The Coq Proof Assistant The standard library

April 11, 2001 Version 7.0 ^{1}

Coq Development Project

1This research was partly supported by ESPRIT Basic Research Action “Types”

V7.0, April 11, 2001

\begin{matrix}c \\ ◯ \end{matrix}INRIA 1999-2001

Contents

1 Logic 4 2 Bool 9 3 Arith 15 4 Reals 61 5 Lists 80 6 Sets 96 7 Relations 124 8 Well-founded relations 132 9 IntMap 137

The Coq standard library

This document is a short description of the Coq standard library. This library comes with the system as a complement of the core library (the Init library ; see the Reference Manual for a description of this library). It provides a set of modules directly available through the Require command.

The standard library is composed of the following subdirectories:

Logic  Classical logic and dependent equality
Bool  Booleans (basic functions and results)
Arith  Basic Peano arithmetic
Zarith  Basic integer arithmetic

Reals Axiomatization of Real Numbers (classical, basic functions and results,

integer part and fractional part, requires the Zarith library).

Lists Monomorphic and polymorphic lists (basic functions and results), Streams (infinite sequences defined with co-inductive types)

Sets  Sets (classical, constructive, finite, infinite, power set, etc.)
Relations  Relations (definitions and basic results).
Wellfounded Well-founded relations (basic results).

IntMap Representation of finite sets by an efficient structure of map (trees indexed by binary integers).

Each of these subdirectories contains a set of modules, whose specifications (Gallina files) have been roughly, and automatically, pasted in the following pages. There is also a version of this document in HTML format on the WWW, which you can access from the Coq home page at

http://pauillac.inria.fr/coq/coq-eng.html.

1 Logic

This library deals with classical logic and its properties. The main file is Classical.v.

This library also provides some facts on an equality which contains its own proof. See the file

Eqdep.v.

Module Classical Prop

Id : Classical_{P} rop.v, v1.22001/03/1513 : 38 : 50filliatrExp Classical Propositional Logic

Hints Unfold not : core.

Axiom classic : (P :Prop)(P ∨ ¬(P)).

Lemma NNPP : (p :Prop)¬(¬(p)) → p.

Lemma not imply elim : (P, Q :Prop)¬(P → Q) → P.

Lemma not imply elim2 : (P, Q :Prop)¬(P → Q) → ¬Q.

Lemma imply to or : (P, Q :Prop)(P → Q) → ¬P ∨ Q.

Lemma imply to and : (P, Q :Prop)¬(P → Q) → P ∧ ¬Q.

Lemma or to imply : (P, Q :Prop)(¬P ∨ Q) → P → Q.

Lemma not and or : (P, Q :Prop)¬(P ∧ Q) → ¬P ∨ ¬Q. Lemma or not and : (P, Q :Prop)(¬P ∨ ¬Q) → ¬(P ∧ Q). Lemma not or and : (P, Q :Prop)¬(P ∨ Q) → ¬P ∧ ¬Q. Lemma and not or : (P, Q :Prop)(¬P ∧ ¬Q) → ¬(P ∨ Q). Lemma imply and or : (P, Q :Prop)(P → Q) → P ∨ Q → Q. Lemma imply and or2 : (P, Q, R :Prop)(P → Q) → P ∨ R → Q ∨ R.

Module Classical Pred Set

Id : Classical_{P} red_{S}et.v, v1.22001/03/1513 : 38 : 50filliatrExp Classical Predicate Logic on Set Require Classical Prop. Section Generic. Variable U : Set. de Morgan laws for quantifiers Lemma not all ex not : (P : U → Prop)(¬(n : U )(P n)) → (EX n : U | ¬(P n)). Lemma not all not ex : (P : U → Prop)(¬(n : U )¬(P n)) → (EX n : U |(P n)). Lemma not ex all not : (P : U → Prop) (¬(EX n : U |(P n))) → (n : U )¬(P n). Lemma not ex not all : (P : U → Prop)(¬(EX n : U | ¬(P n))) → (n : U )(P n). Lemma ex not not all : (P : U → Prop) (EX n : U | ¬(P n)) → ¬(n : U )(P n). Lemma all not not ex : (P : U → Prop) ((n : U )¬(P n)) → ¬(EX n : U |(P n)). End Generic.

Module Eqdep

Id : Eqdep.v, v1.52001/03/1513 : 38 : 50filliatrExp Section Dependent Equality. Variable U : Set. Variable P : U → Set. Inductive eq dep [p : U ; x : (P p)] : (q : U )(P q) → Prop :=

eq dep intro : (eq dep p x p x). Lemma eq dep sym : (p, q : U )(x : (P p))(y : (P q))(eq dep p x q y) → (eq dep q y p x). Hints Lemma eq dep trans : (p, q, r : U )(x : (P p))(y : (P q))(z : (P r))

(eq dep p x q y) → (eq dep q y r z) → (eq dep p x r z). Inductive eq dep1 [p : U ; x : (P p); q : U ; y : (P q)] : Prop :=

eq dep1 intro : (h : q = p)

(x = (eq rec U q P y p h)) → (eq dep1 p x q y).

Axiom eq rec eq : (p : U )(Q : U → Set)(x : (Q p))(h : p = p)

x = (eq rec U p Q x p h).

Lemma eq dep1 dep :

(p : U )(x : (P p))(q : U )(y : (P q))(eq dep1 p x q y) → (eq dep p x q y). Lemma eq dep dep1 : (p, q : U )(x : (P p))(y : (P q))(eq dep p x q y) → (eq dep1 p x q y). Lemma eq dep1 eq : (p : U )(x, y : (P p))(eq dep1 p x p y) → x = y. Lemma eq dep eq : (p : U )(x, y : (P p))(eq dep p x p y) → x = y. Lemma equiv eqex eqdep : (p, q : U )(x : (P p))(y : (P q))

(existS U P p x) = (existS U P q y) ↔ (eq dep p x q y). Lemma inj pair2 : (p : U )(x, y : (P p))

(existS U P p x) = (existS U P p y) → x = y. End Dependent Equality. Hints Resolve eq dep intro : core v62 . Hints

Module Classical Type

Id : Classical_{T} ype.v, v1.22001/03/1513 : 38 : 50filliatrExp Classical Logic for Type Require Export Classical Prop. Require Export Classical Pred Type.

Module Classical Pred Type

Id : Classical_{P} red_{T} ype.v, v1.22001/03/1513 : 38 : 50filliatrExp Classical Predicate Logic on Type Require Classical Prop. Section Generic. Variable U : Type. de Morgan laws for quantifiers Lemma not all ex not : (P : U → Prop)(¬(n : U )(P n)) → (EXT n : U | ¬(P n)). Lemma not all not ex : (P : U → Prop)(¬(n : U )¬(P n)) → (EXT n : U | (P n)). Lemma not ex all not : (P : U → Prop)(¬(EXT n : U | (P n))) → (n : U )¬(P n). Lemma not ex not all : (P : U → Prop)(¬(EXT n : U | ¬(P n))) → (n : U )(P n). Lemma ex not not all : (P : U → Prop) (EXT n : U | ¬(P n)) → ¬(n : U )(P n). Lemma all not not ex : (P : U → Prop) ((n : U )¬(P n)) → ¬(EXT n : U | (P n)). End Generic.

Module Classical

Id : Classical.v, v1.22001/03/1513 : 38 : 50filliatrExp Classical Logic

Require Export Classical Prop. Require Export Classical Pred Set.

Module Eqdep dec

Id : Eqdep_{d}ec.v, v1.82001/04/1112 : 41 : 40filliatrExp We prove that there is only one proof of x = x, i.e (refl equal ? x). This holds if the equality upon the set of x is decidable. A corollary of this theorem is the equality of the right projections of two equal dependent pairs.

Author: Thomas Kleymann <tms@dcs.ed.ac.uk> in Lego adapted to Coq by B. Barras Credit: Proofs up to K dec follows an outline by Michael Hedberg We need some dependent elimination schemes

Scheme eq indd := Induction for eq Sort Prop. Scheme eqT indd := Induction for eqT Sort Prop. Scheme or indd := Induction for or Sort Prop.

Implicit Arguments On.

Bijection between eq and eqT

Definition eq2eqT : (A :Set)(x, y : A)x = y → x == y := [A, x, , eqxy] < [y : A]x == y >Cases eqxy of refl equal ⇒ (refl eqT ? x) end.

Definition eqT2eq : (A :Set)(x, y : A)x == y → x = y := [A, x, , eqTxy] < [y : A]x = y >Cases eqTxy of refl eqT ⇒ (refl equal ? x) end.

Lemma eq eqT bij : (A :Set)(x, y : A)(p : x = y)p == (eqT2eq (eq2eqT p)).

Lemma eqT eq bij : (A :Set)(x, y : A)(p : x == y)p == (eq2eqT (eqT2eq p)).

Section DecidableEqDep.

Variable A : Type.

Local comp [x, y, y′ : A] : x == y → x == y′ → y == y′ := [eq1 , eq2 ](eqT ind ? ? [a]a == y′ eq2 ? eq1 ).

Remark trans sym eqT : (x, y : A)(u : x == y)(comp u u) == (refl eqT ? y).

Variable eq dec : (x, y : A) x == y ∨ ¬x == y.

Variable x : A.

Local nu [y : A] : x == y → x == y :=

[u]Cases (eq dec x y) of

(or introl eqxy) ⇒ eqxy | (or intror neqxy) ⇒ (False ind ? (neqxy u)) end.

Local nu constant : (y : A)(u, v : x == y) (nu u) == (nu v).

Intros. Unfold nu. Elim (eq dec x y) using or indd; Intros. Reflexivity. Case b; Trivial. Save. Local nu inv [y : A] : x == y → x == y := [v](comp (nu (refl eqT ? x)) v). Remark nu left inv : (y : A)(u : x == y) (nu inv (nu u)) == u. Theorem eq proofs unicity : (y : A)(p1 , p2 : x == y) p1 == p2 . Theorem K dec : (P : x == x → Prop)(P (refl eqT ? x)) → (p : x == x)(P p). The corollary Local proj : (P : A → Prop)(ExT P) → (P x) → (P x) :=

[P, exP, def ]Cases exP of (exT intro x′ prf ) ⇒ Cases (eq dec x′ x) of

(or introl eqprf ) ⇒ (eqT ind ? x′ P prf x eqprf ) | ⇒ def end end.

Theorem inj right pair : (P : A → Prop)(y, y′ : (P x))

(exT intro ? P x y) == (exT intro ? P x y′) → y == y′. End DecidableEqDep. We deduce the K axiom for (decidable) Set Theorem K dec set : (A :Set)((x, y : A){x = y} + {¬x = y})

→ (x : A)(P : x = x → Prop)(P (refl equal ? x)) → (p : x = x)(P p).

Module Decidable

Definition decidable := [P :Prop] P ∨ ¬P. Theorem dec not not : (P :Prop)(decidable P) → (¬P → False) → P. Theorem dec True : (decidable True). Theorem dec False : (decidable False). Theorem dec or : (A, B :Prop)(decidable A) → (decidable B) → (decidable (A ∨ B)). Theorem dec and : (A, B :Prop)(decidable A) → (decidable B) → (decidable (A ∧ B)). Theorem dec not : (A :Prop)(decidable A) → (decidable ¬A). Theorem dec imp : (A, B :Prop)(decidable A) → (decidable B) → (decidable (A → B)). Theorem not not : (P :Prop)(decidable P) → (¬(¬P)) → P.

Theorem not or : (A, B :Prop) ¬(A ∨ B) → ¬A ∧ ¬B. Theorem not and : (A, B :Prop) (decidable A) → ¬(A ∧ B) → ¬A ∨ ¬B. Theorem not imp : (A, B :Prop) (decidable A) → ¬(A → B) → A ∧ ¬B. Theorem imp simp : (A, B :Prop) (decidable A) → (A → B) → ¬A ∨ B.

2 Bool

The BOOL library includes the following files:

• Bool.v defines standard operations on booleans and states and proves simple facts on them.

• IfProp.v defines a disjunction which contains its proof and states its properties.

• Zerob.v defines the test against 0 on natural numbers and states and proves properties of it.

• Orb.v states and proves facts on the boolean or.

• DecBool.v defines a conditional from a proof of decidability and states its properties.

Module Zerob

Id : Zerob.v, v1.32001/03/1513 : 38 : 49filliatrExp Require Arith. Require Bool. Definition zerob : nat → bool

:= [n : nat]Cases n of O ⇒ true | (S ) ⇒ false end. Lemma zerob true intro : (n : nat)(n = O) → (zerob n) = true. Hints Resolve zerob true intro : bool. Lemma zerob true elim : (n : nat)(zerob n) = true → (n = O). Lemma zerob false intro : (n : nat)¬(n = O) → (zerob n) = false. Hints Resolve zerob false intro : bool. Lemma zerob false elim : (n : nat)(zerob n) = false → ¬(n = O).

Module IfProp

Id : IfP rop.v, v1.22001/03/1513 : 38 : 49filliatrExp Require Bool. Inductive IfProp [A, B :Prop] : bool → Prop

:= Iftrue : A → (IfProp A B true)

| Iffalse : B → (IfProp A B false). Hints Resolve Iftrue Iffalse : bool v62 . Lemma Iftrue inv : (A, B :Prop)(b : bool) (IfProp A B b) → b = true → A.

Lemma Iffalse inv : (A, B :Prop)(b : bool) (IfProp A B b) → b = false → B. Lemma IfProp true : (A, B :Prop)(IfProp A B true) → A. Lemma Ifprop false : (A, B :Prop)(IfProp A B false) → B. Lemma IfProp or : (A, B :Prop)(b : bool)(IfProp A B b) → A ∨ B. Lemma IfProp sum : (A, B :Prop)(b : bool)(IfProp A B b) → {A} + {B}.

Module DecBool

Id : DecBool.v, v1.22001/03/1513 : 38 : 49filliatrExp Implicit Arguments On. Definition ifdec : (A, B :Prop)(C :Set)({A} + {B}) → C → C → C

:= [A, B, C , H , x, y]if H then [ ]x else [ ]y. Theorem ifdec left : (A, B :Prop)(C :Set)(H : {A} + {B})¬B → (x, y : C )(ifdec H x y) = x. Theorem ifdec right : (A, B :Prop)(C :Set)(H : {A} + {B})¬A → (x, y : C )(ifdec H x y) = y. Implicit Arguments Off .

Module Bool

Id : Bool.v, v1.82001/03/3015 : 04 : 59mohringExp

Booleans The type bool is defined in the prelude as Inductive bool : Set := true : bool | false : bool (from Prelude)

Interpretation of booleans as Propopsition Definition Is true := [b : bool](Cases b of

true ⇒ True | false ⇒ False end).

Hints Unfold Is true : bool. Lemma Is true eq left : (x : bool)x = true → (Is true x). Lemma Is true eq right : (x : bool)true = x → (Is true x). Hints (∗*****************∗) (∗s Discrimination ∗) (∗*****************∗) Lemma diff true false : ¬true = false. Hints Resolve diff true false : bool v62 . Lemma diff false true : ¬false = true. Hints Resolve diff false true : bool v62 . Lemma eq true false abs : (b : bool)(b = true) → (b = false) → False. Hints Resolve eq true false abs : bool.

Lemma not true is false : (b : bool)¬b = true → b = false.

Lemma not false is true : (b : bool)¬b = false → b = true.

Order on booleans

Definition leb := [b1 , b2 : bool] Cases b1 of | true ⇒ b2 = true | false ⇒ True end.

Hints Unfold leb : bool v62 .

Equality

Definition eqb : bool → bool → bool := [b1 , b2 : bool]

Cases b1 b2 of

true true ⇒ true | true false ⇒ false | false true ⇒ false | false false ⇒ true end.

Lemma eqb refl : (x : bool)(Is true (eqb x x)).

Lemma eqb eq : (x, y : bool)(Is true (eqb x y)) → x = y.

Lemma Is true eq true : (x : bool) (Is true x) → x = true.

Lemma Is true eq true2 : (x : bool) x = true → (Is true x).

Lemma eqb subst :

(P : bool → Prop)(b1 , b2 : bool)(eqb b1 b2 ) = true → (P b1 ) → (P b2 ).

Lemma eqb reflx : (b : bool)(eqb b b) = true.

Lemma eqb prop : (a, b : bool)(eqb a b) = true → a = b.

Logical combinators

Definition ifb : bool → bool → bool → bool := [b1 , b2 , b3 : bool](Cases b1 of true ⇒ b2 | false ⇒ b3 end).

Definition andb : bool → bool → bool := [b1 , b2 : bool](ifb b1 b2 false).

Definition orb : bool → bool → bool := [b1 , b2 : bool](ifb b1 true b2 ).

Definition implb : bool → bool → bool := [b1 , b2 : bool](ifb b1 b2 true).

Definition xorb : bool → bool → bool := [b1 , b2 : bool] Cases b1 b2 of

true true ⇒ false | true false ⇒ true | false true ⇒ true | false false ⇒ false end.

Definition negb := [b : bool]Cases b of

true ⇒ false | false ⇒ true end.

Lemmas about negb

Lemma negb intro : (b : bool)b = (negb (negb b)).

Lemma negb elim : (b : bool)(negb (negb b)) = b.

Lemma negb orb : (b1 , b2 : bool)

(negb (orb b1 b2 )) = (andb (negb b1 ) (negb b2 )).

Lemma negb andb : (b1 , b2 : bool)

(negb (andb b1 b2 )) = (orb (negb b1 ) (negb b2 )).

Lemma negb sym : (b, b′ : bool)(b′ = (negb b)) → (b = (negb b′)).

Lemma no fixpoint negb : (b : bool)¬(negb b) = b.

Lemma eqb negb1 : (b : bool)(eqb (negb b) b) = false.

Lemma eqb negb2 : (b : bool)(eqb b (negb b)) = false.

Lemma if negb : (A :Set) (b : bool) (x, y : A) (if (negb b) then x else y) = (if b then y else x). A few lemmas about or

Lemma orb prop :

(a, b : bool)(orb a b) = true → (a = true) ∨ (b = true).

Lemma orb prop2 :

(a, b : bool)(Is true (orb a b)) → (Is true a) ∨ (Is true b).

Lemma orb true intro

: (b1 , b2 : bool)(b1 = true) ∨ (b2 = true) → (orb b1 b2 ) = true. Hints Resolve orb true intro : bool v62 .

Lemma orb b true : (b : bool)(orb b true) = true. Hints Resolve orb b true : bool v62 .

Lemma orb true b : (b : bool)(orb true b) = true.

Lemma orb true elim : (b1 , b2 : bool)(orb b1 b2 ) = true → {b1 = true} + {b2 = true}. Lemma orb false intro

: (b1 , b2 : bool)(b1 = false) → (b2 = false) → (orb b1 b2 ) = false. Hints Resolve orb false intro : bool v62 .

Lemma orb b false : (b : bool)(orb b false) = b. Hints Resolve orb b false : bool v62 .

Lemma orb false b : (b : bool)(orb false b) = b. Hints Resolve orb false b : bool v62 .

Lemma orb false elim :

(b1 , b2 : bool)(orb b1 b2 ) = false → (b1 = false) ∧ (b2 = false).

Lemma orb neg b :

(b : bool)(orb b (negb b)) = true. Hints Resolve orb neg b : bool v62 . Lemma orb sym : (b1 , b2 : bool)(orb b1 b2 ) = (orb b2 b1 ). Lemma orb assoc : (b1 , b2 , b3 : bool)(orb b1 (orb b2 b3 )) = (orb (orb b1 b2 ) b3 ). Hints Resolve orb sym orb assoc orb b false orb false b : bool v62 .

A few lemmas about and Lemma andb prop :

(a, b : bool)(andb a b) = true → (a = true) ∧ (b = true). Hints Resolve andb prop : bool v62 . Lemma andb prop2 :

(a, b : bool)(Is true (andb a b)) → (Is true a) ∧ (Is true b). Hints Resolve andb prop2 : bool v62 . Lemma andb true intro : (b1 , b2 : bool)(b1 = true) ∧ (b2 = true) → (andb b1 b2 ) = true. Hints Resolve andb true intro : bool v62 . Lemma andb true intro2 :

(b1 , b2 : bool)(Is true b1 ) → (Is true b2 ) → (Is true (andb b1 b2 )). Hints Resolve andb true intro2 : bool v62 . Lemma andb false intro1

: (b1 , b2 : bool)(b1 = false) → (andb b1 b2 ) = false. Lemma andb false intro2

: (b1 , b2 : bool)(b2 = false) → (andb b1 b2 ) = false. Lemma andb b false : (b : bool)(andb b false) = false. Lemma andb false b : (b : bool)(andb false b) = false. Lemma andb b true : (b : bool)(andb b true) = b. Lemma andb true b : (b : bool)(andb true b) = b. Lemma andb false elim :

(b1 , b2 : bool)(andb b1 b2 ) = false → {b1 = false} + {b2 = false}. Hints Resolve andb false elim : bool v62 . Lemma andb neg b :

(b : bool)(andb b (negb b)) = false. Hints Resolve andb neg b : bool v62 . Lemma andb sym : (b1 , b2 : bool)(andb b1 b2 ) = (andb b2 b1 ). Lemma andb assoc : (b1 , b2 , b3 : bool)(andb b1 (andb b2 b3 )) = (andb (andb b1 b2 ) b3 ). Hints Resolve andb sym andb assoc : bool v62 .

Properties of xorb Lemma xorb false : (b : bool) (xorb b false) = b. Lemma false xorb : (b : bool) (xorb false b) = b.

Lemma xorb true : (b : bool) (xorb b true) = (negb b). Lemma true xorb : (b : bool) (xorb true b) = (negb b). Lemma xorb nilpotent : (b : bool) (xorb b b) = false. Lemma xorb comm : (b, b′ : bool) (xorb b b′) = (xorb b′ b). Lemma xorb assoc : (b, b′, b′′ : bool) (xorb (xorb b b′) b′′) = (xorb b (xorb b′ b′′)). Lemma xorb eq : (b, b′ : bool) (xorb b b′) = false → b = b′. Lemma xorb move l r 1 : (b, b′, b′′ : bool) (xorb b b′) = b′′ → b′ = (xorb b b′′). Lemma xorb move l r 2 : (b, b′, b′′ : bool) (xorb b b′) = b′′ → b = (xorb b′′ b′). Lemma xorb move r l 1 : (b, b′, b′′ : bool) b = (xorb b′ b′′) → (xorb b′ b) = b′′. Lemma xorb move r l 2 : (b, b′, b′′ : bool) b = (xorb b′ b′′) → (xorb b b′′) = b′.

De Morgan’s law Lemma demorgan1 : (b1 , b2 , b3 : bool)

(andb b1 (orb b2 b3 )) = (orb (andb b1 b2 ) (andb b1 b3 )). Lemma demorgan2 : (b1 , b2 , b3 : bool)

(andb (orb b1 b2 ) b3 ) = (orb (andb b1 b3 ) (andb b2 b3 )). Lemma demorgan3 : (b1 , b2 , b3 : bool)

(orb b1 (andb b2 b3 )) = (andb (orb b1 b2 ) (orb b1 b3 )). Lemma demorgan4 : (b1 , b2 , b3 : bool)

(orb (andb b1 b2 ) b3 ) = (andb (orb b1 b3 ) (orb b2 b3 )). Lemma absoption andb : (b1 , b2 : bool)

(andb b1 (orb b1 b2 )) = b1 . Lemma absoption orb : (b1 , b2 : bool)

(orb b1 (andb b1 b2 )) = b1 .

Module Sumbool

Id : Sumbool.v, v1.22001/03/1513 : 38 : 49filliatrExp Here are collected some results about the type sumbool (see INIT/Specif.v)

(sumbool A B), which is written A+B, is the informative disjunction "A or B", where A and B are logical propositions. Its extraction is isomorphic to the type of booleans. A boolean is either true or false, and this is decidable Lemma sumbool of bool : (b : bool) {b = true} + {b = false}. Hints Resolve sumbool of bool : bool. pourquoi ce machin-la est dans BOOL et pas dans LOGIC ? Papageno Logic connectives on type sumbool Section connectives. Variables A, B, C , D : Prop. Hypothesis H1 : {A} + {B}.

\underline{3 ARITH 15}

Hypothesis H2 : {C } + {D}. Lemma sumbool and : {A ∧ C } + {B ∨ D}. Lemma sumbool or : {A ∨ C } + {B ∧ D}. Lemma sumbool not : {B} + {A}. End connectives. Hints Resolve sumbool and sumbool or sumbool not : core.

3 Arith

The Arith library deals with various arithmetical notions and their properties.

Standard Arith library

The following files are automatically loaded by Require Arith.

• Le.v states and proves properties of the large order le.

• Lt.v states and proves properties of the strict order lt (especially, the relationship with le).

• Plus.v states and proves properties on the addition.

• Gt.v states and proves properties on the strict order gt.

• Minus.v defines the difference on nat and proves properties of it. On nat, (minus n p) is O if n < p.

• Mult.v states and proves properties on the multiplication.

• Between.v defines modalities on nat and proves properties of them.

Additional Arith library

• Compare.v, Compare dec.v and Peano dec.v state and prove various decidability results on

  nat.

• Wf nat.v states and proves various induction and recursion principles on nat. Especially, recursion for objects measurable by a natural number and recursion on nat * nat are provided.

• Min.v defines the minimum of two natural numbers and proves properties of it.

• Eqnat.v defines a specific equality on nat and shows the equivalence with Leibniz’ equality.

• Euclid def.v and Euclid prog.v prove that the euclidean division specification is realisable. Conversely, Div.v exhibits two different algorithms and semi-automatically reconstruct the proof of their correctness. These files emphasize the extraction of program vs reconstruction of proofs paradigm.

Module Le

Id : Le.v, v1.22001/03/1513 : 38 : 48filliatrExp Order on natural numbers

Theorem le n S : (n, m : nat)(le n m) → (le (S n) (S m)).

Theorem le trans : (n, m, p : nat)(le n m) → (le m p) → (le n p).

Theorem le n Sn : (n : nat)(le n (S n)).

Theorem le O n : (n : nat)(le O n).

Hints Resolve le n S le n Sn le O n le n S le trans : arith v62 .

Theorem le pred n : (n : nat)(le (pred n) n). Hints Resolve le pred n : arith v62 .

Theorem le trans S : (n, m : nat)(le (S n) m) → (le n m). Hints Theorem le S n : (n, m : nat)(le (S n) (S m)) → (le n m). Hints (∗ Negative properties ∗)

Theorem le Sn O : (n : nat)¬(le (S n) O). Hints Resolve le Sn O : arith v62 .

Theorem le Sn n : (n : nat)¬(le (S n) n). Hints Resolve le Sn n : arith v62 .

Theorem le antisym : (n, m : nat)(le n m) → (le m n) → (n = m). Hints Theorem le n O eq : (n : nat)(le n O) → (O = n). Hints (∗ A different elimination principle for the order on natural numbers ∗)

Lemma le elim rel : (P : nat → nat → Prop)

((p : nat)(P O p)) →

((p, q : nat)(le p q) → (P p q) → (P (S p) (S q))) → (n, m : nat)(le n m) → (P n m).

Module Lt

Id : Lt.v, v1.22001/03/1513 : 38 : 48filliatrExp

Require Le.

Theorem lt n Sn : (n : nat)(lt n (S n)). Hints Resolve lt n Sn : arith v62 .

Theorem lt S : (n, m : nat)(lt n m) → (lt n (S m)). Hints Resolve lt S : arith v62 .

Theorem lt n S : (n, m : nat)(lt n m) → (lt (S n) (S m)). Hints Resolve lt n S : arith v62 .

Theorem lt S n : (n, m : nat)(lt (S n) (S m)) → (lt n m). Hints Theorem lt O Sn : (n : nat)(lt O (S n)). Hints Resolve lt O Sn : arith v62 .

Theorem lt n O : (n : nat)¬(lt n O). Hints Resolve lt n O : arith v62 .

Theorem lt n n : (n : nat)¬(lt n n). Hints Resolve lt n n : arith v62 .

Lemma S pred : (n, m : nat)(lt m n) → (n = (S (pred n))).

Lemma lt pred : (n, p : nat)(lt (S n) p) → (lt n (pred p)). Hints Lemma lt pred n n : (n : nat)(lt O n) → (lt (pred n) n). Hints Resolve lt pred n n : arith v62 .

Relationship between le and lt

Theorem lt le S : (n, p : nat)(lt n p) → (le (S n) p). Hints Theorem lt n Sm le : (n, m : nat)(lt n (S m)) → (le n m). Hints Theorem le lt n Sm : (n, m : nat)(le n m) → (lt n (S m)). Hints Theorem lt le weak : (n, m : nat)(lt n m) → (le n m). Hints Theorem neq O lt : (n : nat)(¬O = n) → (lt O n). Hints Theorem lt O neq : (n : nat)(lt O n) → (¬O = n). Hints (∗ Transitivity properties ∗)

Theorem lt trans : (n, m, p : nat)(lt n m) → (lt m p) → (lt n p).

Theorem lt le trans : (n, m, p : nat)(lt n m) → (le m p) → (lt n p).

Theorem le lt trans : (n, m, p : nat)(le n m) → (lt m p) → (lt n p).

Hints Resolve lt trans lt le trans le lt trans : arith v62 .

Theorem le lt or eq : (n, m : nat)(le n m) → ((lt n m) ∨ n = m).

Theorem le or lt : (n, m : nat)((le n m) ∨ (lt m n)).

Theorem le not lt : (n, m : nat)(le n m) → ¬(lt m n).

Theorem lt not le : (n, m : nat)(lt n m) → ¬(le m n). Hints Theorem lt not sym : (n, m : nat)(lt n m) → ¬(lt m n).

Theorem nat total order : (m, n : nat) ¬ m = n → (lt m n) ∨ (lt n m).

Module Plus

Id : P lus.v, v1.32001/04/0817 : 18 : 08mohringExp Properties of addition Require Le. Require Lt. Lemma plus sym : (n, m : nat)(plus n m) = (plus m n). Hints Lemma plus Snm nSm :

(n, m : nat)(plus (S n) m) = (plus n (S m)). Lemma simpl plus l : (n, m, p : nat)((plus n m) = (plus n p)) → (m = p). Lemma plus assoc l : (n, m, p : nat)((plus n (plus m p)) = (plus (plus n m) p)). Hints Resolve plus assoc l : arith v62 . Lemma plus permute : (n, m, p : nat) ((plus n (plus m p)) = (plus m (plus n p))). Lemma plus assoc r : (n, m, p : nat)((plus (plus n m) p) = (plus n (plus m p))). Hints Resolve plus assoc r : arith v62 . Lemma simpl le plus l : (p, n, m : nat)(le (plus p n) (plus p m)) → (le n m). Lemma le reg l : (n, m, p : nat)(le n m) → (le (plus p n) (plus p m)). Hints Resolve le reg l : arith v62 . Lemma le reg r : (a, b, c : nat) (le a b) → (le (plus a c) (plus b c)). Hints Resolve le reg r : arith v62 . Lemma le plus plus :

(n, m, p, q : nat) (le n m) → (le p q) → (le (plus n p) (plus m q)). Lemma le plus l : (n, m : nat)(le n (plus n m)). Hints Resolve le plus l : arith v62 . Lemma le plus r : (n, m : nat)(le m (plus n m)). Hints Resolve le plus r : arith v62 . Theorem le plus trans : (n, m, p : nat)(le n m) → (le n (plus m p)). Hints Resolve le plus trans : arith v62 . Lemma simpl lt plus l : (n, m, p : nat)(lt (plus p n) (plus p m)) → (lt n m). Lemma lt reg l : (n, m, p : nat)(lt n m) → (lt (plus p n) (plus p m)). Hints Resolve lt reg l : arith v62 . Lemma lt reg r : (n, m, p : nat)(lt n m) → (lt (plus n p) (plus m p)). Hints Resolve lt reg r : arith v62 . Theorem lt plus trans : (n, m, p : nat)(lt n m) → (lt n (plus m p)). Hints Lemma le lt plus plus : (n, m, p, q : nat) (le n m) → (lt p q) → (lt (plus n p) (plus m q)). Lemma lt le plus plus : (n, m, p, q : nat) (lt n m) → (le p q) → (lt (plus n p) (plus m q)). Lemma lt plus plus : (n, m, p, q : nat) (lt n m) → (lt p q) → (lt (plus n p) (plus m q)).

Lemma plus is O : (m, n : nat) (plus m n) = O → m = O ∧ n = O.

Lemma plus is one : (m, n : nat) (plus m n) = (S O) → {m = O ∧ n = (S O)} + {m = (S O) ∧ n = O}.

Lemma plus permute 2 in 4 : (a, b, c, d : nat)

(plus (plus a b) (plus c d)) = (plus (plus a c) (plus b d)).

Module Gt

Id : Gt.v, v1.22001/03/1513 : 38 : 48filliatrExp

Require Le. Require Lt. Require Plus.

Theorem gt Sn O : (n : nat)(gt (S n) O). Hints Resolve gt Sn O : arith v62 .

Theorem gt Sn n : (n : nat)(gt (S n) n). Hints Resolve gt Sn n : arith v62 .

Theorem le S gt : (n, m : nat)(le (S n) m) → (gt m n). Hints Theorem gt n S : (n, m : nat)(gt n m) → (gt (S n) (S m)). Hints Resolve gt n S : arith v62 .

Theorem gt trans S : (n, m, p : nat)(gt (S n) m) → (gt m p) → (gt n p).

Theorem le gt trans : (n, m, p : nat)(le m n) → (gt m p) → (gt n p).

Theorem gt le trans : (n, m, p : nat)(gt n m) → (le p m) → (gt n p).

Hints Resolve gt trans S le gt trans gt le trans : arith v62 .

Lemma le not gt : (n, m : nat)(le n m) → ¬(gt n m). Hints Resolve le not gt : arith v62 .

Lemma gt antirefl : (n : nat)¬(gt n n). Hints Resolve gt antirefl : arith v62 .

Lemma gt not sym : (n, m : nat)(gt n m) → ¬(gt m n).

Lemma gt not le : (n, m : nat)(gt n m) → ¬(le n m). Hints Resolve gt not sym gt not le : arith v62 .

Lemma gt trans : (n, m, p : nat)(gt n m) → (gt m p) → (gt n p).

Lemma gt S n : (n, p : nat)(gt (S p) (S n)) → (gt p n). Hints Lemma gt S le : (n, p : nat)(gt (S p) n) → (le n p). Hints Lemma gt le S : (n, p : nat)(gt p n) → (le (S n) p). Hints Resolve gt le S : arith v62 .

Lemma le gt S : (n, p : nat)(le n p) → (gt (S p) n). Hints Resolve le gt S : arith v62 .

Lemma gt pred : (n, p : nat)(gt p (S n)) → (gt (pred p) n). Hints Theorem gt S : (n, m : nat)(gt (S n) m) → ((gt n m) ∨ (< nat > m = n)).

Theorem gt O eq : (n : nat)((gt n O) ∨ (< nat > O = n)).

Lemma simpl gt plus l : (n, m, p : nat)(gt (plus p n) (plus p m)) → (gt n m).

Lemma gt reg l : (n, m, p : nat)(gt n m) → (gt (plus p n) (plus p m)). Hints Resolve gt reg l : arith v62 .

Module Minus

Id : Minus.v, v1.32001/04/0817 : 18 : 08mohringExp Subtraction (difference between two natural numbers

Require Lt. Require Le.

Fixpoint minus [n : nat] : nat → nat :=

[m : nat]Cases n m of

O ⇒ O | (S k) O ⇒ (S k) | (S k) (S l) ⇒ (minus k l) end.

Lemma minus plus simpl :

(n, m, p : nat)((minus n m) = (minus (plus p n) (plus p m))). Hints Resolve minus plus simpl : arith v62 .

Lemma minus n O : (n : nat)(n = (minus n O)). Hints Resolve minus n O : arith v62 .

Lemma minus n n : (n : nat)(O = (minus n n)). Hints Resolve minus n n : arith v62 .

Lemma plus minus : (n, m, p : nat)(n = (plus m p)) → (p = (minus n m)). Hints Lemma minus plus : (n, m : nat)(minus (plus n m) n) = m. Hints Resolve minus plus : arith v62 .

Lemma le plus minus : (n, m : nat)(le n m) → (m = (plus n (minus m n))). Hints Resolve le plus minus : arith v62 .

Lemma le plus minus r : (n, m : nat)(le n m) → (plus n (minus m n)) = m. Hints Resolve le plus minus r : arith v62 .

Lemma minus Sn m : (n, m : nat)(le m n) → ((S (minus n m)) = (minus (S n) m)). Hints Resolve minus Sn m : arith v62 .

Lemma lt minus : (n, m : nat)(le m n) → (lt O m) → (lt (minus n m) n). Hints Resolve lt minus : arith v62 .

Lemma lt O minus lt : (n, m : nat)(lt O (minus n m)) → (lt m n). Hints Theorem pred of minus : (x : nat)(pred x) = (minus x (S O)). Theorem inj minus aux : (x, y : nat) ¬(le y x) → (minus x y) = O.

Module Mult

Id : Mult.v, v1.32001/04/0817 : 18 : 08mohringExp Require Export Plus. Require Export Minus. Require Export Lt. Multiplication Lemma mult plus distr :

(n, m, p : nat)((mult (plus n m) p) = (plus (mult n p) (mult m p))). Hints Resolve mult plus distr : arith v62 . Lemma mult plus distr r : (n, m, p : nat) (mult n (plus m p)) = (plus (mult n m) (mult n p)). Lemma mult minus distr : (n, m, p : nat)((mult (minus n m) p) = (minus (mult n p) (mult m p))). Hints Resolve mult minus distr : arith v62 . Lemma mult O le : (n, m : nat)(m = O) ∨ (le n (mult m n)). Hints Resolve mult O le : arith v62 . Lemma mult assoc r : (n, m, p : nat)((mult (mult n m) p) = (mult n (mult m p))). Hints Resolve mult assoc r : arith v62 . Lemma mult assoc l : (n, m, p : nat)(mult n (mult m p)) = (mult (mult n m) p). Hints Resolve mult assoc l : arith v62 . Lemma mult 1 n : (n : nat)(mult (S O) n) = n. Hints Resolve mult 1 n : arith v62 . Lemma mult sym : (n, m : nat)(mult n m) = (mult m n). Hints Resolve mult sym : arith v62 . Lemma mult n 1 : (n : nat)(mult n (S O)) = n. Hints Resolve mult n 1 : arith v62 . Lemma mult le : (m, n, p : nat) (le n p) → (le (mult m n) (mult m p)). Hints Resolve mult le : arith. Lemma mult lt : (m, n, p : nat) (lt n p) → (lt (mult (S m) n) (mult (S m) p)). Hints Resolve mult lt : arith. Lemma mult le conv 1 : (m, n, p : nat) (le (mult (S m) n) (mult (S m) p)) → (le n p).

Module Between

Id : Between.v, v1.22001/03/1513 : 38 : 47filliatrExp Require Le. Require Lt.

Section Between. Variables P, Q : nat → Prop.

Inductive between [k : nat] : nat → Prop := bet emp : (between k k) | bet S : (l : nat)(between k l) → (P l) → (between k (S l)).

Lemma bet eq : (k, l : nat)(l = k) → (between k l).

Hints Resolve bet eq : arith v62 .

Lemma between le : (k, l : nat)(between k l) → (le k l). Hints Lemma between Sk l : (k, l : nat)(between k l) → (le (S k) l) → (between (S k) l). Hints Resolve between Sk l : arith v62 .

Lemma between restr :

(k, l, m : nat)(le k l) → (le l m) → (between k m) → (between l m).

Inductive exists [k : nat] : nat → Prop := exists S : (l : nat)(exists k l) → (exists k (S l)) | exists le : (l : nat)(le k l) → (Q l) → (exists k (S l)).

Lemma exists le S : (k, l : nat)(exists k l) → (le (S k) l).

Lemma exists lt : (k, l : nat)(exists k l) → (lt k l). Hints Lemma exists S le : (k, l : nat)(exists k (S l)) → (le k l). Hints Definition in int := [p, q, r : nat](le p r) ∧ (lt r q).

Lemma in int intro : (p, q, r : nat)(le p r) → (lt r q) → (in int p q r). Hints Resolve in int intro : arith v62 .

Lemma in int lt : (p, q, r : nat)(in int p q r) → (lt p q).

Lemma in int p Sq :

(p, q, r : nat)(in int p (S q) r) → ((in int p q r) ∨ < nat > r = q).

Lemma in int S : (p, q, r : nat)(in int p q r) → (in int p (S q) r). Hints Resolve in int S : arith v62 .

Lemma in int Sp q : (p, q, r : nat)(in int (S p) q r) → (in int p q r). Hints Lemma between in int : (k, l : nat)(between k l) → (r : nat)(in int k l r) → (P r).

Lemma in int between :

(k, l : nat)(le k l) → ((r : nat)(in int k l r) → (P r)) → (between k l).

Lemma exists in int :

(k, l : nat)(exists k l) → (EX m : nat | (in int k l m) & (Q m)).

Lemma in int exists : (k, l, r : nat)(in int k l r) → (Q r) → (exists k l).

Lemma between or exists :

(k, l : nat)(le k l) → ((n : nat)(in int k l n) → ((P n) ∨ (Q n))) → ((between k l) ∨ (exists k l)).

Lemma between not exists : (k, l : nat)(between k l) → ((n : nat)(in int k l n) → (P n) → ¬(Q n)) → ¬(exists k l).

Inductive nth [init : nat] : nat → nat → Prop := nth O : (nth init init O) | nth S : (k, l : nat)(n : nat)(nth init k n) → (between (S k) l)

→ (Q l) → (nth init l (S n)).

Lemma nth le : (init, l, n : nat)(nth init l n) → (le init l).

Definition eventually := [n : nat](EX k : nat | (le k n) & (Q k)).

Lemma event O : (eventually O) → (Q O).

End Between.

Hints Resolve nth O bet S bet emp bet eq between Sk l exists S exists le in int S in int intro : arith v62 . Hints

Module Peano dec

Require Decidable. (∗ Id : P eano_{d}ec.v, v1.32001/04/0817 : 18 : 08mohringExp ∗)

Theorem O or S : (n : nat)({m : nat|(S m) = n}) + {O = n}.

Theorem eq nat dec : (n, m : nat){n = m} + {¬(n = m)}.

Hints Resolve O or S eq nat dec : arith.

Theorem dec eq nat : (x, y : nat)(decidable (x = y)).

Module Arith

Id : Arith.v, v1.52001/03/1513 : 38 : 46filliatrExp

Require Export Le. Require Export Lt. Require Export Plus. Require Export Gt. Require Export Minus. Require Export Mult. Require Export Between. Require Export Minus.

Axiom My special variable : nat → nat.

Grammar nat number := .

Grammar constr constr10 := natural nat [ nat : number($c) ] → [$c].

Grammar constr pattern := natural pat [ nat : pat number($c) ] → [$c].

