For the inductive type nat, the generated induction principle uses the constructors O and S in its statement:
Inductive nat : Set := O : nat | S : nat -> nat
nat_ind
: forall P : nat -> Prop,
P 0 ->
(forall n : nat, P n -> P (S n)) -> forall n : nat, P n
But for le, the generated statement does not uses the constructors le_n and le_S:
Inductive le (n : nat) : nat -> Prop :=
le_n : n <= n | le_S : forall m : nat, n <= m -> n <= S m
le_ind
: forall (n : nat) (P : nat -> Prop),
P n ->
(forall m : nat, n <= m -> P m -> P (S m)) ->
forall n0 : nat, n <= n0 -> P n0
However it is possible to state and prove an induction principle following the same shape as the one for nat:
Lemma le_ind' : forall n (P : forall m, le n m -> Prop),
P n (le_n n) ->
(forall m (p : le n m), P m p -> P (S m) (le_S n m p)) ->
forall m (p : le n m), P m p.
Proof.
fix H 6; intros; destruct p.
apply H0.
apply H1, H.
apply H0.
apply H1.
Qed.
I guess the generated one is more convenient. But how does Coq chooses the shape for its generated induction principle? If there is any rule, I cannot find them in the reference manual. What about other proof assistants such as Agda?
You can manually generate an induction principle for an inductive type by using the command Scheme (see the documentation).
The command comes in two flavours :
Scheme scheme := Induction for Sort Prop generates the standard induction scheme.
Scheme scheme := Minimality for Sort Prop generates a simplified induction scheme more suited to inductive predicates.
If you define an inductive type in Type, the generated induction principle is of the first kind. If you define an inductive type in Prop (i.e. an inductive predicate), the generated induction principle is of the second kind.
To obtain the induction principle that you want in the case of le, you can define it in Type:
Inductive le (n : nat) : nat -> Type :=
| le_n : le n n
| le_S : forall m : nat, le n m -> le n (S m).
Check le_ind.
(* forall (n : nat) (P : forall n0 : nat, le n n0 -> Prop),
P n (le_n n) ->
(forall (m : nat) (l : le n m), P m l -> P (S m) (le_S n m l)) ->
forall (n0 : nat) (l : le n n0), P n0 l
*)
or you can manually ask Coq to generate the expected induction principle:
Inductive le (n : nat) : nat -> Prop :=
| le_n : le n n
| le_S : forall m : nat, le n m -> le n (S m).
Check le_ind.
(* forall (n : nat) (P : nat -> Prop),
P n ->
(forall m : nat, le n m -> P m -> P (S m)) ->
forall n0 : nat, le n n0 -> P n0
*)
Scheme le_ind2 := Induction for le Sort Prop.
Check le_ind2.
(* forall (n : nat) (P : forall n0 : nat, le n n0 -> Prop),
P n (le_n n) ->
(forall (m : nat) (l : le n m), P m l -> P (S m) (le_S n m l)) ->
forall (n0 : nat) (l : le n n0), P n0 l
*)
Related
I am learning Coq right now and in a larger proof I have become stumped by the following sub-proof:
Theorem sub : ∀ n m : nat, n ≤ m → n ≠ m → n < m.
Or, once unfolded:
Theorem sub : ∀ n m : nat, n ≤ m → n ≠ m → S n ≤ m.
Here, "n ≤ m" is inductively defined as follows:
Inductive le : nat → nat → Prop :=
| le_n : ∀ n : nat, le n n
| le_S : ∀ n m : nat, (le n m) → (le n (S m)).
I have not gotten very far, but my attempt looks like this:
Theorem sub : ∀ n m : nat, n ≤ m → n ≠ m → n < m.
Proof.
unfold lt.
intro n.
induction n.
- induction m.
+ intros. exfalso. contradiction.
+ admit.
- admit.
Admitted.
In the first inductive step (marked by the first admit), the inductive hypothesis shows the following :
1 subgoal
m : nat
IHm : 0 ≤ m → 0 ≠ m → 1 ≤ m
______________________________________(1/1)
0 ≤ S m → 0 ≠ S m → 1 ≤ S m
I am not sure how I can leverage this hypothesis to prove the subgoal. I would appreciate any guidance in the right direction.
Since le is defined as an inductive predicate, it makes more sense to do the induction on that, rather than n. le doesn't make any references to 0 or even S n (it does have S m), so induction on n is probably not the way to go. Induction on m might work, but it's probably harder than necessary.
