HAL Id: inria-00407778https://hal.inria.fr/inria-00407778Submitted on 28 Jul 2009HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.An Ssreflect TutorialGeorges Gonthier, Roux Stéphane LeTo cite this version:Georges Gonthier, Roux Stéphane Le. An Ssreflect Tutorial. [Technical Report] RT-0367, INRIA.2009, pp.33. inria-00407778appor t techn ique ISSN0249-0803ISRNINRIA/RT--367--FR+ENGThème SYMINSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUEAn Ssreflect TutorialGeorges Gonthier — Stéphane Le RouxN° 367July 2009Centre de recherche INRIA Saclay – Île-de-FranceParc Orsay Université4, rue Jacques Monod, 91893 ORSAY CedexTéléphone : +33 1 72 92 59 00An Ssreflect TutorialGeorges Gonthier∗ , Stéphane Le Roux†Thème SYM — Systèmes symboliquesÉquipes-Projets Composants Mathématiques, Centre Commun INRIA Microsoft ResearchRapport technique n° 367 — July 2009 — 30 pagesAbstract: This document is a tutorial for ssreflect which is a proof language based on Coq. Thistutorial is mostly dedicated to people who already know the basics of logic.Key-words: proof assistants, formal proofs, Coq, small scale reflection, tactics.∗ Microsoft Research, Cambridge, R-U, Centre commun INRIA Microsoft Research† Centre commun INRIA Microsoft ResearchUn tutoriel SsreflectRésumé : Ce document est un tutoriel pour ssreflect qui est un langage de preuve dérivé de Coq.Ce tutoriel est principalement écrit pour qui connâıt déjà les bases de la logique.Mots-clés : assistants à la preuve, preuve formelle, Coq, réflexion à petite échelle, tactiques.An Ssreflect Tutorial 3Contents1 Introduction 51.1 Ssreflect is based on Coq . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.2 Interactive proof building . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.3 Structure of the tutorial . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 The Coq tutorial briefly translated to ssreflect 62.1 Hilbert’s axiom S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.2 Logical connectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112.3 Two so-called paradoxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142.4 Rewriting with (Leibniz) equalities and definitions . . . . . . . . . . . . . . . . . . 163 Arithmetic for Euclidean division 193.1 Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253.4 Parametric type families and alternative specifications . . . . . . . . . . . . . . . . 294 Conclusion 30RT n° 367An Ssreflect Tutorial 51 Introduction1.1 Ssreflect is based on CoqSsreflect is a formal proof language that is based on Coq. The main design feature of ssreflectis on the one hand that it uses the Coq definition language, i.e. the language that is dedicatedto the definition of objects in Coq, and on the other hand that it provides additional tactics, i.e.reasoning steps, suitable for the long mathematical proofs that ssreflect is intended to help encode.This extension of Coq has already proved very efficient (See the 4-colour theorem proved usingssreflect).The ssreflect additional tactics are few, but they can be combined with additional tacticals,i.e. tactic modifiers, such that one same tactic may cope with a wide range of similar situations.Also the tactics combine nicely with each other, so that proof scripts may be sometimes as shortas the pen-and-paper proofs that they formally encode.1.2 Interactive proof buildingIn Coq and ssreflect, proofs are usually built through the interactive mode: the user writes def-initions, statements and proofs in a window, and asks the software to verify them step by step.Along these verifications the software outputs agreeing or complaining messages in another win-dow. When in the middle of a proof verification, the software displays additional information:which objects are at the user’s disposal and which intermediate statements (subgoals) are still tobe proved in order to complete the proof of the initial statement (goal). These are graphicallyorganised as follows: (part of) the objects that are at the user’s disposal, thus constituting thecontext, are displayed above an horizontal line, while the subgoals are displayed below the line.When several subgoals are still to be proved, they are all displayed below the line but only thecontext of the first subgoal, which is the current/working subgoal, is displayed above the line. Inthe example below, two hypotheses are available in the context: Hyp1 which states that A holdsand Hyp2 which states that B holds. The first subgoal to be proved is that if C holds then D holds,where the implication is represented by an arrow. Moreover, there is a second subgoal E -> F.RT n° 3676 G. Gonthier & S. Le RouxHyp1 : AHyp2 : B===============C -> Dsubgoal 2 is:E -> FIn order to prove the (sub)goal(s), the user performs reasoning steps, which are called tactics.Some tactics can put objects in or remove them from the context, but the other tactics canonly interact with the subgoals. Contexts are shelves storing tools and material, while subgoalsare workbenches where we actually operate the tools and build parts of the intended piece offurniture. Furthermore, subgoals are like stacks: when moving objects around, one can only pushthem to or pop them from the left-hand side of the subgoal. Therefore subgoals may be calledproof stacks. In the first subgoal of the example above, C is at the top of the proof stack.1.3 Structure of the tutorialSection 2 translates part of the Coq tutorial (v8.1) into ssreflect. Section 3 gives slightly moreadvanced arithmetic examples related to Euclidean division. It is strongly advised that the readeractually run the proof script (either from the file tutorial.v or by copy and paste from this tutorial)while reading the tutorial. Also, the explanations given here are mostly intuitive. For more formalexplanations see the reference manual (http://hal.inria.fr/inria-00258384).2 The Coq tutorial briefly translated to ssreflectThe following files are imported from the ssreflect standard library.Require Import ssreflect ssrbool eqtype ssrnat.2.1 Hilbert’s axiom SThe following script proves Hilbert’s axiom S step by step for pedagogical purpose.Section HilbertSaxiom.Variables A B C : Prop.Lemma HilbertS : (A -> B -> C) -> (A -> B) -> A -> C.Proof.move=> hAiBiC hAiB hA.move: hAiBiC.apply.by [].by apply: hAiB.Qed.The commandSection HilbertSaxiom.starts a Coq section that will be closed later.The commandVariables A B C : Prop.INRIAAn Ssreflect Tutorial 7assumes the propositional variables A, B and C (whose type is therefore Prop). These variables willbe available throughout the current section HilbertSaxiom.The lemma above is called HilbertS. It states(A -> B -> C) -> (A -> B) -> A -> CwhereA -> B -> Cstands forA -> (B -> C)which means ”if A holds then if B holds then C holds”.Technically, it is different from(A /\ B) -> Cwhich means ”if A and B hold then C holds”, although these two statements are equivalent.In the proof above, the commandmove=> hAiBiC hAiB hA.first introduces in the context the assumption that lies on the top of the proof stack (goal), i.e.A -> B -> C, and names it hAiBiC; then it proceeds in the same way for the two remainingassumptions of the goal. This actually performs the same job as the Coq commandintros hAiBiC hAiB hA.The commandmove=> hAiBiC hAiB hA TooMany.would fail and yield an error message because it asks ssreflect to pop four assumptions from theproof stack while there are only three.The tactic move=> can be decomposed as follows: move is also a tactic and => is called a tactical.In ssreflect as in Coq, a tactical builds new tactics from existing tactics. Here, the tactic move hasactually no effect and all the semantic of the Coq tactic intros is carried by the tactical => only.Note that the ssreflect writing style prescribes that assumptions have rather informative names,which intends to make larger proof scripts more readable. (Here hAiB stands for ”hypothesis: Aimplies B”.)The colon : is also a tactical. It is the inverse of =>, somove: hAiBiC.takes the hypothesis hAiBiC from the context and pushes it on the top (left-hand side) of the goal.If the hypothesis hAiBiC did not exist in the context, the tactic would fail. This corresponds tothe Coq commandrevert hAiBiC.In