Module Wf nat

Id : W f_{n}at.v, v1.32001/04/1112 : 41 : 38filliatrExp Well-founded relations and natural numbers Require Lt. Chapter Well founded Nat. Variable A : Set. Variable f : A → nat. Definition ltof := [a, b : A](lt (f a) (f b)). Definition gtof := [a, b : A](gt (f b) (f a)). Theorem well founded ltof : (well founded A ltof ). Theorem well founded gtof : (well founded A gtof ). It is possible to directly prove the induction principle going back to primitive recursion on natural numbers (induction ltof1 ) or to use the previous lemmas to extract a program with a fixpoint (induction ltof2 ) the ML-like program for induction ltof1 is :

   let induction_ltof1 F a = indrec ((f a)+1) a
   where rec indrec =
        function 0    -> (function a -> error)
               |(S m) -> (function a -> (F a (function y -> indrec y m)));;

the ML-like program for induction ltof2 is :

   let induction_ltof2 F a = indrec a
   where rec indrec a = F a indrec;;

Theorem induction ltof1 : (P : A → Set)((x : A)((y : A)(ltof y x) → (P y)) → (P x)) → (a : A)(P a). Theorem induction gtof1 : (P : A → Set)((x : A)((y : A)(gtof y x) → (P y)) → (P x)) → (a : A)(P a). Theorem induction ltof2

: (P : A → Set)((x : A)((y : A)(ltof y x) → (P y)) → (P x)) → (a : A)(P a). Theorem induction gtof2 : (P : A → Set)((x : A)((y : A)(gtof y x) → (P y)) → (P x)) → (a : A)(P a). If a relation R is compatible with lt i.e. if x R y => f(x) < f(y) then R is well-founded. Variable R : A → A → Prop. Hypothesis H compat : (x, y : A) (R x y) → (lt (f x) (f y)). Theorem well founded lt compat : (well founded A R). End Well founded Nat. Lemma lt wf : (well founded nat lt). Lemma lt wf rec1 : (p : nat)(P : nat → Set)

((n : nat)((m : nat)(lt m n) → (P m)) → (P n)) → (P p).

Lemma lt wf rec : (p : nat)(P : nat → Set)

((n : nat)((m : nat)(lt m n) → (P m)) → (P n)) → (P p).

Lemma lt wf ind : (p : nat)(P : nat → Prop)

((n : nat)((m : nat)(lt m n) → (P m)) → (P n)) → (P p).

Lemma gt wf rec : (p : nat)(P : nat → Set)

((n : nat)((m : nat)(gt n m) → (P m)) → (P n)) → (P p).

Lemma gt wf ind : (p : nat)(P : nat → Prop)

((n : nat)((m : nat)(gt n m) → (P m)) → (P n)) → (P p).

Lemma lt wf double rec :

(P : nat → nat → Set)

((n, m : nat)((p, q : nat)(lt p n) → (P p q)) → ((p : nat)(lt p m) → (P n p)) → (P n m))

→ (p, q : nat)(P p q). Lemma lt wf double ind :

(P : nat → nat → Prop)

((n, m : nat)((p, q : nat)(lt p n) → (P p q)) → ((p : nat)(lt p m) → (P n p)) → (P n m))

→ (p, q : nat)(P p q). Hints Resolve lt wf : arith. Hints Resolve well founded lt compat : arith.

Module Compare dec

Id : Compare_{d}ec.v, v1.32001/04/0817 : 18 : 08mohringExp Require Le. Require Lt. Require Gt. Require Decidable. Theorem zerop : (n : nat){n = O} + {lt O n}. Theorem lt eq lt dec : (n, m : nat){(lt n m)} + {n = m} + {(lt m n)}. Lemma gt eq gt dec : (n, m : nat)({(gt m n)} + {n = m}) + {(gt n m)}. Lemma le lt dec : (n, m : nat) {le n m} + {lt m n}. Lemma le le S dec : (n, m : nat) {le n m} + {le (S m) n}. Lemma le ge dec : (n, m : nat) {le n m} + {ge n m}. Theorem le gt dec : (n, m : nat){(le n m)} + {(gt n m)}. Theorem le lt eq dec : (n, m : nat)(le n m) → ({(lt n m)} + {n = m}). Proofs of decidability Theorem dec le : (x, y : nat)(decidable (le x y)). Theorem dec lt : (x, y : nat)(decidable (lt x y)).

Theorem dec gt : (x, y : nat)(decidable (gt x y)). Theorem dec ge : (x, y : nat)(decidable (ge x y)). Theorem not eq : (x, y : nat) ¬ x = y → (lt x y) ∨ (lt y x). Theorem not le : (x, y : nat) ¬(le x y) → (gt x y). Theorem not gt : (x, y : nat) ¬(gt x y) → (le x y). Theorem not ge : (x, y : nat) ¬(ge x y) → (lt x y). Theorem not lt : (x, y : nat) ¬(lt x y) → (ge x y).

Module Min

Id : Min.v, v1.22001/03/1513 : 38 : 48filliatrExp Require Arith. minimum of two natural numbers Fixpoint min [n : nat] : nat → nat := [m : nat]Cases n m of

O ⇒ O | (S n′) O ⇒ O | (S n′) (S m′) ⇒ (S (min n′ m′)) end.

Lemma min SS : (n, m : nat)((S (min n m)) = (min (S n) (S m))). Lemma le min l : (n, m : nat)(le (min n m) n). Hints Resolve le min l : arith v62 . Lemma le min r : (n, m : nat)(le (min n m) m). Hints Resolve le min r : arith v62 . min n m is equal to n or m Lemma min case : (n, m : nat)(P : nat → Set)(P n) → (P m) → (P (min n m)).

Module Even

Id : Even.v, v1.42001/03/1513 : 38 : 48filliatrExp Here we define the predicates even and odd by mutual induction and we prove the decidability and the exclusion of those predicates. * The main results about parity are proved in the module Div2. Inductive even : nat → Prop :=

even O : (even O) | even S : (n : nat)(odd n) → (even (S n))

with odd : nat → Prop :=

odd S : (n : nat)(even n) → (odd (S n)). Lemma even or odd : (n : nat) (even n) ∨ (odd n). Lemma even odd dec : (n : nat) { (even n) } + { (odd n) }. Lemma not even and odd : (n : nat) (even n) → (odd n) → False.

Module Compare

Id : Compare.v, v1.32001/03/1513 : 38 : 47filliatrExp equality is decidable on nat Lemma not eq sym : (A :Set)(p, q : A)(¬p = q) → ¬(q = p). Hints Require Arith. Require Peano dec. Require Compare dec. Definition le or le S := le le S dec. Definition compare := gt eq gt dec. Lemma le dec : (n, m : nat) {le n m} + {le m n}. Definition lt or eq := [n, m : nat]{(gt m n)} + {n = m}. Lemma le decide : (n, m : nat)(le n m) → (lt or eq n m). Lemma le le S eq : (p, q : nat)(le p q) → ((le (S p) q) ∨ (p = q)). By special request of G. Kahn - Used in Group Theory Lemma discrete nat : (m, n : nat) (lt m n) →

(S m) = n ∨ (EX r : nat | n = (S (S (plus m r)))). Require Export Wf nat. Require Export Min.

Module Euclid def

Id : Euclid_{d}ef.v, v1.22001/03/1513 : 38 : 48filliatrExp Require Export Mult. Inductive diveucl [a, b : nat] : Set

:= divex : (q, r : nat)(gt b r) → (a = (plus (mult q b) r)) → (diveucl a b).

Module EqNat

Id : EqNat.v, v1.52001/03/1513 : 38 : 48filliatrExp Equality on natural numbers Fixpoint eq nat [n : nat] : nat → Prop :=

[m : nat]Cases n m of

O O ⇒ True | O (S ) ⇒ False | (S ) O ⇒ False | (S n1 ) (S m1 ) ⇒ (eq nat n1 m1 )

end.

Theorem eq nat refl : (n : nat)(eq nat n n).

Hints Resolve eq nat refl : arith v62 .

Theorem eq eq nat : (n, m : nat)(n = m) → (eq nat n m). Hints Theorem eq nat eq : (n, m : nat)(eq nat n m) → (n = m). Hints Theorem eq nat elim : (n : nat)(P : nat → Prop)(P n) → (m : nat)(eq nat n m) → (P m).

Theorem eq nat decide : (n, m : nat){(eq nat n m)} + {¬(eq nat n m)}.

Fixpoint beq nat [n : nat] : nat → bool :=

[m : nat]Cases n m of

O O ⇒ true | O (S ) ⇒ false | (S ) O ⇒ false | (S n1 ) (S m1 ) ⇒ (beq nat n1 m1 )

end.

Lemma beq nat refl : (x : nat)true = (beq nat x x).

Definition beq nat eq : (x, y : nat)true = (beq nat x y) → x = y.

Module Div2

Id : Div2.v, v1.72001/03/1513 : 38 : 47filliatrExp

Require Lt. Require Plus. Require Compare dec. Require Even.

Here we define n/2 and prove some of its properties

Fixpoint div2 [n : nat] : nat :=

Cases n of

O ⇒ O | (S O) ⇒ O | (S (S n′)) ⇒ (S (div2 n′)) end.

Since div2 is recursively defined on 0, 1 and (S (S n)), it is useful to prove the corresponding induction principle

Lemma ind 0 1 SS : (P : nat → Prop)

(P O) → (P (S O)) → ((n : nat)(P n) → (P (S (S n)))) → (n : nat)(P n).

0 <n => n/2 < n

Lemma lt div2 : (n : nat) (lt O n) → (lt (div2 n) n).

Hints Resolve lt div2 : arith.

Properties related to the parity

Lemma even odd div2 : (n : nat)

((even n) ↔ (div2 n) = (div2 (S n))) ∧ ((odd n) ↔ (S (div2 n)) = (div2 (S n))).

Specializations Lemma even div2 : (n : nat) (even n) → (div2 n) = (div2 (S n)). Lemma div2 even : (n : nat) (div2 n) = (div2 (S n)) → (even n). Lemma odd div2 : (n : nat) (odd n) → (S (div2 n)) = (div2 (S n)). Lemma div2 odd : (n : nat) (S (div2 n)) = (div2 (S n)) → (odd n). Hints Resolve even div2 div2 even odd div2 div2 odd : arith. Properties related to the double (2n) Definition double := [n : nat](plus n n). Hints Unfold double : arith. Lemma double S : (n : nat) (double (S n)) = (S (S (double n))). Hints Resolve double S : arith. Lemma even odd double : (n : nat)

((even n) ↔ n = (double (div2 n))) ∧ ((odd n) ↔ n = (S (double (div2 n)))). Specializations Lemma even double : (n : nat) (even n) → n = (double (div2 n)). Lemma double even : (n : nat) n = (double (div2 n)) → (even n). Lemma odd double : (n : nat) (odd n) → n = (S (double (div2 n))). Lemma double odd : (n : nat) n = (S (double (div2 n))) → (odd n). Hints Resolve even double double even odd double double odd : arith. Application: if n is even then there is a p such that n = 2p if n is odd then there is a p such that n = 2p+1 * (Immediate: it is n/2) Lemma even 2n : (n : nat) (even n) → { p : nat | n = (double p) }. Lemma odd S2n : (n : nat) (odd n) → { p : nat | n = (S (double p)) }.

Module Euclid proof

Id : Euclid_{p}roof.v, v1.52001/03/1513 : 38 : 48filliatrExp Require Minus. Require Euclid def . Require Compare dec. Require Wf nat. Lemma eucl dev : (b : nat)(gt b O) → (a : nat)(diveucl a b). Lemma quotient : (b : nat)(gt b O) →

(a : nat){q : nat|(EX r : nat | (a = (plus (mult q b) r)) ∧ (gt b r))}. Lemma modulo : (b : nat)(gt b O) →

(a : nat){r : nat|(EX q : nat | (a = (plus (mult q b) r)) ∧ (gt b r))}. The ZArith library deals with binary integers (those used by the Omega decision tactic). Here

are defined various arithmetical notions and their properties, similar to those of Arith.

Module Fast integer

Binary Integers Pierre Crégut (CNET, Lannion, France)

Require Le. Require Lt. Require Plus. Require Mult. Require Minus.

Definition of fast binary integers

Section fast integers.

Inductive positive : Set :=

xI : positive → positive | xO : positive → positive | xH : positive.

Inductive Z : Set := ZERO : Z | POS : positive → Z | NEG : positive → Z .

Inductive relation : Set := EGAL : relation | INFERIEUR : relation | SUPERIEUR : relation. Addition

Fixpoint add un [x : positive] : positive :=

<positive > Cases x of

(xI x′) ⇒ (xO (add un x′)) | (xO x′) ⇒ (xI x′) | xH ⇒ (xO xH ) end.

Fixpoint add [x, y : positive] : positive :=

<positive >Cases x of

(xI x′) ⇒ < positive >Cases y of

(xI y′) ⇒ (xO (add carry x′ y′)) | (xO y′) ⇒ (xI (add x′ y′)) | xH ⇒ (xO (add un x′)) end

| (xO x′) ⇒ < positive >Cases y of

(xI y′) ⇒ (xI (add x′ y′)) | (xO y′) ⇒ (xO (add x′ y′)) | xH ⇒ (xI x′) end

| xH ⇒ < positive >Cases y of

(xI y′) ⇒ (xO (add un y′)) | (xO y′) ⇒ (xI y′) | xH ⇒ (xO xH ) end

end with add carry [x, y : positive] : positive := <positive >Cases x of

(xI x′) ⇒ < positive >Cases y of

(xI y′) ⇒ (xI (add carry x′ y′)) | (xO y′) ⇒ (xO (add carry x′ y′)) | xH ⇒ (xI (add un x′)) end

| (xO x′) ⇒ < positive >Cases y of

(xI y′) ⇒ (xO (add carry x′ y′)) | (xO y′) ⇒ (xI (add x′ y′)) | xH ⇒ (xO (add un x′)) end

| xH ⇒ < positive >Cases y of

(xI y′) ⇒ (xI (add un y′)) | (xO y′) ⇒ (xO (add un y′)) | xH ⇒ (xI xH ) end

end.

From positive to natural numbers

Fixpoint positive to nat [x : positive] : nat → nat :=

[pow2 : nat] <nat > Cases x of (xI x′) ⇒ (plus pow2 (positive to nat x′ (plus pow2 pow2 )))

| (xO x′) ⇒ (positive to nat x′ (plus pow2 pow2 ))

| xH ⇒ pow2

end.

Definition convert := [x : positive] (positive to nat x (S O)).

From natural numbers to positive

Fixpoint anti convert [n : nat] : positive :=

<positive > Cases n of

O ⇒ xH | (S x′) ⇒ (add un (anti convert x′)) end.

Correctness of addition

Lemma convert add un :

(x : positive)(m : nat)

(positive to nat (add un x) m) = (plus m (positive to nat x m)).

Theorem convert add carry :

(x, y : positive)(m : nat)

(positive to nat (add carry x y) m) = (plus m (positive to nat (add x y) m)).

Theorem cvt carry :

(x, y : positive)(convert (add carry x y)) = (S (convert (add x y))).

Theorem add verif :

(x, y : positive)(m : nat)

(positive to nat (add x y) m) =

(plus (positive to nat x m) (positive to nat y m)).

Theorem convert add :

(x, y : positive) (convert (add x y)) = (plus (convert x) (convert y)).

Correctness of conversion

Theorem bij1 : (m : nat) (convert (anti convert m)) = (S m).

Theorem compare positive to nat O :

(p : positive)(m : nat)(le m (positive to nat p m)).

Theorem compare convert O : (p : positive)(lt O (convert p)).

Hints Resolve compare convert O.

Subtraction

Fixpoint double moins un [x : positive] : positive :=

<positive >Cases x of

(xI x′) ⇒ (xI (xO x′)) | (xO x′) ⇒ (xI (double moins un x′)) | xH ⇒ xH end.

Definition sub un := [x : positive]

<positive > Cases x of

(xI x′) ⇒ (xO x′) | (xO x′) ⇒ (double moins un x′) | xH ⇒ xH end.

Lemma sub add one : (x : positive) (sub un (add un x)) = x.

Lemma is double moins un : (x : positive) (add un (double moins un x)) = (xO x).

Lemma add sub one : (x : positive) (x = xH ) ∨ (add un (sub un x)) = x.

Lemma ZL0 : (S (S O)) = (plus (S O) (S O)).

Lemma ZL1 : (y : positive)(xO (add un y)) = (add un (add un (xO y))).

Lemma ZL2 :

(y : positive)(m : nat)

(positive to nat y (plus m m)) = (plus (positive to nat y m) (positive to nat y m)).

Lemma ZL3 : (x : nat) (add un (anti convert (plus x x))) = (xO (anti convert x)).

Lemma ZL4 : (y : positive) (EX h : nat |(convert y) = (S h)).

Lemma ZL5 : (x : nat) (anti convert (plus (S x) (S x))) = (xI (anti convert x)).

Lemma bij2 : (x : positive) (anti convert (convert x)) = (add un x).

Comparison of positive

Fixpoint compare [x, y : positive] : relation → relation :=

[r : relation] < relation > Cases x of (xI x′) ⇒ < relation >Cases y of

(xI y′) ⇒ (compare x′ y′ r) | (xO y′) ⇒ (compare x′ y′ SUPERIEUR) | xH ⇒ SUPERIEUR end | (xO x′) ⇒ < relation >Cases y of

(xI y′) ⇒ (compare x′ y′ INFERIEUR) | (xO y′) ⇒ (compare x′ y′ r) | xH ⇒ SUPERIEUR end | xH ⇒ < relation >Cases y of

(xI y′) ⇒ INFERIEUR | (xO y′) ⇒ INFERIEUR | xH ⇒ r end

end.

Theorem compare convert1 : (x, y : positive) ¬(compare x y SUPERIEUR) = EGAL ∧ ¬(compare x y INFERIEUR) = EGAL.

Theorem compare convert EGAL : (x, y : positive) (compare x y EGAL) = EGAL → x = y.

Lemma ZL6 :

(p : positive) (positive to nat p (S(S O))) = (plus (convert p) (convert p)).

Lemma ZL7 :

(m, n : nat) (lt m n) → (lt (plus m m) (plus n n)).

Lemma ZL8 :

(m, n : nat) (lt m n) → (lt (S (plus m m)) (plus n n)).

Lemma ZLSI : (x, y : positive) (compare x y SUPERIEUR) = INFERIEUR →

(compare x y EGAL) = INFERIEUR.

Lemma ZLIS : (x, y : positive) (compare x y INFERIEUR) = SUPERIEUR →

(compare x y EGAL) = SUPERIEUR.

Lemma ZLII : (x, y : positive) (compare x y INFERIEUR) = INFERIEUR →

(compare x y EGAL) = INFERIEUR ∨ x = y.

Lemma ZLSS : (x, y : positive) (compare x y SUPERIEUR) = SUPERIEUR →

(compare x y EGAL) = SUPERIEUR ∨ x = y.

Theorem compare convert INFERIEUR :

(x, y : positive) (compare x y EGAL) = INFERIEUR → (lt (convert x) (convert y)).

Theorem compare convert SUPERIEUR :

(x, y : positive) (compare x y EGAL) = SUPERIEUR → (gt (convert x) (convert y)).

Lemma Dcompare : (r : relation) r = EGAL ∨ r = INFERIEUR ∨ r = SUPERIEUR.

Theorem convert compare INFERIEUR :

(x, y : positive)(lt (convert x) (convert y)) → (compare x y EGAL) = INFERIEUR.

Theorem convert compare SUPERIEUR :

(x, y : positive)(gt (convert x) (convert y)) → (compare x y EGAL) = SUPERIEUR.

Theorem convert compare EGAL : (x : positive)(compare x x EGAL) = EGAL.

Natural numbers coded with positive

Inductive entier : Set := Nul : entier | Pos : positive → entier.

Definition Un suivi de := [x : entier] < entier > Cases x of Nul ⇒ (Pos xH ) | (Pos p) ⇒ (Pos (xI p)) end.

Definition Zero suivi de := [x : entier] < entier > Cases x of Nul ⇒ Nul | (Pos p) ⇒ (Pos (xO p)) end.

Definition double moins deux :=

[x : positive] < entier >Cases x of

(xI x′) ⇒ (Pos (xO (xO x′))) | (xO x′) ⇒ (Pos (xO (double moins un x′))) | xH ⇒ Nul end.

Lemma ZS : (p : entier) (Zero suivi de p) = Nul → p = Nul.

Lemma US : (p : entier) ¬(Un suivi de p) = Nul.

Lemma USH : (p : entier) (Un suivi de p) = (Pos xH ) → p = Nul.

Lemma ZSH : (p : entier) ¬(Zero suivi de p) = (Pos xH ).

Fixpoint sub pos[x, y : positive] : entier :=

<entier >Cases x of

(xI x′) ⇒ < entier >Cases y of

(xI y′) ⇒ (Zero suivi de (sub pos x′ y′)) | (xO y′) ⇒ (Un suivi de (sub pos x′ y′)) | xH ⇒ (Pos (xO x′)) end

| (xO x′) ⇒ < entier >Cases y of

(xI y′) ⇒ (Un suivi de (sub neg x′ y′)) | (xO y′) ⇒ (Zero suivi de (sub pos x′ y′)) | xH ⇒ (Pos (double moins un x′)) end

| xH ⇒ < entier >Cases y of

(xI y′) ⇒ (Pos (double moins un y′)) | (xO y′) ⇒ (double moins deux y′) | xH ⇒ Nul end

end with sub neg [x, y : positive] : entier :=

<entier >Cases x of (xI x′) ⇒ < entier >Cases y of

(xI y′) ⇒ (Un suivi de (sub neg x′ y′)) | (xO y′) ⇒ (Zero suivi de (sub pos x′ y′)) | xH ⇒ (Pos (double moins un x′)) end

| (xO x′) ⇒ < entier >Cases y of

(xI y′) ⇒ (Zero suivi de (sub neg x′ y′)) | (xO y′) ⇒ (Un suivi de (sub neg x′ y′)) | xH ⇒ (double moins deux x′) end

| xH ⇒ < entier >Cases y of

(xI y′) ⇒ (Pos (xO y′)) | (xO y′) ⇒ (Pos (double moins un y′)) | xH ⇒ Nul end

end.

Theorem sub pos x x : (x : positive) (sub pos x x) = Nul.

Theorem ZL10 : (x, y : positive) (compare x y EGAL) = SUPERIEUR → (sub pos x y) = (Pos xH ) → (sub neg x y) = Nul.

Lemma ZL11 : (x : positive) (x = xH ) ∨ ¬(x = xH ).

Lemma ZL12 : (q : positive) (add un q) = (add q xH ).

Lemma ZL12bis : (q : positive) (add un q) = (add xH q).

Theorem ZL13 :

(x, y : positive)(add carry x y) = (add un (add x y)).

Theorem ZL14 :

(x, y : positive)(add x (add un y)) = (add un (add x y)).

Theorem ZL15 :

(q, z : positive) ¬z = xH → (add carry q (sub un z)) = (add q z).

Theorem sub pos SUPERIEUR :

(x, y : positive)(compare x y EGAL) = SUPERIEUR →

(EX h : positive | (sub pos x y) = (Pos h) ∧ (add y h) = x ∧ (h = xH ∨ (sub neg x y) = (Pos (sub un h)))).

Lemma ZC1 :

(x, y : positive)(compare x y EGAL) = SUPERIEUR → (compare y x EGAL) = INFERIEUR.

Lemma ZC2 :

(x, y : positive)(compare x y EGAL) = INFERIEUR → (compare y x EGAL) = SUPERIEUR.

Lemma ZC3 : (x, y : positive)(compare x y EGAL) = EGAL → (compare y x EGAL) = EGAL.

Definition Op := [r : relation] <relation >Cases r of

EGAL ⇒ EGAL | INFERIEUR ⇒ SUPERIEUR | SUPERIEUR ⇒ INFERIEUR

end.

Lemma ZC4 : (x, y : positive) (compare x y EGAL) = (Op (compare y x EGAL)).

Theorem add sym : (x, y : positive) (add x y) = (add y x).

Lemma bij3 : (x : positive)(sub un (anti convert (convert x))) = x.

Lemma convert intro : (x, y : positive)(convert x) = (convert y) → x = y.

Lemma simpl add r : (x, y, z : positive) (add x z) = (add y z) → x = y.

Lemma simpl add l : (x, y, z : positive) (add x y) = (add x z) → y = z.

Theorem add assoc : (x, y, z : positive)(add x (add y z)) = (add (add x y) z).

Local true sub := [x, y : positive]

<positive > Cases (sub pos x y) of Nul ⇒ xH | (Pos z) ⇒ z end. Proof. Theorem sub add : (x, y : positive) (compare x y EGAL) = SUPERIEUR → (add y (true sub x y)) = x.

Theorem true sub convert :

(x, y : positive) (compare x y EGAL) = SUPERIEUR →

(convert (true sub x y)) = (minus (convert x) (convert y)). Addition on integers

Definition Zplus := [x, y : Z ]

<Z >Cases x of

ZERO ⇒ y | (POS x′) ⇒

<Z >Cases y of

ZERO ⇒ x | (POS y′) ⇒ (POS (add x′ y′)) | (NEG y′) ⇒

<Z >Cases (compare x′ y′ EGAL) of

EGAL ⇒ ZERO | INFERIEUR ⇒ (NEG (true sub y′ x′)) | SUPERIEUR ⇒ (POS (true sub x′ y′)) end

end

| (NEG x′) ⇒

<Z >Cases y of

ZERO ⇒ x | (POS y′) ⇒

<Z >Cases (compare x′ y′ EGAL) of

EGAL ⇒ ZERO | INFERIEUR ⇒ (POS (true sub y′ x′)) | SUPERIEUR ⇒ (NEG (true sub x′ y′)) end

| (NEG y′) ⇒ (NEG (add x′ y′)) end

end.

Opposite

Definition Zopp := [x : Z ] <Z >Cases x of

ZERO ⇒ ZERO | (POS x) ⇒ (NEG x) | (NEG x) ⇒ (POS x) end.

Theorem Zero left : (x : Z ) (Zplus ZERO x) = x.

Theorem Zopp Zopp : (x : Z ) (Zopp (Zopp x)) = x.

Addition and opposite

Theorem Zero right : (x : Z ) (Zplus x ZERO) = x.

Theorem Zplus inverse r : (x : Z ) (Zplus x (Zopp x)) = ZERO.

Theorem Zopp Zplus :

(x, y : Z ) (Zopp (Zplus x y)) = (Zplus (Zopp x) (Zopp y)).

Theorem Zplus sym : (x, y : Z ) (Zplus x y) = (Zplus y x).

Theorem Zplus inverse l : (x : Z ) (Zplus (Zopp x) x) = ZERO.

Theorem Zopp intro : (x, y : Z ) (Zopp x) = (Zopp y) → x = y.

Theorem Zopp NEG : (x : positive) (Zopp (NEG x)) = (POS x).

Hints Resolve Zero left Zero right.

Theorem weak assoc :

(x, y : positive)(z : Z ) (Zplus (POS x) (Zplus (POS y) z)) = (Zplus (Zplus (POS x) (POS y)) z).

Hints Resolve weak assoc.

Theorem Zplus assoc :

(x, y, z : Z ) (Zplus x (Zplus y z)) = (Zplus (Zplus x y) z).

Lemma Zplus simpl : (n, m, p, q : Z ) n = m → p = q → (Zplus n p) = (Zplus m q). Addition on positive numbers

Fixpoint times1 [x : positive] : (positive → positive) → positive → positive := [f : positive → positive][y : positive] <positive > Cases x of

(xI x′) ⇒ (add (f y) (times1 x′ [z : positive](xO (f z)) y)) | (xO x′) ⇒ (times1 x′ [z : positive](xO (f z)) y) | xH ⇒ (f y)

end.

Local times := [x : positive](times1 x [y : positive]y).

Theorem times1 convert :

(x, y : positive)(f : positive → positive)

(convert (times1 x f y)) = (mult (convert x) (convert (f y))).

Correctness of multiplication on positive Theorem times convert :

(x, y : positive) (convert (times x y)) = (mult (convert x) (convert y)).

Multiplication on integers

Definition Zmult := [x, y : Z ]

<Z >Cases x of

ZERO ⇒ ZERO | (POS x′) ⇒

<Z >Cases y of

ZERO ⇒ ZERO | (POS y′) ⇒ (POS (times x′ y′)) | (NEG y′) ⇒ (NEG (times x′ y′)) end

| (NEG x′) ⇒

<Z >Cases y of

ZERO ⇒ ZERO | (POS y′) ⇒ (NEG (times x′ y′)) | (NEG y′) ⇒ (POS (times x′ y′)) end

end.

Theorem times assoc :

((x, y, z : positive) (times x (times y z)) = (times (times x y) z)).

Theorem times sym : (x, y : positive) (times x y) = (times y x).

Theorem Zmult sym : (x, y : Z ) (Zmult x y) = (Zmult y x).

Theorem Zmult assoc :

(x, y, z : Z ) (Zmult x (Zmult y z)) = (Zmult (Zmult x y) z).

Theorem Zmult one :

(x : Z ) (Zmult (POS xH ) x) = x.

Theorem times add distr :

(x, y, z : positive) (times x (add y z)) = (add (times x y) (times x z)).

Theorem lt mult left : (x, y, z : nat) (lt x y) → (lt (mult (S z) x) (mult (S z) y)).

Theorem times true sub distr :

(x, y, z : positive) (compare y z EGAL) = SUPERIEUR → (times x (true sub y z)) = (true sub (times x y) (times x z)).

Theorem Zero mult left : (x : Z ) (Zmult ZERO x) = ZERO.

Theorem Zero mult right : (x : Z ) (Zmult x ZERO) = ZERO.

Hints Resolve Zero mult left Zero mult right.

Multiplication and Opposite

Theorem Zopp Zmult :

(x, y : Z ) (Zmult (Zopp x) y) = (Zopp (Zmult x y)).

Theorem Zmult Zopp Zopp :

(x, y : Z ) (Zmult (Zopp x) (Zopp y)) = (Zmult x y).

Theorem weak Zmult plus distr r :

(x : positive)(y, z : Z )

(Zmult (POS x) (Zplus y z)) = (Zplus (Zmult (POS x) y) (Zmult (POS x) z)).

Theorem Zmult plus distr r :

(x, y, z : Z ) (Zmult x (Zplus y z)) = (Zplus (Zmult x y) (Zmult x z)).

Comparison on integers

Definition Zcompare := [x, y : Z ]

<relation >Cases x of

ZERO ⇒ < relation >Cases y of

ZERO ⇒ EGAL | (POS y′) ⇒ INFERIEUR | (NEG y′) ⇒ SUPERIEUR end

| (POS x′) ⇒ < relation >Cases y of

ZERO ⇒ SUPERIEUR | (POS y′) ⇒ (compare x′ y′ EGAL) | (NEG y′) ⇒ SUPERIEUR end

| (NEG x′) ⇒ < relation >Cases y of

ZERO ⇒ INFERIEUR | (POS y′) ⇒ INFERIEUR | (NEG y′) ⇒ (Op (compare x′ y′ EGAL)) end

end.

Theorem Zcompare EGAL : (x, y : Z ) (Zcompare x y) = EGAL ↔ x = y.

Theorem Zcompare ANTISYM :

(x, y : Z ) (Zcompare x y) = SUPERIEUR ↔ (Zcompare y x) = INFERIEUR.

Theorem le minus : (i, h : nat) (le (minus i h) i).

Lemma ZL16 : (p, q : positive)(lt (minus (convert p) (convert q)) (convert p)).

Lemma ZL17 : (p, q : positive)(lt (convert p) (convert (add p q))).

Theorem Zcompare Zopp :

(x, y : Z ) (Zcompare x y) = (Zcompare (Zopp y) (Zopp x)).

Hints Resolve convert compare EGAL.

Theorem weaken Zcompare Zplus compatible :

((x, y : Z ) (z : positive)

(Zcompare (Zplus (POS z) x) (Zplus (POS z) y)) = (Zcompare x y)) → (x, y, z : Z ) (Zcompare (Zplus z x) (Zplus z y)) = (Zcompare x y).

Hints Resolve ZC4 .

Theorem weak Zcompare Zplus compatible :

(x, y : Z ) (z : positive)

(Zcompare (Zplus (POS z) x) (Zplus (POS z) y)) = (Zcompare x y).

Theorem Zcompare Zplus compatible :

(x, y, z : Z ) (Zcompare (Zplus z x) (Zplus z y)) = (Zcompare x y).

Theorem Zcompare trans SUPERIEUR :

(x, y, z : Z ) (Zcompare x y) = SUPERIEUR → (Zcompare y z) = SUPERIEUR → (Zcompare x z) = SUPERIEUR.

Lemma SUPERIEUR POS :

(x, y : Z ) (Zcompare x y) = SUPERIEUR → (EX h : positive |(Zplus x (Zopp y)) = (POS h)).

End fast integers.

Module Zarith aux

Binary Integers Pierre Crégut (CNET, Lannion, France)

Require Arith. Require Export fast integer.

Meta Definition ElimCompare com1 com2 :=

Elim (Dcompare (Zcompare com1 com2 )); [

Idtac | Intro hidden auxiliary; Elim hidden auxiliary;

Clear hidden auxiliary ] . Order relations

Definition Zlt := [x, y : Z ](Zcompare x y) = INFERIEUR. Definition Zgt := [x, y : Z ](Zcompare x y) = SUPERIEUR. Definition Zle := [x, y : Z ]¬(Zcompare x y) = SUPERIEUR. Definition Zge := [x, y : Z ]¬(Zcompare x y) = INFERIEUR.

Absolu function

Definition absolu [x : Z ] : nat :=

Cases x of

ZERO ⇒ O | (POS p) ⇒ (convert p) | (NEG p) ⇒ (convert p) end.

Definition Zabs [z : Z ] : Z :=

Cases z of

ZERO ⇒ ZERO | (POS p) ⇒ (POS p) | (NEG p) ⇒ (POS p) end. Properties of absolu function

Lemma Zabs eq : (x : Z ) (Zle ZERO x) → (Zabs x) = x.

From nat to Z Definition inject nat :=

[x : nat]Cases x of

O ⇒ ZERO | (S y) ⇒ (POS (anti convert y)) end.

Successor and Predecessor functions on Z Definition Zs := [x : Z ](Zplus x (POS xH )). Definition Zpred := [x : Z ](Zplus x (NEG xH )). Properties of the order relation Theorem Zgt Sn n : (n : Z )(Zgt (Zs n) n).

Properties of the order Theorem Zle gt trans : (n, m, p : Z )(Zle m n) → (Zgt m p) → (Zgt n p). Theorem Zgt le trans : (n, m, p : Z )(Zgt n m) → (Zle p m) → (Zgt n p). Theorem Zle S gt : (n, m : Z ) (Zle (Zs n) m) → (Zgt m n). Theorem Zcompare n S : (n, m : Z )(Zcompare (Zs n) (Zs m)) = (Zcompare n m). Theorem Zgt n S : (n, m : Z )(Zgt m n) → (Zgt (Zs m) (Zs n)). Lemma Zle not gt : (n, m : Z )(Zle n m) → ¬(Zgt n m). Lemma Zgt antirefl : (n : Z )¬(Zgt n n). Lemma Zgt not sym : (n, m : Z )(Zgt n m) → ¬(Zgt m n). Lemma Zgt not le : (n, m : Z )(Zgt n m) → ¬(Zle n m). Lemma Zgt trans : (n, m, p : Z )(Zgt n m) → (Zgt m p) → (Zgt n p). Lemma Zle gt S : (n, p : Z )(Zle n p) → (Zgt (Zs p) n). Lemma Zgt pred

: (n, p : Z )(Zgt p (Zs n)) → (Zgt (Zpred p) n). Lemma Zsimpl gt plus l

: (n, m, p : Z )(Zgt (Zplus p n) (Zplus p m)) → (Zgt n m). Lemma Zsimpl gt plus r

: (n, m, p : Z )(Zgt (Zplus n p) (Zplus m p)) → (Zgt n m). Lemma Zgt reg l

: (n, m, p : Z )(Zgt n m) → (Zgt (Zplus p n) (Zplus p m)). Lemma Zgt reg r : (n, m, p : Z )(Zgt n m) → (Zgt (Zplus n p) (Zplus m p)). Theorem Zcompare et un :

(x, y : Z ) (Zcompare x y) = SUPERIEUR ↔

¬(Zcompare x (Zplus y (POS xH ))) = INFERIEUR. Lemma Zgt S n : (n, p : Z )(Zgt (Zs p) (Zs n)) → (Zgt p n). Lemma Zle S n : (n, m : Z ) (Zle (Zs m) (Zs n)) → (Zle m n). Lemma Zgt le S : (n, p : Z )(Zgt p n) → (Zle (Zs n) p).

Lemma Zgt S le : (n, p : Z )(Zgt (Zs p) n) → (Zle n p). Theorem Zgt S : (n, m : Z )(Zgt (Zs n) m) → ((Zgt n m) ∨ (< Z > m = n)). Theorem Zgt trans S : (n, m, p : Z )(Zgt (Zs n) m) → (Zgt m p) → (Zgt n p). Theorem Zeq S : (n, m : Z ) n = m → (Zs n) = (Zs m). Theorem Zpred Sn : (m : Z ) m = (Zpred (Zs m)). Theorem Zeq add S : (n, m : Z ) (Zs n) = (Zs m) → n = m. Theorem Znot eq S : (n, m : Z ) ¬(n = m) → ¬((Zs n) = (Zs m)). Lemma Zsimpl plus l : (n, m, p : Z )(Zplus n m) = (Zplus n p) → m = p. Theorem Zn Sn : (n : Z ) ¬(n = (Zs n)). Lemma Zplus n O : (n : Z ) n = (Zplus n ZERO). Lemma Zplus unit left : (n, m : Z ) (Zplus n ZERO) = m → n = m. Lemma Zplus unit right : (n, m : Z ) n = (Zplus m ZERO) → n = m. Lemma Zplus n Sm : (n, m : Z ) (Zs (Zplus n m)) = (Zplus n (Zs m)). Lemma Zmult n O : (n : Z ) ZERO = (Zmult n ZERO). Lemma Zmult n Sm : (n, m : Z ) (Zplus (Zmult n m) n) = (Zmult n (Zs m)). Theorem Zle n : (n : Z ) (Zle n n). Theorem Zle refl : (n, m : Z ) n = m → (Zle n m). Theorem Zle trans : (n, m, p : Z )(Zle n m) → (Zle m p) → (Zle n p). Theorem Zle n Sn : (n : Z )(Zle n (Zs n)). Lemma Zle n S : (n, m : Z ) (Zle m n) → (Zle (Zs m) (Zs n)). Hints Resolve Zle n Zle n Sn Zle trans Zle n S : zarith. Hints Lemma Zs pred : (n : Z ) n = (Zs (Zpred n)). Hints Theorem Zle pred n : (n : Z )(Zle (Zpred n) n). Theorem Zle trans S : (n, m : Z )(Zle (Zs n) m) → (Zle n m). Theorem Zle Sn n : (n : Z )¬(Zle (Zs n) n). Theorem Zle antisym : (n, m : Z )(Zle n m) → (Zle m n) → (n = m). Theorem Zgt lt : (m, n : Z ) (Zgt m n) → (Zlt n m). Theorem Zlt gt : (m, n : Z ) (Zlt m n) → (Zgt n m). Theorem Zge le : (m, n : Z ) (Zge m n) → (Zle n m). Theorem Zle ge : (m, n : Z ) (Zle m n) → (Zge n m). Theorem Zge trans : (n, m, p : Z ) (Zge n m) → (Zge m p) → (Zge n p). Theorem Zlt n Sn : (n : Z )(Zlt n (Zs n)). Theorem Zlt S : (n, m : Z )(Zlt n m) → (Zlt n (Zs m)).

Theorem Zlt n S : (n, m : Z )(Zlt n m) → (Zlt (Zs n) (Zs m)). Theorem Zlt S n : (n, m : Z )(Zlt (Zs n) (Zs m)) → (Zlt n m). Theorem Zlt n n : (n : Z )¬(Zlt n n). Lemma Zlt pred : (n, p : Z )(Zlt (Zs n) p) → (Zlt n (Zpred p)). Lemma Zlt pred n n : (n : Z )(Zlt (Zpred n) n). Theorem Zlt le S : (n, p : Z )(Zlt n p) → (Zle (Zs n) p). Theorem Zlt n Sm le : (n, m : Z )(Zlt n (Zs m)) → (Zle n m). Theorem Zle lt n Sm : (n, m : Z )(Zle n m) → (Zlt n (Zs m)). Theorem Zlt le weak : (n, m : Z )(Zlt n m) → (Zle n m). Theorem Zlt trans : (n, m, p : Z )(Zlt n m) → (Zlt m p) → (Zlt n p). Theorem Zlt le trans : (n, m, p : Z )(Zlt n m) → (Zle m p) → (Zlt n p). Theorem Zle lt trans : (n, m, p : Z )(Zle n m) → (Zlt m p) → (Zlt n p). Theorem Zle lt or eq : (n, m : Z )(Zle n m) → ((Zlt n m) ∨ n = m). Theorem Zle or lt : (n, m : Z )((Zle n m) ∨ (Zlt m n)). Theorem Zle not lt : (n, m : Z )(Zle n m) → ¬(Zlt m n). Theorem Zlt not le : (n, m : Z )(Zlt n m) → ¬(Zle m n). Theorem Zlt not sym : (n, m : Z )(Zlt n m) → ¬(Zlt m n). Theorem Zle le S : (x, y : Z )(Zle x y) → (Zle x (Zs y)). Hints Resolve Zle le S : zarith. Definition Zmin := [n, m : Z ] <Z >Cases (Zcompare n m) of

EGAL ⇒ n | INFERIEUR ⇒ n | SUPERIEUR ⇒ m end.

Lemma Zmin SS : (n, m : Z )((Zs (Zmin n m)) = (Zmin (Zs n) (Zs m))). Lemma Zle min l : (n, m : Z )(Zle (Zmin n m) n). Lemma Zle min r : (n, m : Z )(Zle (Zmin n m) m). Lemma Zmin case : (n, m : Z )(P : Z → Set)(P n) → (P m) → (P (Zmin n m)). Lemma Zmin or : (n, m : Z )(Zmin n m) = n ∨ (Zmin n m) = m. Lemma Zmin n n : (n : Z ) (Zmin n n) = n. Lemma Zplus assoc l : (n, m, p : Z )((Zplus n (Zplus m p)) = (Zplus (Zplus n m) p)). Lemma Zplus assoc r : (n, m, p : Z )(Zplus (Zplus n m) p) = (Zplus n (Zplus m p)). Lemma Zplus permute : (n, m, p : Z ) (Zplus n (Zplus m p)) = (Zplus m (Zplus n p)). Lemma Zsimpl le plus l : (p, n, m : Z )(Zle (Zplus p n) (Zplus p m)) → (Zle n m).

