A Tutorial on [Co-]Inductive Types in Coq

Save this PDF as:

Size: px
Start display at page:

Transcription

1 A Tutorial on [Co-]Inductive Types in Coq Eduardo Giménez, Pierre Castéran May 1998 August 17, 2007 Abstract This document 1 is an introduction to the definition and use of inductive and co-inductive types in the Coq proof environment. It explains how types like natural numbers and infinite streams are defined in Coq, and the kind of proof techniques that can be used to reason about them (case analysis, induction, inversion of predicates, co-induction, etc). Each technique is illustrated through an executable and self-contained Coq script. 1 The first versions of this document were entirely written by Eduardo Gimenez. Pierre Castéran wrote the 2004 revision. 1

2 Contents 1 About this document 4 2 Introducing Inductive Types Lists Vectors The contradictory proposition The tautological proposition Relations as inductive types The propositional equality type Logical connectives The existential quantifier Mutually Dependent Definitions Case Analysis and Pattern-matching Non-dependent Case Analysis Example: the predecessor function Dependent Case Analysis Example: strong specification of the predecessor function Some Examples of Case Analysis The Empty Type The Equality Type The Predicate n m Vectors Case Analysis and Logical Paradoxes The Positivity Condition Impredicative Inductive Types Extraction Constraints Strong Case Analysis on Proofs Summary of Constraints Some Proof Techniques Based on Case Analysis Discrimination of introduction rules Injectiveness of introduction rules Inversion Techniques Interactive mode Static mode Inductive Types and Structural Induction Proofs by Structural Induction Using Elimination Combinators Well-founded Recursion A case study in dependent elimination 49

3 7 Co-inductive Types and Non-ending Constructions Extensional Properties About injection, discriminate, and inversion

5 Moreover, the mathematical symbols,,,,,,, and stand for the character strings <=, <>, exists, forall, ->, <-, \/, /\, and =>, respectively. For instance, the Coq statement forall A:Set,(exists x : A, forall (y:a), x <> y) -> 2 = 3 is written as follows in this tutorial: A:Set,( x:a, y:a, x y) 2 = 3 When a fragment of Coq input text appears in the middle of regular text, we often place this fragment between double quotes.... These double quotes do not belong to the Coq syntax. Finally, any string enclosed between (* and *) is a comment and is ignored by the Coq system. 2 Introducing Inductive Types Inductive types are types closed with respect to their introduction rules. These rules explain the most basic or canonical ways of constructing an element of the type. In this sense, they characterize the recursive type. Different rules must be considered as introducing different objects. In order to fix ideas, let us introduce in Coq the most well-known example of a recursive type: the type of natural numbers. Inductive nat : Set := O : nat S : nat nat. The definition of a recursive type has two main parts. First, we establish what kind of recursive type we will characterize (a set, in this case). Second, we present the introduction rules that define the type (O and S), also called its constructors. The constructors O and S determine all the elements of this type. In other words, if n:nat, then n must have been introduced either by the rule O or by an application of the rule S to a previously constructed natural number. In this sense, we can say that nat is closed. On the contrary, the type Set is an open type, since we do not know a priori all the possible ways of introducing an object of type Set. After entering this command, the constants nat, O and S are available in the current context. We can see their types using the Check command : Check nat. nat : Set Check O. O : nat Check S. S : nat nat 5

6 Moreover, Coq adds to the context three constants named nat_ind, nat_rec and nat_rect, which correspond to different principles of structural induction on natural numbers that Coq infers automatically from the definition. We will come back to them in Section 5. In fact, the type of natural numbers as well as several useful theorems about them are already defined in the basic library of Coq, so there is no need to introduce them. Therefore, let us throw away our (re)definition of nat, using the command Reset. Reset nat. Print nat. Inductive nat : Set := O : nat S : nat nat For S: Argument scope is [nat_scope] Notice that Coq s interpretation scope for natural numbers (called nat_scope) allows us to read and write natural numbers in decimal form (see [4]). For instance, the constructor O can be read or written as the digit 0, and the term S (S (S O)) as 3. Check O. 0 : nat. Check (S (S (S O))). 3 : nat Let us now take a look to some other recursive types contained in the standard library of Coq. 2.1 Lists Lists are defined in library List: Require Import List. Print list. Inductive list (A : Set) : Set := nil : list A cons : A list A list A For nil: Argument A is implicit For cons: Argument A is implicit For list: Argument scope is [type_scope] For nil: Argument scope is [type_scope] For cons: Argument scopes are [type_scope ] In this definition, A is a general parameter, global to both constructors. This kind of definition allows us to build a whole family of inductive types, indexed over the sort Set. This can be observed if we consider the type of identifiers list, cons and nil. Notice the notation (A :=...) which 6

7 must be used when Coq s type inference algorithm cannot infer the implicit parameter A. Check list. list : Set Set Check (nil (A:=nat)). nil : list nat Check (nil (A:= nat nat)). nil : list (nat nat) Check (fun A: Set (cons (A:=A))). fun A : Set cons (A:=A) : A : Set, A list A list A Check (cons 3 (cons 2 nil)). 3 :: 2 :: nil : list nat 2.2 Vectors. Like list, vector is a polymorphic type: if A is a set, and n a natural number, vector A n is the type of vectors of elements of A and size n. Require Import Bvector. Print vector. Inductive vector (A : Set) : nat Set := Vnil : vector A 0 Vcons : A n : nat, vector A n vector A (S n) For vector: Argument scopes are [type_scope nat_scope] For Vnil: Argument scope is [type_scope] For Vcons: Argument scopes are [type_scope _ nat_scope _] Remark the difference between the two parameters A and n: The first one is a general parameter, global to all the introduction rules,while the second one is an index, which is instantiated differently in the introduction rules. Such types parameterized by regular values are called dependent types. Check (Vnil nat). Vnil nat 7