Before starting a formal proof, it can often be helpful to think about how you would prove this informally (still using the same definitions, though). If you assume that n ≤ m, then by the inductive definition of lt, this means that either n and m are the same, or m is the successor of some number m' and n is less than or equal to m' (can you see why the definition of lt implies this?). In the first case, we'll have to use the additional hypothesis that n ≠ m to derive a contradiction. In the second case, we won't even need that. n ≤ m' implies that S n ≤ S m', so since m = S m', S n ≤ m, i.e., n < m.
For the formalization, we'll have to prove that assumption on the last line that n ≤ m implies S n ≤ S m. You should try a similar informal analysis to prove it. Other than that, the informal proof should be straightforward to formalize. Case analysis on H: n ≤ m is just destruct H..
One more thing. This isn't essential, but can often help in the long run. When defining an inductive type (or predicate), if you can factor out a parameter that's used the same way in each constructor, it can make the induction principle more powerful. The way you have it with le, n is universally quantified and used the same way for both constructors. Every instance of le starts with le n.
Inductive le : nat → nat → Prop :=
| le_n : ∀ n : nat, le n n
| le_S : ∀ n m : nat, (le n m) → (le n (S m)).
That means that we can factor out that index into a parameter.
Inductive le' (n: nat) : nat → Prop :=
| le_n' : le' n n
| le_S' : ∀ m : nat, (le' n m) → (le' n (S m)).
This gives you a slightly simpler/better induction principle.
le'_ind
: forall (n : nat) (P : nat -> Prop),
P n ->
(forall m : nat, le' n m -> P m -> P (S m)) ->
forall n0 : nat, le' n n0 -> P n0
Compare this to le_ind.
le_ind
: forall P : nat -> nat -> Prop,
(forall n : nat, P n n) ->
(forall n m : nat, le n m -> P n m -> P n (S m)) ->
forall n n0 : nat, le n n0 -> P n n0
Basically what's happening here is that with le_ind, you have to prove everything for every n. With le'_ind, you only need to prove it for the particular n that you're using. This can sometimes simplify proofs, though it's not necessary for the proof of your theorem. It's a good exercise to prove that these two predicates are equivalent.
I am facing a pretty strange problem: coq doesn't want to move forall variable into the context.
In the old times it did:
Example and_exercise :
forall n m : nat, n + m = 0 -> n = 0 /\ m = 0.
Proof.
intros n m.
It generates:
n, m : nat
============================
n + m = 0 -> n = 0 /\ m = 0
But when we have forall inside forall, it doesn't work:
(* Auxilliary definition *)
Fixpoint All {T : Type} (P : T -> Prop) (l : list T) : Prop :=
(* ... *)
Lemma All_In :
forall T (P : T -> Prop) (l : list T),
(forall x, In x l -> P x) <->
All P l.
Proof.
intros T P l. split.
- intros H.
After this we get:
T : Type
P : T -> Prop
l : list T
H : forall x : T, In x l -> P x
============================
All P l
But how to move x outside of H and destruct it into smaller pieces? I tried:
destruct H as [x H1].
But it gives an error:
Error: Unable to find an instance for the variable x.
What is it? How to fix?
The problem is that forall is nested to the left of an implication rather than the right. It does not make sense to introduce x from a hypothesis of the form forall x, P x, just like it wouldn't make sense to introduce the n in plus_comm : forall n m, n + m = m + n into the context of another proof. Instead, you need to use the H hypothesis by applying it at the right place. I can't give you the answer to this question, but you might want to refer to the dist_not_exists exercise in the same chapter.
With the following definitions I want to prove lemma without_P
Variable n : nat.
Definition mnnat := {m : nat | m < n}.
Variable f : mnnat -> nat.
Lemma without_P : (exists x : mnnat, True) -> (exists x, forall y, f x <= f y).
Lemma without_P means: if you know (the finite) set mnnat is not empty, then there must exist an element in mnnat, that is the smallest of them all, after mapping f onto mnnat.
We know mnnat is finite, as there are n-1 numbers in it and in the context of the proof of without_P we also know mnnat is not empty, because of the premise (exists x : mnnat, True).
Now mnnat being non-empty and finite "naturally/intuitively" has some smallest element (after applying f on all its elements).
At the moment I am stuck at the point below, where I thought to proceed by induction over n, which is not allowed.
1 subgoal
n : nat
f : mnnat -> nat
x : nat
H' : x < n
______________________________________(1/1)
exists (y : nat) (H0 : y < n),
forall (y0 : nat) (H1 : y0 < n),
f (exist (fun m : nat => m < n) y H0) <= f (exist (fun m : nat => m < n) y0 H1)
My only idea here is to assert the existance of a function f' : nat -> nat like this: exists (f' : nat -> nat), forall (x : nat) (H0: x < n), f' (exist (fun m : nat => m < n) x H0) = f x, after solving this assertion I have proven the lemma by induction over n. How can I prove this assertion?