Lemma Zsimpl le plus r : (p, n, m : Z )(Zle (Zplus n p) (Zplus m p)) → (Zle n m). Lemma Zle reg l : (n, m, p : Z )(Zle n m) → (Zle (Zplus p n) (Zplus p m)). Lemma Zle reg r : (a, b, c : Z ) (Zle a b) → (Zle (Zplus a c) (Zplus b c)). Lemma Zle plus plus : (n, m, p, q : Z ) (Zle n m) → (Zle p q) → (Zle (Zplus n p) (Zplus m q)). Lemma Zplus Snm nSm : (n, m : Z )(Zplus (Zs n) m) = (Zplus n (Zs m)). Lemma Zsimpl lt plus l

: (n, m, p : Z )(Zlt (Zplus p n) (Zplus p m)) → (Zlt n m). Lemma Zsimpl lt plus r

: (n, m, p : Z )(Zlt (Zplus n p) (Zplus m p)) → (Zlt n m). Lemma Zlt reg l : (n, m, p : Z )(Zlt n m) → (Zlt (Zplus p n) (Zplus p m)). Lemma Zlt reg r : (n, m, p : Z )(Zlt n m) → (Zlt (Zplus n p) (Zplus m p)). Lemma Zlt le reg : (a, b, c, d : Z ) (Zlt a b) → (Zle c d) → (Zlt (Zplus a c) (Zplus b d)). Lemma Zle lt reg : (a, b, c, d : Z ) (Zle a b) → (Zlt c d) → (Zlt (Zplus a c) (Zplus b d)). Definition Zminus := [m, n : Z ](Zplus m (Zopp n)). Lemma Zminus plus simpl :

(n, m, p : Z )((Zminus n m) = (Zminus (Zplus p n) (Zplus p m))). Lemma Zminus n O : (n : Z )(n = (Zminus n ZERO)). Lemma Zminus n n : (n : Z )(ZERO = (Zminus n n)). Lemma Zplus minus : (n, m, p : Z )(n = (Zplus m p)) → (p = (Zminus n m)). Lemma Zminus plus : (n, m : Z )(Zminus (Zplus n m) n) = m. Lemma Zle plus minus : (n, m : Z ) (Zplus n (Zminus m n)) = m. Lemma Zminus Sn m : (n, m : Z )((Zs (Zminus n m)) = (Zminus (Zs n) m)). Lemma Zlt minus : (n, m : Z )(Zlt ZERO m) → (Zlt (Zminus n m) n). Lemma Zlt O minus lt : (n, m : Z )(Zlt ZERO (Zminus n m)) → (Zlt m n). Lemma Zmult plus distr l :

(n, m, p : Z )((Zmult (Zplus n m) p) = (Zplus (Zmult n p) (Zmult m p))). Lemma Zmult minus distr :

(n, m, p : Z )((Zmult (Zminus n m) p) = (Zminus (Zmult n p) (Zmult m p))). Lemma Zmult assoc r : (n, m, p : Z )((Zmult (Zmult n m) p) = (Zmult n (Zmult m p))). Lemma Zmult assoc l : (n, m, p : Z )(Zmult n (Zmult m p)) = (Zmult (Zmult n m) p). Theorem Zmult permute : (n, m, p : Z )(Zmult n (Zmult m p)) = (Zmult m (Zmult n p)). Lemma Zmult 1 n : (n : Z )(Zmult (POS xH ) n) = n. Lemma Zmult n 1 : (n : Z )(Zmult n (POS xH )) = n.

Lemma Zmult Sm n : (n, m : Z ) (Zplus (Zmult n m) m) = (Zmult (Zs n) m). Just for compatibility with previous versions Use Zmult plus distr r and Zmult plus distr l rather than their synomymous Definition Zmult Zplus distr := Zmult plus distr r. Definition Zmult plus distr := Zmult plus distr l.

Module Auxiliary

Id : auxiliary.v, v1.122001/04/0817 : 18 : 57mohringExp Require Export Arith. Require fast integer. Require zarith aux. Require Decidable. Require Peano dec. Require Export Compare dec. Definition neq := [x, y : nat] ¬(x = y). Definition Zne := [x, y : Z ] ¬(x = y). Theorem add un Zs : (x : positive) (POS (add un x)) = (Zs (POS x)). Theorem inj S : (y : nat) (inject nat (S y)) = (Zs (inject nat y)). Theorem Zplus S n : (x, y : Z ) (Zplus (Zs x) y) = (Zs (Zplus x y)). Theorem inj plus :

(x, y : nat) (inject nat (plus x y)) = (Zplus (inject nat x) (inject nat y)). Theorem inj mult :

(x, y : nat) (inject nat (mult x y)) = (Zmult (inject nat x) (inject nat y)). Theorem inj neq :

(x, y : nat) (neq x y) → (Zne (inject nat x) (inject nat y)). Theorem inj le :

(x, y : nat) (le x y) → (Zle (inject nat x) (inject nat y)). Theorem inj lt : (x, y : nat) (lt x y) → (Zlt (inject nat x) (inject nat y)). Theorem inj gt : (x, y : nat) (gt x y) → (Zgt (inject nat x) (inject nat y)). Theorem inj ge : (x, y : nat) (ge x y) → (Zge (inject nat x) (inject nat y)). Theorem inj eq : (x, y : nat) x = y → (inject nat x) = (inject nat y). Theorem intro Z :

(x : nat) (EX y : Z | (inject nat x) = y ∧

(Zle ZERO (Zplus (Zmult y (POS xH )) ZERO))).

Theorem inj minus1 :

(x, y : nat) (le y x) →

(inject nat (minus x y)) = (Zminus (inject nat x) (inject nat y)). Theorem inj minus2 : (x, y : nat) (gt y x) → (inject nat (minus x y)) = ZERO.

Theorem dec eq : (x, y : Z ) (decidable (x = y)). Theorem dec Zne : (x, y : Z ) (decidable (Zne x y)). Theorem dec Zle : (x, y : Z ) (decidable (Zle x y)). Theorem dec Zgt : (x, y : Z ) (decidable (Zgt x y)). Theorem dec Zge : (x, y : Z ) (decidable (Zge x y)). Theorem dec Zlt : (x, y : Z ) (decidable (Zlt x y)). Theorem dec eq nat : (x, y : nat)(decidable (x = y)). Theorem not Zge : (x, y : Z ) ¬(Zge x y) → (Zlt x y). Theorem not Zlt : (x, y : Z ) ¬(Zlt x y) → (Zge x y). Theorem not Zle : (x, y : Z ) ¬(Zle x y) → (Zgt x y). Theorem not Zgt : (x, y : Z ) ¬(Zgt x y) → (Zle x y). Theorem not Zeq : (x, y : Z ) ¬ x = y → (Zlt x y) ∨ (Zlt y x). Lemma new var : (x : Z ) (EX y : Z |(x = y)). Theorem Zne left : (x, y : Z ) (Zne x y) → (Zne (Zplus x (Zopp y)) ZERO). Theorem Zegal left : (x, y : Z ) (x = y) → (Zplus x (Zopp y)) = ZERO. Theorem Zle left : (x, y : Z ) (Zle x y) → (Zle ZERO (Zplus y (Zopp x))). Theorem Zle left rev : (x, y : Z ) (Zle ZERO (Zplus y (Zopp x)))

→ (Zle x y). Theorem Zlt left rev : (x, y : Z ) (Zlt ZERO (Zplus y (Zopp x)))

→ (Zlt x y). Theorem Zlt left :

(x, y : Z ) (Zlt x y) → (Zle ZERO (Zplus (Zplus y (NEG xH )) (Zopp x))). Theorem Zlt left lt :

(x, y : Z ) (Zlt x y) → (Zlt ZERO (Zplus y (Zopp x))). Theorem Zge left : (x, y : Z ) (Zge x y) → (Zle ZERO (Zplus x (Zopp y))). Theorem Zgt left :

(x, y : Z ) (Zgt x y) → (Zle ZERO (Zplus (Zplus x (NEG xH )) (Zopp y))). Theorem Zgt left gt :

(x, y : Z ) (Zgt x y) → (Zgt (Zplus x (Zopp y)) ZERO). Theorem Zgt left rev : (x, y : Z ) (Zgt (Zplus x (Zopp y)) ZERO)

→ (Zgt x y). Theorem Zopp one : (x : Z )(Zopp x) = (Zmult x (NEG xH )). Theorem Zopp Zmult r : (x, y : Z )(Zopp (Zmult x y)) = (Zmult x (Zopp y)). Theorem Zmult Zopp left : (x, y : Z )(Zmult (Zopp x) y) = (Zmult x (Zopp y)). Theorem Zopp Zmult l : (x, y : Z )(Zopp (Zmult x y)) = (Zmult (Zopp x) y). Theorem Zred factor0 : (x : Z ) x = (Zmult x (POS xH )).

Theorem Zred factor1 : (x : Z ) (Zplus x x) = (Zmult x (POS (xO xH ))).

Theorem Zred factor2 :

(x, y : Z ) (Zplus x (Zmult x y)) = (Zmult x (Zplus (POS xH ) y)).

Theorem Zred factor3 :

(x, y : Z ) (Zplus (Zmult x y) x) = (Zmult x (Zplus (POS xH ) y)). Theorem Zred factor4 :

(x, y, z : Z ) (Zplus (Zmult x y) (Zmult x z)) = (Zmult x (Zplus y z)).

Theorem Zred factor5 : (x, y : Z ) (Zplus (Zmult x ZERO) y) = y.

Theorem Zred factor6 : (x : Z ) x = (Zplus x ZERO).

Theorem Zcompare Zplus compatible2 :

(r : relation)(x, y, z, t : Z )

(Zcompare x y) = r → (Zcompare z t) = r → (Zcompare (Zplus x z) (Zplus y t)) = r.

Lemma add x x : (x : positive) (add x x) = (xO x).

Theorem Zcompare Zmult compatible :

(x : positive)(y, z : Z ) (Zcompare (Zmult (POS x) y) (Zmult (POS x) z)) = (Zcompare y z).

Theorem Zmult eq :

(x, y : Z ) ¬(x = ZERO) → (Zmult y x) = ZERO → y = ZERO.

Theorem Z eq mult :

(x, y : Z ) y = ZERO → (Zmult y x) = ZERO.

Theorem Zmult le :

(x, y : Z ) (Zgt x ZERO) → (Zle ZERO (Zmult y x)) → (Zle ZERO y).

Theorem Zle ZERO mult :

(x, y : Z ) (Zle ZERO x) → (Zle ZERO y) → (Zle ZERO (Zmult x y)).

Lemma Zgt ZERO mult : (a, b : Z ) (Zgt a ZERO) → (Zgt b ZERO)

→ (Zgt (Zmult a b) ZERO).

Theorem Zle mult :

(x, y : Z ) (Zgt x ZERO) → (Zle ZERO y) → (Zle ZERO (Zmult y x)).

Theorem Zmult lt :

(x, y : Z ) (Zgt x ZERO) → (Zlt ZERO (Zmult y x)) → (Zlt ZERO y).

Theorem Zmult gt :

(x, y : Z ) (Zgt x ZERO) → (Zgt (Zmult x y) ZERO) → (Zgt y ZERO).

Theorem Zle mult approx :

(x, y, z : Z ) (Zgt x ZERO) → (Zgt z ZERO) → (Zle ZERO y) → (Zle ZERO (Zplus (Zmult y x) z)).

Lemma Zle Zmult pos right :

(a, b, c : Z )

(Zle a b) → (Zle ZERO c) → (Zle (Zmult a c) (Zmult b c)).

Lemma Zle Zmult pos left :

(a, b, c : Z )

(Zle a b) → (Zle ZERO c) → (Zle (Zmult c a) (Zmult c b)).

Lemma Zge Zmult pos right :

(a, b, c : Z )

(Zge a b) → (Zge c ZERO) → (Zge (Zmult a c) (Zmult b c)).

Lemma Zge Zmult pos left :

(a, b, c : Z )

(Zge a b) → (Zge c ZERO) → (Zge (Zmult c a) (Zmult c b)).

Lemma Zge Zmult pos compat :

(a, b, c, d : Z )

(Zge a c) → (Zge b d) → (Zge c ZERO) → (Zge d ZERO) → (Zge (Zmult a b) (Zmult c d)).

Lemma Zle mult simpl : (a, b, c : Z ) (Zgt c ZERO) → (Zle (Zmult a c) (Zmult b c)) → (Zle a b).

Lemma Zge mult simpl : (a, b, c : Z ) (Zgt c ZERO) → (Zge (Zmult a c) (Zmult b c)) → (Zge a b).

Lemma Zgt mult simpl : (a, b, c : Z ) (Zgt c ZERO) → (Zgt (Zmult a c) (Zmult b c)) → (Zgt a b).

Lemma Zgt square simpl : (x, y : Z ) (Zge x ZERO) → (Zge y ZERO)

→ (Zgt (Zmult x x) (Zmult y y)) → (Zgt x y).

Theorem Zmult le approx :

(x, y, z : Z ) (Zgt x ZERO) → (Zgt x z) → (Zle ZERO (Zplus (Zmult y x) z)) → (Zle ZERO y).

Theorem OMEGA1 : (x, y : Z ) (x = y) → (Zle ZERO x) → (Zle ZERO y).

Theorem OMEGA2 : (x, y : Z ) (Zle ZERO x) → (Zle ZERO y) → (Zle ZERO (Zplus x y)).

Theorem OMEGA3 : (x, y, k : Z )(Zgt k ZERO) → (x = (Zmult y k)) → (x = ZERO) → (y = ZERO).

Theorem OMEGA4 :

(x, y, z : Z )(Zgt x ZERO) → (Zgt y x) → ¬(Zplus (Zmult z y) x) = ZERO.

Theorem OMEGA5 : (x, y, z : Z )(x = ZERO) → (y = ZERO) → (Zplus x (Zmult y z)) = ZERO. Theorem OMEGA6 :

(x, y, z : Z )(Zle ZERO x) → (y = ZERO) → (Zle ZERO (Zplus x (Zmult y z))).

Theorem OMEGA7 :

(x, y, z, t : Z )(Zgt z ZERO) → (Zgt t ZERO) → (Zle ZERO x) → (Zle ZERO y) → (Zle ZERO (Zplus (Zmult x z) (Zmult y t))).

Theorem OMEGA8 : (x, y : Z ) (Zle ZERO x) → (Zle ZERO y) → x = (Zopp y) → x = ZERO.

Theorem OMEGA9 : (x, y, z, t : Z ) y = ZERO → x = z → (Zplus y (Zmult (Zplus (Zopp x) z) t)) = ZERO.

Theorem OMEGA10 : (v, c1 , c2 , l1 , l2 , k1 , k2 : Z )

(Zplus (Zmult (Zplus (Zmult v c1 ) l1 ) k1 ) (Zmult (Zplus (Zmult v c2 ) l2 ) k2 ))

= (Zplus (Zmult v (Zplus (Zmult c1 k1 ) (Zmult c2 k2 )))

(Zplus (Zmult l1 k1 ) (Zmult l2 k2 ))).

Theorem OMEGA11 : (v1 , c1 , l1 , l2 , k1 : Z )

(Zplus (Zmult (Zplus (Zmult v1 c1 ) l1 ) k1 ) l2 )

= (Zplus (Zmult v1 (Zmult c1 k1 )) (Zplus (Zmult l1 k1 ) l2 )).

Theorem OMEGA12 : (v2 , c2 , l1 , l2 , k2 : Z )

(Zplus l1 (Zmult (Zplus (Zmult v2 c2 ) l2 ) k2 ))

= (Zplus (Zmult v2 (Zmult c2 k2 )) (Zplus l1 (Zmult l2 k2 ))).

Theorem OMEGA13 : (v, l1 , l2 : Z )(x : positive)

(Zplus (Zplus (Zmult v (POS x)) l1 ) (Zplus (Zmult v (NEG x)) l2 ))

= (Zplus l1 l2 ).

Theorem OMEGA14 : (v, l1 , l2 : Z )(x : positive)

(Zplus (Zplus (Zmult v (NEG x)) l1 ) (Zplus (Zmult v (POS x)) l2 ))

= (Zplus l1 l2 ). Theorem OMEGA15 : (v, c1 , c2 , l1 , l2 , k2 : Z )

(Zplus (Zplus (Zmult v c1 ) l1 ) (Zmult (Zplus (Zmult v c2 ) l2 ) k2 ))

= (Zplus (Zmult v (Zplus c1 (Zmult c2 k2 )))

(Zplus l1 (Zmult l2 k2 ))).

Theorem OMEGA16 :

(v, c, l, k : Z )

(Zmult (Zplus (Zmult v c) l) k) = (Zplus (Zmult v (Zmult c k)) (Zmult l k)).

Theorem OMEGA17 :

(x, y, z : Z )(Zne x ZERO) → (y = ZERO) → (Zne (Zplus x (Zmult y z)) ZERO).

Theorem OMEGA18 : (x, y, k : Z ) (x = (Zmult y k)) → (Zne x ZERO) → (Zne y ZERO).

Theorem OMEGA19 :

(x : Z ) (Zne x ZERO) → (Zle ZERO (Zplus x (NEG xH ))) ∨ (Zle ZERO (Zplus (Zmult x (NEG xH )) (NEG xH ))).

Theorem OMEGA20 :

(x, y, z : Z )(Zne x ZERO) → (y = ZERO) → (Zne (Zplus x (Zmult y z)) ZERO).

Definition fast Zplus sym := [x, y : Z ][P : Z → Prop][H : (P (Zplus y x))]

(eq ind r Z (Zplus y x) P H (Zplus x y) (Zplus sym x y)).

Definition fast Zplus assoc r := [n, m, p : Z ][P : Z → Prop][H : (P (Zplus n (Zplus m p)))] (eq ind r Z (Zplus n (Zplus m p)) P H (Zplus (Zplus n m) p) (Zplus assoc r n m p)).

Definition fast Zplus assoc l := [n, m, p : Z ][P : Z → Prop][H : (P (Zplus (Zplus n m) p))] (eq ind r Z (Zplus (Zplus n m) p) P H (Zplus n (Zplus m p))

(Zplus assoc l n m p)).

Definition fast Zplus permute := [n, m, p : Z ][P : Z → Prop][H : (P (Zplus m (Zplus n p)))] (eq ind r Z (Zplus m (Zplus n p)) P H (Zplus n (Zplus m p))

(Zplus permute n m p)).

Definition fast OMEGA10 := [v, c1 , c2 , l1 , l2 , k1 , k2 : Z ][P : Z → Prop] [H : (P (Zplus (Zmult v (Zplus (Zmult c1 k1 ) (Zmult c2 k2 )))

(Zplus (Zmult l1 k1 ) (Zmult l2 k2 ))))]

(eq ind r Z (Zplus (Zmult v (Zplus (Zmult c1 k1 ) (Zmult c2 k2 ))) (Zplus (Zmult l1 k1 ) (Zmult l2 k2 )))

P H

(Zplus (Zmult (Zplus (Zmult v c1 ) l1 ) k1 )

(Zmult (Zplus (Zmult v c2 ) l2 ) k2 ))

(OMEGA10 v c1 c2 l1 l2 k1 k2 )).

Definition fast OMEGA11 := [v1 , c1 , l1 , l2 , k1 : Z ][P : Z → Prop] [H : (P (Zplus (Zmult v1 (Zmult c1 k1 )) (Zplus (Zmult l1 k1 ) l2 )))] (eq ind r Z

(Zplus (Zmult v1 (Zmult c1 k1 )) (Zplus (Zmult l1 k1 ) l2 ))

P H

(Zplus (Zmult (Zplus (Zmult v1 c1 ) l1 ) k1 ) l2 )

(OMEGA11 v1 c1 l1 l2 k1 )). Definition fast OMEGA12 := [v2 , c2 , l1 , l2 , k2 : Z ][P : Z → Prop] [H : (P (Zplus (Zmult v2 (Zmult c2 k2 )) (Zplus l1 (Zmult l2 k2 ))))] (eq ind r Z

(Zplus (Zmult v2 (Zmult c2 k2 )) (Zplus l1 (Zmult l2 k2 )))

P H

(Zplus l1 (Zmult (Zplus (Zmult v2 c2 ) l2 ) k2 ))

(OMEGA12 v2 c2 l1 l2 k2 )).

Definition fast OMEGA15 := [v, c1 , c2 , l1 , l2 , k2 : Z ][P : Z → Prop] [H : (P (Zplus (Zmult v (Zplus c1 (Zmult c2 k2 ))) (Zplus l1 (Zmult l2 k2 ))))] (eq ind r Z

(Zplus (Zmult v (Zplus c1 (Zmult c2 k2 ))) (Zplus l1 (Zmult l2 k2 )))

P H

(Zplus (Zplus (Zmult v c1 ) l1 ) (Zmult (Zplus (Zmult v c2 ) l2 ) k2 ))

(OMEGA15 v c1 c2 l1 l2 k2 )). Definition fast OMEGA16 := [v, c, l, k : Z ][P : Z → Prop] [H : (P (Zplus (Zmult v (Zmult c k)) (Zmult l k)))] (eq ind r Z

(Zplus (Zmult v (Zmult c k)) (Zmult l k))

P H

(Zmult (Zplus (Zmult v c) l) k)

(OMEGA16 v c l k)).

Definition fast OMEGA13 := [v, l1 , l2 : Z ][x : positive][P : Z → Prop] [H : (P (Zplus l1 l2 ))] (eq ind r Z

(Zplus l1 l2 )

P H

(Zplus (Zplus (Zmult v (POS x)) l1 ) (Zplus (Zmult v (NEG x)) l2 ))

(OMEGA13 v l1 l2 x )).

Definition fast OMEGA14 := [v, l1 , l2 : Z ][x : positive][P : Z → Prop] [H : (P (Zplus l1 l2 ))] (eq ind r Z

(Zplus l1 l2 )

P H

(Zplus (Zplus (Zmult v (NEG x)) l1 ) (Zplus (Zmult v (POS x)) l2 ))

(OMEGA14 v l1 l2 x )). Definition fast Zred factor0 := [x : Z ][P : Z → Prop] [H : (P (Zmult x (POS xH )) )] (eq ind r Z

(Zmult x (POS xH ))

P H

x

(Zred factor0 x)).

Definition fast Zopp one := [x : Z ][P : Z → Prop] [H : (P (Zmult x (NEG xH )))] (eq ind r Z

(Zmult x (NEG xH ))

P H

(Zopp x)

(Zopp one x)).

Definition fast Zmult sym := [x, y : Z ][P : Z → Prop] [H : (P (Zmult y x))] (eq ind r Z (Zmult y x)

P H

(Zmult x y)

(Zmult sym x y )).

Definition fast Zopp Zplus := [x, y : Z ][P : Z → Prop] [H : (P (Zplus (Zopp x) (Zopp y)) )] (eq ind r Z (Zplus (Zopp x) (Zopp y))

P H

(Zopp (Zplus x y)) (Zopp Zplus x y )).

Definition fast Zopp Zopp := [x : Z ][P : Z → Prop] [H : (P x )] (eq ind r Z x P H (Zopp (Zopp x)) (Zopp Zopp x)).

Definition fast Zopp Zmult r := [x, y : Z ][P : Z → Prop] [H : (P (Zmult x (Zopp y)))] (eq ind r Z

(Zmult x (Zopp y))

P H

(Zopp (Zmult x y)) (Zopp Zmult r x y )).

Definition fast Zmult plus distr := [n, m, p : Z ][P : Z → Prop] [H : (P (Zplus (Zmult n p) (Zmult m p)))] (eq ind r Z

(Zplus (Zmult n p) (Zmult m p))

P H

(Zmult (Zplus n m) p) (Zmult plus distr l n m p)).

Definition fast Zmult Zopp left := [x, y : Z ][P : Z → Prop] [H : (P (Zmult x (Zopp y)))] (eq ind r Z

(Zmult x (Zopp y))

P H

(Zmult (Zopp x) y) (Zmult Zopp left x y)).

Definition fast Zmult assoc r := [n, m, p : Z ][P : Z → Prop] [H : (P (Zmult n (Zmult m p)))] (eq ind r Z

(Zmult n (Zmult m p))

P H

(Zmult (Zmult n m) p) (Zmult assoc r n m p)).

Definition fast Zred factor1 := [x : Z ][P : Z → Prop] [H : (P (Zmult x (POS (xO xH ))) )] (eq ind r Z

(Zmult x (POS (xO xH )))

P H

(Zplus x x) (Zred factor1 x)).

Definition fast Zred factor2 := [x, y : Z ][P : Z → Prop] [H : (P (Zmult x (Zplus (POS xH ) y)))] (eq ind r Z

(Zmult x (Zplus (POS xH ) y))

P H

(Zplus x (Zmult x y)) (Zred factor2 x y)).

Definition fast Zred factor3 := [x, y : Z ][P : Z → Prop] [H : (P (Zmult x (Zplus (POS xH ) y)))] (eq ind r Z

(Zmult x (Zplus (POS xH ) y))

P H

(Zplus (Zmult x y) x) (Zred factor3 x y)).

Definition fast Zred factor4 := [x, y, z : Z ][P : Z → Prop] [H : (P (Zmult x (Zplus y z)))] (eq ind r Z

(Zmult x (Zplus y z))

P H

(Zplus (Zmult x y) (Zmult x z)) (Zred factor4 x y z)).

Definition fast Zred factor5 := [x, y : Z ][P : Z → Prop] [H : (P y)] (eq ind r Z

y

P H

(Zplus (Zmult x ZERO) y) (Zred factor5 x y)).

Definition fast Zred factor6 := [x : Z ][P : Z → Prop] [H : (P(Zplus x ZERO) )] (eq ind r Z

(Zplus x ZERO)

P H

x (Zred factor6 x )).

Module Zsyntax

Id : Zsyntax.v, v1.72001/03/1513 : 38 : 55filliatrExp Require Export fast integer. Require Export zarith aux.

Axiom My special variable0 : positive → positive. Axiom My special variable1 : positive → positive.

Grammar znatural ident := nat id [ prim : var($id) ] → [$id]

with number :=

with negnumber :=

with formula : constr :=

form expr [ expr($p) ] → [$p] | form eq [ expr($p) "=" expr($c) ] → [ (eq Z $p $c) ] | form le [ expr($p) "<=" expr($c) ] → [ (Zle $p $c) ] | form lt [ expr($p) "<" expr($c) ] → [ (Zlt $p $c) ] | form ge [ expr($p) ">=" expr($c) ] → [ (Zge $p $c) ] | form gt [ expr($p) ">" expr($c) ] → [ (Zgt $p $c) ] | form eq eq [ expr($p) "=" expr($c) "=" expr($c1) ]

→ [ (eq Z $p $c) ∧ (eq Z $c $c1) ]

| form le le [ expr($p) "<=" expr($c) "<=" expr($c1) ]

→ [ (Zle $p $c) ∧ (Zle $c $c1) ]

| form le lt [ expr($p) "<=" expr($c) "<" expr($c1) ]

→ [ (Zle $p $c) ∧ (Zlt $c $c1) ]

| form lt le [ expr($p) "<" expr($c) "<=" expr($c1) ]

→ [ (Zlt $p $c) ∧ (Zle $c $c1) ]

| form lt lt [ expr($p) "<" expr($c) "<" expr($c1) ]

→ [ (Zlt $p $c) ∧ (Zlt $c $c1) ]

| form neq [ expr($p) "<>" expr($c) ] → [ ¬(eq Z $p $c) ] | form comp [ expr($p) "?=" expr($c) ] → [ (Zcompare $p $c) ]

with expr : constr :=

expr plus [ expr($p) "+" expr($c) ] → [ (Zplus $p $c) ] | expr minus [ expr($p) "-" expr($c) ] → [ (Zminus $p $c) ] | expr2 [ expr2 ($e) ] → [$e]

with expr2 : constr :=

expr mult [ expr2 ($p) "*" expr2 ($c) ] → [ (Zmult $p $c) ] | expr1 [ expr1 ($e) ] → [$e]

with expr1 : constr :=

expr abs [ "|" expr($c) "|" ] → [ (Zabs $c) ] | expr0 [ expr0 ($e) ] → [$e]

with expr0 : constr :=

expr id [ constr : global($c) ] → [ $c ] | expr com [ "[" constr : constr($c) "]" ] → [$c] | expr appl [ "(" application($a) ")" ] → [$a] | expr num [ number($s) ] → [$s ] | expr negnum [ "-" negnumber($n) ] → [ $n ] | expr inv [ "-" expr0 ($c) ] → [ (Zopp $c) ] with application : constr :=

apply [ application($p) expr($c1) ] → [ ($p $c1) ] | pair [ expr($p) "," expr($c) ] → [ ($p, $c) ] | appl0 [ expr($a) ] → [$a] .

Grammar constr constr0 := z in com [ "`" znatural : formula($c) "`" ] → [$c].

Grammar constr pattern := z in pattern [ "`" znatural : number($c) "`" ] → [$c].

The symbols "‘" "‘" must be printed just once at the top of the expession, to avoid printings like |“x‘ + ‘y“ < ‘45‘| for |x + y < 45|. So when a Z-expression is to be printed, its sub-expresssions are enclosed into an ast (ZEXPR subexpr).(ZEXP Rs) is printed like sbutwithoutsymbols”‘””‘”around. There is just one problem: NEG and Zopp have the same printing rules. If Zopp is opaque, we may not be able to solve a goal like ‘ -5 = -5 ‘ by reflexivity. (In fact, this precise Goal is solved by the Reflexivity tactic, but more complex problems may arise SOLUTION : Print (Zopp 5) for constants and -x for variables

Module ZArith dec

Require Sumbool.

Require fast integer. Require zarith aux. Require auxiliary. Require Zsyntax.

Lemma Dcompare inf : (r : relation) {r = EGAL} + {r = INFERIEUR} + {r = SUPERIEUR}.

Lemma Zcompare rec :

(P :Set)(x, y : Z )

((Zcompare x y) = EGAL → P) →

((Zcompare x y) = INFERIEUR → P) → ((Zcompare x y) = SUPERIEUR → P) → P.

Section decidability.

Local inf decidable := [P :Prop] {P} + {¬P}.

Variables x, y : Z .

Theorem Z eq dec : (inf decidable (x = y)).

Theorem Z lt dec : (inf decidable (Zlt x y)).

Theorem Z le dec : (inf decidable (Zle x y)).

Theorem Z gt dec : (inf decidable (Zgt x y)).

Theorem Z ge dec : (inf decidable (Zge x y)).

Theorem Z lt ge dec : {‘x < y‘} + {‘x ≥ y‘}.

Theorem Z le gt dec : {‘x ≤ y‘} + {‘x > y‘}. Theorem Z gt le dec : {‘x > y‘} + {‘x ≤ y‘}. Theorem Z ge lt dec : {‘x ≥ y‘} + {‘x < y‘}. Theorem Z le lt eq dec : ‘x ≤ y‘ → {‘x < y‘} + {x = y}. End decidability. Theorem Z zerop : (x : Z ){(‘x = 0‘)} + {(‘x ≠ 0‘)}. Definition Z notzerop := [x : Z ](sumbool not ? ? (Z zerop x)). Definition Z noteq dec := [x, y : Z ](sumbool not ? ? (Z eq dec x y)).

Module Wf Z

Id : W f_{Z}.v, v1.62001/03/1513 : 38 : 55filliatrExp Require fast integer. Require zarith aux. Require auxiliary. Require Zsyntax. Our purpose is to write an induction shema for 0,1,2,... similar to the nat schema (Theorem Natlike rec). For that the following implications will be used :

 (n:nat)(Q n)==(n:nat)(P (inject_nat n)) ===> (x:Z)`x > 0) -> (P x)
             /\
     ||
     ||
  (Q O) (n:nat)(Q n)->(Q (S n)) <=== (P 0) (x:Z) (P x) -> (P (Zs x))
                               <=== (inject_nat (S n))=(Zs (inject_nat n))
                               <=== inject_nat_complete
  Then the  diagram will be closed and the theorem proved.

Lemma inject nat complete :

(x : Z )‘0 ≤ x‘ → (EX n : nat | x = (inject nat n)). Lemma ZL4 inf : (y : positive) { h : nat | (convert y) = (S h) }. Lemma inject nat complete inf :

(x : Z )‘0 ≤ x‘ → { n : nat | (x = (inject nat n)) }. Lemma inject nat prop :

(P : Z → Prop)((n : nat)(P (inject nat n))) →

(x : Z ) ‘0 ≤ x‘ → (P x). Lemma ZERO le inj :

(n : nat) ‘0 ≤ (inject nat n)‘.

Lemma natlike ind : (P : Z → Prop) (P ‘0‘) → ((x : Z )(‘0 ≤ x‘ → (P x) → (P (Zs x)))) → (x : Z ) ‘0 ≤ x‘ → (P x).

Lemma Z lt induction :

(P : Z → Prop)

((x : Z )((y : Z )‘0 ≤ y < x‘ → (P y)) → (P x)) → (x : Z )‘0 ≤ x‘ → (P x).

Module Zmisc

Module Zmisc.v : Definitions et lemmes complementaires Division euclidienne Patrick Loiseleur, avril 1997

Require fast integer. Require zarith aux. Require auxiliary. Require Zsyntax. Require Bool.

********************************************************************* Overview of the sections of this file :

- logic : Logic complements. - numbers : a few very simple lemmas for manipulating the constructors POS, NEG, ZERO and xI , xO, xH - registers : defining arrays of bits and their relation with integers. - iter : the n-th iterate of a function is defined for n:nat and n:positive. The two notions are identified and an invariant conservation theorem is proved. - recursors : Here a nat-like recursor is built. - arith : lemmas about < ≤ ? = + × ...

***********************************************************************

Section logic.

Lemma rename : (A :Set)(P : A → Prop)(x : A) ((y : A)(x = y) → (P y)) → (P x).

End logic.

Section numbers.

Definition entier of Z := [z : Z ]Case z of Nul Pos Pos end. Definition Z of entier := [x : entier]Case x of ZERO POS end.

Lemma POS xI : (p : positive) (POS (xI p)) = ‘2 × (POS p) + 1‘. Lemma POS xO : (p : positive) (POS (xO p)) = ‘2 × (POS p)‘. Lemma NEG xI : (p : positive) (NEG (xI p)) = ‘2 × (NEG p) − 1‘. Lemma NEG xO : (p : positive) (NEG (xO p)) = ‘2 × (NEG p)‘.

Lemma POS add : (p, p′ : positive)‘(POS (add p p′)) = (POS p) + (POS p′)‘.

Lemma NEG add : (p, p′ : positive)‘(NEG (add p p′)) = (NEG p) + (NEG p′)‘.

Definition Zle bool := [x, y : Z ]Case ‘x ? = y‘ of true true false end.

Definition Zge bool := [x, y : Z ]Case ‘x ? = y‘ of true false true end. Definition Zlt bool := [x, y : Z ]Case ‘x ? = y‘ of false true false end. Definition Zgt bool := [x, y : Z ]Case ‘ x ? = y‘ of false false true end. Definition Zeq bool := [x, y : Z ]Cases ‘x ? = y‘ of EGAL ⇒ true | ⇒ false end. Definition Zneq bool := [x, y : Z ]Cases ‘x ? = y‘ of EGAL ⇒ false | ⇒ true end.

End numbers.

Section iterate.

l’itere n-ieme d’une fonction f

Fixpoint iter nat[n : nat] : (A :Set)(f : A → A)A → A :=

[A :Set][f : A → A][x : A]

Cases n of O ⇒ x

| (S n′) ⇒ (f (iter nat n′ A f x))

end.

Fixpoint iter pos[n : positive] : (A :Set)(f : A → A)A → A :=

[A :Set][f : A → A][x : A]

Cases n of

xH ⇒ (f x) | (xO n′) ⇒ (iter pos n′ A f (iter pos n′ A f x)) | (xI n′) ⇒ (f (iter pos n′ A f (iter pos n′ A f x)))

end.

Definition iter :=

[n : Z ][A :Set][f : A → A][x : A]Cases n of

ZERO ⇒ x | (POS p) ⇒ (iter pos p A f x) | (NEG p) ⇒ x end.

Theorem iter nat plus :

(n, m : nat)(A :Set)(f : A → A)(x : A)

(iter nat (plus n m) A f x) = (iter nat n A f (iter nat m A f x)).

Theorem iter convert : (n : positive)(A :Set)(f : A → A)(x : A)

(iter pos n A f x) = (iter nat (convert n) A f x).

Theorem iter pos add :

(n, m : positive)(A :Set)(f : A → A)(x : A)

(iter pos (add n m) A f x) = (iter pos n A f (iter pos m A f x)).

Preservation of invariants : if f : A->A preserves the invariant Inv, then the iterates of f also preserve it.

Theorem iter nat invariant :

(n : nat)(A :Set)(f : A → A)(Inv : A → Prop)

((x : A)(Inv x) → (Inv (f x))) → (x : A)(Inv x) → (Inv (iter nat n A f x)).

Theorem iter pos invariant :

(n : positive)(A :Set)(f : A → A)(Inv : A → Prop)

((x : A)(Inv x) → (Inv (f x))) → (x : A)(Inv x) → (Inv (iter pos n A f x)).

End iterate.

Section arith.

Lemma ZERO le POS : (p : positive) ‘0 ≤ (POS p)‘.

Lemma POS gt ZERO : (p : positive) ‘(POS p) > 0‘.

Lemma Zlt ZERO pred le ZERO : (x : Z ) ‘0 < x‘ → ‘0 ≤ (Zpred x)‘.

Zeven, Zodd, Zdiv2 and their related properties

Definition Zeven :=

[z : Z ]Cases z of ZERO ⇒ True | (POS (xO )) ⇒ True | (NEG (xO )) ⇒ True | ⇒ False end.

Definition Zodd :=

[z : Z ]Cases z of (POS xH ) ⇒ True | (NEG xH ) ⇒ True | (POS (xI )) ⇒ True | (NEG (xI )) ⇒ True | ⇒ False end.

Definition Zeven bool :=

[z : Z ]Cases z of ZERO ⇒ true | (POS (xO )) ⇒ true | (NEG (xO )) ⇒ true | ⇒ false end.

Definition Zodd bool :=

[z : Z ]Cases z of ZERO ⇒ false | (POS (xO )) ⇒ false | (NEG (xO )) ⇒ false | ⇒ true end.

Lemma Zeven odd dec : (z : Z ) { (Zeven z) } + { (Zodd z) }.

Lemma Zeven dec : (z : Z ) { (Zeven z) } + { ¬(Zeven z) }.

Lemma Zodd dec : (z : Z ) { (Zodd z) } + { ¬(Zodd z) }.

Lemma Zeven not Zodd : (z : Z )(Zeven z) → ¬(Zodd z).

Lemma Zodd not Zeven : (z : Z )(Zodd z) → ¬(Zeven z).

Hints Unfold Zeven Zodd : zarith.

Zdiv2 is defined on all Z, but notice that for odd negative integers it is not the euclidean quotient: in that case we have n = 2*(n/2)-1 Definition Zdiv2 pos :=

[z : positive]Cases z of xH ⇒ xH | (xO p) ⇒ p | (xI p) ⇒ p end.

Definition Zdiv2 :=

[z : Z ]Cases z of ZERO ⇒ ZERO | (POS xH ) ⇒ ZERO | (POS p) ⇒ (POS (Zdiv2 pos p)) | (NEG xH ) ⇒ ZERO | (NEG p) ⇒ (NEG (Zdiv2 pos p)) end.

Lemma Zeven div2 : (x : Z ) (Zeven x) → ‘x = 2 × (Zdiv2 x)‘.

Lemma Zodd div2 : (x : Z ) ‘x ≥ 0‘ → (Zodd x) → ‘x = 2 × (Zdiv2 x) + 1‘.

Lemma Z modulo 2 : (x : Z ) ‘x ≥ 0‘ → { y : Z | ‘x = 2 × y‘ } + { y : Z | ‘x = 2 × y + 1‘ }.

Very simple

Lemma Zminus Zplus compatible :

(x, y, n : Z ) ‘(x + n) − (y + n) = x − y‘.

Decompose an egality between two ?= relations into 3 implications

Theorem Zcompare egal dec :

(x1 , y1 , x2 , y2 : Z )

(‘x1 < y1 ‘ → ‘x2 < y2 ‘)

→ (‘x1 ? = y1 ‘ = EGAL → ‘x2 ? = y2 ‘ = EGAL) → (‘x1 > y1 ‘ → ‘x2 > y2 ‘) → ‘x1 ? = y1 ‘ = ‘x2 ? = y2 ‘.

Theorem Zcompare elim :

(c1 , c2 , c3 :Prop)(x, y : Z )

((x = y) → c1 ) → (‘x < y‘ → c2 ) → (‘x > y‘ → c3 ) → Case ‘x ? = y‘of c1 c2 c3 end.

Lemma Zcompare x x : (x : Z ) ‘x ? = x‘ = EGAL.

Lemma Zlt not eq : (x, y : Z )‘x < y‘ → ¬x = y.

Lemma Zcompare eq case :

(c1 , c2 , c3 :Prop)(x, y : Z ) c1 → x = y → (Case ‘x ? = y‘ of c1 c2 c3 end).

Four very basic lemmas about Zle, Zlt, Zge, Zgt

Lemma Zle Zcompare :

(x, y : Z )‘x ≤ y‘ → Case ‘x ? = y‘ of True True False end.

Lemma Zlt Zcompare :

(x, y : Z )‘x < y‘ → Case ‘x ? = y‘ of False True False end.

Lemma Zge Zcompare :

(x, y : Z )‘ x ≥ y‘ → Case ‘x ? = y‘ of True False True end.

Lemma Zgt Zcompare :

(x, y : Z )‘x > y‘ → Case ‘x ? = y‘ of False False True end.

Lemmas about Zmin

Lemma Zmin plus : (x, y, n : Z ) ‘(Zmin (x + n)(y + n)) = (Zmin x y) + n‘.

Lemmas about absolu

Lemma absolu lt : (x, y : Z ) ‘0 ≤ x < y‘ → (lt (absolu x) (absolu y)).

End arith.

Module ZArith

Library for manipulating integers based on binary encoding

Require Export fast integer. Require Export zarith aux. Require Export auxiliary. Require Export Zsyntax. Require Export ZArith dec. Require Export Zmisc. Require Export Wf Z .

Hints Resolve Zle n Zplus sym Zplus assoc Zmult sym Zmult assoc

Zero left Zero right Zmult one Zplus inverse l Zplus inverse r

Zmult plus distr l Zmult plus distr r : zarith.

4 Reals

This library contains an axiomatization of real numbers. The main file is Reals.v.

Module TypeSyntax

Id : T ypeSyntax.v, v1.22001/03/1513 : 38 : 53filliatrExp Or and Exist in Type

Inductive sumboolT [A, B :Prop] :Type:= leftT : A → (sumboolT A B) |rightT : B → (sumboolT A B).

Inductive sumorT [A :Type;B :Prop] :Type:= inleftT : A → (sumorT A B) |inrightT : B → (sumorT A B).