the same way,move: (hAiBiC).corresponds to the Coq commandgeneralize hAiBiC.which does not clear the hypothesis from the context. (Try it.) Note that the colons in move: andA : Prop are unrelated, but actual confusion is unlikely.The tacticapplyRT n° 3678 G. Gonthier & S. Le Rouxtries to see the right-hand side of the goal (i.e. the proof stack without its top) as an instance/-consequence of the left-hand side (i.e. the top of the proof stack), and it asks the user to providemissing arguments; this generates two subgoals in the present case.Note the indentation before the next tacticby []which suggests that two subgoals are to be proved at that stage.The success, i.e. approval by the proof system, of the tactic by [] means that the currentsubgoal can be and actually is solved trivially.Note that by [] is a specific instance of the more general syntaxby [tactic1 | tactic2 | ...]which tries to apply tactic1 to the goal; if it fails, it tries tactic2, etc.; if and when it succeeds,it then tries to solve the current subgoal trivially; otherwise it fails and returns an error message.Such tactics that fail when not solving the current subgoal are called terminators. After by []only one subgoal remains, so the indentation becomes normal again. Indentation and terminatorsintend to make larger proof scripts more readable by showing the structure of the proof.The commandapply: hAiB.is a shortcut formove: hAiB.apply.which could also be written as one single compound tactic instead of two thanks to the semi-colonCoq tactical ;.move: hAiB; apply.As in Coq,tactic1; tactic2.performs tactic2 in all the subgoals generated by tactic1, or fails.The last word of the proof is Qed. This triggers the verification of the proof that has just beenbuild. This second checking is more reliable than the step-by-step validation because it relies onlyon the correctness of the small Coq kernel instead of the correctness of the whole set of tactics.Below, a shorter proof of Hilbert’s axiom S. Before actually stating the lemma the hypothe-ses are assumed for good (i.e. throughout the current section) in the context. Note that fromthe system’s viewpoint, Variable, Variables, Hypothesis, and Hypotheses perform the sameoperation.Hypotheses (hAiBiC : A -> B -> C) (hAiB : A -> B) (hA : A).Lemma HilbertS2 : C.Proof.apply: hAiBiC; first by apply: hA.exact: hAiB.Qed.In the proof above, the commandapply: hAiBiC; first by apply: hA.performs firstapply: hAiBiC.and thenINRIAAn Ssreflect Tutorial 9by apply: hA.only in the first subgoal generated by apply: hAiBiC. If the tactical first, which is called aselector, were not written, the system would attempt to perform apply: hA in both subgoals, andwould fail on the second subgoal.If the terminator by were not written, the proof would still succeed. However, the ssreflectwriting style prescribes that every tactic that finishes the proof of a subgoal be a terminator, i.e. a”sub-Qed”. Such information on the proof structure makes not only the proof scripts more readablebut also more robust. Indeed, consider one given theorem relying on a prior development (i.e.definitions and lemmas). When the software or the prior development changes (new version ornew formalism) the previous proof of the theorem may not be valid any longer. In order to patchthe proof, one may want to start modifying the old proof where the interpreter first rejects the oldproof. However, the first rejected step may not be the first step where the proof script deviatesfrom the intended proof. Deviation may have occurred long before the place where an error isdetected, and irrelevant steps may still be approved by the interpreter by chance, which interfereswith debugging. On the contrary, terminators fail if they don’t finish the current subgoal, thusavoiding approval of irrelevant proof steps. This facilitates debugging.The commandexact: hAiB.is a shortcut formove: hAiB; exact.where the terminator exact is a sort of combination between apply and by [].Below, yet a shorter proof of Hilbert’s axiom S.Lemma HilbertS3 : C.Proof. by apply: hAiBiC; last exact: hAiB. Qed.The proof first performsapply: hAiBiC.then it performsexact: hAiB.only in the last subgoal generated by apply: hAiBiC, and terminates this subgoal. Then byterminates the remaining subgoal.Before going any further, we need to explain how to build bigger objects/terms from smallerobjects/terms in Coq, and how these are typed. The variables below were already assumed above.Hypotheses (hAiBiC : A -> B -> C) (hAiB : A -> B) (hA : A).So the term(hAiB hA)has type B (In traditional mathematics one would write hAiB(hA) instead, like f(x)). To verifythe type of the term above, try the following command.Check (hAiB hA).Also, the term (hAiBiC hA) has type B -> C, and the term((hAiBiC hA) (hAiB hA))has type C, and is writtenhAiBiC hA (hAiB hA)since there is no possible confusion.Below, a shorter proof of Hilbert’s axiom S.RT n° 36710 G. Gonthier & S. Le RouxLemma HilbertS4 : C.Proof. exact: (hAiBiC _ (hAiB _)). Qed.The term (hAiBiC _ (hAiB _)) above has two holes represented by the placeholder _. Yet itstill provides enough information about the proof term we mean so that ssreflect (Coq) guesseshow to fill the holes. Note that the last proof above is closely related to the proof of HilbertS3,in terms of what is explicitly given to the software, and what is guessed by the software.Below, an even shorter proof.Lemma HilbertS5 : C.Proof. exact: hAiBiC (hAiB _). Qed.In the proof above, (hAiB _) pushes B on the top of the goal C by saying that the requiredargument A will be somehow provided later. Then it pushes the hypothesis hAiBiC on the goaland applies it, so we need to prove A and we are done. The exact terminator solves it trivially.Lemmas that have been proved can be invoked, just as in the proof below.Lemma HilbertS6 : C.Proof. exact: HilbertS5. Qed.Indeed HilbertS5 belongs to the context although it is not displayed above the graphical line.Below, we compare the different proofs of Hilbert’s axiom S.Print HilbertS5.Print HilbertS2.Print HilbertS.Check HilbertS.End HilbertSaxiom.Print HilbertS5.The commandPrint HilbertS5.prints out the proof term (witnessing lemma) HilbertS5, i.e. the object that is verified at Qedtime. This object is as follows:hAiBiC hA (hAiB hA)It is of type C. Said otherwise, hAiBiC hA (hAiB hA) is a proof of proposition C. PrintingHilbertS2 shows that both objects are identical: the proof terms that are built and ultimatelyverified by the Coq kernel at Qed’s request are the same in both cases, although the ways to builtit are different. The proof term of HilbertS is bigger than the others because the assumptionsare all in the initial statement instead of being section/context variables.The commandCheck HilbertS.prints out the type of HilbertS, that is, only the proposition that it witnesses. The commandCheck may help recall the actual statement of a given lemma.After the Coq section HilbertS has been closed by the commandEnd HilbertSaxiom.the section variables are discharged, i.e. lemmas proved within the section now explicitly accountfor the variables they use. That is why the commandPrint HilbertS5.does not produce the same output as before. Note that lemmas HilbertS and HilbertS5 havethe same proof term now.INRIAAn Ssreflect Tutorial 112.2 Logical connectivesThis new subsection proves a few basic lemmas about booleans and propositions.The commandPrint bool.Displays the following:Inductive bool : Set := true : bool | false : boolThis is how Coq defines/constructs the booleans (bool), i.e. by saying that true and falseare of type bool, which implicitly means that a boolean is either true or false. So true andfalse are called constructors.As we shall see in the remainder of the tutorial, the word Inductive may be involved in manymore inductive (in a broad sense) definitions.Section Symmetric_Conjunction_Disjunction.Lemma andb_sym : forall A B : bool, A && B -> B && A.Proof.case.by case.by [].Qed.The statement is actuallyforall A B : bool, (A && B = true) -> (B && A = true)where && is (a notation for) a function expecting two arguments and computing the booleanconjunction of these. However the statement is represented byforall