Formal Software Verification

2.2. The Universal Quantifier🔗

To prove ∀ x, P x, consider an arbitrary element and prove the proposition at it. The tactic intro, which introduced implications in Lecture 1, also introduces universal quantifiers.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) : x, P x := α:TypeP:α PropQ:α Proph: (x : α), P x Q x (x : α), P x α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αP a All goals completed! 🐙

The proof also uses the elimination rule. A hypothesis h : ∀ x, P x ∧ Q x is a function that returns a proof of P a ∧ Q a for each a, so the application h a instantiates it at a. This parallels Lecture 1, where a proof of an implication was a function on proofs. The tactic specialize instantiates a universal hypothesis in place.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) (a : α) (hPa : P a) : Q a := α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αhPa:P aQ a α:TypeP:α PropQ:α Propa:αh:P a Q ahPa:P aQ a All goals completed! 🐙

The universal quantifier distributes over conjunction. The proof combines the rules for the quantifier with the rules of Lecture 1 for conjunction and the biconditional.

theorem forall_and_distrib (α : Type) (P Q : α Prop) : ( x, P x Q x) ( x, P x) ( x, Q x) := α:TypeP:α PropQ:α Prop(∀ (x : α), P x Q x) (∀ (x : α), P x) (x : α), Q x α:TypeP:α PropQ:α Prop(∀ (x : α), P x Q x) (∀ (x : α), P x) (x : α), Q xα:TypeP:α PropQ:α Prop((∀ (x : α), P x) (x : α), Q x) (x : α), P x Q x α:TypeP:α PropQ:α Prop(∀ (x : α), P x Q x) (∀ (x : α), P x) (x : α), Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q x(∀ (x : α), P x) (x : α), Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q x (x : α), P xα:TypeP:α PropQ:α Proph: (x : α), P x Q x (x : α), Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q x (x : α), P x α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αP a All goals completed! 🐙 α:TypeP:α PropQ:α Proph: (x : α), P x Q x (x : α), Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αQ a All goals completed! 🐙 α:TypeP:α PropQ:α Prop((∀ (x : α), P x) (x : α), Q x) (x : α), P x Q x α:TypeP:α PropQ:α Proph:(∀ (x : α), P x) (x : α), Q xa:αP a Q a All goals completed! 🐙

2.2.1. Examples🔗

The examples below combine the two rules of this section with the connectives of Lecture 1.

Example 1. Implication is reflexive at each element.

example (α : Type) (P : α Prop) : x, P x P x := α:TypeP:α Prop (x : α), P x P x α:TypeP:α Propa:αhPa:P aP a All goals completed! 🐙

Example 2. A universal hypothesis instantiates at any given element. The application h a is already the proof, so no tactics are needed.

example (α : Type) (P : α Prop) (h : x, P x) (a : α) : P a := h a

Example 3. Instantiating both variables of a binary predicate at the same element yields the diagonal. The tactic apply unifies the hypothesis with the goal and finds both instantiations.

example (α : Type) (R : α α Prop) (h : x, y, R x y) : x, R x x := α:TypeR:α α Proph: (x y : α), R x y (x : α), R x x α:TypeR:α α Proph: (x y : α), R x ya:αR a a All goals completed! 🐙

Example 4. Consecutive universal quantifiers commute.

example (α β : Type) (R : α β Prop) (h : x, y, R x y) : y, x, R x y := α:Typeβ:TypeR:α β Proph: (x : α) (y : β), R x y (y : β) (x : α), R x y α:Typeβ:TypeR:α β Proph: (x : α) (y : β), R x yb:βa:αR a b All goals completed! 🐙

Example 5. Conjunction commutes under the quantifier. The tactic have records the instantiated hypothesis, and constructor splits the goal into the two conjuncts.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) : x, Q x P x := α:TypeP:α PropQ:α Proph: (x : α), P x Q x (x : α), Q x P x α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αQ a P a α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αha:P a Q aQ a P a α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αha:P a Q aQ aα:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αha:P a Q aP a α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αha:P a Q aQ a All goals completed! 🐙 α:TypeP:α PropQ:α Proph: (x : α), P x Q xa:αha:P a Q aP a All goals completed! 🐙

Example 6. A disjunct entails the disjunction at each element. Applying Or.inl reduces the disjunction to its left side.

example (α : Type) (P Q : α Prop) (h : x, P x) : x, P x Q x := α:TypeP:α PropQ:α Proph: (x : α), P x (x : α), P x Q x α:TypeP:α PropQ:α Proph: (x : α), P xa:αP a Q a α:TypeP:α PropQ:α Proph: (x : α), P xa:αP a All goals completed! 🐙

Example 7. A pointwise disjunction whose left side fails everywhere yields its right side.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) (hn : x, ¬P x) : x, Q x := α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬P x (x : α), Q x α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬P xa:αQ a cases h a with α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬P xa:αhPa:P aQ a All goals completed! 🐙 α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬P xa:αhQa:Q aQ a All goals completed! 🐙

Example 8. Contraposition applies at each element. The proof reasons forward, deriving Q a with have before reaching the contradiction.

example (α : Type) (P Q : α Prop) (h : x, P x Q x) (hn : x, ¬Q x) : x, ¬P x := α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬Q x (x : α), ¬P x α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬Q xa:αhPa:P aFalse α:TypeP:α PropQ:α Proph: (x : α), P x Q xhn: (x : α), ¬Q xa:αhPa:P ahQa:Q aFalse All goals completed! 🐙

Example 9. An antecedent that does not mention the quantified variable moves inside the quantifier.

example (α : Type) (P : Prop) (Q : α Prop) (h : P x, Q x) : x, P Q x := α:TypeP:PropQ:α Proph:P (x : α), Q x (x : α), P Q x α:TypeP:PropQ:α Proph:P (x : α), Q xa:αhP:PQ a All goals completed! 🐙

Example 10. When the type has an element, ∀ x, P x refutes ∀ x, ¬P x.

example (α : Type) (P : α Prop) (a : α) (h : x, P x) : ¬ x, ¬P x := α:TypeP:α Propa:αh: (x : α), P x¬ (x : α), ¬P x α:TypeP:α Propa:αh: (x : α), P xhn: (x : α), ¬P xFalse All goals completed! 🐙