Is there a way to prove "non-empty, finite sets (after applying f to each element) have a minimum" more directly? My current path seems too hard for my Coq-skills.
Require Import Psatz Arith. (* use lia to solve the linear integer arithmetic. *)
Variable f : nat -> nat.
This below is essentially your goal, modulo packing of the statement into some dependent type. (It doesn't say that mi < n, but you can extend the proof statement to also contain that.)
Goal forall n, exists mi, forall i, i < n -> f mi <= f i.
induction n; intros.
- now exists 0; inversion 1. (* n cant be zero *)
- destruct IHn as [mi IHn]. (* get the smallest pos mi, which is < n *)
(* Is f mi still smallest, or is f n the smallest? *)
(* If f mi < f n then mi is the position of the
smallest value, otherwise n is that position,
so consider those two cases. *)
destruct (lt_dec (f mi) (f n));
[ exists mi | exists n];
intros.
+ destruct (eq_nat_dec i n).
subst; lia.
apply IHn; lia.
+ destruct (eq_nat_dec i n).
subst; lia.
apply le_trans with(f mi).
lia.
apply IHn.
lia.
Qed.
Your problem is an specific instance of a more general result which is proven for example in math-comp. There, you even have a notation for denoting "the minimal x such that it meets P", where P must be a decidable predicate.
Without tweaking your statement too much, we get:
From mathcomp Require Import all_ssreflect.
Variable n : nat.
Variable f : 'I_n.+1 -> nat.
Lemma without_P : exists x, forall y, f x <= f y.
Proof.
have/(_ ord0)[] := arg_minP (P:=xpredT) f erefl => i _ P.
by exists i => ?; apply/P.
Qed.
I found a proof to my assertion (exists (f' : nat -> nat), forall (x : nat) (H0: x < n), f (exist (fun m : nat => m < n) x H0) = f' x). by proving the similar assertion (exists (f' : nat -> nat), forall x : mnnat, f x = f' (proj1_sig x)). with Lemma f'exists. The first assertion then follows almost trivially.
After I proved this assertion I can do a similar proof to user larsr, to prove Lemma without_P.
I used the mod-Function to convert any nat to a nat smaller then n, apart from the base case of n = 0.
Lemma mod_mnnat : forall m,
n > 0 -> m mod n < n.
Proof.
intros.
apply PeanoNat.Nat.mod_upper_bound.
intuition.
Qed.
Lemma mod_mnnat' : forall m,
m < n -> m mod n = m.
Proof.
intros.
apply PeanoNat.Nat.mod_small.
auto.
Qed.
Lemma f_proj1_sig : forall x y,
proj1_sig x = proj1_sig y -> f x = f y.
Proof.
intros.
rewrite (sig_eta x).
rewrite (sig_eta y).
destruct x. destruct y as [y H0].
simpl in *.
subst.
assert (l = H0).
apply proof_irrelevance. (* This was tricky to find.
It means two proofs of the same thing are equal themselves.
This makes (exist a b c) (exist a b d) equal,
if c and d prove the same thing. *)
subst.
intuition.
Qed.
(* Main Lemma *)
Lemma f'exists :
exists (ff : nat -> nat), forall x : mnnat, f x = ff (proj1_sig x).
Proof.
assert (n = 0 \/ n > 0).
induction n.
auto.
intuition.
destruct H.
exists (fun m : nat => m).
intuition. destruct x. assert (l' := l). rewrite H in l'. inversion l'.
unfold mnnat in *.
(* I am using the mod-function to map (m : nat) -> {m | m < n} *)
exists (fun m : nat => f (exist (ltn n) (m mod n) (mod_mnnat m H))).
intros.
destruct x.
simpl.
unfold ltn.
assert (l' := l).
apply mod_mnnat' in l'.
assert (proj1_sig (exist (fun m : nat => m < n) x l) = proj1_sig (exist (fun m : nat => m < n) (x mod n) (mod_mnnat x H))).
simpl. rewrite l'.
auto.
apply f_proj1_sig in H0.
auto.
Qed.
I have to admit that I'm not very good at coinduction. I'm trying to show a bisimulation principle on co-natural numbers, but I'm stuck on a pair of (symmetric) cases.
CoInductive conat :=
| cozero : conat
| cosucc : conat -> conat.
CoInductive conat_eq : conat -> conat -> Prop :=
| eqbase : conat_eq cozero cozero
| eqstep : forall m n, conat_eq m n -> conat_eq (cosucc m) (cosucc n).
Section conat_eq_coind.
Variable R : conat -> conat -> Prop.
Hypothesis H1 : R cozero cozero.
Hypothesis H2 : forall (m n : conat), R (cosucc m) (cosucc n) -> R m n.