A B : bool, A && B -> B && Awhich is more readable. This ssreflect feature uses the Coq coercion mechanism and is defined inthe file ssrbool.v of the ssreflect standard library.Roughly speaking, the tactic case performs a case-splitting along the constructors of (therightmost part of) the top of the proof stack whose type must be defined inductively. So the firstuse of case performs a case-splitting on A being true or false.The tactic by case solves the first subgoal when A is true as follows: it case-splits on B beingtrue or false, both subgoals being trivially solved by the tactical by.The tactic by [] solves trivially the second subgoal generated by the first use of case.Below, the same lemma is proved using brute force.Lemma andb_sym2 : forall A B : bool, A && B -> B && A.Proof. by case; case. Qed.In the proof above, the commandby case; case.case-splits on A and then cases split on B (in each of the two subgoals), and the four subgoals aresolved trivially. Note that this proof is one-line long as the proof of andb_sym is three-line long.It is because the ssreflect writing style prescribes that each line end with one full-stop, and thatfull-stop be only written there. This way, the interpreter validates one line and only one line ateach interpretation step.Below, the same lemma is proved using brute force again.Lemma andb_sym3 : forall A B : bool, A && B -> B && A.Proof. by do 2! case. Qed.The commandRT n° 36712 G. Gonthier & S. Le Rouxdo 2! case.is equivalent tocase; case.If there were ten boolean variables instead of two, one could write do 10! case. In this specificsetting, this (roughly) simulates the tauto tactic without introducing any new tactic.Now let there be two propositional variables and assume that they hold, as below.Variables (C D : Prop) (hC : C) (hD : D).The commandCheck (and C D)displaysC /\ D : Propwhich shows that C /\ D is the Coq notation for propositional conjunction and C D.The commandPrint and.displaysInductive and (A : Prop) (B : Prop) : Prop := conj : A -> B -> A /\ BFor conj: Arguments A, B are implicitThe first line above (the second line is explained in the next paragraph) shows that conjunctionin Coq is defined inductively through one single constructor conj.Checking the type of conj displaysconj : forall A B : Prop, A -> B -> A /\ Bwhich shows that conj expects two propositions A and B (hence forall A B : Prop), then proofsthat the propositions hold, i.e. objects of type A and B (hence A -> B -> ...), and construct-s/returns a proof that the conjunction of the two propositions also holds.According to the explanation above, one would expect the term conj C D hC hD to be well-typed, but this is not the case. Indeed, it is possible to infer C from hC because C is the typeof hC. (The same holds for D and hD.) In the definition of propositional conjunction in Coq,it is specified that the inferable arguments of a function should remain implicit (hence the lineFor conj: Arguments A, B are implicit in the paragraph above). Therefore, Coq consid-ers the term conj hC hD well-typed instead of conj C D hC hD. When we want to explicitlygive all the arguments of a function (even the ones defined as implicit), we use the @ symbol:@conj C D hC hD is well-typed.The commandCheck (conj hC hD).displaysconj hC hD : C /\ Dwhich shows that conj hC hD is a proof that C /\ D holds.Below, we prove the propositional counterpart of the symmetry of conjunction that was provedin a boolean setting above.Lemma and_sym : forall A B : Prop, A /\ B -> B /\ A.Proof. by move=> A1 B []. Qed.In the proof above, the commandmove=> A1 B [].INRIAAn Ssreflect Tutorial 13is a shortcut formove=> A1 B; case.Note that when naming the introduced variables, one can either change the names of the universallyquantified variables, i.e. use A1 instead of A, or keep the same names, i.e. use B.The case performs a ”curryfication” in the goalA1 /\ B -> B /\ A1which becomesA1 -> B -> B /\ A1and is solved trivially. What actually happens is the following: case performs a case-splitting on(the rightmost part of) the top of the proof stack, i.e. A1 /\ B, which has only one constructorconj. So only one subgoal is generated. The goal assumption A1 /\ B can only be built throughconj and the two arguments are of type A1 and B, so A1 and B are provided as assumptions onthe proof stack so that ”no information may be lost” in the case-splitting.Let us now turn our attention to disjunction. Printing the object or displays the definition ofthe Coq disjunction, as follows.Inductive or (A : Prop) (B : Prop) : Prop :=or_introl : A -> A \/ B | or_intror : B -> A \/ BIt involves two constructors because A \/ B may either derive from A or derive from B.Checking the type of either constructor of or (by the command Check or_introl.) suggeststhat a constructor is the same kind of object as a lemma (just as conj). See below.or_introl : forall A B : Prop, A -> A \/ BBelow, we prove the symmetry of the disjunction.Lemma or_sym : forall A B : Prop, A \/ B -> B \/ A.Proof. by move=> A B [hA | hB]; [apply: or_intror | apply: or_introl]. Qed.In the proof above, the termmove=> A B [hA | hB]is a shortcut formove=> A B; case=> [hA | hB]where case=> [hA | hB] case-splits on A \/ B (more specifically on the two constructors of \/)and => [hA | hB] introduces and names the assumptions (more specifically the arguments of theconstructors) in both subgoals A -> B \/ A and B -> B \/ A .Then the syntax[apply: or_intror | apply: or_introl]applies the relevant constructor/lemma in both subgoals. More generally, the syntaxtactic0; [tactic1 | tactic2 | ...]gives instructions for all the subgoals generated by tactic0. Note that the semi-colon is requiredbetween tactic0 and [tactic1 | tactic2 | ...].Below, we prove the symmetry of the disjunction by translating the propositional statementinto its boolean counterpart, which is easily proved using brute force. This proof technique iscalled reflection. Ssreflect’s design allows for and ssreflect’s spirit recommends wide use of such atechnique. Since it is usually used locally to handle efficiently small parts of the proofs (insteadof being used in the overall proof structure), this is called small scale reflection, hence the namessreflect.RT n° 36714 G. Gonthier & S. Le RouxLemma or_sym2 : forall A B : bool, A \/ B -> B \/ A.Proof. by move=> [] [] AorB; apply/orP; move/orP : AorB. Qed.End Symmetric_Conjunction_Disjunction.In the proof above, the syntaxmove=> [] [] AorBis a shortcut forcase; case; move=> AorB.Indeed the first [] yields a case-splitting on A, and the second [] yields a second case-splitting,this time on B, in both subgoals generated by the first []. Then AorB introduces A \/ B in thecontext of the four subgoals corresponding to A (resp. B) being true or false.The commandapply/orP.rephrases the goal using the reflection lemma orP, which is defined in the file ssrbool.v. (Checkit!) A reflection lemma is an equivalence property between the boolean world and the Prop world,and it is called a view when used in this way.The commandmove/orP : AorB.is a shortcut formove: AorB; move/orP.where move/orP rephrases the top of the proof stack, i.e. A \/ B, using the reflection lemma orP.If the proof stack is empty, i.e. there is no universal quantifier or implication, the tactic fails.Note that this kind of proof works with A B : bool, but not with A B : Prop.Also, notice that since move is usually used with => or : in order to pop objects from or pushobjects onto the top of the proof stack, move/lemmaP was designed to modify the top of the proofstack; since apply is usually used with : and considers the whole goal, apply/lemmaP was designedto modify the whole goal.2.3 Two so-called paradoxesThis section uses the existential quantifier ex (print it!), which is defined inductively with oneconstructor and referred to as exists, its more convenient stage name.The following shows that a symmetric and transitive relation is not irreflexive provided that ithas at least one pair.Section R_sym_trans.Variables (D : Type) (R : D -> D -> Prop).Hypothesis R_sym : forall x y, R x y -> R y x.Hypothesis R_trans : forall x y z, R x y -> R y z -> R x z.Lemma refl_if : forall x : D, (exists y, R x