Lecture 2 · Formal Software Verification

Predicate Logic and Sets

Quantifiers, negation laws, quantifier order, and sets as predicates in Lean

Christiano Braga · Mestrado em Sistemas e Computação · IME

Based on How To Prove It with Lean (HTPIwL), chapters 2 and 3.

§2.1 Predicates and quantifiers

A predicate on a type α assigns a proposition to each element, so in Lean it is a function α → Prop.

fun n => n > 3 : Nat → Prop#check fun n : Nat => n > 3

fun n => n > 3 : Nat → Prop

Quantifiers bind the variable of a predicate and produce a proposition (Frege, 1879). The variable ranges over a type, inferred when the context determines it.

Symbol	Name	Reading
∀ x, P x	universal quantifier	P x holds for every x
∃ x, P x	existential quantifier	P x holds for some x

∃ n, n > 3 : Prop#check ∃ n : Nat, n > 3
∀ (n : Nat), n > 3 : Prop#check ∀ n : Nat, n > 3

∃ n, n > 3 : Prop

∀ (n : Nat), n > 3 : Prop

A quantifier takes the predicate, of type Nat → Prop, to a proposition, of type Prop.

§2.2 The universal quantifier

Introduce ∀ x, P x by considering an arbitrary element: intro, the same tactic that introduces implications.
Eliminate it by instantiation. A universal hypothesis is a function, so h a instantiates it at a; specialize does it in place.

example (α : Type) (P Q : α → Prop)
    (h : ∀ x, P x ∧ Q x) : ∀ x, P x := byα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q x⊢ ∀ (x : α), P x
  intro aα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q xa:α⊢ P a
  exact (h a).leftAll goals completed! 🐙

example (α : Type) (P Q : α → Prop) (h : ∀ x, P x → Q x)
    (a : α) (hPa : P a) : Q a := byα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x → Q xa:αhPa:P a⊢ Q a
  specialize h aα:TypeP:α → PropQ:α → Propa:αh:P a → Q ahPa:P a⊢ Q a
  exact h hPaAll goals completed! 🐙

§2.2 Distribution over conjunction

The universal quantifier distributes over conjunction. The proof combines the quantifier rules with the Lecture 1 rules for conjunction and the biconditional.

theorem forall_and_distrib (α : Type) (P Q : α → Prop) :
    (∀ x, P x ∧ Q x) ↔ (∀ x, P x) ∧ (∀ x, Q x) := byα:TypeP:α → PropQ:α → Prop⊢ (∀ (x : α), P x ∧ Q x) ↔ (∀ (x : α), P x) ∧ ∀ (x : α), Q x
  constructormpα:TypeP:α → PropQ:α → Prop⊢ (∀ (x : α), P x ∧ Q x) → (∀ (x : α), P x) ∧ ∀ (x : α), Q xmprα:TypeP:α → PropQ:α → Prop⊢ ((∀ (x : α), P x) ∧ ∀ (x : α), Q x) → ∀ (x : α), P x ∧ Q x
  ·mpα:TypeP:α → PropQ:α → Prop⊢ (∀ (x : α), P x ∧ Q x) → (∀ (x : α), P x) ∧ ∀ (x : α), Q x intro hmpα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q x⊢ (∀ (x : α), P x) ∧ ∀ (x : α), Q x
    constructormp.leftα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q x⊢ ∀ (x : α), P xmp.rightα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q x⊢ ∀ (x : α), Q x
    ·mp.leftα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q x⊢ ∀ (x : α), P x intro amp.leftα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q xa:α⊢ P a
      exact (h a).leftAll goals completed! 🐙
    ·mp.rightα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q x⊢ ∀ (x : α), Q x intro amp.rightα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x ∧ Q xa:α⊢ Q a
      exact (h a).rightAll goals completed! 🐙
  ·mprα:TypeP:α → PropQ:α → Prop⊢ ((∀ (x : α), P x) ∧ ∀ (x : α), Q x) → ∀ (x : α), P x ∧ Q x intro h amprα:TypeP:α → PropQ:α → Proph:(∀ (x : α), P x) ∧ ∀ (x : α), Q xa:α⊢ P a ∧ Q a
    exact ⟨h.left a, h.right a⟩All goals completed! 🐙