Inductive sigT [A :Set;P : A → Prop] :Type:= existT : (x : A)(P x) → (sigT A P).

Inductive sigTT [A :Type;P : A → Prop] :Type:= existTT : (x : A)(P x) → (sigTT A P).

Module Rsyntax

Require Export Rdefinitions.

Axiom NRplus : R → R → R.

Grammar rnatural ident := nat id [ prim : var($id) ] → [$id]

with rnegnumber := neg expr [ "-" rnumber ($c) ] → [<< (Ropp $c) >>]

with rnumber :=

with rformula :=

form expr [ rexpr($p) ] → [$p] | form eq [ rexpr($p) "==" rexpr($c) ] → [<< (eqT R $p $c) >>] | form le [ rexpr($p) "<=" rexpr($c) ] → [<< (Rle $p $c) >>] | form lt [ rexpr($p) "<" rexpr($c) ] → [<< (Rlt $p $c) >>] | form ge [ rexpr($p) ">=" rexpr($c) ] → [<< (Rge $p $c) >>] | form gt [ rexpr($p) ">" rexpr($c) ] → [<< (Rgt $p $c) >>] | form eq eq [ rexpr($p) "==" rexpr($c) "==" rexpr($c1) ]

→ [<< (eqT R $p $c) ∧ (eqT R $c $c1) >>]

| form le le [ rexpr($p) "<=" rexpr($c) "<=" rexpr($c1) ]

→ [<< (Rle $p $c) ∧ (Rle $c $c1) >>]

| form le lt [ rexpr($p) "<=" rexpr($c) "<" rexpr($c1) ]

→ [<< (Rle $p $c) ∧ (Rlt $c $c1) >>]

| form lt le [ rexpr($p) "<" rexpr($c) "<=" rexpr($c1) ]

→ [<< (Rlt $p $c) ∧ (Rle $c $c1) >>]

| form lt lt [ rexpr($p) "<" rexpr($c) "<" rexpr($c1) ]

→ [<< (Rlt $p $c) ∧ (Rlt $c $c1) >>]

| form neq [ rexpr($p) "<>" rexpr($c) ] → [<< ¬(eqT R $p $c) >>]

with rexpr :=

expr plus [ rexpr($p) "+" rexpr($c) ] → [<< (Rplus $p $c) >>] | expr minus [ rexpr($p) "-" rexpr($c) ] → [<< (Rminus $p $c) >>] | rexpr2 [ rexpr2 ($e) ] → [$e]

with rexpr2 :=

expr mult [ rexpr2 ($p) "*" rexpr2 ($c) ] → [<< (Rmult $p $c) >>] | rexpr0 [ rexpr0 ($e) ] → [$e]

with rexpr0 :=

expr id [ constr : global($c) ] → [$c] | expr hole [ "?" ] → [<< ? >>] | expr com [ "[" constr : constr($c) "]" ] → [$c] | expr appl [ "(" rapplication($a) ")" ] → [$a] | expr num [ rnumber($s) ] → [$s ] | expr negnum [ "-" rnegnumber($n) ] → [ $n ] | expr div [ rexpr0 ($p) "/" rexpr0 ($c) ] → [<< (Rdiv $p $c) >>] | expr opp [ "-" rexpr0 ($c) ] → [<< (Ropp $c) >>] | expr inv [ "1" "/" rexpr0 ($c) ] → [<< (Rinv $c) >>] with rapplication :=

apply [ rapplication($p) rexpr($c1) ] → [<< ($p $c1) >>] | pair [ rexpr($p) "," rexpr($c) ] → [<< ($p, $c) >>] | appl0 [ rexpr($a) ] → [$a].

Grammar command command0 := r in com [ "“" rnatural : rformula($c) "“" ] → [$c].

Grammar command atomic pattern := r in pattern [ "“" rnatural : rnumber($c) "“" ] → [$c].

* pp * pb: on rajoute des () lorsque les constantes terminent par 1 lors de l’appel avec NRplus

Module Rdefinitions

Definitions for the axiomatization

Require Export ZArith. Require Export TypeSyntax.

Parameter R :Type. Parameter R0 : R. Parameter R1 : R. Parameter Rplus : R → R → R. Parameter Rmult : R → R → R. Parameter Ropp : R → R. Parameter Rinv : R → R. Parameter Rlt : R → R → Prop. Parameter up : R → Z . (∗*******************************************************∗)

Definition Rgt : R → R → Prop:=[r1 , r2 : R](Rlt r2 r1 ).

Definition Rle : R → R → Prop:=[r1 , r2 : R]((Rlt r1 r2 ) ∨ (r1 == r2 )).

Definition Rge : R → R → Prop:=[r1 , r2 : R]((Rgt r1 r2 ) ∨ (r1 == r2 )).

Definition Rminus : R → R → R := [r1 , r2 : R](Rplus r1 (Ropp r2 )).

Definition Rdiv : R → R → R := [r1 , r2 : R](Rmult r1 (Rinv r2 )).

Module Raxioms

Axiomatisation of the classical reals

Require Export ZArith. Require Export Rsyntax. Require Export TypeSyntax.

Field axioms Addition

Axiom Rplus sym : (r1 , r2 : R)“r1 + r2 == r2 + r1 “.

Hints Resolve Rplus sym : real. Axiom Rplus assoc : (r1 , r2 , r3 : R)“(r1 + r2 ) + r3 == r1 + (r2 + r3 )“. Hints Resolve Rplus assoc : real. Axiom Rplus Ropp r : (r : R)“r + (−r) == 0“. Hints Resolve Rplus Ropp r : real v62 . Axiom Rplus Ol : (r : R)“0 + r == r“. Hints Resolve Rplus Ol : real.

Multiplication Axiom Rmult sym : (r1 , r2 : R)“r1 × r2 == r2 × r1 “. Hints Resolve Rmult sym : real v62 . Axiom Rmult assoc : (r1 , r2 , r3 : R)“(r1 × r2 ) × r3 == r1 × (r2 × r3 )“. Hints Resolve Rmult assoc : real v62 . Axiom Rinv l : (r : R)“r ≠ 0“ → “(1/r) × r == 1“. Hints Resolve Rinv l : real. Axiom Rmult 1l : (r : R)“1 × r == r“. Hints Resolve Rmult 1l : real. Axiom R1 neq R0 : “1 ≠ 0“. Hints Resolve R1 neq R0 : real.

Distributivity Axiom Rmult Rplus distr : (r1 , r2 , r3 : R)“r1 × (r2 + r3 ) == (r1 × r2 ) + (r1 × r3 )“. Hints Resolve Rmult Rplus distr : real v62 . Order axioms

Total Order Axiom total order T : (r1 , r2 : R)(sumorT (sumboolT “r1 < r2 “ r1 == r2 ) “r1 > r2 “).

Lower Axiom Rlt antisym : (r1 , r2 : R)“r1 < r2 “ → ¬ “r2 < r1 “. Axiom Rlt trans : (r1 , r2 , r3 : R)

“r1 < r2 “ → “r2 < r3 “ → “r1 < r3 “. Axiom Rlt compatibility : (r, r1 , r2 : R)“r1 < r2 “ → “r + r1 < r + r2 “. Axiom Rlt monotony : (r, r1 , r2 : R)“0 < r“ → “r1 < r2 “ → “r × r1 < r × r2 “. Hints Resolve Rlt antisym Rlt compatibility Rlt monotony : real.

Injection from N to R Fixpoint INR [n : nat] : R := (Cases n of

O ⇒ “0“

|(S O) ⇒ “1“
|(S n) ⇒ “(INR n) + 1“
end).

Injection from Z to R Definition IZR : Z → R := [z : Z ](Cases z of

ZERO ⇒ “0“ |(POS n) ⇒ (INR (convert n)) |(NEG n) ⇒ “ − (INR (convert n))“

end).

R Archimedian

Axiom archimed : (r : R)“(IZR (up r)) > r“ ∧ “(IZR (up r)) − r ≤ 1“.

R Complete

Definition is upper bound := [E : R → Prop][m : R](x : R)(E x) → “x ≤ m“.

Definition bound := [E : R → Prop](ExT [m : R](is upper bound E m)).

Definition is lub := [E : R → Prop][m : R] (is upper bound E m) ∧ (b : R)(is upper bound E b) → “m ≤ b“.

Axiom complet : (E : R → Prop)(bound E) → (ExT [x : R] (E x)) → (ExT [m : R](is lub E m)).

Module Rbase

Basic lemmas for the classical reals numbers

Require Export Raxioms. Require Export ZArithRing. Require Omega.

Instantiating Ring tactic on reals

Lemma RTheory : (Ring Theory Rplus Rmult R1 R0 Ropp [x, y : R]false).

Add Abstract Ring R Rplus Rmult R1 R0 Ropp [x, y : R]false RTheory.

Relation between orders and equality

Lemma Rlt antirefl : (r : R)¬“r < r“. Hints Resolve Rlt antirefl : real.

Lemma Rlt not eq : (r1 , r2 : R)“r1 < r2 “ → “r1 ≠ r2 “.

Lemma Rgt not eq : (r1 , r2 : R)“r1 > r2 “ → “r1 ≠ r2 “.

Lemma imp not Req : (r1 , r2 : R)(“r1 < r2 “ ∨ “r1 > r2 “) → “r1 ≠ r2 “. Hints Resolve imp not Req : real.

Reasoning by case on equalities and order

Lemma Req EM : (r1 , r2 : R)(r1 == r2 ) ∨ “r1 ≠ r2 “. Hints Resolve Req EM : real.

Lemma total order : (r1 , r2 : R)“r1 < r2 “ ∨ (r1 == r2 ) ∨ “r1 > r2 “.

Lemma not Req : (r1 , r2 : R)“r1 ≠ r2 “ → (“r1 < r2 “ ∨ “r1 > r2 “).

Order Lemma : relating <, >, ≤ and ≥

Lemma Rlt le : (r1 , r2 : R)“r1 < r2 “ → “r1 ≤ r2 “. Hints Resolve Rlt le : real.

Lemma Rle ge : (r1 , r2 : R)“r1 ≤ r2 “ → “r2 ≥ r1 “.

Lemma Rge le : (r1 , r2 : R)“r1 ≥ r2 “ → “r2 ≤ r1 “.

Lemma not Rle : (r1 , r2 : R)¬(“r1 ≤ r2 “) → “r1 > r2 “.

Hints (∗********∗) Lemma Rlt le not : (r1 , r2 : R)“r2 < r1 “ → ¬(“r1 ≤ r2 “).

Lemma Rle not : (r1 , r2 : R)“r1 > r2 “ → ¬(“r1 ≤ r2 “).

Hints (∗********∗) Lemma Rlt ge not : (r1 , r2 : R)“r1 < r2 “ → ¬(“r1 ≥ r2 “).

Hints (∗********∗) Lemma eq Rle : (r1 , r2 : R)r1 == r2 → “r1 ≤ r2 “. Hints Lemma eq Rge : (r1 , r2 : R)r1 == r2 → “r1 ≥ r2 “. Hints Lemma eq Rle sym : (r1 , r2 : R)r2 == r1 → “r1 ≤ r2 “. Hints Lemma eq Rge sym : (r1 , r2 : R)r2 == r1 → “r1 ≥ r2 “. Hints Lemma Rle antisym : (r1 , r2 : R)“r1 ≤ r2 “ → “r2 ≤ r1 “ → r1 == r2 . Hints Resolve Rle antisym : real.

Lemma Rle le eq : (r1 , r2 : R)(“r1 ≤ r2 “ ∧ “r2 ≤ r1 “) ↔ (r1 == r2 ).

Lemma Rle trans : (r1 , r2 , r3 : R) “r1 ≤ r2 “ → “r2 ≤ r3 “ → “r1 ≤ r3 “.

Lemma Rle lt trans : (r1 , r2 , r3 : R)“r1 ≤ r2 “ → “r2 < r3 “ → “r1 < r3 “.

Lemma Rlt le trans : (r1 , r2 , r3 : R)“r1 < r2 “ → “r2 ≤ r3 “ → “r1 < r3 “.

Decidability of the order

Lemma total order Rlt : (r1 , r2 : R)(sumboolT “r1 < r2 “ ¬(“r1 < r2 “)).

Lemma total order Rle : (r1 , r2 : R)(sumboolT “r1 ≤ r2 “ ¬(“r1 ≤ r2 “)).

Lemma total order Rgt : (r1 , r2 : R)(sumboolT “r1 > r2 “ ¬(“r1 > r2 “)).

Lemma total order Rge : (r1 , r2 : R)(sumboolT (“r1 ≥ r2 “) ¬(“r1 ≥ r2 “)).

Lemma total order Rlt Rle : (r1 , r2 : R)(sumboolT “r1 < r2 “ “r2 ≤ r1 “).

Lemma total order Rle Rlt eq : (r1 , r2 : R)“r1 ≤ r2 “ → (sumboolT “r1 < r2 “ “r1 == r2 “).

Lemma inser trans R : (n, m, p, q : R)“n ≤ m < p“ → (sumboolT “n ≤ m < q“ “q ≤ m < p“).

Field Lemmas This part contains lemma involving the Fields operations

Addition

Lemma Rplus ne : (r : R)“r + 0 == r“ ∧ “0 + r == r“. Hints Resolve Rplus ne : real v62 .

Lemma Rplus Or : (r : R)“r + 0 == r“. Hints Resolve Rplus Or : real.

Lemma Rplus Ropp l : (r : R)“(−r) + r == 0“. Hints Resolve Rplus Ropp l : real. Lemma Rplus Ropp : (x, y : R)“x + y == 0“ → “y == − x“. New Lemma Rplus plus r : (r, r1 , r2 : R)(r1 == r2 ) → “r + r1 == r + r2 “. (∗ Old ∗) Hints Resolve Rplus plus r : v62 . Lemma r Rplus plus : (r, r1 , r2 : R)“r + r1 == r + r2 “ → r1 == r2 . Hints Resolve r Rplus plus : real. Lemma Rplus ne i : (r, b : R)“r + b == r“ → “b == 0“.

Multiplication Lemma Rinv r : (r : R)“r ≠ 0“ → “r × (1/r) == 1“. Hints Resolve Rinv r : real. Lemma Rinv l sym : (r : R)“r ≠ 0“ → “1 == (1/r) × r“. Lemma Rinv r sym : (r : R)“r ≠ 0“ → “1 == r × (1/r)“. Hints Resolve Rinv l sym Rinv r sym : real. Lemma Rmult Or : (r : R) “r × 0 == 0“. Hints Resolve Rmult Or : real v62 . Lemma Rmult Ol : (r : R)(“0 × r == 0“). Hints Resolve Rmult Ol : real v62 . Lemma Rmult ne : (r : R)“r × 1 == r“ ∧ “1 × r == r“. Hints Resolve Rmult ne : real v62 . Lemma Rmult 1r : (r : R)(“r × 1 == r“). Hints Resolve Rmult 1r : real. Lemma Rmult mult r : (r, r1 , r2 : R)r1 == r2 → “r × r1 == r × r2 “. (∗ OLD ∗) Hints Resolve Rmult mult r : v62 . Lemma r Rmult mult : (r, r1 , r2 : R)(“r × r1 == r × r2 “) → “r ≠ 0“ → (r1 == r2 ). Lemma without div Od : (r1 , r2 : R)“r1 × r2 == 0“ → “r1 == 0“ ∨ “r2 == 0“. Lemma without div Oi : (r1 , r2 : R) “r1 == 0“ ∨ “r2 == 0“ → “r1 × r2 == 0“. Hints Resolve without div Oi : real. Lemma without div Oi1 : (r1 , r2 : R) “r1 == 0“ → “r1 × r2 == 0“. Lemma without div Oi2 : (r1 , r2 : R) “r2 == 0“ → “r1 × r2 == 0“. Lemma without div O contr : (r1 , r2 : R)“r1 × r2 ≠ 0“ → “r1 ≠ 0“ ∧ “r2 ≠ 0“. Lemma mult non zero : (r1 , r2 : R)“r1 ≠ 0“ ∧ “r2 ≠ 0“ → “r1 × r2 ≠ 0“. Hints Resolve mult non zero : real. Lemma Rmult Rplus distrl :

(r1 , r2 , r3 : R) “(r1 + r2 ) × r3 == (r1 × r3 ) + (r2 × r3 )“.

Square function Definition Rsqr : R → R := [r : R]“r × r“.

Lemma Rsqr O : (Rsqr “0“) == “0“.

Lemma Rsqr r R0 : (r : R)(Rsqr r) == “0“ → “r == 0“.

Opposite

Lemma eq Ropp : (r1 , r2 : R)(r1 == r2 ) → “ − r1 == − r2 “. Hints Resolve eq Ropp : real.

Lemma Ropp O : “ − 0 == 0“. Hints Resolve Ropp O : real v62 .

Lemma eq RoppO : (r : R)“r == 0“ → “ − r == 0“. Hints Resolve eq RoppO : real.

Lemma Ropp Ropp : (r : R)“ − (−r) == r“. Hints Resolve Ropp Ropp : real.

Lemma Ropp neq : (r : R)“r ≠ 0“ → “ − r ≠ 0“. Hints Resolve Ropp neq : real.

Lemma Ropp distr1 : (r1 , r2 : R)“ − (r1 + r2 ) == (−r1 + − r2 )“. Hints Resolve Ropp distr1 : real.

Opposite and multiplication

Lemma Ropp mul1 : (r1 , r2 : R)“(−r1 ) × r2 == − (r1 × r2 )“. Hints Resolve Ropp mul1 : real.

Lemma Ropp mul2 : (r1 , r2 : R)“(−r1 ) × (−r2 ) == r1 × r2 “. Hints Resolve Ropp mul2 : real.

Substraction

Lemma minus R0 : (r : R)“r − 0 == r“. Hints Resolve minus R0 : real.

Lemma Ropp distr2 : (r1 , r2 : R)“ − (r1 − r2 ) == r2 − r1 “. Hints Resolve Ropp distr2 : real.

Lemma eq Rminus : (r1 , r2 : R)(r1 == r2 ) → “r1 − r2 == 0“. Hints Resolve eq Rminus : real.

Lemma Rminus eq : (r1 , r2 : R)“r1 − r2 == 0“ → r1 == r2 . Hints (∗********∗) Lemma Rminus eq contra : (r1 , r2 : R)“r1 ≠ r2 “ → “r1 − r2 ≠ 0“. Hints Resolve Rminus eq contra : real.

Lemma Rminus distr : (x, y, z : R) “x × (y − z) == (x × y) − (x × z)“.

Inverse

Lemma Rinv R1 : “1/1 == 1“. Hints Resolve Rinv R1 : real.

Lemma Rinv neq R0 : (r : R)“r ≠ 0“ → “(1/r) ≠ 0“. Hints Resolve Rinv neq R0 : real.

Lemma Rinv Rinv : (r : R)“r ≠ 0“ → “1/(1/r) == r“. Hints Resolve Rinv Rinv : real.

Lemma Rinv Rmult : (r1 , r2 : R)“r1 ≠ 0“ → “r2 ≠ 0“ → “1/(r1 × r2 ) == (1/r1 ) × (1/r2 )“. Lemma Ropp Rinv : (r : R)“r ≠ 0“ → “ − (1/r) == 1/(−r)“. Lemma Rinv r simpl r : (r1 , r2 : R)“r1 ≠ 0“ → “r1 × (1/r1 ) × r2 == r2 “. Lemma Rinv r simpl l : (r1 , r2 : R)“r1 ≠ 0“ → “r2 × r1 × (1/r1 ) == r2 “. Lemma Rinv r simpl m : (r1 , r2 : R)“r1 ≠ 0“ → “r1 × r2 × (1/r1 ) == r2 “. Hints Resolve Rinv r simpl l Rinv r simpl r Rinv r simpl m : real. Lemma Rinv Rmult simpl : (a, b, c : R)“a ≠ 0“ → “(a × (1/b)) × (c × (1/a)) == c × (1/b)“.

Order and addition Lemma Rlt compatibility r : (r, r1 , r2 : R)“r1 < r2 “ → “r1 + r < r2 + r“. Hints Resolve Rlt compatibility r : real. Lemma Rlt anti compatibility : (r, r1 , r2 : R)“r + r1 < r + r2 “ → “r1 < r2 “. Lemma Rle compatibility : (r, r1 , r2 : R)“r1 ≤ r2 “ → “r + r1 ≤ r + r2 “. Lemma Rle compatibility r : (r, r1 , r2 : R)“r1 ≤ r2 “ → “r1 + r ≤ r2 + r“. Hints Resolve Rle compatibility Rle compatibility r : real. Lemma Rle anti compatibility : (r, r1 , r2 : R)“r + r1 ≤ r + r2 “ → “r1 ≤ r2 “. Lemma sum inequa Rle lt : (a, x, b, c, y, d : R)“a ≤ x“ → “x < b“ →

“c < y“ → “y ≤ d“ → “a + c < x + y < b + d“.

Lemma Rplus lt : (r1 , r2 , r3 , r4 : R)“r1 < r2 “ → “r3 < r4 “ → “r1 + r3 < r2 + r4 “. Lemma Rplus lt le lt : (r1 , r2 , r3 , r4 : R)“r1 < r2 “ → “r3 ≤ r4 “ → “r1 + r3 < r2 + r4 “. Lemma Rplus le lt lt : (r1 , r2 , r3 , r4 : R)“r1 ≤ r2 “ → “r3 < r4 “ → “r1 + r3 < r2 + r4 “. Hints (∗s Order and Opposite ∗) Lemma Rgt Ropp : (r1 , r2 : R) “r1 > r2 “ → “ − r1 < − r2 “. Hints Resolve Rgt Ropp. Lemma Rlt Ropp : (r1 , r2 : R) “r1 < r2 “ → “ − r1 > − r2 “. Hints Resolve Rlt Ropp : real. Lemma Rle Ropp : (r1 , r2 : R) “r1 ≤ r2 “ → “ − r1 ≥ − r2 “. Hints Resolve Rle Ropp : real. Lemma Rge Ropp : (r1 , r2 : R) “r1 ≥ r2 “ → “ − r1 ≤ − r2 “. Hints Resolve Rge Ropp : real. Lemma Rlt RO Ropp : (r : R) “0 < r“ → “0 > − r“. Hints Resolve Rlt RO Ropp : real. Lemma Rgt RO Ropp : (r : R) “0 > r“ → “0 < − r“. Hints Resolve Rgt RO Ropp : real. Lemma Rle RO Ropp : (r : R) “0 ≤ r“ → “0 ≥ − r“. Hints Resolve Rle RO Ropp : real. Lemma Rge RO Ropp : (r : R) “0 ≥ r“ → “0 ≤ − r“.

Hints Resolve Rge RO Ropp : real.

Order and multiplication

Lemma Rlt monotony r : (r, r1 , r2 : R)“0 < r“ → “r1 < r2 “ → “r1 × r < r2 × r“. Hints Resolve Rlt monotony r.

Lemma Rlt anti monotony : (r, r1 , r2 : R)“r < 0“ → “r1 < r2 “ → “r × r1 > r × r2 “.

Lemma Rle monotony :

(r, r1 , r2 : R)“0 ≤ r“ → “r1 ≤ r2 “ → “r × r1 ≤ r × r2 “. Hints Resolve Rle monotony : real.

Lemma Rle monotony r :

(r, r1 , r2 : R)“0 ≤ r“ → “r1 ≤ r2 “ → “r1 × r ≤ r2 × r“. Hints Resolve Rle monotony r : real.

Lemma Rle anti monotony

:(r, r1 , r2 : R)“r ≤ 0“ → “r1 ≤ r2 “ → “r × r1 ≥ r × r2 “. Hints Resolve Rle anti monotony : real.

Lemma Rmult lt : (r1 , r2 , r3 , r4 : R)“r3 > 0“ → “r2 > 0“ → “ r1 < r2 “ → “r3 < r4 “ → “r1 × r3 < r2 × r4 “. Order and Substractions

Lemma Rlt minus : (r1 , r2 : R)“r1 < r2 “ → “r1 − r2 < 0“. Hints Resolve Rlt minus : real.

Lemma Rle minus : (r1 , r2 : R)“r1 ≤ r2 “ → “r1 − r2 ≤ 0“.

Lemma Rminus lt : (r1 , r2 : R)“r1 − r2 < 0“ → “r1 < r2 “.

Lemma Rminus le : (r1 , r2 : R)“r1 − r2 ≤ 0“ → “r1 ≤ r2 “.

Lemma tech Rplus : (r, s : R)“0 ≤ r“ → “0 < s“ → “r + s ≠ 0“. Hints (∗s Order and the square function ∗) Lemma pos Rsqr : (r : R)“0 ≤ (Rsqr r)“.

Lemma pos Rsqr1 : (r : R)“r ≠ 0“ → “0 < (Rsqr r)“. Hints Resolve pos Rsqr pos Rsqr1 : real.

Zero is less than one

Lemma Rlt R0 R1 : “0 < 1“. Hints Resolve Rlt R0 R1 : real.

Order and inverse

Lemma Rlt Rinv : (r : R)“0 < r“ → “0 < 1/r“. Hints Resolve Rlt Rinv : real.

Lemma Rlt Rinv2 : (r : R)“r < 0“ → “1/r < 0“. Hints Resolve Rlt Rinv2 : real.

Lemma Rlt monotony rev :

(r, r1 , r2 : R)“0 < r“ → “r × r1 < r × r2 “ → “r1 < r2 “.

Lemma Rinv lt : (r1 , r2 : R)“0 < r1 × r2 “ → “r1 < r2 “ → “1/r2 < 1/r1 “.

Greater Lemma Rge ge eq : (r1 , r2 : R)“r1 ≥ r2 “ → “r2 ≥ r1 “ → r1 == r2 . Lemma Rlt not ge : (r1 , r2 : R)¬(“r1 < r2 “) → “r1 ≥ r2 “. Lemma Rgt not le : (r1 , r2 : R)¬(“r1 > r2 “) → “r1 ≤ r2 “. Lemma Rgt ge : (r1 , r2 : R)“r1 > r2 “ → “r1 ≥ r2 “. Lemma Rlt sym : (r1 , r2 : R)“r1 < r2 “ ↔ “r2 > r1 “. Lemma Rle sym1 : (r1 , r2 : R)“r1 ≤ r2 “ → “r2 ≥ r1 “. Lemma Rle sym2 : (r1 , r2 : R)“r2 ≥ r1 “ → “r1 ≤ r2 “. Lemma Rle sym : (r1 , r2 : R)“r1 ≤ r2 “ ↔ “r2 ≥ r1 “. Lemma Rge gt trans : (r1 , r2 , r3 : R)“r1 ≥ r2 “ → “r2 > r3 “ → “r1 > r3 “. Lemma Rgt ge trans : (r1 , r2 , r3 : R)“r1 > r2 “ → “r2 ≥ r3 “ → “r1 > r3 “. Lemma Rgt trans : (r1 , r2 , r3 : R)“r1 > r2 “ → “r2 > r3 “ → “r1 > r3 “. Lemma Rge trans : (r1 , r2 , r3 : R)“r1 ≥ r2 “ → “r2 ≥ r3 “ → “r1 ≥ r3 “. Lemma Rgt RoppO : (r : R)“r > 0“ → “(−r) < 0“. Lemma Rlt RoppO : (r : R)“r < 0“ → “ − r > 0“. Hints Resolve Rgt RoppO Rlt RoppO : real. Lemma Rlt r plus R1 : (r : R)“0 ≤ r“ → “0 < r + 1“. Hints Resolve Rlt r plus R1 : real. Lemma Rlt r r plus R1 : (r : R)“r < r + 1“. Hints Resolve Rlt r r plus R1 : real. Lemma tech Rgt minus : (r1 , r2 : R)“0 < r2 “ → “r1 > r1 − r2 “. Lemma Rgt plus plus r : (r, r1 , r2 : R)“r1 > r2 “ → “r + r1 > r + r2 “. Hints Resolve Rgt plus plus r : real. Lemma Rgt r plus plus : (r, r1 , r2 : R)“r + r1 > r + r2 “ → “r1 > r2 “. Lemma Rge plus plus r : (r, r1 , r2 : R)“r1 ≥ r2 “ → “r + r1 ≥ r + r2 “. Hints Resolve Rge plus plus r : real. Lemma Rge r plus plus : (r, r1 , r2 : R)“r + r1 ≥ r + r2 “ → “r1 ≥ r2 “. Lemma Rge monotony : (x, y, z : R) “z ≥ 0“ → “x ≥ y“ → “x × z ≥ y × z“. Lemma Rgt minus : (r1 , r2 : R)“r1 > r2 “ → “r1 − r2 > 0“. Lemma minus Rgt : (r1 , r2 : R)“r1 − r2 > 0“ → “r1 > r2 “. Lemma Rge minus : (r1 , r2 : R)“r1 ≥ r2 “ → “r1 − r2 ≥ 0“. Lemma minus Rge : (r1 , r2 : R)“r1 − r2 ≥ 0“ → “r1 ≥ r2 “. Lemma Rmult gt : (r1 , r2 : R)“r1 > 0“ → “r2 > 0“ → “r1 × r2 > 0“. Lemma Rmult lt 0

:(r1 , r2 , r3 , r4 : R)“r3 ≥ 0“ → “r2 > 0“ → “r1 < r2 “ → “r3 < r4 “ → “r1 × r3 < r2 × r4 “.

Lemma Rmult lt pos : (x, y : R)“0 < x“ → “0 < y“ → “0 < x × y“. Lemma Rplus eq R0 l : (a, b : R)“0 ≤ a“ → “0 ≤ b“ → “a + b == 0“ → “a == 0“. Lemma Rplus eq R0

:(a, b : R)“0 ≤ a“ → “0 ≤ b“ → “a + b == 0“ → “a == 0“ ∧ “b == 0“. Lemma Rplus Rsr eq R0 l : (a, b : R)“(Rsqr a) + (Rsqr b) == 0“ → “a == 0“. Lemma Rplus Rsr eq R0 : (a, b : R)“(Rsqr a) + (Rsqr b) == 0“ → “a == 0“ ∧ “b == 0“.

Injection from N to R Lemma S INR : (n : nat)(INR (S n)) == “(INR n) + 1“. Lemma S O plus INR : (n : nat)

(INR (plus (S O) n)) == “(INR (S O)) + (INR n)“. Lemma plus INR : (n, m : nat)(INR (plus n m)) == “(INR n) + (INR m)“. Lemma minus INR : (n, m : nat)(le m n) → (INR (minus n m)) == “(INR n) − (INR m)“. Lemma mult INR : (n, m : nat)(INR (mult n m)) == (Rmult (INR n) (INR m)). Hints Resolve plus INR minus INR mult INR : real. Lemma INR lt 0 : (n : nat)(lt O n) → “0 < (INR n)“. Hints Resolve INR lt 0 : real. Lemma INR pos : (p : positive)“0 < (INR (convert p))“. Hints Resolve INR pos : real. Lemma INR le : (n : nat)“0 ≤ (INR n)“. Hints Resolve INR le : real. Lemma INR le nm : (n, m : nat)(le n m) → “(INR n) ≤ (INR m)“. Hints Resolve INR le nm : real. Lemma not INR O : (n : nat)“(INR n) ≠ 0“ → ¬n = O. Hints Lemma not O INR : (n : nat)¬n = O → “(INR n) ≠ 0“. Hints Resolve not O INR : real.

Injection from Z to R Definition INZ := inject nat. Lemma IZN : (z : Z )(‘0 ≤ z‘) → (Ex [n : nat] z = (INZ n)). Lemma INR IZR INZ : (n : nat)(INR n) == (IZR (INZ n)). Lemma plus IZR NEG POS :

(p, q : positive)(IZR ‘(POS p) + (NEG q)‘) == “(IZR (POS p)) + (IZR (NEG q))“. Lemma plus IZR : (z, t : Z )(IZR ‘z + t‘) == “(IZR z) + (IZR t)“. Lemma Ropp Ropp IZR : (z : Z )(IZR (‘ − z‘)) == “ − (IZR z)“. Lemma Z R minus : (z1 , z2 : Z )“(IZR z1 ) − (IZR z2 )“ == (IZR ‘z1 − z2 ‘). Lemma lt O IZR : (z : Z )“0 < (IZR z)“ → ‘0 < z‘. Lemma lt IZR : (z1 , z2 : Z )“(IZR z1 ) < (IZR z2 )“ → ‘z1 < z2 ‘.

Lemma eq IZR R0 : (z : Z )“(IZR z) == 0“ → ‘z = 0‘. Lemma eq IZR : (z1 , z2 : Z )(IZR z1 ) == (IZR z2 ) → z1 = z2 . Lemma le O IZR : (z : Z )“0 ≤ (IZR z)“ → ‘0 ≤ z‘. Lemma le IZR : (z1 , z2 : Z )“(IZR z1 ) ≤ (IZR z2 )“ → ‘z1 ≤ z2 ‘. Lemma le IZR R1 : (z : Z )“(IZR z) ≤ 1“ → ‘z ≤ 1‘. Lemma IZR ge : (m, n : Z ) ‘m ≥ n‘ → “(IZR m) ≥ (IZR n)“. Lemma one IZR lt1 : (z : Z )“ − 1 < (IZR z) < 1“ → ‘z = 0‘. Lemma one IZR r R1

: (r : R)(z, x : Z )“r < (IZR z) ≤ r + 1“ → “r < (IZR x) ≤ r + 1“ → z = x. Lemma single z r R1

: (r : R)(z, x : Z )“r < (IZR z)“ → “(IZR z) ≤ r + 1“ → “r < (IZR x)“ → “(IZR x) ≤ r + 1“ → z = x. Lemma tech single z r R1

:(r : R)(z : Z )“r < (IZR z)“ → “(IZR z) ≤ r + 1“ → (Ex [s : Z ] (¬s = z ∧ “r < (IZR s)“ ∧ “(IZR s) ≤ r + 1“)) → False.

Module R Ifp

Id : R_{I}fp.v, v1.42001/03/1513 : 38 : 51filliatrExp Complements for the reals.Integer and fractional part Require Export Rbase. Require Omega. Fractional part Definition Int part : R → Z := [r : R](‘(up r) − 1‘). Definition frac part : R → R := [r : R](Rminus r (IZR (Int part r))). Lemma tech up : (r : R)(z : Z )(Rlt r (IZR z)) → (Rle (IZR z) (Rplus r R1 )) →

z = (up r). Lemma up tech : (r : R)(z : Z )(Rle (IZR z) r) → (Rlt r (IZR ‘z + 1‘)) →

‘z + 1‘ = (up r). Lemma fp R0 : (frac part R0 ) == R0 . Lemma for base fp : (r : R)(Rgt (Rminus (IZR (up r)) r) R0 ) ∧

(Rle (Rminus (IZR (up r)) r) R1 ).

Lemma base fp : (r : R)(Rge (frac part r) R0 ) ∧ (Rlt (frac part r) R1 ). Properties Lemma base Int part : (r : R)(Rle (IZR (Int part r)) r) ∧

(Rgt (Rminus (IZR (Int part r)) r) (Ropp R1 )).

Lemma fp nat : (r : R)(frac part r) == R0 → (Ex [c : Z ](r == (IZR c))). Lemma R0 fp O : (r : R)¬R0 == (frac part r) → ¬R0 == r.

Lemma Rminus Int part1 : (r1 , r2 : R)(Rge (frac part r1 ) (frac part r2 )) → (Int part (Rminus r1 r2 )) = (Zminus (Int part r1 ) (Int part r2 )).

Lemma Rminus Int part2 : (r1 , r2 : R)(Rlt (frac part r1 ) (frac part r2 )) → (Int part (Rminus r1 r2 )) = (Zminus (Zminus (Int part r1 ) (Int part r2 )) ‘1‘).

Lemma Rminus fp1 : (r1 , r2 : R)(Rge (frac part r1 ) (frac part r2 )) → (frac part (Rminus r1 r2 )) == (Rminus (frac part r1 ) (frac part r2 )).

Lemma Rminus fp2 : (r1 , r2 : R)(Rlt (frac part r1 ) (frac part r2 )) → (frac part (Rminus r1 r2 )) == (Rplus (Rminus (frac part r1 ) (frac part r2 )) R1 ).

Lemma plus Int part1 : (r1 , r2 : R)(Rge (Rplus (frac part r1 ) (frac part r2 )) R1 ) → (Int part (Rplus r1 r2 )) = (Zplus (Zplus (Int part r1 ) (Int part r2 )) ‘1‘).

Lemma plus Int part2 : (r1 , r2 : R)(Rlt (Rplus (frac part r1 ) (frac part r2 )) R1 ) → (Int part (Rplus r1 r2 )) = (Zplus (Int part r1 ) (Int part r2 )).

Lemma plus frac part1 : (r1 , r2 : R)

(Rge (Rplus (frac part r1 ) (frac part r2 )) R1 ) → (frac part (Rplus r1 r2 )) == (Rminus (Rplus (frac part r1 ) (frac part r2 )) R1 ).

Lemma plus frac part2 : (r1 , r2 : R)

(Rlt (Rplus (frac part r1 ) (frac part r2 )) R1 ) → (frac part (Rplus r1 r2 )) == (Rplus (frac part r1 ) (frac part r2 )).

Module Rbasic fun

Id : Rbasic_{f}un.v, v1.52001/03/1513 : 38 : 52filliatrExp Complements for the real numbers

Require Export R Ifp.

Rmin

Definition Rmin : R → R → R := [x, y : R]

Cases (total order Rle x y) of

(leftT ) ⇒ x | (rightT ) ⇒ y end.

Lemma Rmin Rgt l : (r1 , r2 , r : R)(Rgt (Rmin r1 r2 ) r) → ((Rgt r1 r) ∧ (Rgt r2 r)).

Lemma Rmin Rgt r : (r1 , r2 , r : R)(((Rgt r1 r) ∧ (Rgt r2 r)) → (Rgt (Rmin r1 r2 ) r)).

Lemma Rmin Rgt : (r1 , r2 , r : R)(Rgt (Rmin r1 r2 ) r) ↔ ((Rgt r1 r) ∧ (Rgt r2 r)).

Rmax

Definition Rmax : R → R → R := [x, y : R] Cases (total order Rle x y) of

(leftT ) ⇒ y | (rightT ) ⇒ x end.

Lemma Rmax Rle : (r1 , r2 , r : R)(Rle r (Rmax r1 r2 )) ↔

((Rle r r1 ) ∨ (Rle r r2 )). Rabsolu Lemma case Rabsolu : (r : R)(sumboolT (Rlt r R0 ) (Rge r R0 )). Definition Rabsolu : R → R :=

[r : R](Cases (case Rabsolu r) of (leftT ) ⇒ (Ropp r) |(rightT ) ⇒ r end).

Lemma Rabsolu R0 : (Rabsolu R0 ) == R0 . Lemma Rabsolu no R0 : (r : R)¬r == R0 → ¬(Rabsolu r) == R0 . Lemma Rabsolu left : (r : R)(Rlt r R0 ) → ((Rabsolu r) == (Ropp r)). Lemma Rabsolu right : (r : R)(Rge r R0 ) → ((Rabsolu r) == r). Lemma Rabsolu pos : (x : R)(Rle R0 (Rabsolu x)). Lemma Rabsolu pos eq : (x : R)(Rle R0 x) → (Rabsolu x) == x. Lemma Rabsolu Rabsolu : (x : R)(Rabsolu (Rabsolu x)) == (Rabsolu x). Lemma Rabsolu pos lt : (x : R)(¬x == R0 ) → (Rlt R0 (Rabsolu x)). Lemma Rabsolu minus sym : (x, y : R) (Rabsolu (Rminus x y)) == (Rabsolu (Rminus y x)). Lemma Rabsolu mult : (x, y : R) (Rabsolu (Rmult x y)) == (Rmult (Rabsolu x) (Rabsolu y)). Lemma Rabsolu Rinv : (r : R)(¬r == R0 ) → (Rabsolu (Rinv r)) ==

(Rinv (Rabsolu r)).

Lemma Rabsolu triang : (a, b : R)(Rle (Rabsolu (Rplus a b))

(Rplus (Rabsolu a) (Rabsolu b))).

Lemma Rabsolu triang inv : (a, b : R)(Rle (Rminus (Rabsolu a) (Rabsolu b))

(Rabsolu (Rminus a b))).

Lemma Rabsolu def1 : (x, a : R)(Rlt x a) → (Rlt (Ropp a) x) → (Rlt (Rabsolu x) a). Lemma Rabsolu def2 : (x, a : R)(Rlt (Rabsolu x) a) → (Rlt x a) ∧ (Rlt (Ropp a) x).

Module Rlimit

Id : Rlimit.v, v1.32001/03/1513 : 38 : 53filliatrExp Definition of the limit Require Export Rbasic fun.

Require Export Classical Prop.

Calculus

Lemma eps2 Rgt R0 : (eps : R)(Rgt eps R0 ) → (Rgt (Rmult eps (Rinv (Rplus R1 R1 ))) R0 ).

Lemma eps2 : (eps : R)(Rplus (Rmult eps (Rinv (Rplus R1 R1 )))

(Rmult eps (Rinv (Rplus R1 R1 )))) == eps.

Lemma eps4 : (eps : R)

(Rplus (Rmult eps (Rinv (Rplus (Rplus R1 R1 ) (Rplus R1 R1 ) )))

(Rmult eps (Rinv (Rplus (Rplus R1 R1 ) (Rplus R1 R1 ) )))) == (Rmult eps (Rinv (Rplus R1 R1 ))).

Lemma Rlt eps2 eps : (eps : R)(Rgt eps R0 ) → (Rlt (Rmult eps (Rinv (Rplus R1 R1 ))) eps).

Lemma Rlt eps4 eps : (eps : R)(Rgt eps R0 ) → (Rlt (Rmult eps (Rinv (Rplus (Rplus R1 R1 ) (Rplus R1 R1 )))) eps).

Lemma prop eps : (r : R)((eps : R)(Rgt eps R0 ) → (Rlt r eps)) → (Rle r R0 ).

Definition mul factor := [l, l′ : R](Rinv (Rplus R1 (Rplus (Rabsolu l)

(Rabsolu l′)))).

Lemma mul factor wd : (l, l′ : R)

¬(Rplus R1 (Rplus (Rabsolu l) (Rabsolu l′))) == R0 .

Lemma mul factor gt : (eps : R)(l, l′ : R)(Rgt eps R0 ) → (Rgt (Rmult eps (mul factor l l′)) R0 ).

Lemma mul factor gt f : (eps : R)(l, l′ : R)(Rgt eps R0 ) → (Rgt (Rmin R1 (Rmult eps (mul factor l l′))) R0 ).

Metric space

Record Metric Space :Type:= { Base :Type; dist : Base → Base → R; dist pos : (x, y : Base)(Rge (dist x y) R0 ); dist sym : (x, y : Base)(dist x y) == (dist y x); dist refl : (x, y : Base)((dist x y) == R0 ↔ x == y); dist tri : (x, y, z : Base)(Rle (dist x y)

(Rplus (dist x z) (dist z y))) }.

