Formal Software Verification

1.9. Worked Examples🔗

Each example below appears three ways, as a natural deduction derivation, as a proof term, and as a tactic proof. The three present the same proof, and Lean checks both proof scripts when the notes are built. These propositions are disjoint from the examples of the earlier sections and from the exercises.

1.9.1. A conjunction entails a conjunct🔗

Elimination projects the left conjunct, and the implication discharges the assumption P ∧ Q.

   [P ∧ Q]
  ──────────  ∧E₁
      P
  ────────────  →I
   P ∧ Q → P
example (P Q : Prop) : P Q P := fun h => h.left example (P Q : Prop) : P Q P := P:PropQ:PropP Q P P:PropQ:Proph:P QP All goals completed! 🐙

1.9.2. Ex Falso Quodlibet🔗

From a proof of the absurdity, ⊥ elimination proves any proposition.3

   [⊥]
  ──────  ⊥E
    P
  ────────  →I
   ⊥ → P
example (P : Prop) : False P := fun h => False.elim h example (P : Prop) : False P := P:PropFalse P P:Proph:FalseP All goals completed! 🐙

1.9.3. Modus Ponens🔗

An implication and its antecedent, both projected from the conjunction, combine by →E to give the consequent.4

   [(P→Q)∧P]           [(P→Q)∧P]
  ───────────── ∧E₁    ───────────── ∧E₂
      P → Q                  P
    ────────────────────────────── →E
                 Q
   ──────────────────────────────── →I
        (P → Q) ∧ P → Q
example (P Q : Prop) : (P Q) P Q := fun h => h.left h.right example (P Q : Prop) : (P Q) P Q := P:PropQ:Prop(P Q) P Q P:PropQ:Proph:(P Q) PQ P:PropQ:Proph:(P Q) PP All goals completed! 🐙

1.9.4. Disjunction Commutes🔗

Case analysis on the disjunction rebuilds it with the disjuncts exchanged.

               [P]           [Q]
   [P ∨ Q]    ─────── ∨I₂   ─────── ∨I₁
              Q ∨ P         Q ∨ P
  ───────────────────────────────────── ∨E
             Q ∨ P
  ──────────────────────  →I
   P ∨ Q → Q ∨ P
example (P Q : Prop) : P Q Q P := fun h => h.elim (fun hP => Or.inr hP) (fun hQ => Or.inl hQ) example (P Q : Prop) : P Q Q P := P:PropQ:PropP Q Q P P:PropQ:Proph:P QQ P cases h with P:PropQ:ProphP:PQ P All goals completed! 🐙 P:PropQ:ProphQ:QQ P All goals completed! 🐙

1.9.5. Double Negation Elimination🔗

This direction requires classical reasoning. Classical.byContradiction discharges the assumption ¬P after deriving ⊥ from it together with ¬¬P.5

   [¬P]  [¬¬P]
  ──────────────  ¬E
        ⊥
    ──────────  RAA
        P
   ───────────────  →I
     ¬¬P → P
example (P : Prop) : ¬¬P P := fun h => Classical.byContradiction (fun hnP => h hnP) example (P : Prop) : ¬¬P P := P:Prop¬¬P P P:Proph:¬¬PP P:Proph:¬¬P¬P False P:Proph:¬¬PhnP:¬PFalse All goals completed! 🐙

3. Ex falso quodlibet is Latin for "from a falsehood, anything follows".

4. Modus ponens is Latin, short for modus ponendo ponens, "the mode that affirms by affirming".

5. The classical step marked RAA is reductio ad absurdum, Latin for "reduction to absurdity".