First part of the lecture:

back to dependent types for some complements!

Using Coq as a proof assistant.

At last, we shall start using Coq as a proof assistant. But before really doing so, we shall see that in fact, we already have all we need to do this with what you learnt from the start of the semester! The present section shall thus be seen as a pedagogical introduction to modelling from scratch proofs as Coq programs, that is really putting Curry-Howard correspondence at work, before really considering how this is actually done in Coq. In order to prevent mixing Coq actual features with our own development, I use french terms in this introductory part, which will also be an occasion for practicing french for some of you! To start with, we set implicit arguments to lighten notations and we define Formulas as an alias for Set. (this will be updated later!)

In the following, we shall introduce some types and type constructions in Formula as well as some Coq terms which shall model inference rules on them. We shall follow the outline:

• true
• false
• implication
• negation
• conjunction
• disjunction
• excluded-middle
• quantifiers
• equality
• first proofs

Let us consider the following inductive types:

Constant True

with its single constructor (introduction rule):

VRAIintro : VRAI VRAI has essentially one proof (inhabitant): its single constructor.

Constant False

with no constructor (no introduction rule) and a generic destructor, eliminating to any formula:

Having no constructor, FAUX has no introduction rule.

Notice the odd shape of this pattern-matching with no clause for matching... but indeed FAUX has no constructor!

FAUXelim : ∀ A : Formula, FAUX → A FAUXelim corresponds to the elimination of the absurd, also known as ex falso sequitur quodlibet.

Implication

with its constructor / introduction rule (if from assuming A, I can deduce B, then I can deduce A => B), and its destructor / elimination rule (Modus Ponens):

IMPintro : ∀ A B : Formula, (A → B) → IMP A B

IMPelim : ∀ A B : Formula, IMP A B → A → B Notice that an alternative, would have been to define IMP simply as an alias for → :

We will come back to this later today.

Negation :

with its introduction rule and its elimination rule (from not A and A, deduce false):

NEGintro : ∀ A : Formula, (A → FAUX) → NEG A

NEGelim : ∀ A : Formula, NEG A → A → FAUX Negation could also be considered as a defined connective:

Conjunction

with its constructor (introduction rule) and its two destructors (elimination rules) :

ETintro : ∀ A B : Formula, A → B → ET A B

ETelim2 : ∀ A B : Formula, ET A B → B

Equivalence

Now that we have disjunction, equivalence can be obtained as a defined connective:

Disjunction

with its two constructors (introduction rule) and its elimination rule:

OUintro1 : ∀ A B : Formula, A → OU A B

OUelim : ∀ A B C : Formula, OU A B → (A → C) → (B → C) → C

Shall a proof of a disjunction only be obtained from a proof of the left disjunct or from the right disjunct? Is there no third option? The excluded-middle is a third option, if you want to accept it. But there is no computational counter-poart to it: one shall add it as an axiom, that is as an additional constant we declare. Do you remember how to do it?

Excluded middle :

What is this term PeirceLaw ??

Quantifiers:

We now introduce formula constructions and deduction schemas for quantifiers. Both for the universal and existential quantifier, we provide two versions of the quantifiers:

• an arithmetical quantification and
• a general quantification over any type in Set.

Forall qantifier

PTNintro : ∀ B : nat → Formula, (∀ x : nat, B x) → POURTOUTN B

POURTOUTNelim : ∀ B : nat → Formula, POURTOUTN B → ∀ t : nat, B t

Exists quantifier

IENintro : ∀ (B : nat → Formula) (x : nat), B x → ILEXISTEN B Be careful in reading this type!! Let us add some parentheses: IENintro : ∀ (B : nat → Formula) (x : nat), (B x → ILEXISTEN B)

ILEXISTENelim : ∀ (B : nat → Formula) (C : Formula), ILEXISTEN B → (∀ x : nat, B x → C) → C Again, it is useful to add some parentheses to parse the above type correctly: ILEXISTENelim : ∀ (B : nat → Formula) (C : Formula), ILEXISTEN B → (∀ x : nat, (B x → C)) → C

Equality

The only introduction rule for equality is the reflexivity of equality. Using equality amounts to substituting equals by equals and this is dealt with through dependent pattern-matching.

EQNintro : ∀ x : nat, EQN x x

EQNelim : ∀ (A : nat → Set) (m n : nat), EQN m n → A m → A n

One can state and prove the first properties about equality :

One can state and prove the first properties about equality even over other individual sorts:

Even and Odd numbers

We shall end this introduction with some more complex statements and proof, involving inductive reasoning. Let us first define two predicates over nat modelling that an natural number is even (resp. odd):

It is natural to be willing to prove that any natural is even or odd. Let us do it !

