "'a => 'a => bool" where "eq x x"

lemma eq_is_eq: "eq x y ≡ (x = y)"
by (rule eq_reflection) (auto intro: eq.intros elim: eq.cases)

definition map :: "('a => 'b) => 'a pred => 'b pred" where
"map f P = P »= (single o f)"


primrec null :: "'a seq => bool" where
"null Empty <-> True"
| "null (Insert x P) <-> False"
| "null (Join P xq) <-> is_empty P ∧ null xq"


lemma null_is_empty:
"null xq <-> is_empty (pred_of_seq xq)"

by (induct xq) (simp_all add: is_empty_bot not_is_empty_single is_empty_sup)

lemma is_empty_code [code]:
"is_empty (Seq f) <-> null (f ())"

by (simp add: null_is_empty Seq_def)

primrec the_only :: "(unit => 'a) => 'a seq => 'a" where
[code del]: "the_only dfault Empty = dfault ()"
| "the_only dfault (Insert x P) = (if is_empty P then x else let y = singleton dfault P in if x = y then x else dfault ())"
| "the_only dfault (Join P xq) = (if is_empty P then the_only dfault xq else if null xq then singleton dfault P
else let x = singleton dfault P; y = the_only dfault xq in
if x = y then x else dfault ())"


lemma the_only_singleton:
"the_only dfault xq = singleton dfault (pred_of_seq xq)"

by (induct xq)
(auto simp add: singleton_bot singleton_single is_empty_def
null_is_empty Let_def singleton_sup)


lemma singleton_code [code]:
"singleton dfault (Seq f) = (case f ()
of Empty => dfault ()
| Insert x P => if is_empty P then x
else let y = singleton dfault P in
if x = y then x else dfault ()
| Join P xq => if is_empty P then the_only dfault xq
else if null xq then singleton dfault P
else let x = singleton dfault P; y = the_only dfault xq in
if x = y then x else dfault ())"

by (cases "f ()")
(auto simp add: Seq_def the_only_singleton is_empty_def
null_is_empty singleton_bot singleton_single singleton_sup Let_def)


definition not_unique :: "'a pred => 'a"
where
[code del]: "not_unique A = (THE x. eval A x)"


definition the :: "'a pred => 'a"
where
[code del]: "the A = (THE x. eval A x)"


lemma the_eq[code]: "the A = singleton (λx. not_unique A) A"
by (auto simp add: the_def singleton_def not_unique_def)

code_abort not_unique

code_reflect Predicate
datatypes pred = Seq and seq = Empty | Insert | Join
functions map


ML {*
signature PREDICATE =
sig
datatype 'a pred = Seq of (unit -> 'a seq)
and 'a seq = Empty | Insert of 'a * 'a pred | Join of 'a pred * 'a seq
val yield: 'a pred -> ('a * 'a pred) option
val yieldn: int -> 'a pred -> 'a list * 'a pred
val map: ('a -> 'b) -> 'a pred -> 'b pred
end;

structure Predicate : PREDICATE =
struct

datatype pred = datatype Predicate.pred
datatype seq = datatype Predicate.seq

fun map f = Predicate.map f;

fun yield (Seq f) = next (f ())
and next Empty = NONE
| next (Insert (x, P)) = SOME (x, P)
| next (Join (P, xq)) = (case yield P
of NONE => next xq
| SOME (x, Q) => SOME (x, Seq (fn _ => Join (Q, xq))));

fun anamorph f k x = (if k = 0 then ([], x)
else case f x
of NONE => ([], x)
| SOME (v, y) => let
val (vs, z) = anamorph f (k - 1) y
in (v :: vs, z) end);

fun yieldn P = anamorph yield P;

end;
*}


no_notation
inf (infixl "\<sqinter>" 70) and
sup (infixl "\<squnion>" 65) and
Inf ("\<Sqinter>_" [900] 900) and
Sup ("\<Squnion>_" [900] 900) and
top ("\<top>") and
bot ("⊥") and
bind (infixl "»=" 70)


hide_type (open) pred seq
hide_const (open) Pred eval single bind is_empty singleton if_pred not_pred holds
Empty Insert Join Seq member pred_of_seq "apply" adjunct null the_only eq map not_unique the


end