8 : vector nat 0 Check (fun (A:Set)(a:A) Vcons _ a _ (Vnil _)). fun (A : Set) (a : A) Vcons A a 0 (Vnil A) : A : Set, A vector A 1 Check (Vcons _ 5 _ (Vcons _ 3 _ (Vnil _))). Vcons nat 5 1 (Vcons nat 3 0 (Vnil nat)) : vector nat The contradictory proposition. Another example of an inductive type is the contradictory proposition. This type inhabits the universe of propositions, and has no element at all. Print False. Inductive False : Prop := Notice that no constructor is given in this definition. 2.4 The tautological proposition. Similarly, the tautological proposition True is defined as an inductive type with only one element I: Print True. Inductive True : Prop := I : True 2.5 Relations as inductive types. Some relations can also be introduced in a smart way as an inductive family of propositions. Let us take as example the order n m on natural numbers, called le in Coq. This relation is introduced through the following definition, quoted from the standard library 2 : Print le. Inductive le (n:nat) : nat Prop := le_n: n n le_s: m, n m n S m. Notice that in this definition n is a general parameter, while the second argument of le is an index (see section 2.2). This definition introduces the 2 In the interpretation scope for Peano arithmetic: nat_scope, n <= m is equivalent to le n m. 8

9 binary relation n m as the family of unary predicates to be greater or equal than a given n, parameterized by n. The introduction rules of this type can be seen as a sort of Prolog rules for proving that a given integer n is less or equal than another one. In fact, an object of type n m is nothing but a proof built up using the constructors le_n and le_s of this type. As an example, let us construct a proof that zero is less or equal than three using Coq s interactive proof mode. Such an object can be obtained applying three times the second introduction rule of le, to a proof that zero is less or equal than itself, which is provided by the first constructor of le: Theorem zero_leq_three: subgoal 0 3 constructor 2. 1 subgoal 0 2 constructor 2. 1 subgoal 0 1 constructor 2 1 subgoal 0 0 constructor 1. Proof completed When the current goal is an inductive type, the tactic constructor i applies the i-th constructor in the definition of the type. We can take a look at the proof constructed using the command Print: Print Print zero_leq_three. zero_leq_three = 9

10 zero_leq_three = le_s 0 2 (le_s 0 1 (le_s 0 0 (le_n 0))) : 0 3 When the parameter i is not supplied, the tactic constructor tries to apply constructor 1, constructor 2,..., constructor n where n is the number of constructors of the inductive type (2 in our example) of the conclusion of the goal. Our little proof can thus be obtained iterating the tactic constructor until it fails: Lemma zero_leq_three : 0 3. repeat constructor. Notice that the strict order on nat, called lt is not inductively defined: Print lt. lt = fun n m : nat S n m : nat nat Prop Lemma zero_lt_three : 0 < 3. unfold lt. ==================== 1 3 repeat constructor. 2.6 The propositional equality type. In Coq, the propositional equality between two inhabitants a and b of the same type A, noted a = b, is introduced as a family of recursive predicates to be equal to a, parameterised by both a and its type A. This family of types has only one introduction rule, which corresponds to reflexivity. Notice that the syntax a = b is an abbreviation for eq a b, and that the parameter A is implicit, as it can be infered from a. Print eq. Inductive eq (A : Type) (x : A) : A Prop := refl_equal : x = x For eq: Argument A is implicit For refl_equal: Argument A is implicit For eq: Argument scopes are [type_scope ] For refl_equal: Argument scopes are [type_scope _] 10

11 Notice also that the first parameter A of eq has type Type. The type system of Coq allows us to consider equality between various kinds of terms: elements of a set, proofs, propositions, types, and so on. Look at [4, 3] to get more details on Coq s type system, as well as implicit arguments and argument scopes. Lemma eq_3_3 : = 3. reflexivity. Lemma eq_proof_proof : refl_equal (2*6) = refl_equal (3*4). reflexivity. Print eq_proof_proof. eq_proof_proof = refl_equal (refl_equal (3 * 4)) : refl_equal (2 * 6) = refl_equal (3 * 4) Lemma eq_lt_le : ( 2 < 4) = (3 4). reflexivity. Lemma eq_nat_nat : nat = nat. reflexivity. Lemma eq_set_set : Set = Set. reflexivity. 2.7 Logical connectives. The conjunction and disjunction of two propositions are also examples of recursive types: Inductive or (A B : Prop) : Prop := or_introl : A A B or_intror : B A B Inductive and (A B : Prop) : Prop := 11

12 conj : A B A B The propositions A and B are general parameters of these connectives. Choosing different universes for A and B and for the inductive type itself gives rise to different type constructors. For example, the type sumbool is a disjunction but with computational contents. Inductive sumbool (A B : Prop) : Set := left : A {A} + {B} right : B {A} + {B} This type noted {A}+{B} in Coq can be used in Coq programs as a sort of boolean type, to check whether it is A or B that is true. The values left p and right q replace the boolean values true and false, respectively. The advantage of this type over bool is that it makes available the proofs p of A or q of B, which could be necessary to construct a verification proof about the program. For instance, let us consider the certified program le_lt_dec of the Standard Library. Require Import Compare_dec. Check le_lt_dec. le_lt_dec : n m : nat, {n m} + {m < n} We use le_lt_dec to build a function for computing the max of two natural numbers: Definition max (n p :nat) := match le_lt_dec n p with left _ p right _ n end. In the following proof, the case analysis on the term le_lt_dec n p gives us an access to proofs of n p in the first case, p < n in the other. Theorem le_max : n p, n p max n p = p. intros n p ; unfold max ; case (le_lt_dec n p); simpl. 2 subgoals n : nat p : nat n p n p p = p 12

13 subgoal 2 is: p < n n p n = p trivial. intros; absurd (p < p); eauto with arith. Once the program verified, the proofs are erased by the extraction procedure: Extraction max. (** val max : nat nat nat **) let max n p = match le_lt_dec n p with Left p Right n Another example of use of sumbool is given in Section The existential quantifier. The existential quantifier is yet another example of a logical connective introduced as an inductive type. Inductive ex (A : Type) (P : A Prop) : Prop := ex_intro : x : A, P x ex P Notice that Coq uses the abreviation x:a, B for ex (fun x:a B). The former quantifier inhabits the universe of propositions. As for the conjunction and disjunction connectives, there is also another version of existential quantification inhabiting the universe Set, which is noted sig P. The syntax {x:a B} is an abreviation for sig (fun x:a B). 2.9 Mutually Dependent Definitions Mutually dependent definitions of recursive types are also allowed in Coq. A typical example of these kind of declaration is the introduction of the trees of unbounded (but finite) width: Inductive tree(a:set) : Set := node : A forest A tree A with forest (A: Set) : Set := nochild : forest A addchild : tree A forest A forest A. 13