y) -> R x x.Proof.move=> x [y Rxy].by apply: R_trans _ (R_sym _ y _).Qed.End R_sym_trans.INRIAAn Ssreflect Tutorial 15Above, D is a type (because it has type Type). This means that we may write x : D, whichsays that x has type D. (Set-theoretically, it reads ”x belongs to D”.) The object R is an arbitrarybinary relation built on D. More specifically, R is a term expecting two inhabitants (i.e. elements)of D and returning a proposition (saying that the two inhabitants are related).In the proof above, the commandmove=> x [y Rxy].is a shortcut formove=> x; case=> y Rxy.One could have writtenmove=> x [y] Rxy.instead, but [y Rxy] is more informative than [y] Rxy since Rxy names a goal assumption gen-erated by the case-splitting.The commandby apply: R_trans (R_sym _ y _).first builds a goal with holes, and then guesses the missing subterms so that the intermediate goal(after pushing (R_sym _ y _)) is indeed an instance of R_trans. Finally, the by finishes the job.Below, we prove that in any bar with at least one person (who is called d below), there isa person such that if she is drinking then everybody is drinking. (Below P x means that x isdrinking.)Section Smullyan_drinker.Variables (D : Type)(P : D -> Prop).Hypothesis (d : D) (EM : forall A, A \/ ~A).Lemma drinker : exists x, P x -> forall y, P y.Proof.case: (EM (exists y, ~P y)) => [[y notPy]| nonotPy]; first by exists y.exists d => _ y; case: (EM (P y)) => // notPy.by case: nonotPy; exists y.Qed.End Smullyan_drinker.First note that the negation~Ais a Coq notation forA -> Falsewhere the proposition False (not the boolean false!) is an inductive proposition with no con-structor. (Print it!)In the first line of the proof above, the commandcase: (EM (exists y, ~P y)).is a shortcut formove: (EM (exists y, ~P y)); case.It case-splits on(exists y, ~P y) \/ ~(exists y, ~P y)RT n° 36716 G. Gonthier & S. Le Rouxand generates two subgoals.In subgoal 1, the command [y notPy] case-splits on the sole constructor of exists (also calledex), and introduces both the witness (called y for the occasion) and its non-drinking property.Thenfirst by exists ysays that in subgoal 1 (hence first), the non-drinking y is a witness for the existence propertyto be proved (hence exists), and that the system can trivially prove this fact (hence by). Theproof actually uses the contradiction between y not drinking and the assumption on top of thegoal stack.In subgoal 2, the assumption that nobody is not drinking is introduced.Note that case: (EM (exists y, ~P y)) => [[y notPy]| nonotPy] could be replaced withhave [[y notPy]| nonotPy] := EM (exists y, ~P y)The tactic have will be introduced later on, but one can already see the point of using have here:the actual branching i.e. [[y notPy]| nonotPy], is written in the beginning of the line whereasthe justification occurs later. This is good because the branching says something about the proofstructure, whereas its justification does not. This is consistent with the ssreflect writing style,which prescribes writing the key information of a line as early as possible for each line. (Ideally,a line being a meaningful compound proof step.)In line 2, in the only remaining goalexists d => _ ysays that d is a witness of the sought property (actually any other inhabitant of D would do) andthe underscore _ discards the assumption on the top of the proof stack. Thencase: (EM (P y)) => // notPy.case-splits on y being drinking or not. Then//tries to solve trivial subgoals (among the two in the present situation). It solves the first one only.Then in the only remaining goal the assumption that y is not drinking is introduced. Note thatalso // is intended to solve trivial subgoals that were just generated, it would not fail if it did notsolve any: // is not a terminator. Therefore it should not be used instead of a terminator whenwe want to underpin the proof structure.In line 3,case: nonotPycase-splits on the constructors of the (rightmost part of) the top of the proof stack, which isthe proposition False here. Indeed recall that ~A stands for A -> False. Since False has noconstructor, this generates no subgoal. However, in the current situation, one can invoke theassumption False only after proving the left-hand part of the implication(exists y : D, ~ P y) -> FalseThis is an existential statement, which is proved using the y at hand.2.4 Rewriting with (Leibniz) equalities and definitionsIn this subsection, we present the ssreflect rewrite tactic, which is one of the main efficientfeatures of ssreflect. In the examples we use natural numbers, i.e. terms typed in nat, but we donot yet need to explain how nat is defined.Section Equality.Variable f : nat -> nat.INRIAAn Ssreflect Tutorial 17Hypothesis f00 : f 0 = 0.Lemma fkk : forall k, k = 0 -> f k = k.Proof.move=> k k0.by rewrite k0.Qed.Like in Coq, the commandrewrite k0.replaces k (the left-hand side of the equality k0) with 0 (the right-hand side) in the goal. Thessreflect rewrite is more general than the Coq rewrite as we shall see in the rest of the tutorial.Below, we prove the same lemma faster.Lemma fkk2 : forall k, k = 0 -> f k = k.Proof. by move=> k ->. Qed.The commandmove=> k ->.is a shortcut formove=> k hyp; rewrite {} hyp.where rewrite {} hyp rewrites with hyp and clears it from the context. The rewriting arrow isuseful when hyp is only to be used once, i.e. most of the time.The following exemplifies other features of rewrite.Variable f10 : f 1 = f 0.Lemma ff10 : f (f 1) = 0.Proof. by rewrite f10 f00. Qed.The commandrewrite f10 f00is a shortcut forrewrite f10; rewrite f00.The proofs of the following two lemmas involve conversion from the Coq equality into booleanequality, and vice versa.Variables (D : eqType) (x y : D).Lemma eq_prop_bool : x = y -> x == y.Proof. by move/eqP. Qed.Lemma eq_bool_prop : x == y -> x = y.Proof. by move/eqP. Qed.End Equality.An eqType is a type with decidable Leibniz (i.e. rewritable) equality. See the file eqType.vfor details. The equality x == y is a boolean, whereas x = y is a proposition. Both proofs aboveinvoke a reflection lemma saying that x == y and x = y are equivalent for x and y of type D. Notethat move/eqP ”guesses” which implication of the equivalence is invoked.The following shows how to rewrite definitions and also presents another use of the syntaxmove/lemma.RT n° 36718 G. Gonthier & S. Le RouxSection Using_Definition.Variable U : Type.Definition set := U -> Prop.Definition subset (A B : set) := forall x, A x -> B x.Definition transitive (T : Type) (R : T -> T -> Prop) :=forall x y z, R x y -> R y z -> R x z.Above, the type U is the ”universe of the discourse” of what follows. Then the commandDefinition set := U -> Prop.defines a new type, i.e. set, using types that already exist, i.e. U and Prop. (Yes, Prop is a type,check it!) More specifically, set is the type of all the predicates on U. Set-theoretically speaking,this corresponds to the subsets of U.In the definitionDefinition subset (A B : set) := forall x, A x -> B x.the object x need not be explicitly typed (we did not write forall x : U), whereas A and B mustbe typed: since the terms A x and B x are written and since A and B have type U -> Prop, thesystem infers that x must have type U for A x and B x to be well-typed. Note that the line aboveactually defines subset A B for two arbitrary parameters A and B, which implicitly defines subsetitself.Lemma subset_trans : transitive set subset.Proof.rewrite /transitive /subset => x y z subxy subyz t xt.by apply: subyz; apply: subxy.Qed.In the proof above, the commandrewrite /transitive /subset.replaces the objects transitive and subset with their actual definitions. This simulates the Coqcommandunfold transitive, subset.without introducing any new tactic, since it is relevant to provide rewrite with this new feature.Note thatrewrite /transitive /subset => x y z subxy subyz t xt.is a shortcut forrewrite /transitive /subset; move=> x y z subxy subyz t xt.Below, we prove the same lemma in a slightly different way, which gives the opportunity topresent new features.Lemma subset_trans2 : transitive set subset.Proof.move=> x y z subxy subyz t.by move/subxy; move/subyz.Qed.End Using_Definition.INRIAAn Ssreflect Tutorial 