Formal Software Verification

2.5. The Order of Quantifiers🔗

The order of quantifiers determines what a statement asserts. In ∀ y, ∃ x, R x y, the witness x may depend on y, and different values of y may require different witnesses. In ∃ x, ∀ y, R x y, a single witness x satisfies R with every y at once. The second form asserts a uniform witness, so it is the stronger statement.

Quantifiers of the same kind commute, and the examples of the two previous sections proved the exchanges for ∀ and for ∃. Quantifiers of different kinds do not commute, and only one direction of the exchange holds. The stronger order implies the weaker one. A witness that satisfies R with every y in particular satisfies R with each given y.

theorem exists_forall_swap (α β : Type) (R : α β Prop) (h : x, y, R x y) : y, x, R x y := α:Typeβ:TypeR:α β Proph: x, (y : β), R x y (y : β), x, R x y α:Typeβ:TypeR:α β Proph: x, (y : β), R x yb:β x, R x b α:Typeβ:TypeR:α β Propb:βa:αha: (y : β), R a y x, R x b All goals completed! 🐙

The converse fails. Over the natural numbers, take R x y to be x ≥ y. Then ∀ y, ∃ x, R x y holds, since each y satisfies y ≥ y, and ∃ x, ∀ y, R x y states that some natural number is greater than or equal to every natural number, which is false.

2.5.1. Examples🔗

The examples below move quantifiers across one another. The last two prove in Lean the two claims of the counterexample above.

Example 1. A witness that relates to every element in particular relates to itself.

example (α : Type) (R : α α Prop) (h : x, y, R x y) : x, R x x := α:TypeR:α α Proph: x, (y : α), R x y x, R x x α:TypeR:α α Propa:αha: (y : α), R a y x, R x x All goals completed! 🐙

Example 2. An existential-universal statement yields the doubly existential one when the inner type has an element.

example (α β : Type) (R : α β Prop) (b : β) (h : x, y, R x y) : x, y, R x y := α:Typeβ:TypeR:α β Propb:βh: x, (y : β), R x y x y, R x y α:Typeβ:TypeR:α β Propb:βa:αha: (y : β), R a y x y, R x y All goals completed! 🐙

Example 3. A doubly universal statement yields the mixed order when the type of witnesses has an element.

example (α β : Type) (R : α β Prop) (a : α) (h : x, y, R x y) : y, x, R x y := α:Typeβ:TypeR:α β Propa:αh: (x : α) (y : β), R x y (y : β), x, R x y α:Typeβ:TypeR:α β Propa:αh: (x : α) (y : β), R x yb:β x, R x b All goals completed! 🐙

Example 4. The theorem exists_forall_swap is a function, and applying it to a hypothesis and an element gives the instantiated conclusion. The proof is the application itself.

example (α β : Type) (R : α β Prop) (h : x, y, R x y) (b : β) : x, R x b := exists_forall_swap α β R h b

Example 5. A conjunction under the two quantifiers projects to its left conjunct, preserving the witness.

example (α β : Type) (R S : α β Prop) (h : x, y, R x y S x y) : x, y, R x y := α:Typeβ:TypeR:α β PropS:α β Proph: x, (y : β), R x y S x y x, (y : β), R x y α:Typeβ:TypeR:α β PropS:α β Propa:αha: (y : β), R a y S a y x, (y : β), R x y α:Typeβ:TypeR:α β PropS:α β Propa:αha: (y : β), R a y S a y (y : β), R a y α:Typeβ:TypeR:α β PropS:α β Propa:αha: (y : β), R a y S a yb:βR a b All goals completed! 🐙

Example 6. Two existential-universal hypotheses combine into a doubly existential conjunction, and each witness instantiates the universal of the other.

example (α β : Type) (R S : α β Prop) (h1 : x, y, R x y) (h2 : y, x, S x y) : x, y, R x y S x y := α:Typeβ:TypeR:α β PropS:α β Proph1: x, (y : β), R x yh2: y, (x : α), S x y x y, R x y S x y α:Typeβ:TypeR:α β PropS:α β Proph2: y, (x : α), S x ya:αha: (y : β), R a y x y, R x y S x y α:Typeβ:TypeR:α β PropS:α β Propa:αha: (y : β), R a yb:βhb: (x : α), S x b x y, R x y S x y All goals completed! 🐙

Example 7. With three quantifiers, the existential witness serves for every z, so the outer universal moves to the front.

example (α β γ : Type) (T : α β γ Prop) (h : x, y, z, T x y z) : z, x, y, T x y z := α:Typeβ:Typeγ:TypeT:α β γ Proph: x, (y : β) (z : γ), T x y z (z : γ), x, (y : β), T x y z α:Typeβ:Typeγ:TypeT:α β γ Proph: x, (y : β) (z : γ), T x y zc:γ x, (y : β), T x y c α:Typeβ:Typeγ:TypeT:α β γ Propc:γa:αha: (y : β) (z : γ), T a y z x, (y : β), T x y c α:Typeβ:Typeγ:TypeT:α β γ Propc:γa:αha: (y : β) (z : γ), T a y z (y : β), T a y c α:Typeβ:Typeγ:TypeT:α β γ Propc:γa:αha: (y : β) (z : γ), T a y zb:βT a b c All goals completed! 🐙

Example 8. Contraposition of exists_forall_swap transports the negation in the opposite direction.

example (α β : Type) (R : α β Prop) (h : ¬ y, x, R x y) : ¬ x, y, R x y := α:Typeβ:TypeR:α β Proph:¬ (y : β), x, R x y¬ x, (y : β), R x y α:Typeβ:TypeR:α β Proph:¬ (y : β), x, R x yhex: x, (y : β), R x yFalse All goals completed! 🐙

Example 9. The first claim of the counterexample above. Each natural number is greater than or equal to itself.

example : y : Nat, x : Nat, x y := (y : Nat), x, x y b:Nat x, x b All goals completed! 🐙

Example 10. The second claim. No natural number is greater than or equal to every natural number, since a + 1 exceeds a. The lemma Nat.not_succ_le_self refutes a ≥ a + 1.

example : ¬ x : Nat, y : Nat, x y := ¬ x, (y : Nat), x y a:Natha: (y : Nat), a yFalse All goals completed! 🐙