§2.3 The existential quantifier

Introduce ∃ x, P x by exhibiting a witness with its proof: the anonymous constructor ⟨3, rfl⟩, or the exists tactic.
Eliminate it by naming a witness and its proof: cases (one case, constructor intro) or obtain ⟨a, ha⟩ := h in one step.

example : ∃ n : Nat, n * n = 9 := ⟨3, rfl⟩

example (α : Type) (P Q : α → Prop)
    (h : ∃ x, P x ∧ Q x) : ∃ x, P x := byα:TypeP:α → PropQ:α → Proph:∃ x, P x ∧ Q x⊢ ∃ x, P x
  cases h with
  | intro a ha =>introα:TypeP:α → PropQ:α → Propa:αha:P a ∧ Q a⊢ ∃ x, P x exact ⟨a, ha.left⟩All goals completed! 🐙

example (α : Type) (P Q : α → Prop)
    (h : ∃ x, P x ∧ Q x) : ∃ x, Q x := byα:TypeP:α → PropQ:α → Proph:∃ x, P x ∧ Q x⊢ ∃ x, Q x
  obtain ⟨a, ha⟩ := hα:TypeP:α → PropQ:α → Propa:αha:P a ∧ Q a⊢ ∃ x, Q x
  exact ⟨a, ha.right⟩All goals completed! 🐙

§2.3 A pointwise implication

The theorem below combines the two quantifiers. A pointwise implication carries existence from P to Q, and the witness does not change.

theorem exists_imp_exists (α : Type) (P Q : α → Prop)
    (h : ∀ x, P x → Q x) : (∃ x, P x) → ∃ x, Q x := byα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x → Q x⊢ (∃ x, P x) → ∃ x, Q x
  intro hexα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x → Q xhex:∃ x, P x⊢ ∃ x, Q x
  obtain ⟨a, hPa⟩ := hexα:TypeP:α → PropQ:α → Proph:∀ (x : α), P x → Q xa:αhPa:P a⊢ ∃ x, Q x
  exact ⟨a, h a hPa⟩All goals completed! 🐙

§2.4 Quantifier negation laws

Name	Equivalence
Negation of ∃	¬(∃ x, P x) ≡ ∀ x, ¬P x
Negation of ∀	¬(∀ x, P x) ≡ ∃ x, ¬P x

They exchange negation with the quantifiers, extending the De Morgan laws of Lecture 1.
The first law is constructive in both directions.
In the second, producing the witness needs classical reasoning, as the first De Morgan law did: two applications of Classical.byContradiction.

§2.4 Beyond intro, obtain, exact

intro accepts the anonymous constructor pattern, introducing the existential and destructing it in one step.
A negated goal is a function into False, so a proof term with a pattern-matching fun proves it, with no tactics.

Pattern intro

example (α : Type) (P : α → Prop)
    (h : ∀ x, ¬P x) : ¬∃ x, P x := byα:TypeP:α → Proph:∀ (x : α), ¬P x⊢ ¬∃ x, P x
  intro ⟨a, hPa⟩α:TypeP:α → Proph:∀ (x : α), ¬P xa:αhPa:P a⊢ False
  exact h a hPaAll goals completed! 🐙

Proof term

example (α : Type) (P : α → Prop)
    (h : ∀ x, P x) : ¬∃ x, ¬P x :=
  fun ⟨a, hnPa⟩ => hnPa (h a)

§2.5 The order of quantifiers

The order determines what a statement asserts.
In ∀ y, ∃ x, R x y, the witness x may depend on y; in ∃ x, ∀ y, R x y, a single witness serves every y. The uniform witness is the stronger statement.
Quantifiers of the same kind commute; the exchanges for ∀ and ∃ appeared as examples in §2.2 and §2.3.
Quantifiers of different kinds do not commute. Only one direction holds: the stronger order implies the weaker one.