Limit in Metric space

Definition limit in := [X : Metric Space; X′ : Metric Space; f : (Base X ) → (Base X′); D : (Base X ) → Prop; x0 : (Base X ); l : (Base X′)] (eps : R)(Rgt eps R0 ) → (EXT alp : R | (Rgt alp R0 ) ∧ (x : (Base X ))(D x) ∧

(Rlt (dist X x x0 ) alp) → (Rlt (dist X′ (f x) l) eps)).

Distance in R Definition R dist : R → R → R := [x, y : R](Rabsolu (Rminus x y)). Lemma R dist pos : (x, y : R)(Rge (R dist x y) R0 ). Lemma R dist sym : (x, y : R)(R dist x y) == (R dist y x). Lemma R dist refl : (x, y : R)((R dist x y) == R0 ↔ x == y). Lemma R dist tri : (x, y, z : R)(Rle (R dist x y)

(Rplus (R dist x z) (R dist z y))).

Lemma R dist plus : (a, b, c, d : R)(Rle (R dist (Rplus a c) (Rplus b d))

(Rplus (R dist a b) (R dist c d))).

R is a metric space Definition R met : Metric Space := (Build Metric Space R R dist

R dist pos R dist sym R dist refl R dist tri). Limit 1 arg Definition Dgf := [Df , Dg : R → Prop][f : R → R][x : R](Df x) ∧ (Dg (f x)). Definition limit1 in : (R → R) → (R → Prop) → R → R → Prop:=

[f : R → R; D : R → Prop; l : R; x0 : R](limit in R met R met f D x0 l). Lemma tech limit : (f : R → R)(D : R → Prop)(l : R)(x0 : R)(D x0 ) →

(limit1 in f D l x0 ) → l == (f x0 ). Lemma tech limit contr : (f : R → R)(D : R → Prop)(l : R)(x0 : R)(D x0 ) → ¬l == (f x0 )

→ ¬(limit1 in f D l x0 ). Lemma lim x : (D : R → Prop)(x0 : R)(limit1 in [x : R]x D x0 x0 ). Lemma limit plus : (f , g : R → R)(D : R → Prop)(l, l′ : R)(x0 : R)

(limit1 in f D l x0 ) → (limit1 in g D l′ x0 ) →

(limit1 in [x : R](Rplus (f x) (g x)) D (Rplus l l′) x0 ). Lemma limit Ropp : (f : R → R)(D : R → Prop)(l : R)(x0 : R)

(limit1 in f D l x0 ) → (limit1 in [x : R](Ropp (f x)) D (Ropp l) x0 ). Lemma limit minus : (f , g : R → R)(D : R → Prop)(l, l′ : R)(x0 : R)

(limit1 in f D l x0 ) → (limit1 in g D l′ x0 ) →

(limit1 in [x : R](Rminus (f x) (g x)) D (Rminus l l′) x0 ). Lemma limit free : (f : R → R)(D : R → Prop)(x : R)(x0 : R)

(limit1 in [h : R](f x) D (f x) x0 ). Lemma limit mul : (f , g : R → R)(D : R → Prop)(l, l′ : R)(x0 : R)

(limit1 in f D l x0 ) → (limit1 in g D l′ x0 ) →

(limit1 in [x : R](Rmult (f x) (g x)) D (Rmult l l′) x0 ). Definition adhDa : (R → Prop) → R → Prop:=[D : R → Prop][a : R]

(alp : R)(Rgt alp R0 ) → (EXT x : R | (D x) ∧ (Rlt (R dist x a) alp)). Lemma single limit : (f : R → R)(D : R → Prop)(l : R)(l′ : R)(x0 : R)

(adhDa D x0 ) → (limit1 in f D l x0 ) → (limit1 in f D l′ x0 ) → l == l′. Lemma limit comp : (f , g : R → R)(Df , Dg : R → Prop)(l, l′ : R)(x0 : R)

(limit1 in f Df l x0 ) → (limit1 in g Dg l′ l) →

(limit1 in [x : R](g (f x)) (Dgf Df Dg f ) l′ x0 ).

Module Rfunctions

Id : Rfunctions.v, v1.52001/04/1112 : 41 : 40filliatrExp Definition of the some functions

Require Export Rlimit.

Factorial

Fixpoint fact [n : nat] : nat :=

Cases n of O ⇒ (S O) |(S n) ⇒ (mult (S n) (fact n))

end.

Lemma fact neq 0 : (n : nat)¬(fact n) = O.

Lemma INR fact neq 0 : (n : nat)¬(INR (fact n)) == R0 .

Lemma simpl fact : (n : nat)(Rmult (Rinv (INR (fact (S n))))

(Rinv (Rinv (INR (fact n))))) == (Rinv (INR (S n))).

Power

Fixpoint pow [r : R; n : nat] : R :=

Cases n of O ⇒ R1 |(S n) ⇒ (Rmult r (pow r n))

end.

Lemma tech pow Rmult : (x : R)(n : nat)(Rmult x (pow x n)) == (pow x (S n)).

Lemma tech pow Rplus : (x : R)(a, n : nat)

(Rplus (pow x a) (Rmult (INR n) (pow x a))) == (Rmult (INR (S n)) (pow x a)).

Sum of n first naturals

Fixpoint sum nat f O [f : nat → nat; n : nat] : nat :=

Cases n of O ⇒ (f O) |(S n′) ⇒ (plus (sum nat f O f n′) (f (S n′))) end.

Definition sum nat f [s, n : nat; f : nat → nat] : nat := (sum nat f O [x : nat](f (plus x s)) (minus n s)).

Definition sum nat O [n : nat] : nat := (sum nat f O [x]x n).

Definition sum nat [s, n : nat] : nat := (sum nat f s n [x]x).

Sum

Fixpoint sum f R0 [f : nat → R; N : nat] : R := Cases N of

O ⇒ (f O)

|(S i) ⇒ (Rplus (sum f R0 f i) (f (S i))) end.

Definition sum f [s, n : nat; f : nat → R] : R := (sum f R0 [x : nat](f (plus x s)) (minus n s)).

Infinit Sum

Definition infinit sum : (nat → R) → R → Prop:=[s : nat → R; l : R] (eps : R)(Rgt eps R0 ) → (Ex[N : nat](n : nat)(ge n N ) → (Rlt (R dist (sum f R0 s n) l) eps)).

Module Rderiv

Id : Rderiv.v, v1.32001/03/1513 : 38 : 52filliatrExp Definition of the derivative,continuity

Require Export Rfunctions. Require Classical Pred Type. Require Omega.

Definition D x : (R → Prop) → R → R → Prop:=[D : R → Prop][y : R][x : R] (D x) ∧ (¬y == x).

Definition continue in : (R → R) → (R → Prop) → R → Prop:= [f : R → R; D : R → Prop; x0 : R](limit1 in f (D x D x0 ) (f x0 ) x0 ).

Definition D in : (R → R) → (R → R) → (R → Prop) → R → Prop:=

[f : R → R; d : R → R; D : R → Prop; x0 : R](limit1 in [x : R] (Rmult (Rminus (f x) (f x0 )) (Rinv (Rminus x x0 ))) (D x D x0 ) (d x0 ) x0 ).

Lemma cont deriv : (f , d : R → R; D : R → Prop;x0 : R)

(D in f d D x0 ) → (continue in f D x0 ).

Lemma Dconst : (D : R → Prop)(y : R)(x0 : R)(D in [x : R]y [x : R]R0 D x0 ).

Lemma Dx : (D : R → Prop)(x0 : R)(D in [x : R]x [x : R]R1 D x0 ).

Lemma Dadd : (D : R → Prop)(df , dg : R → R)(f , g : R → R)(x0 : R)

(D in f df D x0 ) → (D in g dg D x0 ) →

(D in [x : R](Rplus (f x) (g x)) [x : R](Rplus (df x) (dg x)) D x0 ).

Lemma Dmult : (D : R → Prop)(df , dg : R → R)(f , g : R → R)(x0 : R)

(D in f df D x0 ) → (D in g dg D x0 ) →

(D in [x : R](Rmult (f x) (g x))

[x : R](Rplus (Rmult (df x) (g x)) (Rmult (f x) (dg x))) D x0 ).

Lemma Dmult const : (D : R → Prop)(f , df : R → R)(x0 : R)(a : R)(D in f df D x0 ) → (D in [x : R](Rmult a (f x)) ([x : R](Rmult a (df x))) D x0 ).

Lemma Dopp : (D : R → Prop)(f , df : R → R)(x0 : R)(D in f df D x0 ) → (D in [x : R](Ropp (f x)) ([x : R](Ropp (df x))) D x0 ).

Lemma Dminus : (D : R → Prop)(df , dg : R → R)(f , g : R → R)(x0 : R)

(D in f df D x0 ) → (D in g dg D x0 ) →

(D in [x : R](Rminus (f x) (g x)) [x : R](Rminus (df x) (dg x)) D x0 ).

Lemma Dx pow n : (n : nat)(D : R → Prop)(x0 : R)

(D in [x : R](pow x n)

[x : R](Rmult (INR n) (pow x (minus n (1)))) D x0 ).

Lemma Dcomp : (Df , Dg : R → Prop)(df , dg : R → R)(f , g : R → R)(x0 : R)

(D in f df Df x0 ) → (D in g dg Dg (f x0 )) →

(D in [x : R](g (f x)) [x : R](Rmult (df x) (dg (f x)))

(Dgf Df Dg f ) x0 ).

Module Reals

Id : Reals.v, v1.32001/03/1513 : 38 : 53filliatrExp

Require Export Rdefinitions. Require Export TypeSyntax. Require Export Raxioms. Require Export Rbase. Require Export R Ifp. Require Export Rbasic fun. Require Export Rlimit. Require Export Rfunctions. Require Export Rderiv.

5 Lists

The LISTS library includes the following files:

• Lists.v THIS OLD LIBRARY IS HERE ONLY FOR COMPATIBILITY WITH OLDER VERSIONS OF COQS. THE USER SHOULD USE POLYLIST INSTEAD.

• PolyLists.v contains definitions of (polymorphic) lists, functions on lists such as head, tail, map, append and prove some properties of these functions. Implicit arguments are used in this library, so you should read the Referance Manual about implicit arguments before using it.

• TheoryList.v contains complementary results on lists. Here a more theoric point of view is assumed : one extracts functions from propositions, rather than defining functions and then prove them.

• Streams.v defines the type of infinite lists (streams). It is a coinductive type. Basic facts are stated and proved. The streams are also polymorphic.

Module List

Id : List.v, v1.32001/03/1513 : 38 : 50filliatrExp ** THIS IS A OLD CONTRIB. IT IS NO LONGER MAINTAINED Require Le. Parameter List Dom :Set. Definition A := List Dom. Inductive list : Set := nil : list | cons : A → list → list. Fixpoint app [l : list] : list → list

:= [m : list] < list >Cases l of

nil ⇒ m | (cons a l1 ) ⇒ (cons a (app l1 m))

end.

Lemma app nil end : (l : list)(l = (app l nil)). Hints Resolve app nil end : list v62 . Lemma app ass : (l, m, n : list)(app (app l m) n) = (app l (app m n)). Hints Resolve app ass : list v62 . Lemma ass app : (l, m, n : list)(app l (app m n)) = (app (app l m) n). Hints Resolve ass app : list v62 . Definition tail :=

[l : list] < list >Cases l of (cons m) ⇒ m | ⇒ nil end : list → list. Lemma nil cons : (a : A)(m : list)¬nil = (cons a m). Length of lists Fixpoint length [l : list] : nat

:= <nat >Cases l of (cons m) ⇒ (S (length m)) | ⇒ O end. Length order of lists Section length order. Definition lel := [l, m : list](le (length l) (length m)). Hints Unfold lel : list. Variables a, b : A. Variables l, m, n : list. Lemma lel refl : (lel l l). Lemma lel trans : (lel l m) → (lel m n) → (lel l n). Lemma lel cons cons : (lel l m) → (lel (cons a l) (cons b m)). Lemma lel cons : (lel l m) → (lel l (cons b m)). Lemma lel tail : (lel (cons a l) (cons b m)) → (lel l m). Lemma lel nil : (l′ : list)(lel l′ nil) → (nil = l′). End length order. Hints Resolve lel refl lel cons cons lel cons lel nil lel nil nil cons : list v62 . Fixpoint In [a : A; l : list] : Prop := Cases l of

nil ⇒ False | (cons b m) ⇒ (b = a) ∨ (In a m) end.

Lemma in eq : (a : A)(l : list)(In a (cons a l)). Hints Resolve in eq : list v62 .

Lemma in cons : (a, b : A)(l : list)(In b l) → (In b (cons a l)). Hints Resolve in cons : list v62 .

Lemma in app or : (l, m : list)(a : A)(In a (app l m)) → ((In a l) ∨ (In a m)). Hints Lemma in or app : (l, m : list)(a : A)((In a l) ∨ (In a m)) → (In a (app l m)). Hints Resolve in or app : list v62 .

Definition incl := [l, m : list](a : A)(In a l) → (In a m).

Hints Unfold incl : list v62 .

Lemma incl refl : (l : list)(incl l l). Hints Resolve incl refl : list v62 .

Lemma incl tl : (a : A)(l, m : list)(incl l m) → (incl l (cons a m)). Hints Lemma incl tran : (l, m, n : list)(incl l m) → (incl m n) → (incl l n).

Lemma incl appl : (l, m, n : list)(incl l n) → (incl l (app n m)). Hints Lemma incl appr : (l, m, n : list)(incl l n) → (incl l (app m n)). Hints Lemma incl cons : (a : A)(l, m : list)(In a m) → (incl l m) → (incl (cons a l) m). Hints Resolve incl cons : list v62 .

Lemma incl app : (l, m, n : list)(incl l n) → (incl m n) → (incl (app l m) n). Hints Resolve incl app : list v62 .

Module PolyListSyntax

Id : P olyListSyntax.v, v1.42001/03/1513 : 38 : 50filliatrExp Syntax for list concatenation

Require PolyList.

Infix RIGHTA 7 "ˆ " app.

Module PolyList

Id : P olyList.v, v1.92001/04/1112 : 41 : 39filliatrExp

Require Le.

Section Lists.

Variable A : Set.

Implicit Arguments On. Inductive list : Set := nil : list | cons : A → list → list. Concatenation Fixpoint app [l : list] : list → list

:= [m : list]Cases l of

nil ⇒ m | (cons a l1 ) ⇒ (cons a (app l1 m)) end.

Infix RIGHTA 7 "ˆ " app. Lemma app nil end : (l : list)l = (lˆ nil). Hints Resolve app nil end. Lemma app ass : (l, m, n : list)((lˆ m)ˆ n) = (lˆ (mˆ n)). Hints Resolve app ass. Lemma ass app : (l, m, n : list)(lˆ (mˆ n)) = ((lˆ m)ˆ n). Hints Resolve ass app. Definition head :=

[l : list]Cases l of

| nil ⇒ Error

| (cons x ) ⇒ (Value x)

end. Definition tail : list → list :=

[l : list]Cases l of

| nil ⇒ nil

| (cons a m) ⇒ m

end. Lemma nil cons : (a : A)(m : list)¬(nil = (cons a m)). Lemma app comm cons : (x, y : list)(a : A) (cons a (xˆ y)) = ((cons a x)ˆ y). Lemma app eq nil : (x, y : list) (xˆ y) = nil → x = nil ∧ y = nil. Lemma app cons not nil : (x, y : list)(a : A)¬nil = (xˆ (cons a y)). Lemma app eq unit : (x, y : list)(a : A)

(xˆ y) = (cons a nil) → (x = nil) ∧ y = (cons a nil) ∨ x = (cons a nil) ∧ y = nil. Lemma app inj tail : (x, y : list)(a, b : A)

(xˆ (cons a nil)) = (yˆ (cons b nil)) → x = y ∧ a = b. Length of lists Fixpoint length [l : list] : nat

:= Cases l of nil ⇒ O | (cons m) ⇒ (S (length m)) end. Length order of lists Section length order. Definition lel := [l, m : list](le (length l) (length m)).

Variables a, b : A. Variables l, m, n : list. Lemma lel refl : (lel l l). Lemma lel trans : (lel l m) → (lel m n) → (lel l n). Lemma lel cons cons : (lel l m) → (lel (cons a l) (cons b m)). Lemma lel cons : (lel l m) → (lel l (cons b m)). Lemma lel tail : (lel (cons a l) (cons b m)) → (lel l m). Lemma lel nil : (l′ : list)(lel l′ nil) → (nil = l′). End length order. Hints Resolve lel refl lel cons cons lel cons lel nil lel nil nil cons . The In predicate Fixpoint In [a : A; l : list] : Prop :=

Cases l of nil ⇒ False | (cons b m) ⇒ (b = a) ∨ (In a m) end. Lemma in eq : (a : A)(l : list)(In a (cons a l)). Hints Resolve in eq. Lemma in cons : (a, b : A)(l : list)(In b l) → (In b (cons a l)). Hints Resolve in cons. Lemma in nil : (a : A)¬(In a nil). Lemma in inv : (a, b : A)(l : list)

(In b (cons a l)) → a = b ∨ (In b l).

Lemma In dec : ((x, y : A){x = y} + {¬x = y}) → (a : A)(l : list){(In a l)} + {¬(In a l)}. Lemma in app or : (l, m : list)(a : A)(In a (lˆ m)) → ((In a l) ∨ (In a m)). Hints Lemma in or app : (l, m : list)(a : A)((In a l) ∨ (In a m)) → (In a (lˆ m)). Hints Resolve in or app. Inclusion on list Definition incl := [l, m : list](a : A)(In a l) → (In a m). Hints Unfold incl. Lemma incl refl : (l : list)(incl l l). Hints Resolve incl refl. Lemma incl tl : (a : A)(l, m : list)(incl l m) → (incl l (cons a m)). Hints Lemma incl tran : (l, m, n : list)(incl l m) → (incl m n) → (incl l n). Lemma incl appl : (l, m, n : list)(incl l n) → (incl l (nˆ m)). Hints Lemma incl appr : (l, m, n : list)(incl l n) → (incl l (mˆ n)). Hints Lemma incl cons : (a : A)(l, m : list)(In a m) → (incl l m) → (incl (cons a l) m).

Hints Resolve incl cons.

Lemma incl app : (l, m, n : list)(incl l n) → (incl m n) → (incl (lˆ m) n). Hints Resolve incl app.

Nth element of a list

Fixpoint nth [n : nat; l : list] : A → A :=

[default]Cases n l of

O (cons x l′) ⇒ x | O other ⇒ default | (S m) nil ⇒ default | (S m) (cons x t) ⇒ (nth m t default) end.

Fixpoint nth ok [n : nat; l : list] : A → bool :=

[default]Cases n l of

O (cons x l′) ⇒ true | O other ⇒ false | (S m) nil ⇒ false | (S m) (cons x t) ⇒ (nth ok m t default) end.

Lemma nth in or default :

(n : nat)(l : list)(d : A){(In (nth n l d) l)} + {(nth n l d) = d}.

Lemma nth S cons : (n : nat)(l : list)(d : A)(a : A)(In (nth n l d) l)

→ (In (nth (S n) (cons a l) d) (cons a l)).

Reverse Induction Principle on Lists

Section Reverse Induction.

Variable leA : A → A → Prop.

Fixpoint rev [l : list] : list :=

Cases l of

nil ⇒ nil | (cons x l′) ⇒ (rev l′)ˆ (cons x nil) end.

Lemma distr rev : (x, y : list) (rev (xˆ y)) = ((rev y)ˆ (rev x)).

Remark rev unit : (l : list)(a : A) (rev lˆ (cons a nil)) = (cons a (rev l)).

Lemma idempot rev : (l : list)(rev (rev l)) = l.

Implicit Arguments Off . Remark rev list ind : (P : list → Prop)

(P nil)

→ ((a : A)(l : list)(P (rev l)) → (P (rev (cons a l))))

→ (l : list) (P (rev l)).

Implicit Arguments On.

Lemma rev ind : (P : list → Prop)

(P nil) →

((x : A)(l : list)(P l) → (P lˆ (cons x nil))) → (l : list)(P l).

End Reverse Induction.

End Lists.

Hints Resolve nil cons app nil end ass app app ass : datatypes v62 . Hints Resolve app comm cons app cons not nil : datatypes v62 . Hints Hints Resolve app eq unit app inj tail : datatypes v62 . Hints Resolve lel refl lel cons cons lel cons lel nil lel nil nil cons

: datatypes v62 . Hints Resolve in eq in cons in inv in nil in app or in or app : datatypes v62 . Hints Resolve incl refl incl tl incl tran incl appl incl appr incl cons incl app

: datatypes v62 .

Section Functions on lists.

Some generic functions on lists and basic functions of them

Section Map. Variables A, B :Set. Variable f : A → B. Fixpoint map [l : (list A)] : (list B) :=

Cases l of

nil ⇒ (nil B) | (cons a t) ⇒ (cons (f a) (map t)) end.

End Map.

Lemma in map : (A, B :Set)(f : A → B)(l : (list A))(x : A)

(In x l) → (In (f x) (map f l)).

Fixpoint flat map [A, B :Set; f : A → (list B); l : (list A)] : (list B) :=

Cases l of

nil ⇒ (nil B) | (cons x t) ⇒ (app (f x) (flat map f t)) end.

Fixpoint list prod [A :Set; B :Set; l : (list A)] : (list B) → (list A × B) :=

[l′]Cases l of

nil ⇒ (nil A × B) | (cons x t) ⇒ (app (map [y : B](x, y) l′)

(list prod t l′))

end.

Lemma in prod aux :

(A :Set)(B :Set)(x : A)(y : B)(l : (list B)) (In y l) → (In (x, y) (map [y0 : B](x, y0 ) l)).

Lemma in prod : (A :Set)(B :Set)(l : (list A))(l′ : (list B))

(x : A)(y : B)(In x l) → (In y l′) → (In (x, y) (list prod l l′)).

(list power x y) is yˆ x, or the set of sequences of elts of y indexed by elts of x, sorted in lexicographic order.

Fixpoint list power [A, B :Set; l : (list A)] : (list B) → (list (list A × B)) :=

[l′]Cases l of

nil ⇒ (cons (nil A × B) (nil ?)) | (cons x t) ⇒ (flat map [f : (list A × B)](map [y : B](cons (x, y) f ) l′)

(list power t l′))

end.

Section Fold Left Recursor. Variables A, B :Set. Variable f : A → B → A. Fixpoint fold left[l : (list B)] : A → A := [a0 ]Cases l of

nil ⇒ a0 | (cons b t) ⇒ (fold left t (f a0 b)) end.

End Fold Left Recursor.

Section Fold Right Recursor. Variables A, B :Set. Variable f : B → A → A. Variable a0 : A. Fixpoint fold right [l : (list B)] : A :=

Cases l of

nil ⇒ a0 | (cons b t) ⇒ (f b (fold right t)) end.

End Fold Right Recursor.

End Functions on lists.

Implicit Arguments Off .

Module Streams

Id : Streams.v, v1.82001/03/1513 : 38 : 50filliatrExp

Implicit Arguments On.

Section Streams. (∗ The set of streams : definition ∗)

Variable A : Set.

CoInductive Set Stream := Cons : A → Stream → Stream.

Definition hd := [x : Stream] Cases x of (Cons a ) ⇒ a end.

Definition tl := [x : Stream] Cases x of (Cons s) ⇒ s end.

Fixpoint Str nth tl [n : nat] : Stream → Stream :=

[s : Stream] Cases n of

O ⇒ s |(S m) ⇒ (Str nth tl m (tl s))

end.

Definition Str nth : nat → Stream → A := [n : nat][s : Stream](hd (Str nth tl n s)). Lemma unfold Stream : (x : Stream)x = (Cases x of (Cons a s) ⇒ (Cons a s) end). Lemma tl nth tl : (n : nat)(s : Stream)(tl (Str nth tl n s)) = (Str nth tl n (tl s)). Hints Resolve tl nth tl : datatypes v62 . Lemma Str nth tl plus : (n, m : nat)(s : Stream)(Str nth tl n (Str nth tl m s)) = (Str nth tl (plus n m) s). Lemma Str nth plus

: (n, m : nat)(s : Stream)(Str nth n (Str nth tl m s)) = (Str nth (plus n m) s). Extensional Equality between two streams CoInductive EqSt : Stream → Stream → Prop :=

eqst : (s1 , s2 : Stream) ((hd s1 ) = (hd s2 )) → (EqSt (tl s1 ) (tl s2 )) → (EqSt s1 s2 ).

A coinduction principle Meta Definition CoInduction proof :=

Cofix proof ; Intros; Constructor;

[Clear proof | Try (Apply proof ; Clear proof )]. Extensional equality is an equivalence relation Theorem EqSt reflex : (s : Stream)(EqSt s s). Theorem sym EqSt : (s1 : Stream)(s2 : Stream)(EqSt s1 s2 ) → (EqSt s2 s1 ). Theorem trans EqSt : (s1 , s2 , s3 : Stream)(EqSt s1 s2 ) → (EqSt s2 s3 ) → (EqSt s1 s3 ). The definition given is equivalent to require the elements at each position to be equal Theorem eqst ntheq :

(n : nat)(s1 , s2 : Stream)(EqSt s1 s2 ) → (Str nth n s1 ) = (Str nth n s2 ). Theorem ntheq eqst :

(s1 , s2 : Stream)((n : nat)(Str nth n s1 ) = (Str nth n s2 )) → (EqSt s1 s2 ). Section Stream Properties. Variable P : Stream → Prop. Inductive Exists : Stream -> Prop := Here : (x:Stream)(P x) ->(Exists x) | Further : (x:Stream) (P x)->(Exists (tl x))->(Exists x). Inductive Exists : Stream → Prop := Here : (x : Stream)(P x) → (Exists x) | Further : (x : Stream)(Exists (tl x)) → (Exists x).

CoInductive ForAll : Stream → Prop := forall : (x : Stream)(P x) → (ForAll (tl x)) → (ForAll x).

Section Co Induction ForAll. Variable Inv : Stream → Prop. Hypothesis InvThenP : (x : Stream)(Inv x) → (P x). Hypothesis InvIsStable : (x : Stream)(Inv x) → (Inv (tl x)).

Theorem ForAll coind : (x : Stream)(Inv x) → (ForAll x). End Co Induction ForAll.

End Stream Properties.

End Streams.

Section Map. Variables A, B : Set. Variable f : A → B. CoFixpoint map : (Stream A) → (Stream B) := [s : (Stream A)](Cons (f (hd s)) (map (tl s))). End Map.

Section Constant Stream. Variable A : Set. Variable a : A. CoFixpoint const : (Stream A) := (Cons a const). End Constant Stream.

Implicit Arguments Off .

Module ListSet

Id : ListSet.v, v1.52001/04/1112 : 41 : 39filliatrExp A Library for finite sets, implemented as lists A Library with similar interface will soon be available under the name TreeSet in the theories/TREES directory PolyList is loaded, but not exported This allow to "hide" the definitions, functions and theorems of PolyList and to see only the ones of ListSet

Require PolyList.

Implicit Arguments On.

Section first definitions.

Variable A : Set.

Hypothesis Aeq dec : (x, y : A){x = y} + {¬x = y}.

Definition set := (list A).

Definition empty set := (nil A).

Fixpoint set add [a : A; x : set] : set := Cases x of | nil ⇒ (cons a (nil A)) | (cons a1 x1 ) ⇒ Cases (Aeq dec a a1 ) of

| (left ) ⇒ (cons a1 x1 )

| (right ) ⇒ (cons a1 (set add a x1 )) end

end.

Fixpoint set mem [a : A; x : set] : bool := Cases x of | nil ⇒ false | (cons a1 x1 ) ⇒ Cases (Aeq dec a a1 ) of

| (left ) ⇒ true

| (right ) ⇒ (set mem a x1 )

end

end.

If a belongs to x, removes a from x. If not, does nothing

Fixpoint set remove [a : A; x : set] : set := Cases x of | nil ⇒ empty set | (cons a1 x1 ) ⇒ Cases (Aeq dec a a1 ) of

| (left ) ⇒ x1

| (right ) ⇒ (cons a1 (set remove a x1 )) end

end.

Fixpoint set inter [x : set] : set → set := Cases x of | nil ⇒ [y](nil A) | (cons a1 x1 ) ⇒ [y]if (set mem a1 y)

then (cons a1 (set inter x1 y))

else (set inter x1 y)

end.

Fixpoint set union [x, y : set] : set := Cases y of | nil ⇒ x | (cons a1 y1 ) ⇒ (set add a1 (set union x y1 )) end.

returns the set of all els of x that does not belong to y

Fixpoint set diff [x : set] : set → set := [y]Cases x of | nil ⇒ (nil A) | (cons a1 x1 ) ⇒ if (set mem a1 y)

then (set diff x1 y)

else (set add a1 (set diff x1 y))

end. Definition set In : A → set → Prop := (In 1!A). Lemma set In dec : (a : A; x : set){(set In a x)} + {¬(set In a x)}. Lemma set mem ind :

(B :Set)(P : B → Prop)(y, z : B)(a : A)(x : set)

((set In a x) → (P y))

→ (P z)

→ (P (if (set mem a x) then y else z)). Lemma set mem correct1 :

(a : A)(x : set)(set mem a x) = true → (set In a x). Lemma set mem correct2 :

(a : A)(x : set)(set In a x) → (set mem a x) = true. Lemma set mem complete1 :

(a : A)(x : set)(set mem a x) = false → ¬(set In a x). Lemma set mem complete2 :

(a : A)(x : set)¬(set In a x) → (set mem a x) = false. Lemma set add intro1 : (a, b : A)(x : set)

(set In a x) → (set In a (set add b x)). Lemma set add intro2 : (a, b : A)(x : set)

a = b → (set In a (set add b x)). Hints Resolve set add intro1 set add intro2 . Lemma set add intro : (a, b : A)(x : set)

a = b ∨ (set In a x) → (set In a (set add b x)). Lemma set add elim : (a, b : A)(x : set)

(set In a (set add b x)) → a = b ∨ (set In a x). Hints Resolve set add intro set add elim. Lemma set add not empty : (a : A)(x : set)¬(set add a x) = empty set. Lemma set union intro1 : (a : A)(x, y : set)

(set In a x) → (set In a (set union x y)). Lemma set union intro2 : (a : A)(x, y : set)

(set In a y) → (set In a (set union x y)). Hints Resolve set union intro2 set union intro1 . Lemma set union intro : (a : A)(x, y : set)

(set In a x) ∨ (set In a y) → (set In a (set union x y)). Lemma set union elim : (a : A)(x, y : set)

(set In a (set union x y)) → (set In a x) ∨ (set In a y). Lemma set inter intro : (a : A)(x, y : set)

(set In a x) → (set In a y) → (set In a (set inter x y)).

Lemma set inter elim1 : (a : A)(x, y : set)

(set In a (set inter x y)) → (set In a x). Lemma set inter elim2 : (a : A)(x, y : set)

(set In a (set inter x y)) → (set In a y). Hints Resolve set inter elim1 set inter elim2 . Lemma set inter elim : (a : A)(x, y : set)

(set In a (set inter x y)) → (set In a x) ∧ (set In a y). Lemma set diff intro : (a : A)(x, y : set)

(set In a x) → ¬(set In a y) → (set In a (set diff x y)). Lemma set diff elim1 : (a : A)(x, y : set)

(set In a (set diff x y)) → (set In a x). End first definitions. Section other definitions. Variables A, B : Set. Definition set prod : (set A) → (set B) → (set A × B) := (list prod 1!A 2!B). Bˆ A, set of applications from A to B Definition set power : (set A) → (set B) → (set (set A × B)) :=

(list power 1!A 2!B). Definition set map : (A → B) → (set A) → (set B) := (map 1!A 2!B). Definition set fold left : (B → A → B) → (set A) → B → B :=

(fold left 1!B 2!A). Definition set fold right : (A → B → B) → (set A) → B → B :=

[f ][x][b](fold right f b x). End other definitions. Implicit Arguments Off .

Module TheoryList

Id : T heoryList.v, v1.62001/03/1513 : 38 : 50filliatrExp Some programs and results about lists following CAML Manual Require Export PolyList. Implicit Arguments On. Chapter Lists. Variable A : Set. The null function Definition Isnil : (list A) → Prop := [l : (list A)](nil A) = l. Lemma Isnil nil : (Isnil (nil A)). Hints Resolve Isnil nil.

Lemma not Isnil cons : (a : A)(l : (list A))¬(Isnil (cons a l)). Hints Resolve Isnil nil not Isnil cons. Lemma Isnil dec : (l : (list A)){(Isnil l)} + {¬(Isnil l)}. The Uncons function Lemma Uncons : (l : (list A)){a : A & { m : (list A) | (cons a m) = l}} + {Isnil l}. The head function Lemma Hd : (l : (list A)){a : A | (EX m : (list A) |(cons a m) = l)} + {Isnil l}. Lemma Tl : (l : (list A)){m : (list A)| (EX a : A |(cons a m) = l)

∨ ((Isnil l) ∧ (Isnil m)) }.

Length of lists length is defined in PolyList Fixpoint Length l [l : (list A)] : nat → nat

:= [n : nat] Cases l of

nil ⇒ n | (cons m) ⇒ (Length l m (S n)) end.

A tail recursive version Lemma Length l pf : (l : (list A))(n : nat){m : nat|(plus n (length l)) = m}. Lemma Length : (l : (list A)){m : nat|(length l) = m}. Members of lists Inductive In spec [a : A] : (list A) → Prop :=

| in hd : (l : (list A))(In spec a (cons a l))

| in tl : (l : (list A))(b : A)(In a l) → (In spec a (cons b l)). Hints Resolve in hd in tl. Hints Unfold In. Hints Resolve in cons. Theorem In In spec : (a : A)(l : (list A))(In a l) ↔ (In spec a l). Inductive AllS [P : A → Prop] : (list A) → Prop

:= allS nil : (AllS P (nil A))

| allS cons : (a : A)(l : (list A))(P a) → (AllS P l) → (AllS P (cons a l)). Hints Resolve allS nil allS cons. Hypothesis eqA dec : (a, b : A){a = b} + {¬a = b}. Fixpoint mem [a : A; l : (list A)] : bool :=

Cases l of

nil ⇒ false | (cons b m) ⇒ if (eqA dec a b) then [H ]true else [H ](mem a m) end.

Hints Unfold In. Lemma Mem : (a : A)(l : (list A)){(In a l)} + {(AllS [b : A]¬b = a l)}.

Index of elements

Require Le. Require Lt.

Inductive nth spec : (list A) → nat → A → Prop :=

nth spec O : (a : A)(l : (list A))(nth spec (cons a l) (S O) a) | nth spec S : (n : nat)(a, b : A)(l : (list A))

(nth spec l n a) → (nth spec (cons b l) (S n) a).

Hints Resolve nth spec O nth spec S.

Inductive fst nth spec : (list A) → nat → A → Prop :=

fst nth O : (a : A)(l : (list A))(fst nth spec (cons a l) (S O) a) | fst nth S : (n : nat)(a, b : A)(l : (list A))(¬a = b) →

(fst nth spec l n a) → (fst nth spec (cons b l) (S n) a).

Hints Resolve fst nth O fst nth S.

Lemma fst nth nth : (l : (list A))(n : nat)(a : A)(fst nth spec l n a) → (nth spec l n a). Hints Lemma nth lt O : (l : (list A))(n : nat)(a : A)(nth spec l n a) → (lt O n).

Lemma nth le length : (l : (list A))(n : nat)(a : A)(nth spec l n a) → (le n (length l)).

Fixpoint Nth func [l : (list A)] : nat → (Exc A)

:= [n : nat] Cases l n of

(cons a ) (S O) ⇒ (value A a) | (cons l′) (S (S p)) ⇒ (Nth func l′ (S p)) | ⇒ Error end.

Lemma Nth : (l : (list A))(n : nat)

{a : A|(nth spec l n a)} + {(n = O) ∨ (lt (length l) n)}.

Lemma Item : (l : (list A))(n : nat){a : A|(nth spec l (S n) a)} + {(le (length l) n)}.

Require Minus. Require DecBool.

Fixpoint index p [a : A; l : (list A)] : nat → (Exc nat) :=

Cases l of nil ⇒ [p]Error

| (cons b m) ⇒ [p](ifdec (eqA dec a b) (Value p) (index p a m (S p))) end.

Lemma Index p : (a : A)(l : (list A))(p : nat)

{n : nat|(fst nth spec l (minus (S n) p) a)} + {(AllS [b : A]¬a = b l)}.

Lemma Index : (a : A)(l : (list A))

{n : nat|(fst nth spec l n a)} + {(AllS [b : A]¬a = b l)}.

Section Find sec. Variable R, P : A → Prop.

Inductive InR : (list A) → Prop := inR hd : (a : A)(l : (list A))(R a) → (InR (cons a l)) | inR tl : (a : A)(l : (list A))(InR l) → (InR (cons a l)).

Hints Resolve inR hd inR tl.

Definition InR inv :=

[l : (list A)]Cases l of

nil ⇒ False | (cons b m) ⇒ (R b) ∨ (InR m) end.

Lemma InR INV : (l : (list A))(InR l) → (InR inv l).

Lemma InR cons inv : (a : A)(l : (list A))(InR (cons a l)) → ((R a) ∨ (InR l)).

Lemma InR or app : (l, m : (list A))((InR l) ∨ (InR m)) → (InR (app l m)).

Lemma InR app or : (l, m : (list A))(InR (app l m)) → ((InR l) ∨ (InR m)).

Hypothesis RS dec : (a : A){(R a)} + {(P a)}.

Fixpoint find [l : (list A)] : (Exc A) :=

Cases l of nil ⇒ Error

| (cons a m) ⇒ (ifdec (RS dec a) (Value a) (find m)) end.

Lemma Find : (l : (list A)){a : A | (In a l) & (R a)} + {(AllS P l)}.

Variable B : Set. Variable T : A → B → Prop.

Variable TS dec : (a : A){c : B| (T a c)} + {(P a)}.

Fixpoint try find [l : (list A)] : (Exc B) :=

Cases l of

nil ⇒ Error | (cons a l1 ) ⇒

Cases (TS dec a) of

(inleft (exist c )) ⇒ (Value c) | (inright ) ⇒ (try find l1 ) end

end.

Lemma Try find : (l : (list A)){c : B|(EX a : A |(In a l) & (T a c))} + {(AllS P l)}.

End Find sec.

Section Assoc sec.

Variable B : Set. Fixpoint assoc [a : A; l : (list A × B)] : (Exc B) :=

Cases l of nil ⇒ Error

| (cons (a′, b) m) ⇒ (ifdec (eqA dec a a′) (Value b) (assoc a m)) end.

Inductive AllS assoc [P : A → Prop] : (list A × B) → Prop :=

allS assoc nil : (AllS assoc P (nil A × B)) | allS assoc cons : (a : A)(b : B)(l : (list A × B))

(P a) → (AllS assoc P l) → (AllS assoc P (cons (a, b) l)).

Hints Resolve allS assoc nil allS assoc cons. Lemma Assoc : (a : A)(l : (list A × B))(B + {(AllS assoc [a′ : A]¬(a = a′) l)}). End Assoc sec. End Lists. Hints Resolve Isnil nil not Isnil cons in hd in tl in cons allS nil allS cons : datatypes. Hints

6 Sets

This is a library on sets defined by their characteristic predicate. It contains the following modules:

   • Ensembles.v
   • Constructive sets.v, Classical sets.v
   • Relations 1.v, Relations 2.v, Relations 3.v, Relations 1 facts.v,
     Relations 2 facts.v, Relations 3 facts.v
   • Partial Order.v, Cpo.v
   • Powerset.v, Powerset facts.v, Powerset Classical facts.v
   • Finite sets.v, Finite sets facts.v
   • Image.v
   • Infinite sets.v
   • Integers.v

Module Ensembles

Id : Ensembles.v, v1.32001/04/1112 : 41 : 40filliatrExp Section Ensembles. Variable U : Type. Definition Ensemble := U → Prop. Definition In : Ensemble → U → Prop := [A : Ensemble] [x : U ] (A x). Definition Included : Ensemble → Ensemble → Prop :=

[B, C : Ensemble] (x : U ) (In B x) → (In C x). Inductive Empty set : Ensemble :=

. Inductive Full set : Ensemble :=

Full intro : (x : U ) (In Full set x).

NB The following definition builds-in equality of elements in U as Leibniz equality. This may have to be changed if we replace U by a Setoid on U with its own equality eqs, with In singleton : (y : U )(eqs x y) → (In (Singleton x) y).

Inductive Singleton [x : U ] : Ensemble := In singleton : (In (Singleton x) x).

Inductive Union [B, C : Ensemble] : Ensemble :=

Union introl : (x : U ) (In B x) → (In (Union B C ) x) | Union intror : (x : U ) (In C x) → (In (Union B C ) x).

Definition Add : Ensemble → U → Ensemble := [B : Ensemble] [x : U ] (Union B (Singleton x)).

Inductive Intersection [B, C : Ensemble] : Ensemble :=

Intersection intro :

(x : U ) (In B x) → (In C x) → (In (Intersection B C ) x).

Inductive Couple [x, y : U ] : Ensemble :=

Couple l : (In (Couple x y) x) | Couple r : (In (Couple x y) y).

Inductive Triple[x, y, z : U ] : Ensemble :=

Triple l : (In (Triple x y z) x) | Triple m : (In (Triple x y z) y) | Triple r : (In (Triple x y z) z).

Definition Complement : Ensemble → Ensemble := [A : Ensemble] [x : U ] ¬ (In A x).

Definition Setminus : Ensemble → Ensemble → Ensemble := [B : Ensemble] [C : Ensemble] [x : U ] (In B x) ∧ ¬ (In C x).

Definition Subtract : Ensemble → U → Ensemble := [B : Ensemble] [x : U ] (Setminus B (Singleton x)).

Inductive Disjoint [B, C : Ensemble] : Prop := Disjoint intro : ((x : U ) ¬ (In (Intersection B C ) x)) → (Disjoint B C ).

Inductive Inhabited [B : Ensemble] : Prop := Inhabited intro : (x : U ) (In B x) → (Inhabited B).

Definition Strict Included : Ensemble → Ensemble → Prop := [B, C : Ensemble] (Included B C ) ∧ ¬ B == C .

Definition Same set : Ensemble → Ensemble → Prop := [B, C : Ensemble] (Included B C ) ∧ (Included C B).

****** Extensionality Axiom ******

Axiom Extensionality Ensembles :

(A, B : Ensemble) (Same set A B) → A == B. Hints Resolve Extensionality Ensembles.

End Ensembles.

Hints Unfold In Included Same set Strict Included Add Setminus Subtract : sets v62 .

Hints Resolve Union introl Union intror Intersection intro In singleton Couple l

Couple r Triple l Triple m Triple r Disjoint intro

Extensionality Ensembles : sets v62 .