19First note that we did not actually need to rewrite like in the previous proof: the introductionof variables with move=> forces the unfolding of the definition of transitive. Then the commandmove/subxy.transforms the top of the proof stack x t into y t. The transformation is valid for the followingreason: since x t -> y t according to the term subxy, if we prove y t -> z t then we haveproved x t -> z t. This view does not come from a reflection lemma as before, but from a half-equivalence, i.e. an implication. Therefore the view is one-way, whereas the views coming fromreflection/equivalence lemmas are two-way.3 Arithmetic for Euclidean divisionThis section shows a few assets of ssreflect for arithmetic.Subsection 3.1 presents the natural numbers in Coq and the basic arithmetic operations (ad-dition, multiplication) and relations (inequality). We point out the advantages of ssreflect, interms of definitions and how these influence proof efficiency. Subsection 3.2 defines the Euclideandivision. Subsection 3.3 proves that our division meets the requirements for Euclidean divisionand that Euclidean division is injective. Subsection 3.4 shows that the parametric inductive typefamilies that we use for the specification of Euclidean division are not unique but are the mostsuitable.3.1 BasicsIn Coq the natural numbers are formally called nat. Checking the object nat displays the followingline.nat : Setwhere Set is similar to Type, so that it is possible to write the following line below, which meansthat an arbitrary natural number is assumed and named n.Variable n : nat.The natural numbers are built in two steps, inductively: first, zero is a natural; second, thesuccessor of a natural is also a natural. Printing the object nat displays the following line.Inductive nat : Set := O : nat | S : nat -> natThis means that nat has two constructors, which are named O and S, the letters of the alphabet.The constructor O has type nat, and it actually builds the first natural, i.e. zero, which isrepresented by the figure 0 for convenience. The second constructor of nat, i.e. S, expects anatural number, let us call it n, and returns a new natural number S n which is meant to bethe successor of n. In ssreflect S n is usually written n.+1. Fortunately, the system understandsthe notation 3, which represents S(S(S O))), as suggested by the following lemma and its trivialproofs. Otherwise writing big numbers would not be practical.Lemma three : S (S (S O)) = 3 /\ 2 = 0.+1.+1.Proof. by []. Qed.In Coq a primitive notion of fixpoint is defined. Thanks to fixpoints any objects definedinductively, e.g. nat, can be used to define recursive functions (whose domain is the inductivelydefined objects) and induction principles (used to prove predicates on the inductively definedobjects).For instance, the function plus (whose notation in Coq is +) expects two naturals and returnsa natural, and it performs the usual addition over the natural. Printing it displays the following.RT n° 36720 G. Gonthier & S. Le Rouxplus =fix plus (n m : nat) {struct n} : nat :=match n with| 0 => m| p.+1 => (p + m).+1end: nat -> nat -> natWe see from above that plus was defined by recursion thanks to a fixpoint, hencefixThe function expects two arguments but{struct n}tells the system that the recursion is made on the first argument. So, when plus is given twoarguments, it case-splits on the inductive definition of the first argument. The case-splitting isintroduced bymatch n withand performed by| 0 => m (* zero case *)| p.+1 => (p + m).+1 (*non-zero case *)If the first argument is zero, the result of the addition is the second argument, hence| 0 => mIf the first argument is the successor of a given natural, the result is the successor of the additionof the given natural (the first argument is structurally decreasing, so the recursion is well-defined)and the same second argument, hence| p.+1 => (p + m).+1The function plus has an actual computational content, so plus 16 64 reduces to 80 ”easily”.For example, try the proof below with and without the Coq tactic simpl. In this proof the pointis not the lemma and its proof but only the effect of the tactic simpl.Lemma concrete_plus : plus 16 64 = 80.Proof. (* simpl. *) by []. Qed.However, when using simplifying tactics to simplify a specific part of a goal expression, thismay simplify unwanted parts too (such as the addition). Relying on a broad experience of tensof thousands of lines of proof script, ssreflect’s library was designed to avoid this side effect forspecific (but not all) cases. In ssreflect, the natural addition function addn is equivalent to thefollowing.addn = nosimpl plus.The object nosimpl is actually implemented in the file ssreflect.v, but we do not comment on itin this tutorial. In ssreflect, the notation + refers to addn. As one can see below, the proof of16 + 64 = 80 is a trivial as before, but the point is that the Coq tactic simpl has no effect.Lemma concrete_plus_bis : 16 + 64 = 80.Proof. (* simpl. *) by []. Qed.As shown below the natural multiplication, mult or * in Coq, is also defined recursively, alongthe two constructors of the naturals and referring to the addition.INRIAAn Ssreflect Tutorial 21mult =fix mult (n m : nat) {struct n} : nat :=match n with| 0 => 0| p.+1 => (m + p * m)end: nat -> nat -> natJust as for addition, ssreflect blocks unwanted simplifications in the multiplication, muln or *in ssreflect, thanks to the nosimpl function, as below.muln = nosimpl mult.The following shows the advantage of defining <=, i.e. the less-than-or-equal-to relation, asa computable function, i.e. a function returning a boolean, instead of an inductive predicate inProp. In Coq the natural inequality less-than-or-equal-to is also called le, and is defined as aninductive predicate. Printing it yields the following.Inductive le (n : nat) : nat -> Prop :=le_n : (n <= n)| le_S : forall m : nat, (n <= m) -> (n <= m.+1)By construction, a proof of n <= p may come from two different situations: either p equals n sothat the first constructor allows building a proof of n <= p, or p is the successor of some m andwe have a proof of n <= m, so that the second constructor allows building a proof of n <= p.In order to prove that 1 is less than or equal to 3 one may use a transitivity lemma once anda lemma saying that any n is less than or equal to n + 1 twice, as shown below.Lemma concrete_le : le 1 3.Proof. by apply: (Le.le_trans _ 2); apply: Le.le_n_Sn. Qed.If the difference between the two naturals to be compared is big, one may proceed as follows.Lemma concrete_big_le : le 16 64.Proof. by auto 47 with arith. Qed.The tactic auto tries to build a proof automatically (which is more ambitious than ”just” verifyinga proof). The number 47 is a parameter of the depth of the search and arith is the name of apool of lemmas that auto is allowed to invoke. The resulting proof script is indeed small, at thecost of an elaborate (and potentially slow) tactic. Moreover, although the proof script is small,the lemma that it builds is big. (Print it!)In ssreflect, <= is implemented as a Boolean predicate, as follows.leq = fun m n : nat => m - n == 0: nat -> nat -> boolwhere - is a notation for the natural ”non-simplifying” subtraction below.subn = nosimpl subn_rec.where subn_rec is defined as follows with the Fixpoint syntax, which is equivalent to theDefinition-fix syntax, and more synthetic when usable.Fixpoint subn_rec (m n : nat) {struct m} :=match m, n with| m’.+1, n’.+1 => (m’ - n’)| _, _ => mendThis double match allows case-splitting along m and n being zero or not, which sums up to fourcases altogether. The first line of the body of the match-with, namelyRT n° 36722 G. Gonthier & S. Le Roux| m’.+1, n’.