14 Yet another example of mutually dependent types are the predicates even and odd on natural numbers: Inductive even : nat Prop := eveno : even O evens : n, odd n even (S n) with odd : nat Prop := odds : n, even n odd (S n). Lemma odd_49 : odd (7 * 7). simpl; repeat constructor. 3 Case Analysis and Pattern-matching 3.1 Non-dependent Case Analysis An elimination rule for the type A is some way to use an object a : A in order to define an object in some type B. A natural elimination for an inductive type is case analysis. For instance, any value of type nat is built using either O or S. Thus, a systematic way of building a value of type B from any value of type nat is to associate to O a constant t O : B and to every term of the form S p a term t S : B. The following construction has type B: match n return B with O t O S p t S end In most of the cases, Coq is able to infer the type B of the object defined, so the return B part can be omitted. The computing rules associated with this construct are the expected ones (the notation t S {q/p} stands for the substitution of p by q in t S :) match O return b with O t O S p t S end = t O match S q return b with O t O S p t S end = t S {q/p} Example: the predecessor function. An example of a definition by case analysis is the function which computes the predecessor of any given natural number: Definition pred (n:nat) := match n with O O S m m end. 14

15 Eval simpl in pred 56. = 55 : nat Eval simpl in pred 0. = 0 : nat Eval simpl in fun p pred (S p). = fun p : nat p : nat nat As in functional programming, tuples and wild-cards can be used in patterns. Such definitions are automatically compiled by Coq into an expression which may contain several nested case expressions. For example, the exclusive or on booleans can be defined as follows: Definition xorb (b1 b2:bool) := match b1, b2 with false, true true true, false true _, _ false end. This kind of definition is compiled in Coq as follows 3 : Print xorb. xorb = fun b1 b2 : bool if b1 then if b2 then false else true else if b2 then true else false : bool bool bool 3.2 Dependent Case Analysis For a pattern matching construct of the form match n with...end a more general typing rule is obtained considering that the type of the whole expression may also depend on n. For instance, let us consider some function Q : nat Set, and n : nat. In order to build a term of type Q n, we can associate to the constructor O some term t O : Q O and to the pattern S p some term t S : Q (S p). Notice that the terms t O and t S do not have the same type. 3 Coq uses the conditional if b then a else b as an abreviation to match b with true a false b end. 15

16 The syntax of the dependent case analysis and its associated typing rule make precise how the resulting type depends on the argument of the pattern matching, and which constraint holds on the branches of the pattern matching: Q : nat Set t O : Q O p : nat t p : Q (S p) n : nat match n as n 0 return Q n 0 with O t O S p t S end : Q n The interest of this rule of dependent pattern-matching is that it can also be read as the following logical principle (replacing Set by Prop in the type of Q): in order to prove that a property Q holds for all n, it is sufficient to prove that Q holds for O and that for all p : nat, Q holds for (S p). The former, non-dependent version of case analysis can be obtained from this latter rule just taking Q as a constant function on n. Notice that destructuring n into O or S p doesn t make appear in the goal the equalities n = O and n = S p. They are internalized in the rules above (see section 4.3.) Example: strong specification of the predecessor function. In Section 3.1.1, the predecessor function was defined directly as a function from nat to nat. It remains to prove that this function has some desired properties. Another way to proceed is to, first introduce a specification of what is the predecessor of a natural number, under the form of a Coq type, then build an inhabitant of this type: in other words, a realization of this specification. This way, the correctness of this realization is ensured by Coq s type system. A reasonable specification for pred is to say that for all n there exists another m such that either m = n = 0, or (S m) is equal to n. The function pred should be just the way to compute such an m. Definition pred_spec (n:nat) := {m:nat n=0 m=0 n = S m}. Definition predecessor : n:nat, pred_spec n. intro n; case n. n : nat pred_spec 0 unfold pred_spec;exists 0;auto. ============= n0 : nat, pred_spec (S n0) 16

17 unfold pred_spec; intro n0; exists n0; auto. Defined. If we print the term built by Coq, we can observe its dependent patternmatching structure: predecessor = fun n : nat match n as n0 return (pred_spec n0) with O exist (fun m : nat 0 = 0 m = 0 0 = S m) 0 (or_introl (0 = 1) (conj (refl_equal 0) (refl_equal 0))) S n0 exist (fun m : nat S n0 = 0 m = 0 S n0 = S m) n0 (or_intror (S n0 = 0 n0 = 0) (refl_equal (S n0))) end : n : nat, pred_spec n Notice that there are many variants to the pattern intros...; case.... Look at the reference manual and/or the book: tactics destruct, intro pattern, etc. The command Extraction can be used to see the computational contents associated to the certified function predecessor: Extraction predecessor. (** val predecessor : nat pred_spec **) let predecessor = function O O S n0 n0 Exercise 3.1 Prove the following theorem: Theorem nat_expand : n:nat, n = match n with 0 0 S p S p end. 3.3 Some Examples of Case Analysis The reader will find in the Reference manual all details about typing case analysis (chapter 4: Calculus of Inductive Constructions, and chapter 15: Extended Pattern-Matching). The following commented examples will show the different situations to consider. 17

18 3.3.1 The Empty Type In a definition by case analysis, there is one branch for each introduction rule of the type. Hence, in a definition by case analysis on p : False there are no cases to be considered. In other words, the rule of (non-dependent) case analysis for the type False is (for s in Prop, Set or Type): Q : s p : False match p return Q with end : Q As a corollary, if we could construct an object in False, then it could be possible to define an object in any type. The tactic contradiction corresponds to the application of the elimination rule above. It searches in the context for an absurd hypothesis (this is, a hypothesis whose type is False) and then proves the goal by a case analysis of it. Theorem fromfalse : False 0=1. intro H. contradiction. In Coq the negation is defined as follows : Definition not (P:Prop) := P False The proposition not A is also written A. If A and B are propositions, a is a proof of A and H is a proof of A, the term match H a return B with end is a proof term of B. Thus, if your goal is B and you have some hypothesis H : A, the tactic case H generates a new subgoal with statement A, as shown by the following example 4. Fact Nosense : = 3. intro H; case H. =========================== 0 = 0 reflexivity. The tactic absurd A (where A is any proposition), is based on the same principle, but generates two subgoals: A and A, for solving B. 4 Notice that a b is just an abreviation for a= b 18