Module Constructive sets

Id : Constructive_{s}ets.v, v1.22001/03/1513 : 38 : 53filliatrExp

Require Export Ensembles.

Section Ensembles facts. Variable U : Type.

Lemma Extension : (B, C : (Ensemble U )) B == C → (Same set U B C ).

Lemma Noone in empty : (x : U ) ¬ (In U (Empty set U ) x). Hints Resolve Noone in empty.

Lemma Included Empty : (A : (Ensemble U ))(Included U (Empty set U ) A). Hints Resolve Included Empty.

Lemma Add intro1 :

(A : (Ensemble U )) (x, y : U ) (In U A y) → (In U (Add U A x) y). Hints Resolve Add intro1 .

Lemma Add intro2 : (A : (Ensemble U )) (x : U ) (In U (Add U A x) x). Hints Resolve Add intro2 .

Lemma Inhabited add : (A : (Ensemble U )) (x : U ) (Inhabited U (Add U A x)). Hints Resolve Inhabited add.

Lemma Inhabited not empty :

(X : (Ensemble U )) (Inhabited U X ) → ¬ X == (Empty set U ). Hints Resolve Inhabited not empty.

Lemma Add not Empty : (A : (Ensemble U )) (x : U ) ¬ (Add U A x) == (Empty set U ). Hints Resolve Add not Empty.

Lemma not Empty Add : (A : (Ensemble U )) (x : U ) ¬ (Empty set U ) == (Add U A x). Hints Resolve not Empty Add.

Lemma Singleton inv : (x, y : U ) (In U (Singleton U x) y) → x == y. Hints Resolve Singleton inv.

Lemma Singleton intro : (x, y : U ) x == y → (In U (Singleton U x) y). Hints Resolve Singleton intro.

Lemma Union inv : (B, C : (Ensemble U )) (x : U )

(In U (Union U B C ) x) → (In U B x) ∨ (In U C x).

Lemma Add inv :

(A : (Ensemble U )) (x, y : U ) (In U (Add U A x) y) → (In U A y) ∨ x == y.

Lemma Intersection inv :

(B, C : (Ensemble U )) (x : U ) (In U (Intersection U B C ) x) → (In U B x) ∧ (In U C x).

Hints Resolve Intersection inv.

Lemma Couple inv : (x, y, z : U ) (In U (Couple U x y) z) → z == x ∨ z == y. Hints Resolve Couple inv.

Lemma Setminus intro :

(A, B : (Ensemble U )) (x : U ) (In U A x) → ¬ (In U B x) → (In U (Setminus U A B) x).

Hints Resolve Setminus intro.

Lemma Strict Included intro :

(X , Y : (Ensemble U )) (Included U X Y ) ∧ ¬ X == Y →

(Strict Included U X Y ).

Hints Resolve Strict Included intro.

Lemma Strict Included strict : (X : (Ensemble U )) ¬ (Strict Included U X X ). Hints Resolve Strict Included strict.

End Ensembles facts.

Hints Resolve Singleton inv Singleton intro Add intro1 Add intro2

Intersection inv Couple inv Setminus intro Strict Included intro
Strict Included strict Noone in empty Inhabited not empty

Add not Empty not Empty Add Inhabited add Included Empty : sets v62 .

Module Classical sets

Id : Classical_{s}ets.v, v1.22001/03/1513 : 38 : 53filliatrExp

Require Export Ensembles. Require Export Constructive sets. Require Export Classical Type.

Hints Unfold not .

Section Ensembles classical. Variable U : Type.

Lemma not included empty Inhabited :

(A : (Ensemble U )) ¬ (Included U A (Empty set U )) → (Inhabited U A). Hints Resolve not included empty Inhabited.

Lemma not empty Inhabited :

(A : (Ensemble U )) ¬ A == (Empty set U ) → (Inhabited U A).

Lemma Inhabited Setminus : (X , Y : (Ensemble U )) (Included U X Y ) → ¬ (Included U Y X ) →

(Inhabited U (Setminus U Y X )). Hints Resolve Inhabited Setminus.

Lemma Strict super set contains new element :

(X , Y : (Ensemble U )) (Included U X Y ) → ¬ X == Y →

(Inhabited U (Setminus U Y X )). Hints Resolve Strict super set contains new element.

Lemma Subtract intro :

(A : (Ensemble U )) (x, y : U ) (In U A y) → ¬ x == y →

(In U (Subtract U A x) y). Hints Resolve Subtract intro.

Lemma Subtract inv :

(A : (Ensemble U )) (x, y : U ) (In U (Subtract U A x) y) →

(In U A y) ∧ ¬ x == y.

Lemma Included Strict Included :

(X , Y : (Ensemble U )) (Included U X Y ) → (Strict Included U X Y ) ∨ X == Y .

Lemma Strict Included inv :

(X , Y : (Ensemble U )) (Strict Included U X Y ) →

(Included U X Y ) ∧ (Inhabited U (Setminus U Y X )).

Lemma not SIncl empty :

(X : (Ensemble U )) ¬ (Strict Included U X (Empty set U )).

Lemma Complement Complement :

(A : (Ensemble U )) (Complement U (Complement U A)) == A.

End Ensembles classical.

Hints Resolve Strict super set contains new element Subtract intro not SIncl empty : sets v62 .

Module Relations 1 facts

Require Export Relations 1 .

Definition Complement : (U : Type) (Relation U ) → (Relation U ) := [U : Type] [R : (Relation U )] [x, y : U ] ¬ (R x y).

Theorem Rsym imp notRsym : (U : Type) (R : (Relation U )) (Symmetric U R) → (Symmetric U (Complement U R)).

Theorem Equiv from preorder :

(U : Type) (R : (Relation U )) (Preorder U R) →

(Equivalence U [x, y : U ] (R x y) ∧ (R y x)).

Hints Resolve Equiv from preorder.

Theorem Equiv from order :

(U : Type) (R : (Relation U )) (Order U R) →

(Equivalence U [x, y : U ] (R x y) ∧ (R y x)).

Hints Resolve Equiv from order.

Theorem contains is preorder :

(U : Type) (Preorder (Relation U ) (contains U )). Hints Resolve contains is preorder.

Theorem same relation is equivalence :

(U : Type) (Equivalence (Relation U ) (same relation U )). Hints Resolve same relation is equivalence.

Theorem cong reflexive same relation :

(U :Type) (R, R′ : (Relation U )) (same relation U R R′) → (Reflexive U R) → (Reflexive U R′).

Theorem cong symmetric same relation :

(U :Type) (R, R′ : (Relation U )) (same relation U R R′) → (Symmetric U R) → (Symmetric U R′).

Theorem cong antisymmetric same relation :

(U :Type) (R, R′ : (Relation U )) (same relation U R R′) → (Antisymmetric U R) → (Antisymmetric U R′).

Theorem cong transitive same relation :

(U :Type) (R, R′ : (Relation U )) (same relation U R R′) → (Transitive U R) → (Transitive U R′).

Module Relations 1

Id : Relations_{1}.v, v1.22001/03/1513 : 38 : 54filliatrExp

Section Relations 1 .

Variable U : Type.

Definition Relation := U → U → Prop.

Variable R : Relation.

Definition Reflexive : Prop := (x : U ) (R x x).

Definition Transitive : Prop := (x, y, z : U ) (R x y) → (R y z) → (R x z).

Definition Symmetric : Prop := (x, y : U ) (R x y) → (R y x).

Definition Antisymmetric : Prop := (x : U ) (y : U ) (R x y) → (R y x) → x == y.

Definition contains : Relation → Relation → Prop := [R, R′ : Relation] (x : U ) (y : U ) (R′ x y) → (R x y).

Definition same relation : Relation → Relation → Prop := [R, R′ : Relation] (contains R R′) ∧ (contains R′ R).

Inductive Preorder : Prop := Definition of preorder : Reflexive → Transitive → Preorder.

Inductive Order : Prop := Definition of order : Reflexive → Transitive → Antisymmetric → Order.

Inductive Equivalence : Prop :=

Definition of equivalence :

Reflexive → Transitive → Symmetric → Equivalence.

Inductive PER : Prop := Definition of PER : Symmetric → Transitive → PER.

End Relations 1 . Hints Unfold Reflexive Transitive Antisymmetric Symmetric contains

same relation : sets v62 . Hints Resolve Definition of preorder Definition of order

Definition of equivalence Definition of PER : sets v62 .

Module Permut

Id : P ermut.v, v1.32001/04/1112 : 41 : 40filliatrExp G. Huet 1-9-95 We consider a Set U, given with a commutative-associative operator op, and a congruence cong; we show permutation lemmas Section Axiomatisation. Variable U : Set. Variable op : U → U → U . Variable cong : U → U → Prop. Hypothesis op comm : (x, y : U )(cong (op x y) (op y x)). Hypothesis op ass : (x, y, z : U )(cong (op (op x y) z) (op x (op y z))). Hypothesis cong left : (x, y, z : U )(cong x y) → (cong (op x z) (op y z)). Hypothesis cong right : (x, y, z : U )(cong x y) → (cong (op z x) (op z y)). Hypothesis cong trans : (x, y, z : U )(cong x y) → (cong y z) → (cong x z). Hypothesis cong sym : (x, y : U )(cong x y) → (cong y x). Remark. we do not need: Hypothesis cong refl : (x : U )(cong x x). Lemma cong congr : (x, y, z, t : U )(cong x y) → (cong z t) → (cong (op x z) (op y t)). Lemma comm right : (x, y, z : U )(cong (op x (op y z)) (op x (op z y))). Lemma comm left : (x, y, z : U )(cong (op (op x y) z) (op (op y x) z)). Lemma perm right : (x, y, z : U )(cong (op (op x y) z) (op (op x z) y)). Lemma perm left : (x, y, z : U )(cong (op x (op y z)) (op y (op x z))). Lemma op rotate : (x, y, z, t : U )(cong (op x (op y z)) (op z (op x y))). Needed for treesort ... Lemma twist : (x, y, z, t : U )

(cong (op x (op (op y z) t)) (op (op y (op x t)) z)). End Axiomatisation.

Module Partial Order

Id : P artial_{O}rder.v, v1.32001/03/1513 : 38 : 54filliatrExp Require Export Ensembles.

Require Export Relations 1 .

Section Partial orders. Variable U : Type.

Definition Carrier := (Ensemble U ).

Definition Rel := (Relation U ).

Record PO : Type := Definition of PO { Carrier of : (Ensemble U ); Rel of : (Relation U ); PO cond1 : (Inhabited U Carrier of ); PO cond2 : (Order U Rel of ) }.

Variable p : PO.

Definition Strict Rel of : Rel := [x, y : U ] (Rel of p x y) ∧ ¬ x == y.

Inductive covers [y, x : U ] : Prop := Definition of covers : (Strict Rel of x y) →

¬ (EXT z | (Strict Rel of x z) ∧ (Strict Rel of z y)) → (covers y x).

End Partial orders.

Hints Unfold Carrier of Rel of Strict Rel of : sets v62 . Hints Resolve Definition of covers : sets v62 .

Section Partial order facts. Variable U :Type. Variable D : (PO U ).

Lemma Strict Rel Transitive with Rel :

(x : U ) (y : U ) (z : U ) (Strict Rel of U D x y) → (Rel of U D y z) → (Strict Rel of U D x z).

Lemma Strict Rel Transitive with Rel left :

(x : U ) (y : U ) (z : U ) (Rel of U D x y) → (Strict Rel of U D y z) → (Strict Rel of U D x z).

Lemma Strict Rel Transitive : (Transitive U (Strict Rel of U D)). End Partial order facts.

Module Cpo

Id : Cpo.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Export Ensembles. Require Export Relations 1 . Require Export Partial Order.

Section Bounds. Variable U : Type. Variable D : (PO U ).

Local C := (Carrier of U D).

Local R := (Rel of U D).

Inductive Upper Bound [B : (Ensemble U ); x : U ] : Prop :=

Upper Bound definition :

(In U C x) → ((y : U ) (In U B y) → (R y x)) → (Upper Bound B x).

Inductive Lower Bound [B : (Ensemble U ); x : U ] : Prop :=

Lower Bound definition :

(In U C x) → ((y : U ) (In U B y) → (R x y)) → (Lower Bound B x).

Inductive Lub [B : (Ensemble U ); x : U ] : Prop :=

Lub definition :

(Upper Bound B x) → ((y : U ) (Upper Bound B y) → (R x y)) → (Lub B x).

Inductive Glb [B : (Ensemble U ); x : U ] : Prop :=

Glb definition :

(Lower Bound B x) → ((y : U ) (Lower Bound B y) → (R y x)) → (Glb B x).

Inductive Bottom [bot : U ] : Prop :=

Bottom definition :

(In U C bot) → ((y : U ) (In U C y) → (R bot y)) → (Bottom bot).

Inductive Totally ordered [B : (Ensemble U )] : Prop :=

Totally ordered definition : ((Included U B C ) →

(x : U ) (y : U ) (Included U (Couple U x y) B) → (R x y) ∨ (R y x)) → (Totally ordered B).

Definition Compatible : (Relation U ) := [x : U ] [y : U ] (In U C x) → (In U C y) → (EXT z | (In U C z) ∧ (Upper Bound (Couple U x y) z)).

Inductive Directed [X : (Ensemble U )] : Prop :=

Definition of Directed : (Included U X C ) → (Inhabited U X ) → ((x1 : U ) (x2 : U ) (Included U (Couple U x1 x2 ) X ) →

(EXT x3 | (In U X x3 ) ∧ (Upper Bound (Couple U x1 x2 ) x3 ))) → (Directed X ).

Inductive Complete : Prop :=

Definition of Complete :

((EXT bot | (Bottom bot))) →

((X : (Ensemble U )) (Directed X ) → (EXT bsup | (Lub X bsup))) → Complete.

Inductive Conditionally complete : Prop :=

Definition of Conditionally complete : ((X : (Ensemble U )) (Included U X C ) → (EXT maj | (Upper Bound X maj )) → (EXT bsup | (Lub X bsup))) → Conditionally complete.

End Bounds.

Hints Resolve Totally ordered definition Upper Bound definition

Lower Bound definition Lub definition Glb definition
Bottom definition Definition of Complete

Definition of Complete Definition of Conditionally complete.

Section Specific orders. Variable U : Type.

Record Cpo : Type := Definition of cpo { PO of cpo : (PO U ); Cpo cond : (Complete U PO of cpo) }.

Record Chain : Type := Definition of chain { PO of chain : (PO U ); Chain cond : (Totally ordered U PO of chain (Carrier of U PO of chain)) }.

End Specific orders.

Module Powerset

Id : P owerset.v, v1.32001/03/1513 : 38 : 54filliatrExp

Require Export Ensembles. Require Export Relations 1 . Require Export Relations 1 facts. Require Export Partial Order. Require Export Cpo.

Section The power set partial order. Variable U : Type.

Inductive Power set [A : (Ensemble U )] : (Ensemble (Ensemble U )) := Definition of Power set : (X : (Ensemble U )) (Included U X A) → (In (Ensemble U ) (Power set A) X ).

Hints Resolve Definition of Power set.

Theorem Empty set minimal : (X : (Ensemble U )) (Included U (Empty set U ) X ). Hints Resolve Empty set minimal.

Theorem Power set Inhabited :

(X : (Ensemble U )) (Inhabited (Ensemble U ) (Power set X )). Hints Resolve Power set Inhabited.

Theorem Inclusion is an order : (Order (Ensemble U ) (Included U )). Hints Resolve Inclusion is an order.

Theorem Inclusion is transitive : (Transitive (Ensemble U ) (Included U )). Hints Resolve Inclusion is transitive.

Definition Power set PO : (Ensemble U ) → (PO (Ensemble U )). Hints Unfold Power set PO.

Theorem Strict Rel is Strict Included :

(same relation (Ensemble U ) (Strict Included U ) (Strict Rel of (Ensemble U ) (Power set PO (Full set U )))).

Hints Resolve Strict Rel Transitive Strict Rel is Strict Included.

Lemma Strict inclusion is transitive with inclusion :

(x, y, z : (Ensemble U )) (Strict Included U x y) → (Included U y z) → (Strict Included U x z).

Lemma Strict inclusion is transitive with inclusion left :

(x, y, z : (Ensemble U )) (Included U x y) → (Strict Included U y z) → (Strict Included U x z).

Lemma Strict inclusion is transitive :

(Transitive (Ensemble U ) (Strict Included U )).

Theorem Empty set is Bottom :

(A : (Ensemble U )) (Bottom (Ensemble U ) (Power set PO A) (Empty set U )). Hints Resolve Empty set is Bottom.

Theorem Union minimal :

(a, b, X : (Ensemble U )) (Included U a X ) → (Included U b X ) →

(Included U (Union U a b) X ). Hints Resolve Union minimal.

Theorem Intersection maximal :

(a, b, X : (Ensemble U )) (Included U X a) → (Included U X b) →

(Included U X (Intersection U a b)).

Theorem Union increases l : (a, b : (Ensemble U )) (Included U a (Union U a b)).

Theorem Union increases r : (a, b : (Ensemble U )) (Included U b (Union U a b)).

Theorem Intersection decreases l :

(a, b : (Ensemble U )) (Included U (Intersection U a b) a).

Theorem Intersection decreases r :

(a, b : (Ensemble U )) (Included U (Intersection U a b) b). Hints Resolve Union increases l Union increases r Intersection decreases l

Intersection decreases r.

Theorem Union is Lub :

(A : (Ensemble U )) (a, b : (Ensemble U )) (Included U a A) → (Included U b A) → (Lub (Ensemble U ) (Power set PO A) (Couple (Ensemble U ) a b) (Union U a b)).

Theorem Intersection is Glb :

(A : (Ensemble U )) (a, b : (Ensemble U )) (Included U a A) → (Included U b A) → (Glb

(Ensemble U ) (Power set PO A) (Couple (Ensemble U ) a b) (Intersection U a b)).

End The power set partial order.

Hints Resolve Empty set minimal : sets v62 .

Hints Resolve Power set Inhabited : sets v62 . Hints Resolve Inclusion is an order : sets v62 . Hints Resolve Inclusion is transitive : sets v62 . Hints Resolve Union minimal : sets v62 . Hints Resolve Union increases l : sets v62 . Hints Resolve Union increases r : sets v62 . Hints Resolve Intersection decreases l : sets v62 . Hints Resolve Intersection decreases r : sets v62 . Hints Resolve Empty set is Bottom : sets v62 . Hints Resolve Strict inclusion is transitive : sets v62 .

Module Powerset facts

Id : P owerset_{f}acts.v, v1.42001/03/1513 : 38 : 54filliatrExp

Require Export Ensembles. Require Export Constructive sets. Require Export Relations 1 . Require Export Relations 1 facts. Require Export Partial Order. Require Export Cpo. Require Export Powerset.

Section Sets as an algebra. Variable U : Type. Hints Unfold not.

Theorem Empty set zero :

(X : (Ensemble U )) (Union U (Empty set U ) X ) == X . Hints Resolve Empty set zero.

Theorem Empty set zero′ :

(x : U ) (Add U (Empty set U ) x) == (Singleton U x). Hints Resolve Empty set zero′.

Lemma less than empty :

(X : (Ensemble U )) (Included U X (Empty set U )) → X == (Empty set U ). Hints Resolve less than empty.

Theorem Union commutative :

(A, B : (Ensemble U )) (Union U A B) == (Union U B A).

Theorem Union associative :

(A, B, C : (Ensemble U ))

(Union U (Union U A B) C ) == (Union U A (Union U B C )). Hints Resolve Union associative.

Theorem Union idempotent : (A : (Ensemble U )) (Union U A A) == A.

Lemma Union absorbs :

(A, B : (Ensemble U )) (Included U B A) → (Union U A B) == A.

Theorem Couple as union :

(x, y : U ) (Union U (Singleton U x) (Singleton U y)) == (Couple U x y).

Theorem Triple as union :

(x, y, z : U )

(Union U (Union U (Singleton U x) (Singleton U y)) (Singleton U z)) == (Triple U x y z).

Theorem Triple as Couple : (x, y : U ) (Couple U x y) == (Triple U x x y).

Theorem Triple as Couple Singleton :

(x, y, z : U ) (Triple U x y z) == (Union U (Couple U x y) (Singleton U z)).

Theorem Intersection commutative :

(A, B : (Ensemble U )) (Intersection U A B) == (Intersection U B A).

Theorem Distributivity :

(A, B, C : (Ensemble U ))

(Intersection U A (Union U B C )) ==

(Union U (Intersection U A B) (Intersection U A C )).

Theorem Distributivity′ :

(A, B, C : (Ensemble U ))

(Union U A (Intersection U B C )) ==

(Intersection U (Union U A B) (Union U A C )).

Theorem Union add :

(A, B : (Ensemble U )) (x : U )

(Add U (Union U A B) x) == (Union U A (Add U B x)). Hints Resolve Union add.

Theorem Non disjoint union :

(X : (Ensemble U )) (x : U ) (In U X x) → (Add U X x) == X .

Theorem Non disjoint union′ :

(X : (Ensemble U )) (x : U ) ¬ (In U X x) → (Subtract U X x) == X .

Lemma singlx : (x, y : U ) (In U (Add U (Empty set U ) x) y) → x == y. Hints Resolve singlx.

Lemma incl add :

(A, B : (Ensemble U )) (x : U ) (Included U A B) →

(Included U (Add U A x) (Add U B x)). Hints Resolve incl add.

Lemma incl add x :

(A, B : (Ensemble U ))

(x : U ) ¬ (In U A x) → (Included U (Add U A x) (Add U B x)) →

(Included U A B).

Lemma Add commutative :

(A : (Ensemble U )) (x, y : U ) (Add U (Add U A x) y) == (Add U (Add U A y) x).

Lemma Add commutative′ :

(A : (Ensemble U )) (x, y, z : U )

(Add U (Add U (Add U A x) y) z) == (Add U (Add U (Add U A z) x) y).

Lemma Add distributes :

(A, B : (Ensemble U )) (x, y : U ) (Included U B A) →

(Add U (Add U A x) y) == (Union U (Add U A x) (Add U B y)).

Lemma setcover intro :

(U : Type)

(A : (Ensemble U ))

(x, y : (Ensemble U ))

(Strict Included U x y) →

¬ (EXT z | (Strict Included U x z)

∧ (Strict Included U z y)) →

(covers (Ensemble U ) (Power set PO U A) y x). Hints Resolve setcover intro.

End Sets as an algebra.

Hints Resolve Empty set zero Empty set zero′ Union associative Union add singlx incl add : sets v62 .

Id : P owerset_{f}acts.v, v1.42001/03/1513 : 38 : 54filliatrExp

Module Powerset Classical facts

Id : P owerset_{C}lassical_{f}acts.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Export Ensembles. Require Export Constructive sets. Require Export Relations 1 . Require Export Relations 1 facts. Require Export Partial Order. Require Export Cpo. Require Export Powerset. Require Export Powerset facts. Require Export Classical Type. Require Export Classical sets.

Section Sets as an algebra.

Variable U : Type.

Lemma sincl add x :

(A, B : (Ensemble U ))

(x : U ) ¬ (In U A x) → (Strict Included U (Add U A x) (Add U B x)) → (Strict Included U A B).

Lemma incl soustr in :

(X : (Ensemble U )) (x : U ) (In U X x) → (Included U (Subtract U X x) X ). Hints Resolve incl soustr in : sets v62 .

Lemma incl soustr :

(X , Y : (Ensemble U )) (x : U ) (Included U X Y ) →

(Included U (Subtract U X x) (Subtract U Y x)). Hints Resolve incl soustr : sets v62 .

Lemma incl soustr add l :

(X : (Ensemble U )) (x : U ) (Included U (Subtract U (Add U X x) x) X ). Hints Resolve incl soustr add l : sets v62 .

Lemma incl soustr add r :

(X : (Ensemble U )) (x : U ) ¬ (In U X x) →

(Included U X (Subtract U (Add U X x) x)). Hints Resolve incl soustr add r : sets v62 .

Lemma add soustr 2 :

(X : (Ensemble U )) (x : U ) (In U X x) →

(Included U X (Add U (Subtract U X x) x)).

Lemma add soustr 1 :

(X : (Ensemble U )) (x : U ) (In U X x) →

(Included U (Add U (Subtract U X x) x) X ). Hints Resolve add soustr 1 add soustr 2 : sets v62 .

Lemma add soustr xy :

(X : (Ensemble U )) (x, y : U ) ¬ x == y →

(Subtract U (Add U X x) y) == (Add U (Subtract U X y) x). Hints Resolve add soustr xy : sets v62 .

Lemma incl st add soustr :

(X , Y : (Ensemble U )) (x : U ) ¬ (In U X x) →

(Strict Included U (Add U X x) Y ) →

(Strict Included U X (Subtract U Y x)).

Lemma Sub Add new :

(X : (Ensemble U )) (x : U ) ¬ (In U X x) → X == (Subtract U (Add U X x) x).

Lemma Simplify add :

(X , X0 : (Ensemble U )) (x : U )

¬ (In U X x) → ¬ (In U X0 x) → (Add U X x) == (Add U X0 x) → X == X0 .

Lemma Included Add :

(X , A : (Ensemble U )) (x : U ) (Included U X (Add U A x)) →

(Included U X A) ∨

(EXT A′ | X == (Add U A′ x) ∧ (Included U A′ A)).

Lemma setcover inv : (A : (Ensemble U )) (x, y : (Ensemble U )) (covers (Ensemble U ) (Power set PO U A) y x) → (Strict Included U x y) ∧ ((z : (Ensemble U )) (Included U x z) → (Included U z y) → x == z ∨ z == y).

Theorem Add covers :

(A : (Ensemble U )) (a : (Ensemble U )) (Included U a A) →

(x : U ) (In U A x) → ¬ (In U a x) →

(covers (Ensemble U ) (Power set PO U A) (Add U a x) a).

Theorem covers Add :

(A : (Ensemble U ))

(a, a′ : (Ensemble U ))

(Included U a A) →

(Included U a′ A) → (covers (Ensemble U ) (Power set PO U A) a′ a) → (EXT x | a′ == (Add U a x) ∧ ((In U A x) ∧ ¬ (In U a x))).

Theorem covers is Add :

(A : (Ensemble U ))

(a, a′ : (Ensemble U )) (Included U a A) → (Included U a′ A) → (iff

(covers (Ensemble U ) (Power set PO U A) a′ a)

(EXT x | a′ == (Add U a x) ∧ ((In U A x) ∧ ¬ (In U a x)))).

Theorem Singleton atomic :

(x : U ) (A : (Ensemble U )) (In U A x) →

(covers (Ensemble U ) (Power set PO U A) (Singleton U x) (Empty set U )).

Lemma less than singleton :

(X : (Ensemble U )) (x : U ) (Strict Included U X (Singleton U x)) → X == (Empty set U ).

End Sets as an algebra.

Hints Resolve incl soustr in : sets v62 . Hints Resolve incl soustr : sets v62 . Hints Resolve incl soustr add l : sets v62 . Hints Resolve incl soustr add r : sets v62 . Hints Resolve add soustr 1 add soustr 2 : sets v62 . Hints Resolve add soustr xy : sets v62 .

Module Finite sets

Id : F inite_{s}ets.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Ensembles.

Section Ensembles finis. Variable U : Type.

Inductive Finite : (Ensemble U ) → Prop :=

Empty is finite : (Finite (Empty set U )) | Union is finite :

(A : (Ensemble U )) (Finite A) →

(x : U ) ¬ (In U A x) → (Finite (Add U A x)).

Inductive cardinal : (Ensemble U ) → nat → Prop :=

card empty : (cardinal (Empty set U ) O) | card add :

(A : (Ensemble U )) (n : nat) (cardinal A n) → (x : U ) ¬ (In U A x) → (cardinal (Add U A x) (S n)).

End Ensembles finis.

Hints Resolve Empty is finite Union is finite : sets v62 . Hints Resolve card empty card add : sets v62 .

Require Constructive sets.

Section Ensembles finis facts. Variable U : Type.

Lemma cardinal invert : (X : (Ensemble U )) (p : nat)(cardinal U X p) → Case p of

X == (Empty set U ) [n : nat] (EXT A | (EXT x |

X == (Add U A x) ∧ ¬ (In U A x) ∧ (cardinal U A n))) end.

Lemma cardinal elim : (X : (Ensemble U )) (p : nat)(cardinal U X p) → Case p of

X == (Empty set U ) [n : nat](Inhabited U X ) end.

End Ensembles finis facts.

Module Finite sets facts

Id : F inite_{s}ets_{f}acts.v, v1.32001/03/1513 : 38 : 54filliatrExp

Require Export Finite sets. Require Export Constructive sets. Require Export Classical Type. Require Export Classical sets. Require Export Powerset. Require Export Powerset facts. Require Export Powerset Classical facts. Require Export Gt. Require Export Lt.

Section Finite sets facts. Variable U : Type.

Lemma finite cardinal : (X : (Ensemble U )) (Finite U X ) → (EX n : nat |(cardinal U X n)).

Lemma cardinal finite :

(X : (Ensemble U )) (n : nat) (cardinal U X n) → (Finite U X ).

Theorem Add preserves Finite :

(X : (Ensemble U )) (x : U ) (Finite U X ) → (Finite U (Add U X x)). Hints Resolve Add preserves Finite.

Theorem Singleton is finite : (x : U ) (Finite U (Singleton U x)). Hints Resolve Singleton is finite.

Theorem Union preserves Finite :

(X , Y : (Ensemble U )) (Finite U X ) → (Finite U Y ) → (Finite U (Union U X Y )).

Lemma Finite downward closed :

(A : (Ensemble U )) (Finite U A) →

(X : (Ensemble U )) (Included U X A) → (Finite U X ).

Lemma Intersection preserves finite :

(A : (Ensemble U )) (Finite U A) → (X : (Ensemble U )) (Finite U (Intersection U X A)).

Lemma cardinalO empty :

(X : (Ensemble U )) (cardinal U X O) → X == (Empty set U ). Hints Resolve cardinalO empty.

Lemma inh card gt O :

(X : (Ensemble U )) (Inhabited U X ) → (n : nat) (cardinal U X n) → (gt n O).

Lemma card soustr 1 :

(X : (Ensemble U )) (n : nat) (cardinal U X n) → (x : U ) (In U X x) → (cardinal U (Subtract U X x) (pred n)).

Lemma cardinal is functional :

(X : (Ensemble U )) (c1 : nat) (cardinal U X c1 ) → (Y : (Ensemble U )) (c2 : nat) (cardinal U Y c2 ) → X == Y → c1 = c2 .

Lemma cardinal Empty : (m : nat)(cardinal U (Empty set U ) m) → O = m.

Lemma cardinal unicity :

(X : (Ensemble U )) (n : nat) (cardinal U X n) → (m : nat) (cardinal U X m) → n = m.

Lemma card Add gen :

(A : (Ensemble U )) (x : U ) (n, n′ : nat) (cardinal U A n) → (cardinal U (Add U A x) n′) → (le n′ (S n)).

Lemma incl st card lt :

(X : (Ensemble U )) (c1 : nat) (cardinal U X c1 ) → (Y : (Ensemble U )) (c2 : nat) (cardinal U Y c2 ) → (Strict Included U X Y ) →

(gt c2 c1 ).

Lemma incl card le :

(X , Y : (Ensemble U )) (n, m : nat) (cardinal U X n) → (cardinal U Y m) → (Included U X Y ) → (le n m).

Lemma G aux :

(P : (Ensemble U ) → Prop) ((X : (Ensemble U )) (Finite U X ) → ((Y : (Ensemble U )) (Strict Included U Y X ) → (P Y )) → (P X )) → (P (Empty set U )).

Hints Unfold not.

Lemma Generalized induction on finite sets :

(P : (Ensemble U ) → Prop) ((X : (Ensemble U )) (Finite U X ) → ((Y : (Ensemble U )) (Strict Included U Y X ) → (P Y )) → (P X )) → (X : (Ensemble U )) (Finite U X ) → (P X ).

End Finite sets facts.

Module Image

Id : Image.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Export Finite sets. Require Export Constructive sets. Require Export Classical Type. Require Export Classical sets. Require Export Powerset. Require Export Powerset facts. Require Export Powerset Classical facts. Require Export Gt. Require Export Lt. Require Export Le. Require Export Finite sets facts.

Section Image. Variables U , V : Type.

Inductive Im [X : (Ensemble U ); f : U → V ] : (Ensemble V ) := Im intro : (x : U ) (In ? X x) → (y : V ) y == (f x) → (In ? (Im X f ) y).

Lemma Im def :

(X : (Ensemble U )) (f : U → V ) (x : U ) (In ? X x) → (In ? (Im X f ) (f x)). Hints Resolve Im def .

Lemma Im add :

(X : (Ensemble U )) (x : U ) (f : U → V )

(Im (Add ? X x) f ) == (Add ? (Im X f ) (f x)).

Lemma image empty : (f : U → V ) (Im (Empty set U ) f ) == (Empty set V ). Hints Resolve image empty.

Lemma finite image :

(X : (Ensemble U )) (f : U → V ) (Finite ? X ) → (Finite ? (Im X f )). Hints Resolve finite image.

Lemma Im inv :

(X : (Ensemble U )) (f : U → V ) (y : V ) (In ? (Im X f ) y) →

(exT ? [x : U ] (In ? X x) ∧ (f x) == y).

Definition injective := [f : U → V ] (x, y : U ) (f x) == (f y) → x == y.

Lemma not injective elim :

(f : U → V ) ¬ (injective f ) →

(EXT x | (EXT y | (f x) == (f y) ∧ ¬ x == y)).

Lemma cardinal Im intro :

(A : (Ensemble U )) (f : U → V ) (n : nat) (cardinal ? A n) →

(EX p : nat | (cardinal ? (Im A f ) p)).

Lemma In Image elim :

(A : (Ensemble U )) (f : U → V ) (injective f ) →

(x : U ) (In ? (Im A f ) (f x)) → (In ? A x).

Lemma injective preserves cardinal :

(A : (Ensemble U )) (f : U → V ) (n : nat) (injective f ) → (cardinal ? A n) → (n′ : nat) (cardinal ? (Im A f ) n′) → n′ = n.

Lemma cardinal decreases :

(A : (Ensemble U )) (f : U → V ) (n : nat) (cardinal U A n) →

(n′ : nat) (cardinal V (Im A f ) n′) → (le n′ n).

Theorem Pigeonhole :

(A : (Ensemble U )) (f : U → V ) (n : nat) (cardinal U A n) →

(n′ : nat) (cardinal V (Im A f ) n′) → (lt n′ n) → ¬ (injective f ).

Lemma Pigeonhole principle :

(A : (Ensemble U )) (f : U → V ) (n : nat) (cardinal ? A n) →

(n′ : nat) (cardinal ? (Im A f ) n′) → (lt n′ n) →

(EXT x | (EXT y | (f x) == (f y) ∧ ¬ x == y)). End Image. Hints Resolve Im def image empty finite image : sets v62 .

Module Relations 2

Id : Relations_{2}.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Export Relations 1 .

Section Relations 2 . Variable U : Type. Variable R : (Relation U ).

Inductive Rstar : (Relation U ) :=

Rstar 0 : (x : U ) (Rstar x x) | Rstar n : (x, y, z : U ) (R x y) → (Rstar y z) → (Rstar x z).

Inductive Rstar1 : (Relation U ) :=

Rstar1 0 : (x : U ) (Rstar1 x x) | Rstar1 1 : (x : U ) (y : U ) (R x y) → (Rstar1 x y) | Rstar1 n : (x, y, z : U ) (Rstar1 x y) → (Rstar1 y z) → (Rstar1 x z).

Inductive Rplus : (Relation U ) :=

Rplus 0 : (x, y : U ) (R x y) → (Rplus x y) | Rplus n : (x, y, z : U ) (R x y) → (Rplus y z) → (Rplus x z).

Definition Strongly confluent : Prop := (x, a, b : U ) (R x a) → (R x b) → (exT U [z : U ] (R a z) ∧ (R b z)).

End Relations 2 .

Hints Resolve Rstar 0 : sets v62 . Hints Resolve Rstar1 0 : sets v62 . Hints Resolve Rstar1 1 : sets v62 . Hints Resolve Rplus 0 : sets v62 .

Module Infinite sets

Id : Infinite_{s}ets.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Export Finite sets. Require Export Constructive sets. Require Export Classical Type. Require Export Classical sets. Require Export Powerset. Require Export Powerset facts. Require Export Powerset Classical facts. Require Export Gt. Require Export Lt. Require Export Le. Require Export Finite sets facts. Require Export Image.

Section Approx. Variable U : Type.

Inductive Approximant [A, X : (Ensemble U )] : Prop :=

Defn of Approximant : (Finite U X ) → (Included U X A) → (Approximant A X ). End Approx.

Hints Resolve Defn of Approximant.

Section Infinite sets. Variable U : Type.

Lemma make new approximant :

(A : (Ensemble U )) (X : (Ensemble U )) ¬ (Finite U A) → (Approximant U A X ) → (Inhabited U (Setminus U A X )).

Lemma approximants grow :

(A : (Ensemble U )) (X : (Ensemble U )) ¬ (Finite U A) →

(n : nat) (cardinal U X n) → (Included U X A) →

(EXT Y | (cardinal U Y (S n)) ∧ (Included U Y A)).

Lemma approximants grow′ :

(A : (Ensemble U )) (X : (Ensemble U )) ¬ (Finite U A) →

(n : nat) (cardinal U X n) → (Approximant U A X ) →

(EXT Y | (cardinal U Y (S n)) ∧ (Approximant U A Y )).

Lemma approximant can be any size :

(A : (Ensemble U )) (X : (Ensemble U )) ¬ (Finite U A) →

(n : nat) (EXT Y | (cardinal U Y n) ∧ (Approximant U A Y )).

Variable V : Type.

Theorem Image set continuous :

(A : (Ensemble U ))

(f : U → V ) (X : (Ensemble V )) (Finite V X ) → (Included V X (Im U V A f )) → (EX n | (EXT Y | ((cardinal U Y n) ∧ (Included U Y A)) ∧ (Im U V Y f ) == X )).

Theorem Image set continuous′ :

(A : (Ensemble U ))

(f : U → V ) (X : (Ensemble V )) (Approximant V (Im U V A f ) X ) → (EXT Y | (Approximant U A Y ) ∧ (Im U V Y f ) == X ).

Theorem Pigeonhole bis :

(A : (Ensemble U )) (f : U → V ) ¬ (Finite U A) → (Finite V (Im U V A f )) → ¬ (injective U V f ).

Theorem Pigeonhole ter :

(A : (Ensemble U ))

(f : U → V ) (n : nat) (injective U V f ) → (Finite V (Im U V A f )) → (Finite U A).

End Infinite sets.

Module Relations 2 facts

Require Export Relations 1 . Require Export Relations 1 facts. Require Export Relations 2 .

Theorem Rstar reflexive :

(U : Type) (R : (Relation U )) (Reflexive U (Rstar U R)).

Theorem Rplus contains R :

(U : Type) (R : (Relation U )) (contains U (Rplus U R) R).

Theorem Rstar contains R :

(U : Type) (R : (Relation U )) (contains U (Rstar U R) R).

Theorem Rstar contains Rplus :

(U : Type) (R : (Relation U )) (contains U (Rstar U R) (Rplus U R)).

Theorem Rstar transitive :

(U : Type) (R : (Relation U )) (Transitive U (Rstar U R)).

Theorem Rstar cases :

(U : Type) (R : (Relation U )) (x, y : U ) (Rstar U R x y) → x == y ∨ (EXT u | (R x u) ∧ (Rstar U R u y)).

Theorem Rstar equiv Rstar1 :

(U : Type) (R : (Relation U )) (same relation U (Rstar U R) (Rstar1 U R)).

Theorem Rsym imp Rstarsym :

(U : Type) (R : (Relation U )) (Symmetric U R) → (Symmetric U (Rstar U R)).

Theorem Sstar contains Rstar :

(U : Type) (R, S : (Relation U )) (contains U (Rstar U S) R) →

(contains U (Rstar U S) (Rstar U R)).

Theorem star monotone :

(U : Type) (R, S : (Relation U )) (contains U S R) →

(contains U (Rstar U S) (Rstar U R)).

Theorem RstarRplus RRstar :

(U : Type) (R : (Relation U )) (x, y, z : U )

(Rstar U R x y) → (Rplus U R y z) → (EXT u | (R x u) ∧ (Rstar U R u z)).

Theorem Lemma1 :

(U : Type) (R : (Relation U )) (Strongly confluent U R) → (x, b : U ) (Rstar U R x b) → (a : U ) (R x a) → (EXT z | (Rstar U R a z) ∧ (R b z)).

Module Relations 3

Require Export Relations 1 . Require Export Relations 2 .

Section Relations 3 .

Variable U : Type.

Variable R : (Relation U ).

Definition coherent : U → U → Prop := [x, y : U ] (EXT z | (Rstar U R x z) ∧ (Rstar U R y z)).

Definition locally confluent : U → Prop := [x : U ] (y, z : U ) (R x y) → (R x z) → (coherent y z).

Definition Locally confluent : Prop := (x : U ) (locally confluent x).

Definition confluent : U → Prop := [x : U ] (y, z : U ) (Rstar U R x y) → (Rstar U R x z) → (coherent y z).

Definition Confluent : Prop := (x : U ) (confluent x).

Inductive noetherian : U → Prop :=

definition of noetherian : (x : U ) ((y : U ) (R x y) → (noetherian y)) → (noetherian x).

Definition Noetherian : Prop := (x : U ) (noetherian x).

End Relations 3 . Hints Unfold coherent : sets v62 . Hints Unfold locally confluent : sets v62 . Hints Unfold confluent : sets v62 . Hints Unfold Confluent : sets v62 . Hints Resolve definition of noetherian : sets v62 . Hints Unfold Noetherian : sets v62 .

Id : Relations_{3}.v, v1.22001/03/1513 : 38 : 54filliatrExp

Module Integers

Id : Integers.v, v1.22001/03/1513 : 38 : 54filliatrExp

Require Export Finite sets.

Require Export Constructive sets. Require Export Classical Type. Require Export Classical sets. Require Export Powerset. Require Export Powerset facts. Require Export Powerset Classical facts. Require Export Gt. Require Export Lt. Require Export Le. Require Export Finite sets facts. Require Export Image. Require Export Infinite sets. Require Export Compare dec. Require Export Relations 1 . Require Export Partial Order. Require Export Cpo.

Section Integers sect.

Inductive Nat : Type := mkNat : nat → Nat.

Parameter nat of Nat : Nat → nat.

Axiom nat of nat returns : (n : nat) (nat of Nat (mkNat n)) = n.

Lemma mkNat injective : (n1 , n2 : nat) (mkNat n1 ) == (mkNat n2 ) → n1 = n2 .

Inductive Integers : (Ensemble Nat) :=

Integers defn : (x : Nat) (In Nat Integers x). Hints Resolve Integers defn.

Inductive Le Nat [x, y : Nat] : Prop :=

Definition of Le nat :

(n1 , n2 : nat) x == (mkNat n1 ) → y == (mkNat n2 ) → (le n1 n2 ) → (Le Nat x y).

