Formal Software Verification

2.3. The Existential Quantifier🔗

To prove ∃ x, P x, exhibit a witness and prove the proposition at it. The anonymous constructor of Lecture 1 pairs the witness with the proof. The term rfl proves an equation whose two sides compute to the same value.

example : n : Nat, n * n = 9 := 3, rfl

The tactic exists provides the witness in tactic mode and closes the remaining goal when it holds by computation.

example : n : Nat, n * n = 9 := n, n * n = 9 All goals completed! 🐙

To use a hypothesis h : ∃ x, P x, name a witness and the proof that it satisfies P. The proposition ∃ x, P x has the single constructor intro, so the tactic cases treats it as it treated disjunction in Lecture 1, now with one case.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) : x, P x := α:TypeP:α PropQ:α Proph: x, P x Q x x, P x cases h with α:TypeP:α PropQ:α Propa:αha:P a Q a x, P x All goals completed! 🐙

The tactic obtain destructures the hypothesis in one step, with a pattern that mirrors the anonymous constructor.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) : x, Q x := α:TypeP:α PropQ:α Proph: x, P x Q x x, Q x α:TypeP:α PropQ:α Propa:αha:P a Q a x, Q x All goals completed! 🐙

The theorem below combines the two quantifiers. A pointwise implication carries existence from P to Q, and the witness does not change.

theorem exists_imp_exists (α : Type) (P Q : α Prop) (h : x, P x Q x) : ( x, P x) x, Q x := α:TypeP:α PropQ:α Proph: (x : α), P x Q x( x, P x) x, Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q xhex: x, P x x, Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αhPa:P a x, Q x All goals completed! 🐙

2.3.1. Examples🔗

The examples below combine the witness rule and existential elimination with the connectives of Lecture 1.

Example 1. The witness 7 proves a concrete existential by computation.

example : n : Nat, n + 5 = 12 := 7, rfl

Example 2. Both 0 and 1 satisfy n * n = n, and the proof picks the witness 1.

example : n : Nat, n * n = n := n, n * n = n All goals completed! 🐙

Example 3. An element together with a proof at it is the introduction rule packaged as a pair.

example (α : Type) (P : α Prop) (a : α) (hPa : P a) : x, P x := a, hPa

Example 4. On an inhabited type, a universal statement yields an existential one. The tactic specialize instantiates the hypothesis, and exists finds it as an assumption.

example (α : Type) (P : α Prop) (a : α) (h : x, P x) : x, P x := α:TypeP:α Propa:αh: (x : α), P x x, P x α:TypeP:α Propa:αh:P a x, P x All goals completed! 🐙

Example 5. A proposition that does not mention the bound variable escapes the quantifier.

example (α : Type) (P : Prop) (h : _ : α, P) : P := α:TypeP:Proph: x, PP α:TypeP:Propw✝:αhP:PP All goals completed! 🐙

Example 6. Conjunction commutes under the quantifier.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) : x, Q x P x := α:TypeP:α PropQ:α Proph: x, P x Q x x, Q x P x cases h with α:TypeP:α PropQ:α Propa:αha:P a Q a x, Q x P x All goals completed! 🐙

Example 7. An existential of a conjunction splits, and the two parts share the witness. The pattern of obtain destructures the conjunction under the quantifier in one step.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) : ( x, P x) ( x, Q x) := α:TypeP:α PropQ:α Proph: x, P x Q x( x, P x) x, Q x α:TypeP:α PropQ:α Propa:αhPa:P ahQa:Q a( x, P x) x, Q x α:TypeP:α PropQ:α Propa:αhPa:P ahQa:Q a x, P xα:TypeP:α PropQ:α Propa:αhPa:P ahQa:Q a x, Q x α:TypeP:α PropQ:α Propa:αhPa:P ahQa:Q a x, P x All goals completed! 🐙 α:TypeP:α PropQ:α Propa:αhPa:P ahQa:Q a x, Q x All goals completed! 🐙

Example 8. The witness for P x also witnesses Q x → P x.

example (α : Type) (P Q : α Prop) (h : x, P x) : x, Q x P x := α:TypeP:α PropQ:α Proph: x, P x x, Q x P x α:TypeP:α PropQ:α Propa:αhPa:P a x, Q x P x α:TypeP:α PropQ:α Propa:αhPa:P aQ a P a α:TypeP:α PropQ:α Propa:αhPa:P a_hQ:Q aP a All goals completed! 🐙

Example 9. Consecutive existential quantifiers commute.

example (α β : Type) (R : α β Prop) (h : x, y, R x y) : y, x, R x y := α:Typeβ:TypeR:α β Proph: x y, R x y y x, R x y α:Typeβ:TypeR:α β Propa:αb:βhab:R a b y x, R x y All goals completed! 🐙

Example 10. An existential disjunction whose right side fails everywhere witnesses its left side.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) (hn : x, ¬Q x) : x, P x := α:TypeP:α PropQ:α Proph: x, P x Q xhn: (x : α), ¬Q x x, P x α:TypeP:α PropQ:α Prophn: (x : α), ¬Q xa:αha:P a Q a x, P x cases ha with α:TypeP:α PropQ:α Prophn: (x : α), ¬Q xa:αhPa:P a x, P x All goals completed! 🐙 α:TypeP:α PropQ:α Prophn: (x : α), ¬Q xa:αhQa:Q a x, P x All goals completed! 🐙