19 3.3.2 The Equality Type Let A : Type, a, b of type A, and π a proof of a = b. Non dependent case analysis of π allows us to associate to any proof of Q a a proof of Q b, where Q : A s (where s {Prop, Set, Type}). The following term is a proof of Q a Q b. fun H : Q a match π in (_ = y) return Q y with refl_equal H end Notice the header of the match construct. It expresses how the resulting type Q y depends on the type of p. Notice also that in the pattern introduced by the keyword in, the parameter a in the type a = y must be implicit, and replaced by a wildcard _. Therefore, case analysis on a proof of the equality a = b amounts to replacing all the occurrences of the term b with the term a in the goal to be proven. Let us illustrate this through an example: the transitivity property of this equality. Theorem trans : n m p:nat, n=m m=p n=p. intros n m p eqnm. n : nat m : nat p : nat eqnm : n = m m = p n = p case eqnm. n : nat m : nat p : nat eqnm : n = m n = p n = p trivial. Exercise 3.2 Prove the symmetry property of equality. Instead of using case, we can use the tactic rewrite. If H is a proof of a = b, then rewrite H performs a case analysis on a proof of b = a, obtained by applying a symmetry theorem to H. This application of symmetry 19

20 allows us to rewrite the equality from left to right, which looks more natural. An optional parameter (either or ) can be used to precise in which sense the equality must be rewritten. By default, rewrite H corresponds to rewrite H Lemma Rw : x y: nat, y = y * x y * x * x = y. intros x y e; do 2 rewrite <- e. 1 subgoal x : nat y : nat e : y = y * x y = y reflexivity. Notice that, if H : a = b, then the tactic rewrite H replaces all the occurrences of a by b. However, in certain situations we could be interested in rewriting some of the occurrences, but not all of them. This can be done using the tactic pattern. Let us consider yet another example to illustrate this. Let us start with some simple theorems of arithmetic; two of them are already proven in the Standard Library, the last is left as an exercise. mult_1_l : n : nat, 1 * n = n mult_plus_distr_r : n m p : nat, (n + m) * p = n * p + m * p mult_distr_s : n p : nat, n * p + p = (S n)* p. Let us now prove a simple result: Lemma four_n : n:nat, n+n+n+n = 4*n. intro n;rewrite <- (mult_1_l n). n : nat 1 * n + 1 * n + 1 * n + 1 * n = 4 * (1 * n) 20

21 We can see that the rewrite tactic call replaced all the occurrences of n by the term 1 * n. If we want to do the rewriting ony on the leftmost occurrence of n, we can mark this occurrence using the pattern tactic: Undo. intro n; pattern n at 1. n : nat (fun n0 : nat n0 + n + n + n = 4 * n) n Applying the tactic pattern n at 1 allowed us to explicitly abstract the first occurrence of n from the goal, putting this goal under the form Q n, thus pointing to rewrite the particular predicate on n that we search to prove. rewrite <- mult_1_l. 1 subgoal n : nat 1 * n + n + n + n = 4 * n repeat rewrite mult_distr_s. n : nat 4 * n = 4 * n trivial The Predicate n m The last but one instance of the elimination schema that we will illustrate is case analysis for the predicate n m: Let n and p be terms of type nat, and Q a predicate of type nat Prop. If H is a proof of n p, H 0 a proof of Q n and H S a proof of m:nat, n m Q (S m), then the term match H in (_ q) return (Q q) with le_n H0 le_s m Hm HS m Hm end 21

22 is a proof term of Q p. The two patterns of this match construct describe all possible forms of proofs of n m (notice again that the general parameter n is implicit in the in... clause and is absent from the match patterns. Notice that the choice of introducing some of the arguments of the predicate as being general parameters in its definition has consequences on the rule of case analysis that is derived. In particular, the type Q of the object defined by the case expression only depends on the indexes of the predicate, and not on the general parameters. In the definition of the predicate, the first argument of this relation is a general parameter of the definition. Hence, the predicate Q to be proven only depends on the second argument of the relation. In other words, the integer n is also a general parameter of the rule of case analysis. An example of an application of this rule is the following theorem, showing that any integer greater or equal than 1 is the successor of another natural number: Lemma predecessor_of_positive : n, 1 n p:nat, n = S p. intros n H;case H. n : nat H : 1 n p : nat, 1 = S p exists 0; trivial. n : nat H : 1 n m : nat, 0 m p : nat, S m = S p intros m _. exists m. trivial Vectors The vector polymorphic and dependent family of types will give an idea of the most general scheme of pattern-matching. For instance, let us define a function for computing the tail of any vector. 22

23 Notice that we shall build a total function, by considering that the tail of an empty vector is this vector itself. In that sense, it will be slightly different from the Vtail function of the Standard Library, which is defined only for vectors of type vector A (S n). The header of the function we want to build is the following: Definition Vtail_total (A : Set) (n : nat) (v : vector A n) : vector A (pred n):= Since the branches will not have the same type (depending on the parameter n), the body of this function is a dependent pattern matching on v. So we will have : match v in (vector _ n0) return (vector A (pred n0)) with The first branch deals with the constructor Vnil and must return a value in vector A (pred 0), convertible to vector A 0. So, we propose: Vnil Vnil A The second branch considers a vector in vector A (S n0) of the form Vcons A n0 v0, with v0:vector A n0, and must return a value in vector A (pred (S n0)), convertible to v0:vector A n0. This second branch is thus : Vcons _ n0 v0 v0 Here is the full definition: Definition Vtail_total (A : Set) (n : nat) (v : vector A n) : vector A (pred n):= match v in (vector _ n0) return (vector A (pred n0)) with Vnil Vnil A Vcons _ n0 v0 v0 end. 3.4 Case Analysis and Logical Paradoxes In the previous section we have illustrated the general scheme for generating the rule of case analysis associated to some recursive type from the definition of the type. However, if the logical soundness is to be preserved, certain restrictions to this schema are necessary. This section provides a brief explanation of these restrictions. 23

CIS 500 Software Foundations Midterm I. Answer key. October 10, 2007

CIS 500 Software Foundations Midterm I Answer key October 10, 2007 Functional Programming 1. (2 points) Consider the following Fixpoint definition in Coq. Fixpoint zip (X Y : Set) (lx : list X) (ly : list