Theorem conat_eq_coind : forall m n : conat,
R m n -> conat_eq m n.
Proof.
cofix. intros m n H.
destruct m, n.
simpl in H1.
- exact eqbase.
- admit.
- admit.
- specialize (H2 H).
specialize (conat_eq_coind _ _ H2).
exact (eqstep conat_eq_coind).
Admitted.
End conat_eq_coind.
This is what the context looks like when focused on the first admitted case:
1 subgoal
R : conat -> conat -> Prop
H1 : R cozero cozero
H2 : forall m n : conat, R (cosucc m) (cosucc n) -> R m n
conat_eq_coind : forall m n : conat, R m n -> conat_eq m n
n : conat
H : R cozero (cosucc n)
______________________________________(1/1)
conat_eq cozero (cosucc n)
Thoughts?
I do not understand what you try to prove here. This is wrong. Take the trivial predicate that is always True for example.
Theorem conat_eq_coind_false :
~ forall (R : conat -> conat -> Prop) (H1 : R cozero cozero)
(H2 : forall (m n : conat), R (cosucc m) (cosucc n) -> R m n)
(m n : conat) (H3 : R m n), conat_eq m n.
Proof.
intros contra.
specialize (contra (fun _ _ => True) I (fun _ _ _ => I)
cozero (cosucc cozero) I).
inversion contra.
Qed.
When using induction, I'd like to have hypotheses n = 0 and n = S n' to separate the cases.
Section x.
Variable P : nat -> Prop.
Axiom P0: P 0.
Axiom PSn : forall n, P n -> P (S n).
Theorem Pn: forall n:nat, P n.
Proof. intros n. induction n.
- (* = 0 *)
apply P0.
- (* = S n *)
apply PSn. assumption.
Qed.
In theory I could do this with induction n eqn: Hn, but that seems to mess up the inductive hypothesis:
Theorem Pn2: forall n:nat, P n.
Proof. intros n. induction n eqn: Hn.
- (* Hn : n = 0 *)
apply P0.
- (* Hn : n = S n0 *)
(*** 1 subgoals
P : nat -> Prop
n : nat
n0 : nat
Hn : n = S n0
IHn0 : n = n0 -> P n0
______________________________________(1/1)
P (S n0)
****)
Abort.
End x.
Is there an easy way to get what I want here?
Matt was almost right, you just forgot to generalize a bit your goal by reverting the remembered n:
Theorem Pn2: forall n:nat, P n.
Proof. intros n. remember n. revert n0 Heqn0.
induction n as [ | p hi]; intros m heq.
- (* heq : n = 0 *) subst. apply P0.
- (* heq : n = S n0 *)
(*
1 subgoal
P : nat -> Prop
p : nat
hi : forall n0 : nat, n0 = p -> P n0
m : nat
heq : m = S p
______________________________________(1/1)
P m
*) subst; apply (PSn p). apply hi. reflexivity.
Ooo, I think I figured it out!
Applying the inductive hypothesis changes your goal from (P n) to (P (constructor n')), so I think in general you can just match against the goal to create the equation n = construct n'.
Here's a tactic that I think does this:
(* like set (a:=b) except introduces a name and hypothesis *)
Tactic Notation
"provide_name" ident(n) "=" constr(v)
"as" simple_intropattern(H) :=
assert (exists n, n = v) as [n H] by (exists v; reflexivity).
Tactic Notation
"induction_eqn" ident(n) "as" simple_intropattern(HNS)
"eqn:" ident(Hn) :=
let PROP := fresh in (
pattern n;
match goal with [ |- ?FP _ ] => set ( PROP := FP ) end;
induction n as HNS;
match goal with [ |- PROP ?nnn ] => provide_name n = nnn as Hn end;
unfold PROP in *; clear PROP
).
It works for my example:
Theorem Pn_3: forall n:nat, P n.
Proof.
intros n.
induction_eqn n as [|n'] eqn: Hn.
- (* n: nat, Hn: n = 0; Goal: P 0 *)
apply P0.
- (* n': nat, IHn': P n';
n: nat, Hn: n = S n'
Goal: P (S n') *)
apply PSn. exact IHn'.
Qed.
I'm not sure if this is any easier, than what you have done in your second attempt, but you can first "remember" n.
Theorem Pn: forall n:nat, P n.
Proof. intro n. remember n. induction n.
- (*P : nat -> Prop
n0 : nat
Heqn0 : n0 = 0
============================
P n0
*)
subst. apply P0.
- (* P : nat -> Prop
n : nat
n0 : nat
Heqn0 : n0 = S n
IHn : n0 = n -> P n0
============================
P n0
*)