+1 => (m’ - n’)accounts for when both naturals are non-zero. The second line, namely| _, _ => maccounts for all the cases that have not been accounted for before this line. In the specific specificsituation at hand, it accounts for when at least one of the naturals is zero.This way, through subtraction and leq, the concept of natural inequality is given a computa-tional content, and a proof script of concrete inequality may involve a basic tactic only.Lemma concrete_big_leq : 0 <= 51.Proof. by []. Qed.Moreover, the lemma itself is as small as its proof. (Print it!) It involves only a coercion of Booleanto Prop.A few semi-concrete-semi-abstract lemmas involving inequality may also be proved by plaincomputation.Lemma semi_concrete_leq : forall n m, n <= m -> 51 + n <= 51 + m.Proof. by []. Qed.The lemma above has a trivial proof because 51 + n <= 51 + m reduces to 50 + n <= 50 + m,and ultimately to n <= m. The corresponding lemma using Coq definitions and tactics wouldrequire a structured proof, whereas, in ssreflect, most of the proof burden is born by a simplecomputation. This feature is not limited to arithmetic inequality: it is one of the main motivationsof ssreflect’s design. For instance Boolean connectives are also made for computing, as shownbelow.Lemma concrete_arith : (50 < 100) && (3 + 4 < 3 * 4 <= 17 - 2).Proof. by []. Qed.For any objects defined inductively, Coq generates an induction principle automatically. Fornat, the generated induction principle nat_ind is the usual one. Checking nat_ind displays thefollowing.nat_ind: forall P : nat -> Prop,P 0 -> (forall n : nat, P n -> P n.+1) -> forall n : nat, P nLiterally, nat_ind states that for every predicate P over the naturals the following holds: if P 0holds, if P n implies P n.+1 for every natural n, then the predicate holds for all naturals.The following proves the commutativity of the addition of natural numbers.Lemma plus_commute : forall n1 m1, n1 + m1 = m1 + n1.Proof.by elim=> [| n IHn m]; [elim | rewrite -[n.+1 + m]/(n + m).+1 IHn; elim: m].Qed.The tacticelimperforms an induction on the top universally-quantified variable of the goal (along the inductionprinciple generated automatically for the type of the variable), which is possible only when thetype of the variable has been defined inductively. So in the proof above, the first elim performsan induction on the natural n1 (along the usual induction principle for naturals). So this elim isan extension ofapply: nat_ind.INRIAAn Ssreflect Tutorial 23Put otherwise, elim case-splits on an object of an inductive type by considering the differentconstructors alternatively, just like the tactic case. In addition elim assumes the induction hy-pothesis, which case does not. So, elim is strictly more powerful. Still, the ssreflect writing styleprescribes using case whenever possible to make the proof script more informative: a proof thatmentions the induction hypothesis without actually using it may be confusing.Then=> [| n IHn m]introduces no variable in the first subgoal, where n1 is 0, hence [|, and it introduces the naturaln, the induction hypothesis about commutativity, and the natural m in the second subgoal.Then[elim |performs an induction on m1 in the first subgoal, both branches being solved trivially thanks tothe by at the beginning of the line.In the second subgoal,rewrite -[n.+1 + m]/(n + m).+1 IHnrewrites n.+1 + m into (n + m).+1. This works because the two formulas are convertible: theycompute to the same value and generates no additional subgoal. More precisely, rewrite /...instructs to replace an expression by this definition, the - instructs to do the inverse, then tomake the formula appear, and the fragment [...] indicates where this should happen. Then,the rewrite tactic rewrites with the equality of the induction hypothesis named IHn. Note thatalthough there is a quantifier before the equality, the rewrite tactic uses a pattern matchingalgorithm to find a matching pattern (In the current goal there is only one such pattern) andrewrites all of its instances (In the current goal there is only one such instance).Then, still in the second subgoal,elim: mwhich is a shorthand formove: m; elimperforms an induction on m, both branches being solved trivially thanks to the by at the beginningof the line.3.2 DefinitionsThis section explains how the euclidean division is implemented in the file div.v of the ssreflectstandard library, and it mentions how it may be used.First is defined the function edivn_rec whose type is as follows.nat -> nat -> nat -> nat * natSo edivn_rec expects three natural arguments and returns a pair of naturals. The actual definitionisDefinition edivn_rec d := fix loop (m q : nat) {struct m} :=if m - d is m’.+1 then loop m’ q.+1 else (q, m).The function edivn_rec above is defined through an auxiliary function loop which is definedrecursively. The first argument of edivn_rec, namely d, can be defined as a parameter because itsvalue remains constant throughout the recursion of loop. The last two arguments of edivn_recare the two arguments of loop, namely m and q. As specified by{struct m}RT n° 36724 G. Gonthier & S. Le Rouxthe recursion of loop uses m, so Coq will accept the recursive definition of loop iff it complieswith the Coq sufficient conditions guaranteeing that the first argument m is actually decreasingstructurally. The body of the recursive definition involves the ssreflect syntaxif-is-then-elsewhich corresponds to the Coq syntaxmatch-withThe if-is-then-else syntax is designed to provide one-line, readable pattern matching.The recursion says that if the first argument m minus the parameter d is not zero (i.e. m isgreater than d.+1), the function loop is re-invoked with another first argument, i.e. m - (d.+1)(recognised by Coq as structurally smaller than m) and the second argument incremented by 1; ifm minus d is zero, the function returns both arguments in a pair. The parameter d is meant tobe the predecessor of the divisor of the Euclidean division defined afterwards; the argument m ismeant to be the remainder; and the argument q is meant to be the quotient.Below the auxiliary function edivn_rec is used in the definition of the actual Euclidean divisionedivn, which expects two arguments, a dividend and a divisor, and returns the quotient and theremainder.Definition edivn m d := if d > 0 then edivn_rec d.-1 m 0 else (0, m).The function edivn expecting the divisor as an argument invokes edivn_rec with the predecessorof the divisor, and edivn_rec actually subtracts the successor of its argument. This may soundawkward at first glance: why first subtract 1 to the divisor (d.-1) and then add 1 back again(m - d is m’.+1)? Actually, it makes much sense. Indeed, in the definition of edivn this doesnot cost anything because, in the first place, the function needs to case-split on the divisor beingzero or not. Without the subtraction, the function would be as follows.Definition edivn2 m d := if d > 0 then edivn_rec2 d m 0 else (0, m).In edivn_rec the subtraction-addition allows case-splitting on the temporary remainder beingless than the divisor or not, through a simple subtraction. If using edivn2, we would need to usean auxiliary function like below.Definition edivn_rec2 d := fix loop (m q : nat) {struct m} :=if m - (d - 1) is m’.+1 then loop m’ q.+1 else (q, m).Indeed, consider the following function with the same recursive structure as edivn_rec.Definition edivn_rec3 d := fix loop (m q : nat) {struct m} :=if m - d is m’.+1 then term1 else term2.where term1 and term2 are arbitrary. edivn_rec3 could not work with edivn2: when m - d iszero, it may be either because they are equal, in which case we need one more recursive call, orbecause m is less than d, in which case we can return the values now.In order to prove that edivn_rec actually performs the Euclidean division, we need to specifywhat we mean by Euclidean division first. This is done with the definition below.CoInductive edivn_spec (m d : nat) : nat * nat -> Type :=EdivnSpec q r of m = q * d + r & (d > 0) ==> (r < d) :edivn_spec m d (q, r).The difference between CoInductive and Inductive is that CoInductive does not try to generatea recursion or induction principle. Since the definition above is not intended to be used withsuch principles, using CoInductive ensures that it will not be so. The definition above definesparametric families of types. The parameters are m and d. For given m and d, the type familyexpects a pair of naturals and returns a Type. It builds (and returns) a Type as follows: to theconstructor EdivnSpec, it gives two naturals q and r, a proof of m = q * d + r, and a proof of(d > 0) ==> (r < d). Then the resulting object has type edivn_spec m d (q, r). The of-&INRIAAn Ssreflect Tutorial 25syntax is from ssreflect. To define the same type in a Coq style with exactly the same inhabitants(i.e., ”elements”), we could write the following.CoInductive edivn_spec (m d : nat) : nat * nat -> Type :=EdivnSpec :forall q r, m = q * d + r -> (d > 0 -> r < d) -> edivn_spec m d (q, r).3.3 ResultsIn the remainder of this section we are going to see two results. The first one says that the functionedivn meets the specification edivn_spec and thus performs one Euclidean division. The secondresult says that if some naturals meet the specifications then they must be the ones returned byedivn. This shows uniqueness of the Euclidean division.Below, let us prove that edivn complies with edivn_spec.Lemma edivnP : forall m d, edivn_spec m d (edivn m d).Proof.rewrite /edivn => m [|d] //=; rewrite -{1}[m]/(0 * d.