CHAPTER 7 GENERAL PROOF SYSTEMS

CHAPTER 7 GENERAL PROOF SYSTEMS 1 Introduction Proof systems are built to prove statements. They can be thought as an inference machine with special statements, called provable statements, or sometimes

Coq tutorial Program verification using Coq

Coq tutorial Program verification using Coq CNRS Université Paris Sud TYPES summer school August 23th, 2005 Introduction This lecture: how to use Coq to verify purely functional programs Thursday s lecture:

Mathematical Induction

Mathematical Induction In logic, we often want to prove that every member of an infinite set has some feature. E.g., we would like to show: N 1 : is a number 1 : has the feature Φ ( x)(n 1 x! 1 x) How

Discrete Mathematics, Chapter 5: Induction and Recursion

Discrete Mathematics, Chapter 5: Induction and Recursion Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 5 1 / 20 Outline 1 Well-founded

ML for the Working Programmer

ML for the Working Programmer 2nd edition Lawrence C. Paulson University of Cambridge CAMBRIDGE UNIVERSITY PRESS CONTENTS Preface to the Second Edition Preface xiii xv 1 Standard ML 1 Functional Programming

Fundamentals of Mathematics Lecture 6: Propositional Logic

Fundamentals of Mathematics Lecture 6: Propositional Logic Guan-Shieng Huang National Chi Nan University, Taiwan Spring, 2008 1 / 39 Connectives Propositional Connectives I 1 Negation: (not A) A A T F

OPERATIONAL TYPE THEORY by Adam Petcher Prepared under the direction of Professor Aaron Stump A thesis presented to the School of Engineering of

WASHINGTON NIVERSITY SCHOOL OF ENGINEERING AND APPLIED SCIENCE DEPARTMENT OF COMPTER SCIENCE AND ENGINEERING DECIDING JOINABILITY MODLO GROND EQATIONS IN OPERATIONAL TYPE THEORY by Adam Petcher Prepared

Chapter II. Controlling Cars on a Bridge

Chapter II. Controlling Cars on a Bridge 1 Introduction The intent of this chapter is to introduce a complete example of a small system development. During this development, you will be made aware of the

[Refer Slide Time: 05:10]

Principles of Programming Languages Prof: S. Arun Kumar Department of Computer Science and Engineering Indian Institute of Technology Delhi Lecture no 7 Lecture Title: Syntactic Classes Welcome to lecture

CS510 Software Engineering

CS510 Software Engineering Propositional Logic Asst. Prof. Mathias Payer Department of Computer Science Purdue University TA: Scott A. Carr Slides inspired by Xiangyu Zhang http://nebelwelt.net/teaching/15-cs510-se

Termination Checking: Comparing Structural Recursion and Sized Types by Examples

Termination Checking: Comparing Structural Recursion and Sized Types by Examples David Thibodeau Decemer 3, 2011 Abstract Termination is an important property for programs and is necessary for formal proofs

3. Mathematical Induction

3. MATHEMATICAL INDUCTION 83 3. Mathematical Induction 3.1. First Principle of Mathematical Induction. Let P (n) be a predicate with domain of discourse (over) the natural numbers N = {0, 1,,...}. If (1)

Parametric Domain-theoretic models of Linear Abadi & Plotkin Logic

Parametric Domain-theoretic models of Linear Abadi & Plotkin Logic Lars Birkedal Rasmus Ejlers Møgelberg Rasmus Lerchedahl Petersen IT University Technical Report Series TR-00-7 ISSN 600 600 February 00

Inference Rules and Proof Methods

Inference Rules and Proof Methods Winter 2010 Introduction Rules of Inference and Formal Proofs Proofs in mathematics are valid arguments that establish the truth of mathematical statements. An argument

CHAPTER 3. Methods of Proofs. 1. Logical Arguments and Formal Proofs

CHAPTER 3 Methods of Proofs 1. Logical Arguments and Formal Proofs 1.1. Basic Terminology. An axiom is a statement that is given to be true. A rule of inference is a logical rule that is used to deduce

263-2200 Types and Programming Languages

263-2200 Types and Programming Languages 1 / 49 Outline Types Evaluation Rules Typing Rules Properties of the Typing Relation The Inversion Lemma Prolog Implementation Reasoning Involving Types Progress

A first step towards modeling semistructured data in hybrid multimodal logic

A first step towards modeling semistructured data in hybrid multimodal logic Nicole Bidoit * Serenella Cerrito ** Virginie Thion * * LRI UMR CNRS 8623, Université Paris 11, Centre d Orsay. ** LaMI UMR

Deterministic Discrete Modeling

Deterministic Discrete Modeling Formal Semantics of Firewalls in Isabelle/HOL Cornelius Diekmann, M.Sc. Dr. Heiko Niedermayer Prof. Dr.-Ing. Georg Carle Lehrstuhl für Netzarchitekturen und Netzdienste

2. Methods of Proof Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try.

2. METHODS OF PROOF 69 2. Methods of Proof 2.1. Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try. Trivial Proof: If we know q is true then

Likewise, we have contradictions: formulas that can only be false, e.g. (p p).

CHAPTER 4. STATEMENT LOGIC 59 The rightmost column of this truth table contains instances of T and instances of F. Notice that there are no degrees of contingency. If both values are possible, the formula

POLYTYPIC PROGRAMMING OR: Programming Language Theory is Helpful

POLYTYPIC PROGRAMMING OR: Programming Language Theory is Helpful RALF HINZE Institute of Information and Computing Sciences Utrecht University Email: ralf@cs.uu.nl Homepage: http://www.cs.uu.nl/~ralf/

Chapter 1 LOGIC AND PROOF

Chapter 1 LOGIC AND PROOF To be able to understand mathematics and mathematical arguments, it is necessary to have a solid understanding of logic and the way in which known facts can be combined to prove

+ addition - subtraction and unary minus * multiplication / division mod modulo

Chapter 4 Basic types We examine in this chapter the Caml basic types. 4.1 Numbers Caml Light provides two numeric types: integers (type int) and floating-point numbers (type float). Integers are limited