Lemma Le Nat direct : (n1 , n2 : nat) (le n1 n2 ) → (Le Nat (mkNat n1 ) (mkNat n2 )). Hints Resolve Le Nat direct.

Lemma Le Nat Reflexive : (Reflexive Nat Le Nat). Hints Resolve Le Nat Reflexive.

Lemma Le Nat antisym : (Antisymmetric Nat Le Nat).

Hints Resolve Le Nat antisym.

Lemma Le Nat trans : (Transitive Nat Le Nat). Hints Resolve Le Nat trans.

Lemma Le Nat Order : (Order Nat Le Nat). Hints Resolve Le Nat Order.

Definition Nat O := (mkNat O).

Lemma triv Nat : (n : nat) (In Nat Integers (mkNat n)).

Hints Resolve triv Nat. Definition Nat po : (PO Nat). Hints Unfold Nat po. Lemma Le Nat total order : (Totally ordered Nat Nat po Integers). Hints Resolve Le Nat total order. Lemma Finite subset has lub :

(X : (Ensemble Nat)) (Finite Nat X ) → (EXT m : Nat | (Upper Bound Nat Nat po X m)).

Lemma Integers has no ub : ¬ (EXT m : Nat | (Upper Bound Nat Nat po Integers m)). Lemma Integers infinite : ¬ (Finite Nat Integers). End Integers sect.

Module Multiset

Id : Multiset.v, v1.32001/04/1112 : 41 : 40filliatrExp G. Huet 1-9-95 Require Permut. Implicit Arguments On. Section multiset defs. Variable A : Set. Variable eqA : A → A → Prop. Hypothesis Aeq dec : (x, y : A){(eqA x y)} + {¬(eqA x y)}. Inductive multiset : Set :=

Bag : (A → nat) → multiset. Definition EmptyBag := (Bag [a : A]O). Definition SingletonBag := [a : A]

(Bag [a′ : A]Cases (Aeq dec a a′) of

(left ) ⇒ (S O) | (right ) ⇒ O end

). Definition multiplicity : multiset → A → nat :=

[m : multiset][a : A]let (f ) = m in (f a). multiset equality Definition meq := [m1 , m2 : multiset]

(a : A)(multiplicity m1 a) = (multiplicity m2 a). Hints Unfold meq multiplicity. Lemma meq refl : (x : multiset)(meq x x). Hints Resolve meq refl.

Lemma meq trans : (x, y, z : multiset)(meq x y) → (meq y z) → (meq x z).

Lemma meq sym : (x, y : multiset)(meq x y) → (meq y x). Hints (∗ multiset union ∗) Definition munion := [m1 , m2 : multiset]

(Bag [a : A](plus (multiplicity m1 a)(multiplicity m2 a))).

Lemma munion empty left :

(x : multiset)(meq x (munion EmptyBag x)). Hints Resolve munion empty left.

Lemma munion empty right :

(x : multiset)(meq x (munion x EmptyBag)).

Require Plus. (∗ comm. and ass. of plus ∗)

Lemma munion comm : (x, y : multiset)(meq (munion x y) (munion y x)). Hints Resolve munion comm.

Lemma munion ass :

(x, y, z : multiset)(meq (munion (munion x y) z) (munion x (munion y z))). Hints Resolve munion ass.

Lemma meq left : (x, y, z : multiset)(meq x y) → (meq (munion x z) (munion y z)). Hints Resolve meq left.

Lemma meq right : (x, y, z : multiset)(meq x y) → (meq (munion z x) (munion z y)). Hints Resolve meq right.

Here we should make multiset an abstract datatype, by hiding Bag, munion, multiplicity; all further properties are proved abstractly

Lemma munion rotate :

(x, y, z : multiset)(meq (munion x (munion y z)) (munion z (munion x y))).

Lemma meq congr : (x, y, z, t : multiset)(meq x y) → (meq z t) → (meq (munion x z) (munion y t)).

Lemma munion perm left :

(x, y, z : multiset)(meq (munion x (munion y z)) (munion y (munion x z))).

Lemma multiset twist1 : (x, y, z, t : multiset)

(meq (munion x (munion (munion y z) t)) (munion (munion y (munion x t)) z)).

Lemma multiset twist2 : (x, y, z, t : multiset)

(meq (munion x (munion (munion y z) t)) (munion (munion y (munion x z)) t)).

specific for treesort

Lemma treesort twist1 : (x, y, z, t, u : multiset) (meq u (munion y z)) → (meq (munion x (munion u t)) (munion (munion y (munion x t)) z)).

Lemma treesort twist2 : (x, y, z, t, u : multiset) (meq u (munion y z)) → (meq (munion x (munion u t)) (munion (munion y (munion x z)) t)).

theory of minter to do similarly Require Min. (* multiset intersection *) Definition minter := m1 , m2 : multiset (Bag a : A(min (multiplicity m1 a)(multiplicity m2 a))).

End multiset defs.

Implicit Arguments Off .

Hints Unfold meq multiplicity : v62 datatypes. Hints Resolve munion empty right munion comm munion ass meq left meq right munion empty left : v62 datatypes. Hints

Module Relations 3 facts

Require Export Relations 1 . Require Export Relations 1 facts. Require Export Relations 2 . Require Export Relations 2 facts. Require Export Relations 3 .

Theorem Rstar imp coherent :

(U : Type) (R : (Relation U )) (x : U ) (y : U ) (Rstar U R x y) →

(coherent U R x y). Hints Resolve Rstar imp coherent.

Theorem coherent symmetric :

(U : Type) (R : (Relation U )) (Symmetric U (coherent U R)).

Theorem Strong confluence :

(U : Type) (R : (Relation U )) (Strongly confluent U R) → (Confluent U R).

Theorem Strong confluence direct :

(U : Type) (R : (Relation U )) (Strongly confluent U R) → (Confluent U R).

Theorem Noetherian contains Noetherian :

(U : Type) (R, R′ : (Relation U )) (Noetherian U R) → (contains U R R′) → (Noetherian U R′).

Theorem Newman :

(U : Type) (R : (Relation U )) (Noetherian U R) → (Locally confluent U R) → (Confluent U R).

Module Uniset

Id : Uniset.v, v1.42001/04/1112 : 41 : 40filliatrExp Sets as characteristic functions G. Huet 1-9-95 Updated Papageno 12/98

Require Bool.

Implicit Arguments On.

Section defs.

Variable A : Set. Variable eqA : A → A → Prop.

Hypothesis eqA dec : (x, y : A){(eqA x y)} + {¬(eqA x y)}. Inductive uniset : Set :=

Charac : (A → bool) → uniset. Definition charac : uniset → A → bool :=

[s : uniset][a : A]Case s of [f : A → bool](f a) end. Definition Emptyset := (Charac [a : A]false). Definition Fullset := (Charac [a : A]true). Definition Singleton := [a : A](Charac [a′ : A]

Case (eqA dec a a′) of [h : (eqA a a′)] true [h : ¬(eqA a a′)] false end).

Definition In : uniset → A → Prop :=

[s : uniset][a : A](charac s a) = true. Hints Unfold In. uniset inclusion Definition incl := [s1 , s2 : uniset]

(a : A)(leb (charac s1 a) (charac s2 a)). Hints Unfold incl. uniset equality Definition seq := [s1 , s2 : uniset]

(a : A)(charac s1 a) = (charac s2 a). Hints Unfold seq. Lemma leb refl : (b : bool)(leb b b). Hints Resolve leb refl. Lemma incl left : (s1 , s2 : uniset)(seq s1 s2 ) → (incl s1 s2 ). Lemma incl right : (s1 , s2 : uniset)(seq s1 s2 ) → (incl s2 s1 ). Lemma seq refl : (x : uniset)(seq x x). Hints Resolve seq refl. Lemma seq trans : (x, y, z : uniset)(seq x y) → (seq y z) → (seq x z). Lemma seq sym : (x, y : uniset)(seq x y) → (seq y x). uniset union Definition union := [m1 , m2 : uniset]

(Charac [a : A](orb (charac m1 a)(charac m2 a))). Lemma union empty left :

(x : uniset)(seq x (union Emptyset x)). Hints Resolve union empty left. Lemma union empty right :

(x : uniset)(seq x (union x Emptyset)). Hints Resolve union empty right.

Lemma union comm : (x, y : uniset)(seq (union x y) (union y x)). Hints Resolve union comm.

Lemma union ass :

(x, y, z : uniset)(seq (union (union x y) z) (union x (union y z))). Hints Resolve union ass.

Lemma seq left : (x, y, z : uniset)(seq x y) → (seq (union x z) (union y z)). Hints Resolve seq left.

Lemma seq right : (x, y, z : uniset)(seq x y) → (seq (union z x) (union z y)). Hints Resolve seq right.

All the proofs that follow duplicate Multiset of A Here we should make uniset an abstract datatype, by hiding Charac, union, charac; all further properties are proved abstractly

Require Permut.

Lemma union rotate :

(x, y, z : uniset)(seq (union x (union y z)) (union z (union x y))).

Lemma seq congr : (x, y, z, t : uniset)(seq x y) → (seq z t) → (seq (union x z) (union y t)).

Lemma union perm left :

(x, y, z : uniset)(seq (union x (union y z)) (union y (union x z))).

Lemma uniset twist1 : (x, y, z, t : uniset)

(seq (union x (union (union y z) t)) (union (union y (union x t)) z)).

Lemma uniset twist2 : (x, y, z, t : uniset)

(seq (union x (union (union y z) t)) (union (union y (union x z)) t)).

specific for treesort

Lemma treesort twist1 : (x, y, z, t, u : uniset) (seq u (union y z)) → (seq (union x (union u t)) (union (union y (union x t)) z)).

Lemma treesort twist2 : (x, y, z, t, u : uniset) (seq u (union y z)) → (seq (union x (union u t)) (union (union y (union x z)) t)).

theory of minter to do similarly Require Min. (* uniset intersection *) Definition minter := m1 , m2 : uniset (Charac a : A(andb (charac m1 a)(charac m2 a))).

End defs.

Implicit Arguments Off .

7 Relations

This library develops closure properties of relations.

• Relation Definitions.v deals with the general notions about binary relations (orders, equivalences, ...)

• Relation Operators.v and Rstar.v define various closures of relations (by symmetry, by transitivity, ...) and lexicographic orderings.

• Operators Properties.v states and proves facts on the various closures of a relation.

   • Relations.v puts Relation Definitions.v, Relation Operators.v and
     Operators Properties.v together.

• Newman.v proves Newman’s lemma on noetherian and locally confluent relations.

Module Rstar

Id : Rstar.v, v1.22001/03/1513 : 38 : 53filliatrExp Properties of a binary relation R on type A Parameter A : Type.

Parameter R : A → A → Prop. Definition of the reflexive-transitive closure R* of R Smallest reflexive P containing R o P Definition Rstar := [x, y : A](P : A → A → Prop)

((u : A)(P u u)) → ((u : A)(v : A)(w : A)(R u v) → (P v w) → (P u w)) → (P x y). Theorem Rstar reflexive : (x : A)(Rstar x x). Theorem Rstar R : (x : A)(y : A)(z : A)(R x y) → (Rstar y z) → (Rstar x z). We conclude with transitivity of Rstar : Theorem Rstar transitive : (x : A)(y : A)(z : A)(Rstar x y) → (Rstar y z) → (Rstar x z). Another characterization of R* Smallest reflexive P containing R o R* Definition Rstar′ := [x : A][y : A](P : A → A → Prop)

((P x x)) → ((u : A)(R x u) → (Rstar u y) → (P x y)) → (P x y). Theorem Rstar′ reflexive : (x : A)(Rstar′ x x). Theorem Rstar′ R : (x : A)(y : A)(z : A)(R x z) → (Rstar z y) → (Rstar′ x y). Equivalence of the two definitions: Theorem Rstar′ Rstar : (x : A)(y : A)(Rstar′ x y) → (Rstar x y). Theorem Rstar Rstar′ : (x : A)(y : A)(Rstar x y) → (Rstar′ x y). Property of Commutativity of two relations Definition commut := [A :Set][R1 , R2 : A → A → Prop]

(x, y : A)(R1 y x) → (z : A)(R2 z y) → (EX y′ : A |(R2 y′ x) & (R1 z y′)).

Module Newman

Id : Newman.v, v1.22001/03/1513 : 38 : 53filliatrExp Require Rstar. Definition coherence := [x : A][y : A] (exT2 ? (Rstar x) (Rstar y)). Theorem coherence intro : (x : A)(y : A)(z : A)(Rstar x z) → (Rstar y z) → (coherence x y). A very simple case of coherence : Lemma Rstar coherence : (x : A)(y : A)(Rstar x y) → (coherence x y). coherence is symmetric Lemma coherence sym : (x : A)(y : A)(coherence x y) → (coherence y x). Definition confluence :=

[x : A](y : A)(z : A)(Rstar x y) → (Rstar x z) → (coherence y z). Definition local confluence :=

[x : A](y : A)(z : A)(R x y) → (R x z) → (coherence y z). Definition noetherian :=

(x : A)(P : A → Prop)((y : A)((z : A)(R y z) → (P z)) → (P y)) → (P x). Section Newman section. The general hypotheses of the theorem Hypothesis Hyp1 : noetherian. Hypothesis Hyp2 : (x : A)(local confluence x). The induction hypothesis Section Induct.

Variable x : A.

Hypothesis hyp ind : (u : A)(R x u) → (confluence u). Confluence in x Variables y, z : A.

Hypothesis h1 : (Rstar x y).

Hypothesis h2 : (Rstar x z). particular case x->u and u->*y Section Newman .

Variable u : A.

Hypothesis t1 : (R x u).

Hypothesis t2 : (Rstar u y). In the usual diagram, we assume also x->v and v->*z Theorem Diagram : (v : A)(u1 : (R x v))(u2 : (Rstar v z))(coherence y z). Theorem caseRxy : (coherence y z). (∗ case x->v->*z ∗) End Newman .

Theorem Ind proof : (coherence y z). (∗ case x->u->*z ∗) End Induct. Theorem Newman : (x : A)(confluence x). End Newman section.

Module Relation Definitions

Id : Relation_{D}efinitions.v, v1.22001/03/1513 : 38 : 53filliatrExp Section Relation Definition. Variable A : Set. Definition relation := A → A → Prop. Variable R : relation. Section General Properties of Relations. Definition reflexive : Prop := (x : A) (R x x).

Definition transitive : Prop := (x, y, z : A) (R x y) → (R y z) → (R x z).

Definition symmetric : Prop := (x, y : A) (R x y) → (R y x).

Definition antisymmetric : Prop := (x, y : A) (R x y) → (R y x) → x = y. for compatibility with Equivalence in ../PROGRAMS/ALG/ Definition equiv := reflexive ∧ transitive ∧ symmetric. End General Properties of Relations. Section Sets of Relations. Record preorder : Prop := {

preord refl : reflexive; preord trans : transitive }.

Record order : Prop := { ord refl : reflexive; ord trans : transitive; ord antisym : antisymmetric }.

Record equivalence : Prop := { equiv refl : reflexive; equiv trans : transitive; equiv sym : symmetric }.

Record PER : Prop := { per sym : symmetric; per trans : transitive }.

End Sets of Relations. Section Relations of Relations. Definition inclusion : relation → relation → Prop :=

[R1 , R2 : relation] (x, y : A) (R1 x y) → (R2 x y).

Definition same relation : relation → relation → Prop := [R1 , R2 : relation] (inclusion R1 R2 ) ∧ (inclusion R2 R1 ).

Definition commut : relation → relation → Prop :=

[R1 , R2 : relation] (x, y : A) (R1 y x) → (z : A) (R2 z y) → (EX y′ : A |(R2 y′ x) & (R1 z y′)).

End Relations of Relations.

End Relation Definition.

Hints Unfold reflexive transitive antisymmetric symmetric : sets v62 .

Hints Resolve Build preorder Build order Build equivalence

Build PER preord refl preord trans
ord refl ord trans ord antisym
equiv refl equiv trans equiv sym

per sym per trans : sets v62 .

Hints Unfold inclusion same relation commut : sets v62 .

Module Relation Operators

Id : Relation_{O}perators.v, v1.42001/03/1513 : 38 : 53filliatrExp Bruno Barras Cristina Cornes Some of these definitons were taken from : Constructing Recursion Operators in Type Theory L. Paulson JSC (1986) 2, 325-355

Require Relation Definitions. Require PolyList. Require PolyListSyntax.

Some operators to build relations

Section Transitive Closure.

Variable A : Set.

Variable R : (relation A).

Inductive clos trans : A → A → Prop :=

t step : (x, y : A)(R x y) → (clos trans x y) | t trans : (x, y, z : A)(clos trans x y) → (clos trans y z) → (clos trans x z).

End Transitive Closure.

Section Reflexive Transitive Closure.

Variable A : Set.

Variable R : (relation A).

Inductive clos refl trans : (relation A) :=

rt step : (x, y : A)(R x y) → (clos refl trans x y) | rt refl : (x : A)(clos refl trans x x) | rt trans : (x, y, z : A)(clos refl trans x y) → (clos refl trans y z)

→ (clos refl trans x z).

End Reflexive Transitive Closure.

Section Reflexive Symetric Transitive Closure.

Variable A : Set.

Variable R : (relation A).

Inductive clos refl sym trans : (relation A) :=

rst step : (x, y : A)(R x y) → (clos refl sym trans x y) | rst refl : (x : A)(clos refl sym trans x x) | rst sym : (x, y : A)(clos refl sym trans x y) → (clos refl sym trans y x) | rst trans : (x, y, z : A)(clos refl sym trans x y) → (clos refl sym trans y z)

→ (clos refl sym trans x z).

End Reflexive Symetric Transitive Closure.

Section Transposee.

Variable A : Set.

Variable R : (relation A).

Definition transp := [x, y : A](R y x). End Transposee.

Section Union.

Variable A : Set.

Variable R1 , R2 : (relation A).

Definition union := [x, y : A](R1 x y) ∨ (R2 x y). End Union.

Section Disjoint Union. Variable A, B :Set. Variable leA : A → A → Prop. Variable leB : B → B → Prop.

Inductive le AsB : A + B → A + B → Prop :=

le aa : (x, y : A) (leA x y) → (le AsB (inl A B x) (inl A B y)) | le ab : (x : A)(y : B) (le AsB (inl A B x) (inr A B y)) | le bb : (x, y : B) (leB x y) → (le AsB (inr A B x) (inr A B y)).

End Disjoint Union.

Section Lexicographic Product. (∗ Lexicographic order on dependent pairs ∗)

Variable A :Set. Variable B : A → Set. Variable leA : A → A → Prop. Variable leB : (x : A)(B x) → (B x) → Prop.

Inductive lexprod : (sigS A B) → (sigS A B) → Prop :=

left lex : (x, x′ : A)(y : (B x)) (y′ : (B x′))

(leA x x′) → (lexprod (existS A B x y) (existS A B x′ y′))

| right lex : (x : A) (y, y′ : (B x))

(leB x y y′) → (lexprod (existS A B x y) (existS A B x y′)).

End Lexicographic Product.

Section Symmetric Product.

Variable A :Set.

Variable B :Set.

Variable leA : A → A → Prop.

Variable leB : B → B → Prop.

Inductive symprod : (A × B) → (A × B) → Prop :=

left sym : (x, x′ : A)(leA x x′) → (y : B)(symprod (x, y) (x′, y)) | right sym : (y, y′ : B)(leB y y′) → (x : A)(symprod (x, y) (x, y′)).

End Symmetric Product.

Section Swap.

Variable A :Set.

Variable R : A → A → Prop.

Inductive swapprod : (A × A) → (A × A) → Prop :=

sp noswap : (x, x′ : A × A)(symprod A A R R x x′) → (swapprod x x′) | sp swap : (x, y : A)(p : A × A)(symprod A A R R (x, y) p) → (swapprod (y, x) p).

End Swap.

Section Lexicographic Exponentiation.

Variable A : Set. Variable leA : A → A → Prop. Local Nil := (nil A). Local List := (list A).

Inductive Ltl : List → List → Prop :=

Lt nil : (a : A)(x : List)(Ltl Nil (cons a x)) | Lt hd : (a, b : A) (leA a b) → (x, y : (list A))(Ltl (cons a x) (cons b y)) | Lt tl : (a : A)(x, y : List)(Ltl x y) → (Ltl (cons a x) (cons a y)).

Inductive Desc : List → Prop :=

d nil : (Desc Nil) | d one : (x : A)(Desc (cons x Nil)) | d conc : (x, y : A)(l : List)(leA x y)

→ (Desc lˆ (cons y Nil)) → (Desc (lˆ (cons y Nil))ˆ (cons x Nil)).

Definition Pow :Set := (sig List Desc).

Definition lex exp : Pow → Pow → Prop := [a, b : Pow](Ltl (proj1 sig List Desc a) (proj1 sig List Desc b)).

End Lexicographic Exponentiation.

Hints Unfold transp union : sets v62 . Hints Resolve t step rt step rt refl rst step rst refl : sets v62 . Hints

Module Operators Properties

Id : Operators_{P} roperties.v, v1.32001/03/1513 : 38 : 53filliatrExp Bruno Barras Require Relation Definitions. Require Relation Operators. Section Properties. Variable A : Set.

Variable R : (relation A). Local incl : (relation A) → (relation A) → Prop :=

[R1 , R2 : (relation A)] (x, y : A) (R1 x y) → (R2 x y). Section Clos Refl Trans. Lemma clos rt is preorder : (preorder A (clos refl trans A R)). Lemma clos rt idempotent :

(incl (clos refl trans A (clos refl trans A R))

(clos refl trans A R)).

Lemma clos refl trans ind left : (A :Set)(R : A → A → Prop)(M : A)(P : A → Prop) (P M ) → ((P0 , N : A)

(clos refl trans A R M P0 ) → (P P0 ) → (R P0 N ) → (P N )) → (a : A)(clos refl trans A R M a) → (P a).

End Clos Refl Trans. Section Clos Refl Sym Trans. Lemma clos rt clos rst : (inclusion A (clos refl trans A R)

(clos refl sym trans A R)).

Lemma clos rst is equiv : (equivalence A (clos refl sym trans A R)). Lemma clos rst idempotent :

(incl (clos refl sym trans A (clos refl sym trans A R)) (clos refl sym trans A R)).

End Clos Refl Sym Trans. End Properties.

Module Relations

Id : Relations.v, v1.22001/03/1513 : 38 : 53filliatrExp Require Export Relation Definitions. Require Export Relation Operators. Require Export Operators Properties. Lemma inverse image of equivalence : (A, B :Set)(f : A → B)

(r : (relation B))(equivalence B r) → (equivalence A [x, y : A](r (f x) (f y))). Lemma inverse image of eq : (A, B :Set)(f : A → B)

(equivalence A [x, y : A](f x) = (f y)).

8 Well-founded relations

This library gives definitions and results about well-founded relations.

Module Inclusion

Id : Inclusion.v, v1.22001/03/1513 : 38 : 55filliatrExp Bruno Barras

Require Relation Definitions.

Section WfInclusion.

Variable A :Set.

Variable R1 , R2 : A → A → Prop.

Lemma Acc incl : (inclusion A R1 R2 ) → (z : A)(Acc A R2 z) → (Acc A R1 z).

Hints Resolve Acc incl.

Theorem wf incl :

(inclusion A R1 R2 ) → (well founded A R2 ) → (well founded A R1 ).

End WfInclusion.

Module Disjoint Union

Id : Disjoint_{U}nion.v, v1.32001/03/1513 : 38 : 55filliatrExp Cristina Cornes From : Constructing Recursion Operators in Type Theory L. Paulson JSC (1986) 2, 325-355

Require Relation Operators.

Section Wf Disjoint Union. Variable A, B :Set. Variable leA : A → A → Prop. Variable leB : B → B → Prop.

Syntactic Definition Le AsB := (le AsB A B leA leB).

Lemma acc A sum : (x : A)(Acc A leA x) → (Acc A + B Le AsB (inl A B x)).

Lemma acc B sum : (well founded A leA) → (x : B)(Acc B leB x)

→ (Acc A + B Le AsB (inr A B x)).

Lemma wf disjoint sum : (well founded A leA)

→ (well founded B leB) → (well founded A + B Le AsB).

End Wf Disjoint Union.

Module Transitive Closure

Id : T ransitive_{C}losure.v, v1.22001/03/1513 : 38 : 55filliatrExp Bruno Barras Require Relation Definitions. Require Relation Operators. Section Wf Transitive Closure.

Variable A : Set.

Variable R : (relation A). Syntactic Definition trans clos := (clos trans A R). Lemma incl clos trans : (inclusion A R trans clos). Lemma Acc clos trans : (x : A)(Acc A R x) → (Acc A trans clos x). Hints Resolve Acc clos trans. Lemma Acc inv trans : (x, y : A)(trans clos y x) → (Acc A R x) → (Acc A R y). Theorem wf clos trans : (well founded A R) → (well founded A trans clos). End Wf Transitive Closure.

Module Inverse Image

Id : Inverse_{I}mage.v, v1.22001/03/1513 : 38 : 55filliatrExp Bruno Barras Section Inverse Image. Variables A, B :Set.

Variable R : B → B → Prop.

Variable f : A → B. Local Rof : A → A → Prop := [x, y : A](R (f x) (f y)). Remark Acc lemma : (y : B)(Acc B R y) → (x : A)(y = (f x)) → (Acc A Rof x). Lemma Acc inverse image : (x : A)(Acc B R (f x)) → (Acc A Rof x). Theorem wf inverse image : (well founded B R) → (well founded A Rof ). End Inverse Image. Id : Inverse_{I}mage.v, v1.22001/03/1513 : 38 : 55filliatrExp

Module Lexicographic Exponentiation

Id : Lexicographic_{E}xponentiation.v, v1.42001/03/1513 : 38 : 55filliatrExp Cristina Cornes From : Constructing Recursion Operators in Type Theory L. Paulson JSC (1986) 2, 325-355 Require Eqdep. Require PolyList. Require PolyListSyntax. Require Relation Operators.

Require Transitive Closure.

Section Wf Lexicographic Exponentiation. Variable A :Set. Variable leA : A → A → Prop.

Syntactic Definition Power := (Pow A leA). Syntactic Definition Lex Exp := (lex exp A leA). Syntactic Definition ltl := (Ltl A leA). Syntactic Definition Descl := (Desc A leA).

Syntactic Definition List := (list A). Syntactic Definition Nil := (nil A). (∗ useless but symmetric ∗) Syntactic Definition Cons := (cons 1!A).

Hints Resolve d one d nil t step.

Lemma left prefix : (x, y, z : List)(ltl xˆ y z) → (ltl x z).

Lemma right prefix :

(x, y, z : List)(ltl x yˆ z) → (ltl x y) ∨ (EX y′ : List | x = (yˆ y′) ∧ (ltl y′ z)).

Lemma desc prefix : (x : List)(a : A)(Descl xˆ (Cons a Nil)) → (Descl x).

Lemma desc tail : (x : List)(a, b : A)

(Descl (Cons b (xˆ (Cons a Nil)))) → (clos trans A leA a b).

Lemma dist aux : (z : List)(Descl z) → (x, y : List)z = (xˆ y) → (Descl x) ∧ (Descl y).

Lemma dist Desc concat : (x, y : List)(Descl xˆ y) → (Descl x) ∧ (Descl y).

Lemma desc end : (a, b : A)(x : List)

(Descl xˆ (Cons a Nil)) ∧ (ltl xˆ (Cons a Nil) (Cons b Nil)) → (clos trans A leA a b).

Lemma ltl unit : (x : List)(a, b : A) (Descl (xˆ (Cons a Nil))) → (ltl xˆ (Cons a Nil) (Cons b Nil))

→ (ltl x (Cons b Nil)).

Lemma acc app :

(x1 , x2 : List)(y1 : (Descl x1 ˆ x2 ))

(Acc Power Lex Exp (exist List Descl (x1 ˆ x2 ) y1 ))

→ (x : List)

(y : (Descl x))

(ltl x (x1 ˆ x2 )) → (Acc Power Lex Exp (exist List Descl x y)).

Theorem wf lex exp :

(well founded A leA) → (well founded Power Lex Exp).

End Wf Lexicographic Exponentiation.

Module Union

Id : Union.v, v1.22001/03/1513 : 38 : 55filliatrExp Bruno Barras Require Relation Operators. Require Relation Definitions. Require Transitive Closure.

Section WfUnion.

Variable A : Set.

Variable R1 , R2 : (relation A).

Syntactic Definition Union := (union A R1 R2 ).

Hints Resolve Acc clos trans wf clos trans.

Remark strip commut :

(commut A R1 R2 ) → (x, y : A)(clos trans A R1 y x) → (z : A)(R2 z y) → (EX y′ : A | (R2 y′ x) & (clos trans A R1 z y′)).

Lemma Acc union : (commut A R1 R2 ) → ((x : A)(Acc A R2 x) → (Acc A R1 x)) → (a : A)(Acc A R2 a) → (Acc A Union a).

Theorem wf union : (commut A R1 R2 ) → (well founded A R1 ) → (well founded A R2 ) → (well founded A Union).

End WfUnion.

Module Well Ordering

Id : W ell_{O}rdering.v, v1.32001/03/1513 : 38 : 55filliatrExp Cristina Cornes From: Constructing Recursion Operators in Type Theory L. Paulson JSC (1986) 2, 325-355

Require Eqdep.

Section WellOrdering. Variable A :Set. Variable B : A → Set.

Inductive WO : Set := sup : (a : A)(f : (B a) → WO)WO.

Inductive le WO : WO → WO → Prop := le sup : (a : A)(f : (B a) → WO)(v : (B a)) (le WO (f v) (sup a f )).

Theorem wf WO : (well founded WO le WO ).

End WellOrdering.

Section Characterisation wf relations. (∗ wellfounded relations are the inverse image of wellordering types ∗) (∗ in course of development ∗)

Variable A :Set. Variable leA : A → A → Prop.

Definition B := [a : A] {x : A | (leA x a)}.

Definition wof : (well founded A leA) → A → (WO A B).

End Characterisation wf relations.

Module Lexicographic Product

Id : Lexicographic_{P} roduct.v, v1.52001/04/1112 : 41 : 40filliatrExp Bruno Barras Cristina Cornes

Require Eqdep. Require Relation Operators. Require Transitive Closure.

From : Constructing Recursion Operators in Type Theory L. Paulson JSC (1986) 2, 325-355

Section WfLexicographic Product. Variable A :Set. Variable B : A → Set. Variable leA : A → A → Prop. Variable leB : (x : A)(B x) → (B x) → Prop.

Syntactic Definition LexProd := (lexprod A B leA leB).

Hints Resolve t step Acc clos trans wf clos trans.

Lemma acc A B lexprod : (x : A)(Acc A leA x)

→ ((x0 : A)(clos trans A leA x0 x) → (well founded (B x0 ) (leB x0 )))

→ (y : (B x))(Acc (B x) (leB x) y) → (Acc (sigS A B) LexProd (existS A B x y)).

Theorem wf lexprod :

(well founded A leA) → ((x : A) (well founded (B x) (leB x))) → (well founded (sigS A B) LexProd).

End WfLexicographic Product.

Section Wf Symmetric Product.

Variable A :Set.

Variable B :Set.

Variable leA : A → A → Prop.

Variable leB : B → B → Prop.

Syntactic Definition Symprod := (symprod A B leA leB).

Lemma Acc symprod : (x : A)(Acc A leA x) → (y : B)(Acc B leB y)

→ (Acc (A × B) Symprod (x, y)).

Lemma wf symprod : (well founded A leA) → (well founded B leB)

→ (well founded (A × B) Symprod).

End Wf Symmetric Product.

Section Swap.

Variable A :Set.

Variable R : A → A → Prop.

Syntactic Definition SwapProd := (swapprod A R).

Lemma swap Acc : (x, y : A)(Acc A × A SwapProd (x, y)) → (Acc A × A SwapProd (y, x)).

Lemma Acc swapprod : (x, y : A)(Acc A R x) → (Acc A R y)

→ (Acc A × A SwapProd (x, y)).

Lemma wf swapprod : (well founded A R) → (well founded A × A SwapProd).

End Swap.

Module Wellfounded

Id : W ellfounded.v, v1.22001/03/1513 : 38 : 55filliatrExp

Require Export Disjoint Union. Require Export Inclusion. Require Export Inverse Image. Require Export Lexicographic Exponentiation. Require Export Lexicographic Product. Require Export Transitive Closure. Require Export Union. Require Export Well Ordering.

9 IntMap

This library contains a data structure for finite sets implemented by an efficient structure of map (trees indexed by binary integers).

Module Addr

Representation of adresses by positive the type of binary numbers

Require Bool. Require ZArith.

Inductive ad : Set :=

ad z : ad | ad x : positive → ad.

Lemma ad sum : (a : ad) {p : positive | a = (ad x p)} + {a = ad z}.

Fixpoint p xor [p : positive] : positive → ad :=

[p2 ] Cases p of

xH ⇒ Cases p2 of

xH ⇒ ad z | (xO p′2 ) ⇒ (ad x (xI p′2 )) | (xI p′2 ) ⇒ (ad x (xO p′2 ))

end | (xO p′) ⇒ Cases p2 of

xH ⇒ (ad x (xI p′)) | (xO p′2 ) ⇒ Cases (p xor p′ p′2 ) of

ad z ⇒ ad z | (ad x p′′) ⇒ (ad x (xO p′′))

end | (xI p′2 ) ⇒ Cases (p xor p′ p′2 ) of

ad z ⇒ (ad x xH ) | (ad x p′′) ⇒ (ad x (xI p′′))

end

end

| (xI p′) ⇒ Cases p2 of

xH ⇒ (ad x (xO p′)) | (xO p′2 ) ⇒ Cases (p xor p′ p′2 ) of

ad z ⇒ (ad x xH ) | (ad x p′′) ⇒ (ad x (xI p′′))

end | (xI p′2 ) ⇒ Cases (p xor p′ p′2 ) of

ad z ⇒ ad z | (ad x p′′) ⇒ (ad x (xO p′′))

end

end

end.

Definition ad xor := [a, a′ : ad]

Cases a of

ad z ⇒ a′ | (ad x p) ⇒ Cases a′ of

ad z ⇒ a | (ad x p′) ⇒ (p xor p p′)

end

end.

Lemma ad xor neutral left : (a : ad) (ad xor ad z a) = a.

Lemma ad xor neutral right : (a : ad) (ad xor a ad z) = a.

Lemma ad xor comm : (a, a′ : ad) (ad xor a a′) = (ad xor a′ a).

Lemma ad xor nilpotent : (a : ad) (ad xor a a) = ad z.

Fixpoint ad bit 1 [p : positive] : nat → bool :=

Cases p of

xH ⇒ [n : nat] Cases n of

O ⇒ true | (S ) ⇒ false

end

| (xO p) ⇒ [n : nat] Cases n of

O ⇒ false | (S n′) ⇒ (ad bit 1 p n′)

end

| (xI p) ⇒ [n : nat] Cases n of

O ⇒ true | (S n′) ⇒ (ad bit 1 p n′)

end

end.

Definition ad bit := [a : ad]

Cases a of

ad z ⇒ [ : nat] false | (ad x p) ⇒ (ad bit 1 p)

end. Definition eqf := [f , g : nat → bool] (n : nat) (f n) = (g n). Lemma ad faithful 1 : (a : ad) (eqf (ad bit ad z) (ad bit a)) → ad z = a. Lemma ad faithful 2 : (a : ad) (eqf (ad bit (ad x xH )) (ad bit a)) → (ad x xH ) = a. Lemma ad faithful 3 :

(a : ad) (p : positive)

((p′ : positive) (eqf (ad bit (ad x p)) (ad bit (ad x p′))) → p = p′)

→ (eqf (ad bit (ad x (xO p))) (ad bit a))

→ (ad x (xO p)) = a. Lemma ad faithful 4 :

(a : ad) (p : positive)

((p′ : positive) (eqf (ad bit (ad x p)) (ad bit (ad x p′))) → p = p′)

→ (eqf (ad bit (ad x (xI p))) (ad bit a))

→ (ad x (xI p)) = a. Lemma ad faithful : (a, a′ : ad) (eqf (ad bit a) (ad bit a′)) → a = a′. Definition adf xor := [f , g : nat → bool; n : nat] (xorb (f n) (g n)). Lemma ad xor sem 1 : (a′ : ad) (ad bit (ad xor ad z a′) O) = (ad bit a′ O). Lemma ad xor sem 2 : (a′ : ad) (ad bit (ad xor (ad x xH ) a′) O) = (negb (ad bit a′ O)). Lemma ad xor sem 3 : (p : positive) (a′ : ad) (ad bit (ad xor (ad x (xO p)) a′) O) = (ad bit a′ O). Lemma ad xor sem 4 : (p : positive) (a′ : ad)

(ad bit (ad xor (ad x (xI p)) a′) O) = (negb (ad bit a′ O)). Lemma ad xor sem 5 : (a, a′ : ad) (ad bit (ad xor a a′) O) = (adf xor (ad bit a) (ad bit a′) O). Lemma ad xor sem 6 : (n : nat)

((a, a′ : ad) (ad bit (ad xor a a′) n) = (adf xor (ad bit a) (ad bit a′) n))

→ (a, a′ : ad) (ad bit (ad xor a a′) (S n)) = (adf xor (ad bit a) (ad bit a′) (S n)). Lemma ad xor semantics : (a, a′ : ad) (eqf (ad bit (ad xor a a′)) (adf xor (ad bit a) (ad bit a′))). Lemma eqf sym : (f , f′ : nat → bool) (eqf f f′) → (eqf f′ f ). Lemma eqf refl : (f : nat → bool) (eqf f f ). Lemma eqf trans : (f , f′, f′′ : nat → bool) (eqf f f′) → (eqf f′ f′′) → (eqf f f′′). Lemma adf xor eq : (f , f′ : nat → bool) (eqf (adf xor f f′) [n : nat] false) → (eqf f f′). Lemma ad xor eq : (a, a′ : ad) (ad xor a a′) = ad z → a = a′. Lemma adf xor assoc : (f , f′, f′′ : nat → bool)

(eqf (adf xor (adf xor f f′) f′′) (adf xor f (adf xor f′ f′′))).

Lemma eqf xor 1 : (f , f′, f′′, f′′′ : nat → bool) (eqf f f′) → (eqf f′′ f′′′) → (eqf (adf xor f f′′) (adf xor f′ f′′′)).

Lemma ad xor assoc : (a, a′, a′′ : ad) (ad xor (ad xor a a′) a′′) = (ad xor a (ad xor a′ a′′)).

Definition ad double := [a : ad]

Cases a of

ad z ⇒ ad z | (ad x p) ⇒ (ad x (xO p))

end.

Definition ad double plus un := [a : ad]

Cases a of

ad z ⇒ (ad x xH ) | (ad x p) ⇒ (ad x (xI p))

end.

Definition ad div 2 := [a : ad]

Cases a of

ad z ⇒ ad z | (ad x xH ) ⇒ ad z | (ad x (xO p)) ⇒ (ad x p) | (ad x (xI p)) ⇒ (ad x p)

end.

Lemma ad double div 2 : (a : ad) (ad div 2 (ad double a)) = a.

Lemma ad double plus un div 2 : (a : ad) (ad div 2 (ad double plus un a)) = a.

Lemma ad double inj : (a0 , a1 : ad) (ad double a0 ) = (ad double a1 ) → a0 = a1 .

Lemma ad double plus un inj : (a0 , a1 : ad) (ad double plus un a0 ) = (ad double plus un a1 ) → a0 = a1 .

Definition ad bit 0 := [a : ad]

Cases a of

ad z ⇒ false | (ad x (xO )) ⇒ false | ⇒ true

end.

Lemma ad double bit 0 : (a : ad) (ad bit 0 (ad double a)) = false.

Lemma ad double plus un bit 0 : (a : ad) (ad bit 0 (ad double plus un a)) = true.

Lemma ad div 2 double : (a : ad) (ad bit 0 a) = false → (ad double (ad div 2 a)) = a.

Lemma ad div 2 double plus un : (a : ad) (ad bit 0 a) = true → (ad double plus un (ad div 2 a)) = a.

Lemma ad bit 0 correct : (a : ad) (ad bit a O) = (ad bit 0 a).

Lemma ad div 2 correct : (a : ad) (n : nat) (ad bit (ad div 2 a) n) = (ad bit a (S n)).

Lemma ad xor bit 0 : (a, a′ : ad) (ad bit 0 (ad xor a a′)) = (xorb (ad bit 0 a) (ad bit 0 a′)).

Lemma ad xor div 2 : (a, a′ : ad) (ad div 2 (ad xor a a′)) = (ad xor (ad div 2 a) (ad div 2 a′)).

Lemma ad neg bit 0 : (a, a′ : ad) (ad bit 0 (ad xor a a′)) = true → (ad bit 0 a) = (negb (ad bit 0 a′)).

Lemma ad neg bit 0 1 : (a, a′ : ad) (ad xor a a′) = (ad x xH ) → (ad bit 0 a) = (negb (ad bit 0 a′)).

Lemma ad neg bit 0 2 : (a, a′ : ad) (p : positive) (ad xor a a′) = (ad x (xI p)) → (ad bit 0 a) = (negb (ad bit 0 a′)).

Lemma ad same bit 0 : (a, a′ : ad) (p : positive) (ad xor a a′) = (ad x (xO p)) → (ad bit 0 a) = (ad bit 0 a′).

Module Adist

Require Bool. Require ZArith. Require Arith. Require Min. Require Addr.

Fixpoint ad plength 1 [p : positive] : nat :=

Cases p of

xH ⇒ O | (xI ) ⇒ O | (xO p′) ⇒ (S (ad plength 1 p′))

end.

Inductive natinf : Set :=

infty : natinf | ni : nat → natinf .

Definition ad plength := [a : ad]

Cases a of

ad z ⇒ infty | (ad x p) ⇒ (ni (ad plength 1 p))

end.

Lemma ad plength infty : (a : ad) (ad plength a) = infty → a = ad z.

Lemma ad plength zeros : (a : ad) (n : nat) (ad plength a) = (ni n) → (k : nat) (lt k n) → (ad bit a k) = false.

Lemma ad plength one : (a : ad) (n : nat) (ad plength a) = (ni n) → (ad bit a n) = true.

Lemma ad plength first one : (a : ad) (n : nat)

((k : nat) (lt k n) → (ad bit a k) = false) → (ad bit a n) = true → (ad plength a) = (ni n).