§2.5 The swap and the counterexample

theorem exists_forall_swap (α β : Type) (R : α → β → Prop)
    (h : ∃ x, ∀ y, R x y) : ∀ y, ∃ x, R x y := byα:Typeβ:TypeR:α → β → Proph:∃ x, ∀ (y : β), R x y⊢ ∀ (y : β), ∃ x, R x y
  intro bα:Typeβ:TypeR:α → β → Proph:∃ x, ∀ (y : β), R x yb:β⊢ ∃ x, R x b
  obtain ⟨a, ha⟩ := hα:Typeβ:TypeR:α → β → Propb:βa:αha:∀ (y : β), R a y⊢ ∃ x, R x b
  exact ⟨a, ha b⟩All goals completed! 🐙

The converse fails. Over ℕ take R x y as x ≥ y. Both claims of the counterexample hold in Lean.

example : ∀ y : Nat, ∃ x : Nat, x ≥ y := by⊢ ∀ (y : Nat), ∃ x, x ≥ y
  intro bb:Nat⊢ ∃ x, x ≥ b
  exact ⟨b, Nat.le_refl b⟩All goals completed! 🐙

example : ¬∃ x : Nat, ∀ y : Nat, x ≥ y := by⊢ ¬∃ x, ∀ (y : Nat), x ≥ y
  intro ⟨a, ha⟩a:Natha:∀ (y : Nat), a ≥ y⊢ False
  exact absurd (ha (a + 1)) (Nat.not_succ_le_self a)All goals completed! 🐙

§2.6 Sets as predicates

A set of elements of α is determined by which elements belong to it, so the membership predicate determines the set. We take this as the definition.
A set given by a property is the predicate, and a membership proof is a proof of the property.

def Set (α : Type) : Type := α → Prop

def Evens : Set Nat := fun n => ∃ k, n = 2 * k

example : (6 : Nat) ∈ Evens := ⟨3, rfl⟩

§2.6 Where the symbol ∈ comes from

A type class declares an operation and leaves it without meaning; an instance supplies the meaning at one type. The symbol reaches our sets in three steps.
The symbol is notation from the core module Init.Notation, and it abbreviates an application. The name on its right is the one field of a class from Init.Prelude.

notation:50 a:50 " ∈ " b:50 => Membership.mem b a

class Membership (α : outParam (Type u)) (γ : Type v) where
  mem : γ → α → Prop

The container comes first in mem and second in the notation, so x ∈ s abbreviates Membership.mem s x.
The third step is ours. The elaborator searches the registered instances for the type of s, and Set α is a definition of this lecture, so without an instance of our own the search fails.

§2.6 Type classes and instances

The instances below end that search: x ∈ s is s x by definition, and ⊆, ∪ and ∩ are defined from it.

instance : Membership α (Set α) :=
  ⟨fun s a => s a⟩

instance : HasSubset (Set α) :=
  ⟨fun s t => ∀ x, x ∈ s → x ∈ t⟩

instance : Union (Set α) :=
  ⟨fun s t => fun x => x ∈ s ∨ x ∈ t⟩

instance : Inter (Set α) :=
  ⟨fun s t => fun x => x ∈ s ∧ x ∈ t⟩

Each notation unfolds to its definition

example (α : Type) (s t : Set α) (h : s ⊆ t)
    (x : α) (hx : x ∈ s) : x ∈ t := h x hx

example (α : Type) (s t : Set α) (x : α)
    (hx : x ∈ s) : x ∈ s ∪ t := Or.inl hx

example (α : Type) (s t : Set α) (x : α)
    (hx : x ∈ s ∩ t) : x ∈ t := hx.right

§2.6 Russell's paradox

Naive set theory admits a set for every property. Take R to be the set of all sets that are not elements of themselves.
Then R ∈ R holds exactly when R ∉ R, a contradiction, and the theory collapses.
In Lean, s : Set α contains only elements of α, and s itself has type Set α, not α, so s ∈ s is not well typed. There is no way to state the property that defines R, and the paradox does not arise.

B. Russell, letter to Frege, 16 June 1902.

Summary

A predicate is a function α → Prop; quantifiers bind its variable and yield a proposition.
∀: introduce with intro; eliminate by instantiation, h a or specialize.
∃: introduce with a witness, ⟨3, rfl⟩ or exists; eliminate with obtain ⟨a, ha⟩ := h.
The negation laws exchange ¬ with the quantifiers; ¬∃ is constructive in both directions, ¬∀ needs Classical.byContradiction.
Quantifier order matters: the uniform witness ∃ x, ∀ y is stronger, and only (∃ x, ∀ y) → (∀ y, ∃ x) holds.
A set is its membership predicate, Set α := α → Prop, with Membership, HasSubset, Union, Inter instances giving the notation.
Inclusion proofs start with intro x hx; membership in ∩ is a conjunction and in ∪ a disjunction, pointwise.

Exercises: see the lecture notes.