Verifying Specifications with Proof Scores in CafeOBJ

Verifying Specifications with Proof Scores in CafeOBJ FUTATSUGI, Kokichi 二 木 厚 吉 Chair of Language Design Graduate School of Information Science Japan Advanced Institute of Science and Technology (JAIST)

Higher-Order Logic. Specification and Verification with Higher-Order Logic

Higher-Order Logic Specification and Verification with Higher-Order Logic Arnd Poetzsch-Heffter Software Technology Group Fachbereich Informatik Technische Universität Kaiserslautern Sommersemester 2010

Chapter 1. Logic and Proof

Chapter 1. Logic and Proof 1.1 Remark: A little over 100 years ago, it was found that some mathematical proofs contained paradoxes, and these paradoxes could be used to prove statements that were known

the type checking problem (TCP) schema the proof checking problem the type synthesis problem (TSP) decidability input: Γ M :? polymorphism in Coq

schema the type checking problem (TCP) decidability polymorphism in Coq dependent inductive data-types in Coq further reading overview input: Γ M : N? output: true yes the typing judgement is derivable

So let us begin our quest to find the holy grail of real analysis.

1 Section 5.2 The Complete Ordered Field: Purpose of Section We present an axiomatic description of the real numbers as a complete ordered field. The axioms which describe the arithmetic of the real numbers

Chapter 2 Mathematical Background

Chapter 2 Mathematical Background We start this chapter with a summary of basic concepts and notations for sets and first-order logic formulas, which will be used in the rest of the book. Our aim is to

Formal Languages and Automata Theory - Regular Expressions and Finite Automata -

Formal Languages and Automata Theory - Regular Expressions and Finite Automata - Samarjit Chakraborty Computer Engineering and Networks Laboratory Swiss Federal Institute of Technology (ETH) Zürich March

ON FUNCTIONAL SYMBOL-FREE LOGIC PROGRAMS

PROCEEDINGS OF THE YEREVAN STATE UNIVERSITY Physical and Mathematical Sciences 2012 1 p. 43 48 ON FUNCTIONAL SYMBOL-FREE LOGIC PROGRAMS I nf or m at i cs L. A. HAYKAZYAN * Chair of Programming and Information

Induction and Recursion

Induction and Recursion Jan van Eijck June 3, 2003 Abstract A very important proof method that is not covered by the recipes from Chapter 3 is the method of proof by Mathematical Induction. Roughly speaking,

Handout #1: Mathematical Reasoning

Math 101 Rumbos Spring 2010 1 Handout #1: Mathematical Reasoning 1 Propositional Logic A proposition is a mathematical statement that it is either true or false; that is, a statement whose certainty or

Chapter 6 Finite sets and infinite sets. Copyright 2013, 2005, 2001 Pearson Education, Inc. Section 3.1, Slide 1

Chapter 6 Finite sets and infinite sets Copyright 013, 005, 001 Pearson Education, Inc. Section 3.1, Slide 1 Section 6. PROPERTIES OF THE NATURE NUMBERS 013 Pearson Education, Inc.1 Slide Recall that denotes

(Refer Slide Time: 1:41)

Discrete Mathematical Structures Dr. Kamala Krithivasan Department of Computer Science and Engineering Indian Institute of Technology, Madras Lecture # 10 Sets Today we shall learn about sets. You must

A Propositional Dynamic Logic for CCS Programs

A Propositional Dynamic Logic for CCS Programs Mario R. F. Benevides and L. Menasché Schechter {mario,luis}@cos.ufrj.br Abstract This work presents a Propositional Dynamic Logic in which the programs are

Truth Conditional Meaning of Sentences. Ling324 Reading: Meaning and Grammar, pg

Truth Conditional Meaning of Sentences Ling324 Reading: Meaning and Grammar, pg. 69-87 Meaning of Sentences A sentence can be true or false in a given situation or circumstance. (1) The pope talked to

This asserts two sets are equal iff they have the same elements, that is, a set is determined by its elements.

3. Axioms of Set theory Before presenting the axioms of set theory, we first make a few basic comments about the relevant first order logic. We will give a somewhat more detailed discussion later, but

PROGRAM-ing Finger Trees in COQ

PROGRAM-ing Finger Trees in COQ Matthieu Sozeau Univ. Paris Sud, CNRS, Laboratoire LRI, UMR 8623, Orsay, F-91405 INRIA Futurs, ProVal, Parc Orsay Université, F-91893 sozeau@lri.fr Abstract Finger Trees

Discrete Mathematics and Probability Theory Fall 2009 Satish Rao, David Tse Note 2

CS 70 Discrete Mathematics and Probability Theory Fall 2009 Satish Rao, David Tse Note 2 Proofs Intuitively, the concept of proof should already be familiar We all like to assert things, and few of us

MAT2400 Analysis I. A brief introduction to proofs, sets, and functions

MAT2400 Analysis I A brief introduction to proofs, sets, and functions In Analysis I there is a lot of manipulations with sets and functions. It is probably also the first course where you have to take

1. R In this and the next section we are going to study the properties of sequences of real numbers.

+a 1. R In this and the next section we are going to study the properties of sequences of real numbers. Definition 1.1. (Sequence) A sequence is a function with domain N. Example 1.2. A sequence of real

1 Some mathematical preliminaries: sets, relations and functions

Bengt Nordström, November 4, 2013 Department of Computing Science, Chalmers and University of Göteborg, Göteborg, Sweden 1 Some mathematical preliminaries: sets, relations and functions 1.1 Propositions,

Prime Numbers. Chapter Primes and Composites

Chapter 2 Prime Numbers The term factoring or factorization refers to the process of expressing an integer as the product of two or more integers in a nontrivial way, e.g., 42 = 6 7. Prime numbers are

DISCRETE MATHEMATICS W W L CHEN

DISCRETE MATHEMATICS W W L CHEN c W W L Chen, 1982, 2008. This chapter originates from material used by the author at Imperial College, University of London, between 1981 and 1990. It is available free

Dependent Types at Work

Dependent Types at Work Ana Bove and Peter Dybjer Chalmers University of Technology, Göteborg, Sweden {bove,peterd}@chalmers.se Abstract. In these lecture notes we give an introduction to functional programming

Deductive Systems. Marco Piastra. Artificial Intelligence. Artificial Intelligence - A.A Deductive Systems [1]