+1 + m).elim: m {-2}m 0 (leqnn m) => [|n IHn] [|m] q //=; rewrite ltnS => le_mn.rewrite subn_if_gt; case: ltnP => [// | le_dm].rewrite -{1}(subnK le_dm) -addSn addnA -mulSnr; apply: IHn.apply: leq_trans le_mn; exact: leq_subr.Qed.In the first line of the proof, the pattern[|d]case-splits on d. The first case is solved by the tactic//=which is actually a combination of // and/=We have already seen that // solves trivial subgoals (generated by [|d] in this specific example).As for /=, it simplifies all subgoals (generated by [|d] in this specific example), like simpl in Coq.So //= simplifies all subgoals and solves the trivial ones. Then in the only remaining subgoal, i.e.the second one, we replace the first occurrence of m with 0 * d.+1 + m, usingrewrite -{1}[m]/(0 * d.+1 + m)The tactic succeeds because 0 * d.+1 + m is reducible to m. The reason why we replace m withthe more complicated 0 * d.+1 + m will become clear below.Before the second line of the proof, the goal isedivn_spec (0 * d.+1 + m) d.+1 (edivn_rec d m 0)We need a proof by strong induction rather than simple induction: instead of usingnat_ind: forall P : nat -> Prop,P 0 -> (forall n : nat, P n -> P n.+1) -> forall n : nat, P nwe invoke a property resembling the generic strong induction principle below.forall P : nat -> Prop,P 0 -> (forall n, (forall k, k <= n -> P k) -> P n.+1) -> forall n, P nRT n° 36726 G. Gonthier & S. Le RouxDepending on the situation, the strong induction principle that is required may vary slightly,so there is no strong induction principle that suits every situation (even in the specific case ofnaturals). Nonetheless this is not an issue in ssreflect because strong induction can be invoked inone line.In this second line of the proof,(leqnn m)pushes m <= m on top of the proof stack, and just to the left of (leqnn m)0generalises 0 in an arbitrary natural n. So, in order to prove what we want, we first prove a moregeneral property. This was the purpose of the mysterious rewrite in the first line of the proof.Then{-2}mgeneralises every occurrence of m in the goal (m corresponds to k in the generic strong inductionprinciple above) except the second occurrence, which is intended to correspond to the upper boundn in the generic strong induction principle above. Finallyelim: mstarts an induction on the upper bound m, which amounts to the strong induction that we needed.This elim: m generates two subgoals. Thanks to[|n IHn]we introduce an upper bound and the corresponding induction hypothesis in the second subgoal.Then in both subgoals, the[|m]case-splits on the natural below the upper bound and in the four (new) subgoalsqintroduces the ”generalised 0”. Three subgoals out of the four are solved by //=. Finally,rewrite ltnSrewrites a strict inequality < into a non-strict inequality <= thanks to the lemma ltnS.At the third line of the proof, the goal isedivn_spec (q * d.+1 + m.+1) d.+1match m.+1 - d with| 0 => (q, m.+1)| m’.+1 => edivn_rec d m’ q.+1endThanks to the lemma subn_if_gt (and thanks to inequality being defined through subtraction inssreflect) we rewrite the match-with syntax into the Coq if-then-else syntax. The next proofstep iscase: ltnPTo understand what this does let us first check ltnP.ltnP : forall m n : nat, ltn_xor_geq m n (n <= m) (m < n)And then print ltn_xor_geq.CoInductive ltn_xor_geq (m : nat) (n : nat) : bool -> bool -> Set :=LtnNotGeq : m < n -> ltn_xor_geq m n false true| GeqNotLtn : n <= m -> ltn_xor_geq m n true falseINRIAAn Ssreflect Tutorial 27Here again, a coinductive is preferred to an inductive to build a non-recursive type family withoutgenerating an inductive principle. If the first constructor LtnNotGeq is given a proof of m < n thenit returns an object of type ltn_xor_geq m n false true. If the second constructor GeqNotLtnis given a proof of n <= m then it returns an object of type ltn_xor_geq m n true false.Technically, ltnP m d means that the pair (m < d, d <= m) is (true,false) if m < d, and(false,true) if d <= m. Thus lemma ltnP says that for all naturals m and n, either m < n orn <= m in a mutually exclusive way, which is useful here. The command case: ltnP case-splits onsuch a disjunction. Since lemma ltnP is given no parameter, a pattern matching algorithm (dif-ferent from the one used in the rewrite tactic) finds two relevant naturals for the case-splitting.Here it case-splits on m < d or d <= m, which is in the present situation more convenient than thedisjunction m < d or ~m < d.Writing case: (ltnP m d) instead would work just as well without relying on the patternmatching algorithm.Then, note that[// | le_dm]could be shortened into// le_dmbut the slightly longer command explains that the trivial subgoal is the first one, which the shortercommand does not suggest.At the fourth line of the proof, the goal isedivn_spec (q * d.+1 + m.+1) d.+1 (edivn_rec d (m - d) q.+1)By writingrewrite -addSnwe find in the goal the first pattern that matches the equality of lemma addSn and rewrites in thegoal all occurrences of this pattern using the equality from right to left (hence the minus symbol).Insteadrewrite -{1}(subnK le_dm)rewrites, from right to left, only the first occurrence (hence {1}) of the first pattern that matchesthe equality of lemma subnK le_dm. At this stage of the tutorial, the rest of the proof is under-standable without further explanations.The following lemma and its proof show that for any divisor, quotient, and remainder that isless than the divisor, edivn with first argument the remainder plus the quotient times the divisorand second argument the divisor returns the quotient and the remainder. This proves that thespecifications for the Euclidean division are non-ambiguous.Lemma edivn_eq : forall d q r, r < d -> edivn (q * d + r) d = (q, r).Proof.move=> d q r lt_rd; have d_pos: 0 < d by exact: leq_trans lt_rd.case: edivnP lt_rd => q’ r’; rewrite d_pos /=.wlog: q q’ r r’ / q <= q’ by case (ltnP q q’); last symmetry; eauto.rewrite leq_eqVlt; case: eqP => [-> _|_] /=; first by move/addnI->.rewrite -(leq_pmul2r d_pos); move/leq_add=> Hqr Eqr _; move/Hqr {Hqr}.by rewrite addnS ltnNge mulSn -addnA Eqr addnCA addnA leq_addr.Qed.In the first line of the proof above, the commandhave d_pos: 0 < d by exact: leq_trans lt_rdasserts that 0 < d, proves it byby exact: leq_trans lt_rdRT n° 36728 G. Gonthier & S. Le Rouxthen names this proved assertion d_pos and puts it in the context.Second line of the proof, the commandcase: edivnP lt_rdPushes first hypothesis lt_rd stating r < d, then lemma edivnP on the top of the proof stack.Then it case-splits on lemma edivnP. (It may do so since the conclusion of lemma edivnP is theinductively defined edivn_spec.) It is a shortcut formove: edivnP lt_rd; case.and the subgoal after move: edivnP lt_rd is(forall m d0 : nat, edivn_spec m d0 (edivn m d0)) ->r < d -> edivn (q * d + r) d = (q, r)Since no argument is given to lemma edivnP before the case, since lemma edivnP involves the termedivn m d0, and since the goal involves the term edivn (q * d + r) d, the pattern matchingalgorithm (specific to the case tactic) decides to instantiate m with (q * d + r) and d0 with d.So, alternatively, we could have writtencase: (edivnP (q * d + r) d) lt_rd.or evenmove: (edivnP (q * d + r) d) lt_rd; case.to understand better what is happening. After move: (edivnP (q * d + r) d) lt_rd, the goalisedivn_spec (q * d + r) d (edivn (q * d + r) d) ->r < d -> edivn (q * d + r) d = (q, r)Since edivn_spec has only one constructor, the case tactic generates no additional subgoal. Whathappens in the goal, roughly, is that edivn_spec (q * d + r) d (edivn (q * d + r) d) is re-placed with the conditions of construction of edivn_spec. Since the last argument of edivn_spec isa pair of natural, all occurrences of edivn (q * d + r) d are rewritten into the relevant (q0,r0).Then the commandrewrite d_pos /=is equivalent torewrite d_pos => /=In the example above only one => is spared, but it is especially useful when we need to rewriteagain after the simplification.Third line of the proof, the goal isq * d + r = q’ * d + r’ -> r’ < d -> r < d -> (q’, r’) = (q, r)The commandwlog: q q’ r r’ / q <= q’(where wlog is a shorthand for the tactic without loss) states that we can assume q <= q’without loss of generality. More specifically, the original unique goal becomes the second subgoalwhere the assumption q <= q’ has been pushed on the proof stack, and a first subgoal is generated,which states that if for all q, q’, r, and r’ the inequality assumption implies the property, thenthe property holds. The sequencemove: r r’; wlog: q q’ / q <= q’would do too, butmove: q q’ r r’; wlog: / q <= q’INRIAAn Ssreflect Tutorial 29although valid, would not help since the assumption q <= q’ must be inserted before the q andq’ variables are generalised. Therefore the tactic wlog cannot be easily simulated using other Coqtactics or even ssreflect tactics that we have seen so far: it has a substantial added value.The tactics symmetry (inverting equalities) and eauto (automatic basic proof searching) areboth Coq tactics.Fourth line of the proof:move/addnIsimplifies the top of the proof stack using injectivity of the addition.The rest of the proof should not require detailed explanations at this stage of the tutorial.3.4 Parametric type families and alternative specificationsNow we explain why the arguments of edivn_spec whose type isnat -> nat -> nat * nat -> Setare not all mentioned at the same stage of the definition of edivn_spec. Indeed the first two argu-ments are parameters and the last one, the pair of naturals, makes edivn_spec m d an inductivelydefined type family. The chosen definition is the following one.CoInductive edivn_spec (m d : nat) : nat * nat -> Type :=EdivnSpec q r of m = q * d + r & (d > 0) ==> (r < d) :edivn_spec m d (q, r).Two alternative definitions are presented below. The first one isCoInductive edivn_spec_right : nat -> nat -> nat * nat -> Type :=EdivnSpec_right m d q r of m = q * d + r & (d > 0) ==> (r < d) :edivn_spec_right m d (q, r).It shifts the two parameters to the right of the colon :, so that edivn_spec_right has the sametype as edivn_spec. There is no longer any parameter, but the alternative type constructorEdivnSpec_right requires two more arguments than EdivnSpec, namely m and d.The second alternative definition isCoInductive edivn_spec_left (m d : nat)(qr : nat * nat) : Type :=EdivnSpec_left of m = (fst qr) * d + (snd qr) & (d > 0) ==> (snd qr < d) :edivn_spec_left m d qr.It shifts the pair argument to the left of the colon :, so that every argument is seen as a parameterand edivn_spec_left has the same type as edivn_spec. So EdivnSpec_left requires two lessarguments than EdivnSpec. However, the last parameter of edivn_spec_left being a pair, weneed to project it before using it in the body of the definition.The two lemmasLemma edivnP_right : forall m d, edivn_spec_right m d (edivn m d).andLemma edivnP_left : forall m d, edivn_spec_left m d (edivn m d).can be proved with the proof of lemma edivnP. However it gets more complicated for the lemmascorresponding to lemma edivn_eq, as shown by their proofs.Lemma edivn_eq_right : forall d q r, r < d -> edivn (q * d + r) d = (q, r).Proof.move=> d q r lt_rd; have d_pos: 0 < d by exact: leq_trans lt_rd.set m := q * d + r; have: m = q * d + r by [].set d’ := d; have: d’ = d by [].case: (edivnP_right m d’) => {m d’} m d’ q’ r’ -> lt_r’d’ d’d q’d’r’.RT n° 36730 G. Gonthier & S. Le Rouxmove: q’d’r’ lt_r’d’ lt_rd; rewrite d’d d_pos {d’d m} /=.wlog: q q’ r r’ / q <= q’ by case (ltnP q q’); last symmetry; eauto.rewrite leq_eqVlt; case: eqP => [-> _|_] /=; first by move/addnI->.rewrite -(leq_pmul2r d_pos); move/leq_add=> Hqr Eqr _; move/Hqr {Hqr}.by rewrite addnS ltnNge mulSn -addnA -Eqr addnCA addnA leq_addr.Qed.Beside lines 2 to 5 and -Eq on the last line, the proof above is similar to the proof of lemmaedivn_eq. The second line of the proof,set m := q * d + rdefines m as q * d + r and replaces q * d + r with m in the goal. The two have push thecorresponding equalities on the proof stack. These four operations intend to keep track of d andq * d + r after the case which replaces them with fresh universally quantified variables becausethe first two arguments of edivn_spec_right are no longer (compare to edivn_spec) parametric.Line 4, note that edivnP_right needs arguments. Lines 4 and 5, {m d’} and {d’d m} clear uselesscontext variables and hypotheses.Lemma edivn_eq_left : forall d q r, r < d -> edivn (q * d + r) d = (q, r).Proof.move=> d q r lt_rd; have d_pos: 0 < d by exact: leq_trans lt_rd.case: (edivnP_left (q * d + r) d) lt_rd; rewrite d_pos /=.set q’:= (edivn (q * d + r) d).1; set r’:= (edivn (q * d + r) d).2.rewrite (surjective_pairing (edivn (q * d + r) d)) -/q’ -/r’.wlog: q r q’ r’ / q <= q’ by case (ltnP q q’); last symmetry; eauto.rewrite leq_eqVlt; case: eqP => [-> _|_] /=; first by move/addnI->.rewrite -(leq_pmul2r d_pos); move/leq_add=> Hqr Eqr _; move/Hqr {Hqr}.by rewrite addnS ltnNge mulSn -addnA Eqr addnCA addnA leq_addr.Qed.The proof above is similar to the proof of lemma edivn_eq, beside lines 3 and 4, and edivnP_leftneeding arguments for the case-splitting, and the variables reordering in wlog: q r q’ r’. Line3 the commandset q’:= (edivn (q * d + r) d).1defines q’ as the first component of the pair edivn (q * d + r) d.Thenrewrite (surjective_pairing (edivn (q * d + r) d)) -/q’ -/r’decomposes the pair explicitly and folds the definitions of q’ and r’, which enables the withoutloss of generality subsequent proof structure.This example suggests that, in the definition of edivn_spec, the choice to define some argu-ments as parametric (to the left of the typing colon) and some other arguments as non-parametric(to the right of the typing colon) is made in order to minimise the proof burden. Generally speak-ing, such a choice should be carefully made, while bearing in mind that parametric type familiesthat are equal in extension may not be equivalent in terms of usability. Experience will tell.4 ConclusionBy shortening the Coq tutorial and coping with Euclidean division, ssreflect has proved to be asynthetic and efficient proof language. The reader may look at the ssreflect standard library tofind more examples or even to practise by reproving the results therein. This is recommended.INRIACentre de recherche INRIA Saclay – Île-de-FranceParc Orsay Université - ZAC des Vignes4, rue Jacques Monod - 91893 Orsay Cedex (France)Centre de recherche INRIA Bordeaux – Sud Ouest : Domaine Universitaire - 351, cours de la Libération - 33405 Talence CedexCentre de recherche INRIA Grenoble – Rhône-Alpes : 655, avenue de l’Europe - 38334 Montbonnot Saint-IsmierCentre de recherche INRIA Lille – Nord Europe : Parc Scientifique de la Haute Borne - 40, avenue Halley - 59650 Villeneuve d’AscqCentre de recherche INRIA Nancy – Grand Est : LORIA, Technopôle de Nancy-Brabois - Campus scientifique615, rue du Jardin Botanique - BP 101 - 54602 Villers-lès-Nancy CedexCentre de recherche INRIA Paris – Rocquencourt : Domaine de Voluceau - Rocquencourt - BP 105 - 78153 Le Chesnay CedexCentre de recherche INRIA Rennes – Bretagne Atlantique : IRISA, Campus universitaire de Beaulieu - 35042 Rennes CedexCentre de recherche INRIA Sophia Antipolis – Méditerranée :2004, route des Lucioles - BP 93 - 06902 Sophia Antipolis CedexÉditeurINRIA - Domaine de Voluceau - Rocquencourt, BP 105 - 78153 Le Chsnay Cedex (France)http://www.inria.frISSN 0249-0803

An Ssreflect Tutorial

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server