reserve p,p1,p2,q,r,F,G,G1,G2,H,H1,H2 for ZF-formula,
  x,x1,x2,y,y1,y2,z,z1,z2,s,t for Variable,
  a,X for set;
reserve M for non empty set,
  m,m9 for Element of M,
  v,v9 for Function of VAR,M;
reserve i,j for Element of NAT;

theorem
  M |= 'not' x 'in' y iff x = y or for X st X in M holds X misses M
proof
  thus M |= 'not' x 'in' y implies x = y or for X st X in M holds X misses M
  proof
    set v = the Function of VAR,M;
    assume that
A1: for v holds M,v |= 'not' x 'in' y and
A2: x <> y;
    let X;
    set a = the Element of X /\ M;
    assume X in M;
    then reconsider m = X as Element of M;
    assume
A3: X /\ M <> {};
    then reconsider a as Element of M by XBOOLE_0:def 4;
    M,(v/(x,a))/(y,m) |= 'not' x 'in' y by A1;
    then not M,(v/(x,a))/(y,m) |= x 'in' y by ZF_MODEL:14;
    then
A4: not (v/(x,a))/(y,m).x in (v/(x,a))/(y,m).y by ZF_MODEL:13;
A5: v/(x,a).x = a & (v/(x,a))/(y,m).y = m by FUNCT_7:128;
    (v/(x,a))/(y,m).x = v/(x,a).x by A2,FUNCT_7:32;
    hence contradiction by A3,A4,A5,XBOOLE_0:def 4;
  end;
  now
    assume
A6: for X st X in M holds X misses M;
    let v;
    v.y misses M by A6;
    then not v.x in v.y by XBOOLE_0:3;
    then not M,v |= x 'in' y by ZF_MODEL:13;
    hence M,v |= 'not' x 'in' y by ZF_MODEL:14;
  end;
  hence thesis by Th81;
end;