Artificial Intelligence Deductive Systems Marco Piastra Artificial Intelligence - A.A. 2012- Deductive Systems 1] Symbolic calculus? A wff is entailed by a set of wff iff every model of is also model of

Elementary Number Theory We begin with a bit of elementary number theory, which is concerned

CONSTRUCTION OF THE FINITE FIELDS Z p S. R. DOTY Elementary Number Theory We begin with a bit of elementary number theory, which is concerned solely with questions about the set of integers Z = {0, ±1,

Chapter I Logic and Proofs

MATH 1130 1 Discrete Structures Chapter I Logic and Proofs Propositions A proposition is a statement that is either true (T) or false (F), but or both. s Propositions: 1. I am a man.. I am taller than

Chapter 7: Functional Programming Languages

Chapter 7: Functional Programming Languages Aarne Ranta Slides for the book Implementing Programming Languages. An Introduction to Compilers and Interpreters, College Publications, 2012. Fun: a language

INTRODUCTORY SET THEORY

M.Sc. program in mathematics INTRODUCTORY SET THEORY Katalin Károlyi Department of Applied Analysis, Eötvös Loránd University H-1088 Budapest, Múzeum krt. 6-8. CONTENTS 1. SETS Set, equal sets, subset,

Mathematics for Computer Science/Software Engineering. Notes for the course MSM1F3 Dr. R. A. Wilson

Mathematics for Computer Science/Software Engineering Notes for the course MSM1F3 Dr. R. A. Wilson October 1996 Chapter 1 Logic Lecture no. 1. We introduce the concept of a proposition, which is a statement

Journal of Functional Programming, volume 3 number 4, 1993. Dynamics in ML

Journal of Functional Programming, volume 3 number 4, 1993. Dynamics in ML Xavier Leroy École Normale Supérieure Michel Mauny INRIA Rocquencourt Abstract Objects with dynamic types allow the integration

WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT?

WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT? introduction Many students seem to have trouble with the notion of a mathematical proof. People that come to a course like Math 216, who certainly

Automated Theorem Proving - summary of lecture 1

Automated Theorem Proving - summary of lecture 1 1 Introduction Automated Theorem Proving (ATP) deals with the development of computer programs that show that some statement is a logical consequence of

Rigorous Software Development CSCI-GA 3033-009

Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 11 Semantics of Programming Languages Denotational Semantics Meaning of a program is defined as the mathematical

The Foundations: Logic and Proofs. Chapter 1, Part III: Proofs

The Foundations: Logic and Proofs Chapter 1, Part III: Proofs Rules of Inference Section 1.6 Section Summary Valid Arguments Inference Rules for Propositional Logic Using Rules of Inference to Build Arguments

The PCAT Programming Language Reference Manual

The PCAT Programming Language Reference Manual Andrew Tolmach and Jingke Li Dept. of Computer Science Portland State University (revised October 8, 2004) 1 Introduction The PCAT language (Pascal Clone

Satisfiability Checking

Satisfiability Checking First-Order Logic Prof. Dr. Erika Ábrahám RWTH Aachen University Informatik 2 LuFG Theory of Hybrid Systems WS 14/15 Satisfiability Checking Prof. Dr. Erika Ábrahám (RWTH Aachen

Equality and dependent type theory. Oberwolfach, March 2 (with some later corrections)

Oberwolfach, March 2 (with some later corrections) The Axiom of Univalence, a type-theoretic view point In type theory, we reduce proof-checking to type-checking Hence we want type-checking to be decidable

Theory of Computation Lecture Notes

Theory of Computation Lecture Notes Abhijat Vichare August 2005 Contents 1 Introduction 2 What is Computation? 3 The λ Calculus 3.1 Conversions: 3.2 The calculus in use 3.3 Few Important Theorems 3.4 Worked

MATH20302 Propositional Logic. Mike Prest School of Mathematics Alan Turing Building Room

MATH20302 Propositional Logic Mike Prest School of Mathematics Alan Turing Building Room 1.120 mprest@manchester.ac.uk April 10, 2015 Contents I Propositional Logic 3 1 Propositional languages 4 1.1 Propositional

This chapter is all about cardinality of sets. At first this looks like a

CHAPTER Cardinality of Sets This chapter is all about cardinality of sets At first this looks like a very simple concept To find the cardinality of a set, just count its elements If A = { a, b, c, d },

Formal Engineering for Industrial Software Development

Shaoying Liu Formal Engineering for Industrial Software Development Using the SOFL Method With 90 Figures and 30 Tables Springer Contents Introduction 1 1.1 Software Life Cycle... 2 1.2 The Problem 4 1.3

Math 3000 Section 003 Intro to Abstract Math Homework 2

Math 3000 Section 003 Intro to Abstract Math Homework 2 Department of Mathematical and Statistical Sciences University of Colorado Denver, Spring 2012 Solutions (February 13, 2012) Please note that these

Logic, Sets, and Proofs

Logic, Sets, and Proofs David A. Cox and Catherine C. McGeoch Amherst College 1 Logic Logical Statements. A logical statement is a mathematical statement that is either true or false. Here we denote logical

Continued Fractions and the Euclidean Algorithm

Continued Fractions and the Euclidean Algorithm Lecture notes prepared for MATH 326, Spring 997 Department of Mathematics and Statistics University at Albany William F Hammond Table of Contents Introduction

Correspondence analysis for strong three-valued logic

Correspondence analysis for strong three-valued logic A. Tamminga abstract. I apply Kooi and Tamminga s (2012) idea of correspondence analysis for many-valued logics to strong three-valued logic (K 3 ).

Monitoring Metric First-order Temporal Properties

Monitoring Metric First-order Temporal Properties DAVID BASIN, FELIX KLAEDTKE, SAMUEL MÜLLER, and EUGEN ZĂLINESCU, ETH Zurich Runtime monitoring is a general approach to verifying system properties at

Problem Set 1: Program Verification

Problem Set 1: Program Verification CS 173 Honors Section Assigned: September 7, 2011 Due on: September 14, 2011 One of the applications of logic in computer science is its use in proving programs to be

Fundamental Computer Science Concepts Sequence TCSU CSCI SEQ A

Fundamental Computer Science Concepts Sequence TCSU CSCI SEQ A A. Description Introduction to the discipline of computer science; covers the material traditionally found in courses that introduce problem

Summary Last Lecture. Automated Reasoning. Outline of the Lecture. Definition sequent calculus. Theorem (Normalisation and Strong Normalisation)

Summary Summary Last Lecture sequent calculus Automated Reasoning Georg Moser Institute of Computer Science @ UIBK Winter 013 (Normalisation and Strong Normalisation) let Π be a proof in minimal logic

Degrees of Truth: the formal logic of classical and quantum probabilities as well as fuzzy sets.