EvenOrOdd : (∀N) (fun n : nat ⇒ Even n ∨ Odd n)

SKIP THIS!!

Commutativity of addition.

AddComm : (∀N) (fun m : nat ⇒ (∀N) (fun n : nat ⇒ m + n == n + m))

Encounter with the third kind: Prop

Since the start of the semester, we worked with a first universe hierarchy (Type(i), i in |N) (and Set is Type(0).

Alias for the first level Type(0)

The various levels of the hierarchy are used to "type types":

Set is Type(0)

Here, Type is Type(1)

Here, Type is Type(1)

Here, Type → Type : Type should be read Type(i) → Type(j) : Type(max(i,j)+1 Since Type(i) : Type(i+1) and Type(j) : Type(j+1)

Another universe : Prop The universe of logical statement and proofs For proofs

is the canonical proof of True, hence I : True

Back to the type hierarchy

                Type(...)
                   |
                 Type(3)
                   |
                 Type(2)
                   |
                 Type(1)
               /         \
             /            \
           /               \
Set=Type(0)                Prop
 /   |     \               |   \
nat bool bool->nat       True  False
 |   |       \             |
 O   true    \             I     -  (no close proof of False)
      (fun (x:nat) => 1)           

An upward link between T and S represents the fact that one can derive T : S in Coq type system. In Coq, the arrow type A→B is actually not a primitive construction, it is a particular case of a product ∀x:A,B (Coq syntax ∀ x:A, B). When variable x does not occur in B (non-dependent product), we write A→B. For a first example of dependent product, see the definition of identity below. Roughly, the typing rule for a product looks like :

• If Γ ⊢ A:Type and Γ+x:A ⊢ B:Type then Γ ⊢ (∀ x:A,B) : Type

In reality, one must take care of the indices of the Type universes : the rightmost index is the max of the other two indices:

• If Γ ⊢ A: Type(i) and Γ+x:A ⊢ B:Type(j) then

Γ ⊢ (∀ x:A,B) : Type(max(i,j)) Or, written as an inference rule:

Γ ⊢ A:Type(i)         Γ+x:A ⊢ B:Type(j)
________________________________________(Prod-Type)
  Γ ⊢ (forall x:A,B) : Type(max(i,j))

Prop has some specificities that we shall investigate below in more details.

Terminology about Set vs Prop

• In Set:
  • A specification is any type S of the sort Set
  • A program is any term t the type of which is a specification.
• In Prop:
  • A proposition or statement is any type P of the sort Prop
  • A proof is any term t the type of which is a proposition.

To sum up: A program is an inhabitant of a specification while a proof is an inhabitant of a proposition.

Rules for forming dependent product in the Calculus of Constructions:

The above lines respectively correspond to:

• simple types
• impredicativity of Prop
• dependency
• higher-order

Stating theorems and proving them using Coq

Entering the proof mode

The user indicates she wants to start a proof with a command such as : Lemma and_commut : ∀ A B : Prop, A ∧ B ↔ B ∧ A. This command give a name (here and_commut) to the lemma, this will allow later to refer to this lemma later. Instead of Lemma, one can use similar keywords such as Theorem or Proposition or Fact: they are all equivalent form the point of view of Coq and are used to help the human reader to follow a formal proof development, as in common mathematical texts. After that, the command Proof. is to be used to mark the actual beginning of the proof itself (actually not mandatory but strongly recommanded).

Subgoals and tactics

When a proof is started, the proof mode of Coq will display in the higher right part one or several subgoals that are to be proved separately, one by one. These subgoals are essentially sequents of the natural deduction logic, written vertically : the (named) hypothesis comes first on top and the conclusion is below the bar. In the upper part one can also find the variable declarations. The proof is to be done by tactics, that are orders given by the user to progress in the proof of the current goal, by transforming this goal in various ways. Tactics have lowercase names. For instance, the intro tactic performed on a goal of the form A → B will introduce an hypothesis H : A in the context, and replace the conclusion by B. Each inference rule of the natural deduction logic will correspond to one tactic (or more), but some tactics allow to perform more advanced proof steps, for instance solving linear inequalities in the Presburger arithmetic (tactic lia). Each tactic may generate several subgoals (corresponding to premises of the underlying logical rule), or on the contrary it may completely solve the current goal and hence remove it. The proof is finished when all subgoals are proved. In this case, the command Qed is to be used (from Quod erat demonstrandum) to conclude the proof and leave the proof mode. Here comes a possible complete proof for the previous statement:

When tactics are separated by dots, Coq will execute them steps-by-steps. One can also use semi-colon ; to chain tactics : the second tactic is applied to all subgoals resulting from the first tactic on the current goal, and so forth. For instance, split;assumption applies assumption on the two subgoals created by split. Before a tactic, one may optionally write a bullet, i.e. one of the character - or + or ×. These bullets help organizing the proof in a hierarchical way, with delimitation of each sub-part (enforced by Coq). Such a proof script is to be saved in a file with a .v extension, as done in the previous lectures for instance myproofs.v. Then it can be compiled via the unix command coqc myproofs.v. If the content of this file is correct, then a binary file myproofs.vo is produced, allowing later a fast reload of our proofs (via the Require Import command).

A detailed study of Coq's built-in logical propositions.

We shall now redo what we did in the first part of this lecture, but using Coq natively defined types. You should experience some déjà vu but there will be some difference (mainly for implication and quantification).

Just about the same as this: Definition my_first_proof_bis : True := I. Operators, for building more advanced statements

->, implication

or step by step : intro : the tactic of introduction of -> :

  A |- B
-----------(->intro)
 |- A-> B 

to inspect the proof term being built

the axiom rule of natural deduction

forall, the dependent version of the ->

Same introduction tactic : intro.

forall and its non-dependent version -> are the only primitive operators. To introduce them, one has the following introduction tactics: intro / intros / intros ... It is possible to name the hypothesis or quantified variables, otherwise, Coq name them automatically: it can be convenient but may result in less maintainable formal proofs. On the other hand, in order to used an implicative of universally quantified statement, one uses their elimination: apply H.

assumption. apply a.

By default, apply work on the goal to be prove, it is backward-chaining, proving from the conclusion to the hypothesis. But one can also specify that apply should be used on an hypothesis, reasoning in forward-chaining mode, from the hypotheses to the conclusion:

assumption. apply a.

Other operators

True

False

no closed construction

elimination of a False hypothesis

Compare with the predifined :

negation is a shortcut for ...->False

Lemma attempt : ~True. Proof. unfold "~" in *. intro.

/\, conjunction

• introduction is done via the split tactic
• elimination via destruct ...

or destruct H as [HA HB].

Check and_ind. Available bullets for structuring a proof script : - + ×

\/, disjunction

• introduction is done via the left and right tactics
• elimination via destruct ...

or destruct H as [HA | HB].

<-> equivalence

A<->B is just a shortcut for (A->B)/\(B->A)

exists : introduction via : exists ... elimination via : destruct ...

Summary of elementary tactics

• assumption if the current goal is exactly one of the hypothesis (cf. the axiom rule in logic).
• For all primitive connectors (quantification ∀, implication →):
  • introduction via intro (or one of its variants intros,
  intro x, intros x y ...)
  • elimination via apply H (where H is the name of
  the hypothesis to eliminate).
• The other connectors (which are actually inductive definitions) may ideally be introduced by constructor and eliminated by destruct H. But the introduction frequently requires more ad-hoc tactics:
  • split for a conjunction ∧ (written /\)
  • left and right for a disjunction ∨ (written \/)
  • ∃ ... (written exists) for a quantification ∃
  (where ... is the place where the existential witness is given)
  • No introduction tactic for False !
  • For True (seldom used in Coq), the introduction can
  be done via constructor, but nothing to eliminate.
• Some abbreviations:
  • A negation ¬A (written ~A) is just a shortcut for A→False.
  Hence introduction via intro (or intros a, giving a name forces the introduction) and elimination via apply H or destruct H (whether one wants to focus on the underlying → or False).
  • An equivalence A↔B (written A<->B) is just a shortcut for (A→B)/\(B→A),
  hence is manipulated as a conjunction of implications.
• Some automatic tactics : trivial, easy, auto, eauto, intuition, firstorder. See the Coq documentation for more details.

In today practical session, you will first try to prove the statements with no or little automatisation, and then experiment with these tactics in a second time. Indeed, it can be helpful later to know how to proceed steps-by-steps, since real-life proofs are seldom doable by just automatic tactics.

Some more tactics

In Coq, a definition d could be replaced by its body thanks to the tactic unfold d. The equality is handled by tactics:

• reflexivity
• symmetry
• transitivity ... (where you need to give the intermediate

term) and

• rewrite ... (give the equality name or lemma to use as a

rewrite rule) or

• rewrite <- ... (right-to-left rewriting)

Inductive reasoning will be studied at length in coming lectures. Just to state it immediately:

• induction ... (to do inductive reasoning, to be investigated in the next lectures).