Degrees of Truth: the formal logic of classical and quantum probabilities as well as fuzzy sets. Logic is the study of reasoning. A language of propositions is fundamental to this study as well as true

Static Typing for Object-Oriented Programming

Science of Computer Programming 23(1):19 53, 1994. Static Typing for Object-Oriented Programming Jens Palsberg palsberg@daimi.aau.dk Michael I. Schwartzbach mis@daimi.aau.dk Computer Science Department

Mathematical Induction

Mathematical Induction Victor Adamchik Fall of 2005 Lecture 2 (out of three) Plan 1. Strong Induction 2. Faulty Inductions 3. Induction and the Least Element Principal Strong Induction Fibonacci Numbers

Section 3 Sequences and Limits

Section 3 Sequences and Limits Definition A sequence of real numbers is an infinite ordered list a, a 2, a 3, a 4,... where, for each n N, a n is a real number. We call a n the n-th term of the sequence.

Foundational Proof Certificates

An application of proof theory to computer science INRIA-Saclay & LIX, École Polytechnique CUSO Winter School, Proof and Computation 30 January 2013 Can we standardize, communicate, and trust formal proofs?

Math 3000 Running Glossary

Math 3000 Running Glossary Last Updated on: July 15, 2014 The definition of items marked with a must be known precisely. Chapter 1: 1. A set: A collection of objects called elements. 2. The empty set (

3. Recurrence Recursive Definitions. To construct a recursively defined function:

3. RECURRENCE 10 3. Recurrence 3.1. Recursive Definitions. To construct a recursively defined function: 1. Initial Condition(s) (or basis): Prescribe initial value(s) of the function.. Recursion: Use a

MATH 55: HOMEWORK #2 SOLUTIONS

MATH 55: HOMEWORK # SOLUTIONS ERIC PETERSON * 1. SECTION 1.5: NESTED QUANTIFIERS 1.1. Problem 1.5.8. Determine the truth value of each of these statements if the domain of each variable consists of all

MATHS 315 Mathematical Logic

MATHS 315 Mathematical Logic Second Semester, 2006 Contents 2 Formal Statement Logic 1 2.1 Post production systems................................. 1 2.2 The system L.......................................

Regression Verification: Status Report

Regression Verification: Status Report Presentation by Dennis Felsing within the Projektgruppe Formale Methoden der Softwareentwicklung 2013-12-11 1/22 Introduction How to prevent regressions in software

Reading 13 : Finite State Automata and Regular Expressions

CS/Math 24: Introduction to Discrete Mathematics Fall 25 Reading 3 : Finite State Automata and Regular Expressions Instructors: Beck Hasti, Gautam Prakriya In this reading we study a mathematical model

Regular Languages and Finite Automata

Regular Languages and Finite Automata 1 Introduction Hing Leung Department of Computer Science New Mexico State University Sep 16, 2010 In 1943, McCulloch and Pitts [4] published a pioneering work on a

Elementary Number Theory and Methods of Proof. CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.

Elementary Number Theory and Methods of Proof CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.edu/~cse215 1 Number theory Properties: 2 Properties of integers (whole

Mathematical Induction

Mathematical Induction (Handout March 8, 01) The Principle of Mathematical Induction provides a means to prove infinitely many statements all at once The principle is logical rather than strictly mathematical,

1.3 Induction and Other Proof Techniques

4CHAPTER 1. INTRODUCTORY MATERIAL: SETS, FUNCTIONS AND MATHEMATICAL INDU 1.3 Induction and Other Proof Techniques The purpose of this section is to study the proof technique known as mathematical induction.

Turing Degrees and Definability of the Jump. Theodore A. Slaman. University of California, Berkeley. CJuly, 2005

Turing Degrees and Definability of the Jump Theodore A. Slaman University of California, Berkeley CJuly, 2005 Outline Lecture 1 Forcing in arithmetic Coding and decoding theorems Automorphisms of countable

Moving from CS 61A Scheme to CS 61B Java

Moving from CS 61A Scheme to CS 61B Java Introduction Java is an object-oriented language. This document describes some of the differences between object-oriented programming in Scheme (which we hope you

We would like to state the following system of natural deduction rules preserving falsity:

A Natural Deduction System Preserving Falsity 1 Wagner de Campos Sanz Dept. of Philosophy/UFG/Brazil sanz@fchf.ufg.br Abstract This paper presents a natural deduction system preserving falsity. This new

Automata and Languages

Automata and Languages Computational Models: An idealized mathematical model of a computer. A computational model may be accurate in some ways but not in others. We shall be defining increasingly powerful

A note on normal forms for the closed fragment of system IL

MATHEMATICAL COMMUNICATIONS 195 Math. Commun. 17(2012), 195 204 A note on normal forms for the closed fragment of system IL Vedran Čačić1 and Mladen Vuković 1, 1 Department of Mathematics, University of

SQL INJECTION ATTACKS By Zelinski Radu, Technical University of Moldova

SQL INJECTION ATTACKS By Zelinski Radu, Technical University of Moldova Where someone is building a Web application, often he need to use databases to store information, or to manage user accounts. And

Software Engineering

Software Engineering Lecture 04: The B Specification Method Peter Thiemann University of Freiburg, Germany SS 2013 Peter Thiemann (Univ. Freiburg) Software Engineering SWT 1 / 50 The B specification method

THE TURING DEGREES AND THEIR LACK OF LINEAR ORDER

THE TURING DEGREES AND THEIR LACK OF LINEAR ORDER JASPER DEANTONIO Abstract. This paper is a study of the Turing Degrees, which are levels of incomputability naturally arising from sets of natural numbers.

Relations: their uses in programming and computational specifications

PEPS Relations, 15 December 2008 1/27 Relations: their uses in programming and computational specifications Dale Miller INRIA - Saclay & LIX, Ecole Polytechnique 1. Logic and computation Outline 2. Comparing