Definition ni min := [d, d′ : natinf ]

Cases d of

infty ⇒ d′ | (ni n) ⇒ Cases d′ of

infty ⇒ d

| (ni n′) ⇒ (ni (min n n′)) end

end. Lemma ni min idemp : (d : natinf ) (ni min d d) = d. Lemma ni min comm : (d, d′ : natinf ) (ni min d d′) = (ni min d′ d). Lemma ni min assoc : (d, d′, d′′ : natinf ) (ni min (ni min d d′) d′′) = (ni min d (ni min d′ d′′)). Lemma ni min O l : (d : natinf ) (ni min (ni O) d) = (ni O). Lemma ni min O r : (d : natinf ) (ni min d (ni O)) = (ni O). Lemma ni min inf l : (d : natinf ) (ni min infty d) = d. Lemma ni min inf r : (d : natinf ) (ni min d infty) = d. Definition ni le := [d, d′ : natinf ] (ni min d d′) = d. Lemma ni le refl : (d : natinf ) (ni le d d). Lemma ni le antisym : (d, d′ : natinf ) (ni le d d′) → (ni le d′ d) → d = d′. Lemma ni le trans : (d, d′, d′′ : natinf ) (ni le d d′) → (ni le d′ d′′) → (ni le d d′′). Lemma ni le min 1 : (d, d′ : natinf ) (ni le (ni min d d′) d). Lemma ni le min 2 : (d, d′ : natinf ) (ni le (ni min d d′) d′). Lemma ni min case : (d, d′ : natinf ) (ni min d d′) = d ∨ (ni min d d′) = d′. Lemma ni le total : (d, d′ : natinf ) (ni le d d′) ∨ (ni le d′ d). Lemma ni le min induc : (d, d′, dm : natinf ) (ni le dm d) → (ni le dm d′)

→ ((d′′ : natinf ) (ni le d′′ d) → (ni le d′′ d′) → (ni le d′′ dm))

→ (ni min d d′) = dm. Lemma le ni le : (m, n : nat) (le m n) → (ni le (ni m) (ni n)). Lemma ni le le : (m, n : nat) (ni le (ni m) (ni n)) → (le m n). Lemma ad plength lb : (a : ad) (n : nat) ((k : nat) (lt k n) → (ad bit a k) = false)

→ (ni le (ni n) (ad plength a)). Lemma ad plength ub : (a : ad) (n : nat) (ad bit a n) = true

→ (ni le (ad plength a) (ni n)).

We define an ultrametric distance between addresses: d(a, a′) = 1/2^{p}d(a, a′), where pd(a, a′) is the number of identical bits at the beginning of a and a′ (infinity if a = a′). Instead of working with d, we work with pd, namely ad pdist: Definition ad pdist := [a, a′ : ad] (ad plength (ad xor a a′)).

d is a distance, so d(a, a′) = 0 iff a = a′; this means that pd(a, a′) = infty iff a = a′: Lemma ad pdist eq 1 : (a : ad) (ad pdist a a) = infty. Lemma ad pdist eq 2 : (a, a′ : ad) (ad pdist a a′) = infty → a = a′.

d is a distance, so d(a, a′) = d(a′, a): Lemma ad pdist comm : (a, a′ : ad) (ad pdist a a′) = (ad pdist a′ a).

d is an ultrametric distance, that is, not only d(a, a′) ≤ d(a, a′′) + d(a′′, a′), but in fact d(a, a′) ≤ max(d(a, a′′), d(a′′, a′)). This means that min(pd(a, a′′), pd(a′′, a′)) <= pd(a, a′) (lemma ad pdist ultra below). This follows from the fact that a ⇒ |a| = 1/2ad plength(a)) is an ultrametric norm, i.e. that |a − a′| ≤ max(|a − a′′|, |a′′ − a′|), or equivalently that |a + b| <= max(|a|, |b|), i.e. that min (ad plength(a), ad plength(b)) ≤ ad plength(a xor b) (lemma ad plength ultra).

Lemma ad plength ultra 1 : (a, a′ : ad)

(ni le (ad plength a) (ad plength a′))

→ (ni le (ad plength a) (ad plength (ad xor a a′))).

Lemma ad plength ultra : (a, a′ : ad)

(ni le (ni min (ad plength a) (ad plength a′)) (ad plength (ad xor a a′))).

Lemma ad pdist ultra : (a, a′, a′′ : ad)

(ni le (ni min (ad pdist a a′′) (ad pdist a′′ a′)) (ad pdist a a′)).

Module Addec

Equality on adresses

Require Bool. Require Sumbool. Require ZArith. Require Addr.

Fixpoint ad eq 1 [p1 , p2 : positive] : bool :=

Cases p1 p2 of

xH xH ⇒ true | (xO p′1 ) (xO p′2 ) ⇒ (ad eq 1 p′1 p′2 ) | (xI p′1 ) (xI p′2 ) ⇒ (ad eq 1 p′1 p′2 ) | ⇒ false

end.

Definition ad eq := [a, a′ : ad]

Cases a a′ of

ad z ad z ⇒ true | (ad x p) (ad x p′) ⇒ (ad eq 1 p p′) | ⇒ false

end.

Lemma ad eq correct : (a : ad) (ad eq a a) = true.

Lemma ad eq complete : (a, a′ : ad) (ad eq a a′) = true → a = a′.

Lemma ad eq comm : (a, a′ : ad) (ad eq a a′) = (ad eq a′ a).

Lemma ad xor eq true : (a, a′ : ad) (ad xor a a′) = ad z → (ad eq a a′) = true.

Lemma ad xor eq false : (a, a′ : ad) (p : positive) (ad xor a a′) = (ad x p) → (ad eq a a′) = false.

Lemma ad bit 0 1 not double : (a : ad) (ad bit 0 a) = true → (a0 : ad) (ad eq (ad double a0 ) a) = false.

Lemma ad not div 2 not double : (a, a0 : ad) (ad eq (ad div 2 a) a0 ) = false → (ad eq a (ad double a0 )) = false.

Lemma ad bit 0 0 not double plus un : (a : ad) (ad bit 0 a) = false → (a0 : ad) (ad eq (ad double plus un a0 ) a) = false.

Lemma ad not div 2 not double plus un : (a, a0 : ad) (ad eq (ad div 2 a) a0 ) = false → (ad eq (ad double plus un a0 ) a) = false.

Lemma ad bit 0 neq : (a, a′ : ad) (ad bit 0 a) = false → (ad bit 0 a′) = true → (ad eq a a′) = false.

Lemma ad div eq : (a, a′ : ad) (ad eq a a′) = true → (ad eq (ad div 2 a) (ad div 2 a′)) = true.

Lemma ad div neq : (a, a′ : ad) (ad eq (ad div 2 a) (ad div 2 a′)) = false → (ad eq a a′) = false.

Lemma ad div bit eq : (a, a′ : ad) (ad bit 0 a) = (ad bit 0 a′) → (ad div 2 a) = (ad div 2 a′) → a = a′.

Lemma ad div bit neq : (a, a′ : ad) (ad eq a a′) = false → (ad bit 0 a) = (ad bit 0 a′) → (ad eq (ad div 2 a) (ad div 2 a′)) = false.

Lemma ad neq : (a, a′ : ad) (ad eq a a′) = false → (ad bit 0 a) = (negb (ad bit 0 a′)) ∨ (ad eq (ad div 2 a) (ad div 2 a′)) = false.

Lemma ad double or double plus un : (a : ad)

{a0 : ad | a = (ad double a0 )} + {a1 : ad | a = (ad double plus un a1 )}.

Module Map

Definition of finite sets as trees indexed by adresses

Require Bool. Require Sumbool. Require ZArith. Require Addr. Require Adist. Require Addec.

Section MapDefs.

We define maps from ad to A.

Variable A : Set.

Inductive Map : Set :=

M0 : Map | M1 : ad → A → Map | M2 : Map → Map → Map.

Inductive option : Set :=

NONE : option | SOME : A → option.

Lemma option sum : (o : option) {y : A | o = (SOME y)} + {o = NONE}.

The semantics of maps is given by the function MapGet. The semantics of a map m is a partial, finite function from ad to A:

Fixpoint MapGet [m : Map] : ad → option :=

Cases m of

M0 ⇒ [a : ad] NONE | (M1 x y) ⇒ [a : ad] if (ad eq x a)

then (SOME y) else NONE

| (M2 m1 m2 ) ⇒ [a : ad]

Cases a of

ad z ⇒ (MapGet m1 ad z) | (ad x xH ) ⇒ (MapGet m2 ad z) | (ad x (xO p)) ⇒ (MapGet m1 (ad x p)) | (ad x (xI p)) ⇒ (MapGet m2 (ad x p))

end end.

Definition newMap := M0 .

Definition MapSingleton := M1 .

Definition eqm := [g, g′ : ad → option] (a : ad) (g a) = (g′ a).

Lemma newMap semantics : (eqm (MapGet newMap) [a : ad] NONE).

Lemma MapSingleton semantics : (a : ad) (y : A)

(eqm (MapGet (MapSingleton a y)) [a′ : ad] if (ad eq a a′) then (SOME y) else NONE).

Lemma M1 semantics 1 : (a : ad) (y : A) (MapGet (M1 a y) a) = (SOME y).

Lemma M1 semantics 2 : (a, a′ : ad) (y : A) (ad eq a a′) = false → (MapGet (M1 a y) a′) = NONE.

Lemma Map2 semantics 1 : (m, m′ : Map) (eqm (MapGet m) [a : ad] (MapGet (M2 m m′) (ad double a))).

Lemma Map2 semantics 1 eq : (m, m′ : Map) (f : ad → option) (eqm (MapGet (M2 m m′)) f )

→ (eqm (MapGet m) [a : ad] (f (ad double a))).

Lemma Map2 semantics 2 : (m, m′ : Map) (eqm (MapGet m′) [a : ad] (MapGet (M2 m m′) (ad double plus un a))).

Lemma Map2 semantics 2 eq : (m, m′ : Map) (f : ad → option) (eqm (MapGet (M2 m m′)) f )

→ (eqm (MapGet m′) [a : ad] (f (ad double plus un a))).

Lemma MapGet M2 bit 0 0 : (a : ad) (ad bit 0 a) = false → (m, m′ : Map) (MapGet (M2 m m′) a) = (MapGet m (ad div 2 a)).

Lemma MapGet M2 bit 0 1 : (a : ad) (ad bit 0 a) = true → (m, m′ : Map) (MapGet (M2 m m′) a) = (MapGet m′ (ad div 2 a)).

Lemma MapGet M2 bit 0 if : (m, m′ : Map) (a : ad) (MapGet (M2 m m′) a) = (if (ad bit 0 a) then (MapGet m′ (ad div 2 a)) else (MapGet m (ad div 2 a))).

Lemma MapGet M2 bit 0 : (m, m′, m′′ : Map)

(a : ad) (if (ad bit 0 a) then (MapGet (M2 m′ m) a) else (MapGet (M2 m m′′) a)) =

(MapGet m (ad div 2 a)).

Lemma Map2 semantics 3 : (m, m′ : Map) (eqm (MapGet (M2 m m′))

[a : ad] Cases (ad bit 0 a) of

false ⇒ (MapGet m (ad div 2 a)) | true ⇒ (MapGet m′ (ad div 2 a))

end).

Lemma Map2 semantics 3 eq : (m, m′ : Map) (f , f′ : ad → option)

(eqm (MapGet m) f ) → (eqm (MapGet m′) f′) → (eqm (MapGet (M2 m m′))

[a : ad] Cases (ad bit 0 a) of

false ⇒ (f (ad div 2 a)) | true ⇒ (f′ (ad div 2 a))

end).

Fixpoint MapPut1 [a : ad; y : A; a′ : ad; y′ : A; p : positive] : Map :=

Cases p of

(xO p′) ⇒ let m = (MapPut1 (ad div 2 a) y (ad div 2 a′) y′ p′) in

Cases (ad bit 0 a) of

false ⇒ (M2 m M0 ) | true ⇒ (M2 M0 m)

end | ⇒ Cases (ad bit 0 a) of

false ⇒ (M2 (M1 (ad div 2 a) y) (M1 (ad div 2 a′) y′)) | true ⇒ (M2 (M1 (ad div 2 a′) y′) (M1 (ad div 2 a) y))

end

end.

Lemma MapGet if commute : (b : bool) (m, m′ : Map) (a : ad)

(MapGet (if b then m else m′) a) = (if b then (MapGet m a) else (MapGet m′ a)).

Lemma MapGet if same : (m : Map) (b : bool) (a : ad) (MapGet (if b then m else m) a) = (MapGet m a).

Lemma MapGet M2 bit 0 2 : (m, m′, m′′ : Map)

(a : ad) (MapGet (if (ad bit 0 a) then (M2 m m′) else (M2 m′ m′′)) a) = (MapGet m′ (ad div 2 a)).

Lemma MapPut1 semantics 1 : (p : positive) (a, a′ : ad) (y, y′ : A)

(ad xor a a′) = (ad x p)

→ (MapGet (MapPut1 a y a′ y′ p) a) = (SOME y).

Lemma MapPut1 semantics 2 : (p : positive) (a, a′ : ad) (y, y′ : A)

(ad xor a a′) = (ad x p)

→ (MapGet (MapPut1 a y a′ y′ p) a′) = (SOME y′).

Lemma MapGet M2 both NONE : (m, m′ : Map) (a : ad)

(MapGet m (ad div 2 a)) = NONE → (MapGet m′ (ad div 2 a)) = NONE → (MapGet (M2 m m′) a) = NONE.

Lemma MapPut1 semantics 3 : (p : positive) (a, a′, a0 : ad) (y, y′ : A)

(ad xor a a′) = (ad x p) → (ad eq a a0 ) = false → (ad eq a′ a0 ) = false → (MapGet (MapPut1 a y a′ y′ p) a0 ) = NONE.

Lemma MapPut1 semantics : (p : positive) (a, a′ : ad) (y, y′ : A)

(ad xor a a′) = (ad x p)

→ (eqm (MapGet (MapPut1 a y a′ y′ p))

[a0 : ad] if (ad eq a a0 ) then (SOME y) else if (ad eq a′ a0 ) then (SOME y′) else NONE).

Lemma MapPut1 semantics′ : (p : positive) (a, a′ : ad) (y, y′ : A)

(ad xor a a′) = (ad x p)

→ (eqm (MapGet (MapPut1 a y a′ y′ p))

[a0 : ad] if (ad eq a′ a0 ) then (SOME y′) else if (ad eq a a0 ) then (SOME y) else NONE).

Fixpoint MapPut [m : Map] : ad → A → Map :=

Cases m of

M0 ⇒ M1 | (M1 a y) ⇒ [a′ : ad; y′ : A]

Cases (ad xor a a′) of

ad z ⇒ (M1 a′ y′) | (ad x p) ⇒ (MapPut1 a y a′ y′ p)

end | (M2 m1 m2 ) ⇒ [a : ad; y : A]

Cases a of

ad z ⇒ (M2 (MapPut m1 ad z y) m2 ) | (ad x xH ) ⇒ (M2 m1 (MapPut m2 ad z y)) | (ad x (xO p)) ⇒ (M2 (MapPut m1 (ad x p) y) m2 ) | (ad x (xI p)) ⇒ (M2 m1 (MapPut m2 (ad x p) y))

end end.

Lemma MapPut semantics 1 : (a : ad) (y : A) (a0 : ad)

(MapGet (MapPut M0 a y) a0 ) = (MapGet (M1 a y) a0 ).

Lemma MapPut semantics 2 1 : (a : ad) (y, y′ : A) (a0 : ad)

(MapGet (MapPut (M1 a y) a y′) a0 ) = (if (ad eq a a0 ) then (SOME y′) else NONE).

Lemma MapPut semantics 2 2 : (a, a′ : ad) (y, y′ : A) (a0 : ad) (a′′ : ad) (ad xor a a′) = a′′ → (MapGet (MapPut (M1 a y) a′ y′) a0 ) = (if (ad eq a′ a0 ) then (SOME y′) else if (ad eq a a0 ) then (SOME y) else NONE).

Lemma MapPut semantics 2 : (a, a′ : ad) (y, y′ : A) (a0 : ad)

(MapGet (MapPut (M1 a y) a′ y′) a0 ) = (if (ad eq a′ a0 ) then (SOME y′) else if (ad eq a a0 ) then (SOME y) else NONE).

Lemma MapPut semantics 3 1 : (m, m′ : Map) (a : ad) (y : A)

(MapPut (M2 m m′) a y) = (if (ad bit 0 a) then (M2 m (MapPut m′ (ad div 2 a) y)) else (M2 (MapPut m (ad div 2 a) y) m′)).

Lemma MapPut semantics : (m : Map) (a : ad) (y : A)

(eqm (MapGet (MapPut m a y)) [a′ : ad] if (ad eq a a′) then (SOME y) else (MapGet m a′)).

Fixpoint MapPut behind [m : Map] : ad → A → Map :=

Cases m of

M0 ⇒ M1 | (M1 a y) ⇒ [a′ : ad; y′ : A] Cases (ad xor a a′) of ad z ⇒ m

| (ad x p) ⇒ (MapPut1 a y a′ y′ p) end

| (M2 m1 m2 ) ⇒ [a : ad; y : A]

Cases a of

ad z ⇒ (M2 (MapPut behind m1 ad z y) m2 ) | (ad x xH ) ⇒ (M2 m1 (MapPut behind m2 ad z y)) | (ad x (xO p)) ⇒ (M2 (MapPut behind m1 (ad x p) y) m2 ) | (ad x (xI p)) ⇒ (M2 m1 (MapPut behind m2 (ad x p) y))

end end.

Lemma MapPut behind semantics 3 1 : (m, m′ : Map) (a : ad) (y : A)

(MapPut behind (M2 m m′) a y) =

(if (ad bit 0 a) then (M2 m (MapPut behind m′ (ad div 2 a) y)) else (M2 (MapPut behind m (ad div 2 a) y) m′)).

Lemma MapPut behind as before 1 : (a, a′, a0 : ad) (ad eq a′ a0 ) = false →

(y, y′ : A) (MapGet (MapPut (M1 a y) a′ y′) a0 )

=(MapGet (MapPut behind (M1 a y) a′ y′) a0 ).

Lemma MapPut behind as before : (m : Map) (a : ad) (y : A)

(a0 : ad) (ad eq a a0 ) = false → (MapGet (MapPut m a y) a0 ) = (MapGet (MapPut behind m a y) a0 ).

Lemma MapPut behind new : (m : Map) (a : ad) (y : A)

(MapGet (MapPut behind m a y) a) = (Cases (MapGet m a) of

(SOME y′) ⇒ (SOME y′) | ⇒ (SOME y)

end).

Lemma MapPut behind semantics : (m : Map) (a : ad) (y : A)

(eqm (MapGet (MapPut behind m a y)) [a′ : ad] Cases (MapGet m a′) of

(SOME y′) ⇒ (SOME y′) | ⇒ if (ad eq a a′) then (SOME y) else NONE

end).

Definition makeM2 := [m, m′ : Map] Cases m m′ of

M0 M0 ⇒ M0 | M0 (M1 a y) ⇒ (M1 (ad double plus un a) y) | (M1 a y) M0 ⇒ (M1 (ad double a) y) | ⇒ (M2 m m′)

end.

Lemma makeM2 M2 : (m, m′ : Map) (eqm (MapGet (makeM2 m m′)) (MapGet (M2 m m′))).

Fixpoint MapRemove [m : Map] : ad → Map :=

Cases m of

M0 ⇒ [ : ad] M0 | (M1 a y) ⇒ [a′ : ad]

Cases (ad eq a a′) of true ⇒ M0 | false ⇒ m

end | (M2 m1 m2 ) ⇒ [a : ad] if (ad bit 0 a) then (makeM2 m1 (MapRemove m2 (ad div 2 a))) else (makeM2 (MapRemove m1 (ad div 2 a)) m2 )

end.

Lemma MapRemove semantics : (m : Map) (a : ad)

(eqm (MapGet (MapRemove m a)) [a′ : ad] if (ad eq a a′) then NONE else (MapGet m a′)).

Fixpoint MapCard [m : Map] : nat :=

Cases m of

M0 ⇒ O | (M1 ) ⇒ (S O) | (M2 m m′) ⇒ (plus (MapCard m) (MapCard m′))

end.

Fixpoint MapMerge [m : Map] : Map → Map :=

Cases m of

M0 ⇒ [m′ : Map] m′ | (M1 a y) ⇒ [m′ : Map] (MapPut behind m′ a y) | (M2 m1 m2 ) ⇒ [m′ : Map] Cases m′ of

M0 ⇒ m | (M1 a′ y′) ⇒ (MapPut m a′ y′) | (M2 m′1 m′2 ) ⇒ (M2 (MapMerge m1 m′1 ) (MapMerge m2 m′2 ))

end

end.

Lemma MapMerge semantics : (m, m′ : Map)

(eqm (MapGet (MapMerge m m′))

[a0 : ad] Cases (MapGet m′ a0 ) of

(SOME y′) ⇒ (SOME y′) | NONE ⇒ (MapGet m a0 )

end).

MapInter, MapRngRestrTo, MapRngRestrBy, MapInverse not implemented: need a decidable equality on A.

Fixpoint MapDelta [m : Map] : Map → Map :=

Cases m of

M0 ⇒ [m′ : Map] m′ | (M1 a y) ⇒ [m′ : Map] Cases (MapGet m′ a) of

NONE ⇒ (MapPut m′ a y) | ⇒ (MapRemove m′ a)

end

| (M2 m1 m2 ) ⇒ [m′ : Map] Cases m′ of

M0 ⇒ m | (M1 a′ y′) ⇒ Cases (MapGet m a′) of

NONE ⇒ (MapPut m a′ y′) | ⇒ (MapRemove m a′)

end

| (M2 m′1 m′2 ) ⇒ (makeM2 (MapDelta m1 m′1 )

(MapDelta m2 m′2 ))

end

end.

Lemma MapDelta semantics comm : (m, m′ : Map)

(eqm (MapGet (MapDelta m m′)) (MapGet (MapDelta m′ m))).

Lemma MapDelta semantics 1 1 : (a : ad) (y : A) (m′ : Map) (a0 : ad)

(MapGet (M1 a y) a0 ) = NONE → (MapGet m′ a0 ) = NONE → (MapGet (MapDelta (M1 a y) m′) a0 ) = NONE.

Lemma MapDelta semantics 1 : (m, m′ : Map) (a : ad)

(MapGet m a) = NONE → (MapGet m′ a) = NONE → (MapGet (MapDelta m m′) a) = NONE.

Lemma MapDelta semantics 2 1 : (a : ad) (y : A) (m′ : Map) (a0 : ad) (y0 : A)

(MapGet (M1 a y) a0 ) = NONE → (MapGet m′ a0 ) = (SOME y0 ) → (MapGet (MapDelta (M1 a y) m′) a0 ) = (SOME y0 ).

Lemma MapDelta semantics 2 2 : (a : ad) (y : A) (m′ : Map) (a0 : ad) (y0 : A)

(MapGet (M1 a y) a0 ) = (SOME y0 ) → (MapGet m′ a0 ) = NONE → (MapGet (MapDelta (M1 a y) m′) a0 ) = (SOME y0 ).

Lemma MapDelta semantics 2 : (m, m′ : Map) (a : ad) (y : A)

(MapGet m a) = NONE → (MapGet m′ a) = (SOME y) → (MapGet (MapDelta m m′) a) = (SOME y).

Lemma MapDelta semantics 3 1 : (a0 : ad) (y0 : A) (m′ : Map) (a : ad) (y, y′ : A)

(MapGet (M1 a0 y0 ) a) = (SOME y) → (MapGet m′ a) = (SOME y′) → (MapGet (MapDelta (M1 a0 y0 ) m′) a) = NONE.

Lemma MapDelta semantics 3 : (m, m′ : Map) (a : ad) (y, y′ : A)

(MapGet m a) = (SOME y) → (MapGet m′ a) = (SOME y′) → (MapGet (MapDelta m m′) a) = NONE.

Lemma MapDelta semantics : (m, m′ : Map)

(eqm (MapGet (MapDelta m m′))

[a0 : ad] Cases (MapGet m a0 ) (MapGet m′ a0 ) of

NONE (SOME y′) ⇒ (SOME y′) | (SOME y) NONE ⇒ (SOME y) | ⇒ NONE

end).

Definition MapEmptyp := [m : Map] Cases m of

M0 ⇒ true

| ⇒ false end.

Lemma MapEmptyp correct : (MapEmptyp M0 ) = true.

Lemma MapEmptyp complete : (m : Map) (MapEmptyp m) = true → m = M0 .

MapSplit not implemented: not the preferred way of recursing over Maps (use MapSweep, MapCollect, or MapFold in Mapiter.v.

End MapDefs.

Module Fset

Sets operations on maps

Require Bool. Require Sumbool. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map.

Section Dom.

Variable A, B : Set.

Fixpoint MapDomRestrTo [m : (Map A)] : (Map B) → (Map A) :=

Cases m of

M0 ⇒ [ : (Map B)] (M0 A) | (M1 a y) ⇒ [m′ : (Map B)] Cases (MapGet B m′ a) of

NONE ⇒ (M0 A) | ⇒ m

end

| (M2 m1 m2 ) ⇒ [m′ : (Map B)] Cases m′ of

M0 ⇒ (M0 A) | (M1 a′ y′) ⇒ Cases (MapGet A m a′) of

NONE ⇒ (M0 A) | (SOME y) ⇒ (M1 A a′ y)

end

| (M2 m′1 m′2 ) ⇒ (makeM2 A (MapDomRestrTo m1 m′1 )

(MapDomRestrTo m2 m′2 ))

end

end.

Lemma MapDomRestrTo semantics : (m : (Map A)) (m′ : (Map B))

(eqm A (MapGet A (MapDomRestrTo m m′))

[a0 : ad] Cases (MapGet B m′ a0 ) of

NONE ⇒ (NONE A) | ⇒ (MapGet A m a0 )

end).

Fixpoint MapDomRestrBy [m : (Map A)] : (Map B) → (Map A) :=

Cases m of

M0 ⇒ [ : (Map B)] (M0 A) | (M1 a y) ⇒ [m′ : (Map B)] Cases (MapGet B m′ a) of

NONE ⇒ m | ⇒ (M0 A)

end

| (M2 m1 m2 ) ⇒ [m′ : (Map B)] Cases m′ of

M0 ⇒ m | (M1 a′ y′) ⇒ (MapRemove A m a′) | (M2 m′1 m′2 ) ⇒ (makeM2 A (MapDomRestrBy m1 m′1 )

(MapDomRestrBy m2 m′2 ))

end

end.

Lemma MapDomRestrBy semantics : (m : (Map A)) (m′ : (Map B))

(eqm A (MapGet A (MapDomRestrBy m m′))

[a0 : ad] Cases (MapGet B m′ a0 ) of

NONE ⇒ (MapGet A m a0 ) | ⇒ (NONE A)

end).

Definition in dom := [a : ad; m : (Map A)]

Cases (MapGet A m a) of NONE ⇒ false

| ⇒ true end.

Lemma in dom M0 : (a : ad) (in dom a (M0 A)) = false.

Lemma in dom M1 : (a, a0 : ad) (y : A) (in dom a0 (M1 A a y)) = (ad eq a a0 ).

Lemma in dom M1 1 : (a : ad) (y : A) (in dom a (M1 A a y)) = true.

Lemma in dom M1 2 : (a, a0 : ad) (y : A) (in dom a0 (M1 A a y)) = true → a = a0 .

Lemma in dom some : (m : (Map A)) (a : ad) (in dom a m) = true → {y : A | (MapGet A m a) = (SOME A y)}.

Lemma in dom none : (m : (Map A)) (a : ad) (in dom a m) = false → (MapGet A m a) = (NONE A).

Lemma in dom put : (m : (Map A)) (a0 : ad) (y0 : A) (a : ad)

(in dom a (MapPut A m a0 y0 )) = (orb (ad eq a a0 ) (in dom a m)).

Lemma in dom put behind : (m : (Map A)) (a0 : ad) (y0 : A) (a : ad)

(in dom a (MapPut behind A m a0 y0 )) = (orb (ad eq a a0 ) (in dom a m)).

Lemma in dom remove : (m : (Map A)) (a0 : ad) (a : ad)

(in dom a (MapRemove A m a0 )) = (andb (negb (ad eq a a0 )) (in dom a m)).

Lemma in dom merge : (m, m′ : (Map A)) (a : ad)

(in dom a (MapMerge A m m′)) = (orb (in dom a m) (in dom a m′)).

Lemma in dom delta : (m, m′ : (Map A)) (a : ad)

(in dom a (MapDelta A m m′)) = (xorb (in dom a m) (in dom a m′)). End Dom. Section InDom. Variable A, B : Set. Lemma in dom restrto : (m : (Map A)) (m′ : (Map B)) (a : ad)

(in dom A a (MapDomRestrTo A B m m′)) = (andb (in dom A a m) (in dom B a m′)). Lemma in dom restrby : (m : (Map A)) (m′ : (Map B)) (a : ad)

(in dom A a (MapDomRestrBy A B m m′)) = (andb (in dom A a m) (negb (in dom B a m′))). End InDom. Definition FSet := (Map unit). Section FSetDefs. Variable A : Set. Definition in FSet : ad → FSet → bool := (in dom unit). Fixpoint MapDom [m : (Map A)] : FSet :=

Cases m of

M0 ⇒ (M0 unit) | (M1 a ) ⇒ (M1 unit a tt) | (M2 m m′) ⇒ (M2 unit (MapDom m) (MapDom m′))

end. Lemma MapDom semantics 1 : (m : (Map A)) (a : ad) (y : A) (MapGet A m a) = (SOME A y) →

(in FSet a (MapDom m)) = true. Lemma MapDom semantics 2 : (m : (Map A)) (a : ad) (in FSet a (MapDom m)) = true →

{y : A | (MapGet A m a) = (SOME A y)}. Lemma MapDom semantics 3 : (m : (Map A)) (a : ad) (MapGet A m a) = (NONE A) →

(in FSet a (MapDom m)) = false. Lemma MapDom semantics 4 : (m : (Map A)) (a : ad) (in FSet a (MapDom m)) = false →

(MapGet A m a) = (NONE A). Lemma MapDom Dom : (m : (Map A)) (a : ad) (in dom A a m) = (in FSet a (MapDom m)). Definition FSetUnion : FSet → FSet → FSet := [s, s′ : FSet] (MapMerge unit s s′). Lemma in FSet union : (s, s′ : FSet) (a : ad)

(in FSet a (FSetUnion s s′)) = (orb (in FSet a s) (in FSet a s′)). Definition FSetInter : FSet → FSet → FSet := [s, s′ : FSet] (MapDomRestrTo unit unit s s′). Lemma in FSet inter : (s, s′ : FSet) (a : ad)

(in FSet a (FSetInter s s′)) = (andb (in FSet a s) (in FSet a s′)). Definition FSetDiff : FSet → FSet → FSet := [s, s′ : FSet] (MapDomRestrBy unit unit s s′). Lemma in FSet diff : (s, s′ : FSet) (a : ad)

(in FSet a (FSetDiff s s′)) = (andb (in FSet a s) (negb (in FSet a s′))).

Definition FSetDelta : FSet → FSet → FSet := [s, s′ : FSet] (MapDelta unit s s′).

Lemma in FSet delta : (s, s′ : FSet) (a : ad)

(in FSet a (FSetDelta s s′)) = (xorb (in FSet a s) (in FSet a s′)).

End FSetDefs.

Lemma FSet Dom : (s : FSet) (MapDom unit s) = s.

Module Adalloc

Require Bool. Require Sumbool. Require ZArith. Require Arith. Require Addr. Require Adist. Require Addec. Require Map. Require Fset.

Section AdAlloc.

Variable A : Set.

Definition nat of ad := [a : ad] Cases a of

ad z ⇒ O | (ad x p) ⇒ (convert p)

end.

Fixpoint nat le [m : nat] : nat → bool :=

Cases m of

O ⇒ [ : nat] true | (S m′) ⇒ [n : nat] Cases n of

O ⇒ false | (S n′) ⇒ (nat le m′ n′)

end

end.

Lemma nat le correct : (m, n : nat) (le m n) → (nat le m n) = true.

Lemma nat le complete : (m, n : nat) (nat le m n) = true → (le m n).

Lemma nat le correct conv : (m, n : nat) (lt m n) → (nat le n m) = false.

Lemma nat le complete conv : (m, n : nat) (nat le n m) = false → (lt m n).

Definition ad of nat := [n : nat] Cases n of

O ⇒ ad z | (S n′) ⇒ (ad x (anti convert n′))

end.

Lemma ad of nat of ad : (a : ad) (ad of nat (nat of ad a)) = a.

Lemma nat of ad of nat : (n : nat) (nat of ad (ad of nat n)) = n. Definition ad le := [a, b : ad] (nat le (nat of ad a) (nat of ad b)). Lemma ad le refl : (a : ad) (ad le a a) = true. Lemma ad le antisym : (a, b : ad) (ad le a b) = true → (ad le b a) = true → a = b. Lemma ad le trans : (a, b, c : ad) (ad le a b) = true → (ad le b c) = true → (ad le a c) = true. Lemma ad le lt trans : (a, b, c : ad) (ad le a b) = true → (ad le c b) = false → (ad le c a) = false. Lemma ad lt le trans : (a, b, c : ad) (ad le b a) = false → (ad le b c) = true → (ad le c a) = false. Lemma ad lt trans : (a, b, c : ad) (ad le b a) = false → (ad le c b) = false → (ad le c a) = false. Lemma ad lt le weak : (a, b : ad) (ad le b a) = false → (ad le a b) = true. Definition ad min := [a, b : ad] if (ad le a b) then a else b. Lemma ad min choice : (a, b : ad) {(ad min a b) = a} + {(ad min a b) = b}. Lemma ad min le 1 : (a, b : ad) (ad le (ad min a b) a) = true. Lemma ad min le 2 : (a, b : ad) (ad le (ad min a b) b) = true. Lemma ad min le 3 : (a, b, c : ad) (ad le a (ad min b c)) = true → (ad le a b) = true. Lemma ad min le 4 : (a, b, c : ad) (ad le a (ad min b c)) = true → (ad le a c) = true. Lemma ad min le 5 : (a, b, c : ad) (ad le a b) = true → (ad le a c) = true →

(ad le a (ad min b c)) = true. Lemma ad min lt 3 : (a, b, c : ad) (ad le (ad min b c) a) = false → (ad le b a) = false. Lemma ad min lt 4 : (a, b, c : ad) (ad le (ad min b c) a) = false → (ad le c a) = false. Allocator: returns an address not in the domain of m. This allocator is optimal in that it returns the lowest possible address, in the usual ordering on integers. It is not the most efficient, however. Fixpoint ad alloc opt [m : (Map A)] : ad :=

Cases m of

M0 ⇒ ad z | (M1 a ) ⇒ if (ad eq a ad z)

then (ad x xH ) else ad z

| (M2 m1 m2 ) ⇒ (ad min (ad double (ad alloc opt m1 ))

(ad double plus un (ad alloc opt m2 )))

end. Lemma ad alloc opt allocates 1 : (m : (Map A)) (MapGet A m (ad alloc opt m)) = (NONE A). Lemma ad alloc opt allocates : (m : (Map A)) (in dom A (ad alloc opt m) m) = false. Moreover, this is optimal: all addresses below (ad alloc opt m) are in dom m: Lemma convert xH : (convert xH ) = (1).

Lemma positive to nat mult : (p : positive) (n, m : nat)

(positive to nat p (mult m n)) = (mult m (positive to nat p n)).

Lemma positive to nat 2 : (p : positive)

(positive to nat p (2)) = (mult (2) (positive to nat p (1))).

Lemma positive to nat 4 : (p : positive)

(positive to nat p (4)) = (mult (2) (positive to nat p (2))).

Lemma convert xO : (p : positive) (convert (xO p)) = (mult (2) (convert p)).

Lemma convert xI : (p : positive) (convert (xI p)) = (S (mult (2) (convert p))).

Lemma nat of ad double : (a : ad) (nat of ad (ad double a)) = (mult (2) (nat of ad a)).

Lemma nat of ad double plus un : (a : ad)

(nat of ad (ad double plus un a)) = (S (mult (2) (nat of ad a))).

Lemma ad le double mono : (a, b : ad) (ad le a b) = true → (ad le (ad double a) (ad double b)) = true.

Lemma ad le double plus un mono : (a, b : ad) (ad le a b) = true → (ad le (ad double plus un a) (ad double plus un b)) = true.

Lemma ad le double mono conv : (a, b : ad) (ad le (ad double a) (ad double b)) = true → (ad le a b) = true.

Lemma ad le double plus un mono conv : (a, b : ad)

(ad le (ad double plus un a) (ad double plus un b)) = true → (ad le a b) = true.

Lemma ad lt double mono : (a, b : ad) (ad le a b) = false → (ad le (ad double a) (ad double b)) = false.

Lemma ad lt double plus un mono : (a, b : ad) (ad le a b) = false → (ad le (ad double plus un a) (ad double plus un b)) = false.

Lemma ad lt double mono conv : (a, b : ad) (ad le (ad double a) (ad double b)) = false → (ad le a b) = false.

Lemma ad lt double plus un mono conv : (a, b : ad)

(ad le (ad double plus un a) (ad double plus un b)) = false → (ad le a b) = false.

Lemma ad alloc opt optimal 1 : (m : (Map A)) (a : ad) (ad le (ad alloc opt m) a) = false → {y : A | (MapGet A m a) = (SOME A y)}.

Lemma ad alloc opt optimal : (m : (Map A)) (a : ad) (ad le (ad alloc opt m) a) = false → (in dom A a m) = true.

End AdAlloc.

Module Mapaxioms

Require Bool. Require Sumbool. Require ZArith. Require Addr. Require Adist.

Require Addec. Require Map. Require Fset. Section MapAxioms. Variable A, B, C : Set. Lemma eqm sym : (f , f′ : ad → (option A)) (eqm A f f′) → (eqm A f′ f ). Lemma eqm refl : (f : ad → (option A)) (eqm A f f ). Lemma eqm trans : (f , f′, f′′ : ad → (option A)) (eqm A f f′) → (eqm A f′ f′′) → (eqm A f f′′). Definition eqmap := [m, m′ : (Map A)] (eqm A (MapGet A m) (MapGet A m′)). Lemma eqmap sym : (m, m′ : (Map A)) (eqmap m m′) → (eqmap m′ m). Lemma eqmap refl : (m : (Map A)) (eqmap m m). Lemma eqmap trans : (m, m′, m′′ : (Map A)) (eqmap m m′) → (eqmap m′ m′′) → (eqmap m m′′). Lemma MapPut as Merge : (m : (Map A)) (a : ad) (y : A)

(eqmap (MapPut A m a y) (MapMerge A m (M1 A a y))). Lemma MapPut ext : (m, m′ : (Map A)) (eqmap m m′) →

(a : ad) (y : A) (eqmap (MapPut A m a y) (MapPut A m′ a y)). Lemma MapPut behind as Merge : (m : (Map A)) (a : ad) (y : A)

(eqmap (MapPut behind A m a y) (MapMerge A (M1 A a y) m)). Lemma MapPut behind ext : (m, m′ : (Map A)) (eqmap m m′) →

(a : ad) (y : A) (eqmap (MapPut behind A m a y) (MapPut behind A m′ a y)). Lemma MapMerge empty m 1 : (m : (Map A)) (MapMerge A (M0 A) m) = m. Lemma MapMerge empty m : (m : (Map A)) (eqmap (MapMerge A (M0 A) m) m). Lemma MapMerge m empty 1 : (m : (Map A)) (MapMerge A m (M0 A)) = m. Lemma MapMerge m empty : (m : (Map A)) (eqmap (MapMerge A m (M0 A)) m). Lemma MapMerge empty l : (m, m′ : (Map A)) (eqmap (MapMerge A m m′) (M0 A)) →

(eqmap m (M0 A)). Lemma MapMerge empty r : (m, m′ : (Map A)) (eqmap (MapMerge A m m′) (M0 A)) →

(eqmap m′ (M0 A)). Lemma MapMerge assoc : (m, m′, m′′ : (Map A)) (eqmap

(MapMerge A (MapMerge A m m′) m′′) (MapMerge A m (MapMerge A m′ m′′))).

Lemma MapMerge idempotent : (m : (Map A)) (eqmap (MapMerge A m m) m). Lemma MapMerge ext : (m1 , m2 , m′1 , m′2 : (Map A))

(eqmap m1 m′1 ) → (eqmap m2 m′2 ) → (eqmap (MapMerge A m1 m2 ) (MapMerge A m′1 m′2 )). Lemma MapMerge ext l : (m1 , m′1 , m2 : (Map A))

(eqmap m1 m′1 ) → (eqmap (MapMerge A m1 m2 ) (MapMerge A m′1 m2 )). Lemma MapMerge ext r : (m1 , m2 , m′2 : (Map A))

(eqmap m2 m′2 ) → (eqmap (MapMerge A m1 m2 ) (MapMerge A m1 m′2 )). Lemma MapMerge RestrTo l : (m, m′, m′′ : (Map A))

(eqmap (MapMerge A (MapDomRestrTo A A m m′) m′′)

(MapDomRestrTo A A (MapMerge A m m′′) (MapMerge A m′ m′′))).

Lemma MapRemove as RestrBy : (m : (Map A)) (a : ad) (y : B)

(eqmap (MapRemove A m a) (MapDomRestrBy A B m (M1 B a y))). Lemma MapRemove ext : (m, m′ : (Map A)) (eqmap m m′) →

(a : ad) (eqmap (MapRemove A m a) (MapRemove A m′ a)). Lemma MapDomRestrTo empty m 1 : (m : (Map B)) (MapDomRestrTo A B (M0 A) m) = (M0 A). Lemma MapDomRestrTo empty m : (m : (Map B)) (eqmap (MapDomRestrTo A B (M0 A) m) (M0 A)). Lemma MapDomRestrTo m empty 1 : (m : (Map A)) (MapDomRestrTo A B m (M0 B)) = (M0 A). Lemma MapDomRestrTo m empty : (m : (Map A)) (eqmap (MapDomRestrTo A B m (M0 B)) (M0 A)). Lemma MapDomRestrTo assoc : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrTo A C (MapDomRestrTo A B m m′) m′′)

(MapDomRestrTo A B m (MapDomRestrTo B C m′ m′′))).

Lemma MapDomRestrTo idempotent : (m : (Map A)) (eqmap (MapDomRestrTo A A m m) m). Lemma MapDomRestrTo Dom : (m : (Map A)) (m′ : (Map B))

(eqmap (MapDomRestrTo A B m m′) (MapDomRestrTo A unit m (MapDom B m′))). Lemma MapDomRestrBy empty m 1 : (m : (Map B)) (MapDomRestrBy A B (M0 A) m) = (M0 A). Lemma MapDomRestrBy empty m : (m : (Map B)) (eqmap (MapDomRestrBy A B (M0 A) m) (M0 A)). Lemma MapDomRestrBy m empty 1 : (m : (Map A)) (MapDomRestrBy A B m (M0 B)) = m. Lemma MapDomRestrBy m empty : (m : (Map A)) (eqmap (MapDomRestrBy A B m (M0 B)) m). Lemma MapDomRestrBy Dom : (m : (Map A)) (m′ : (Map B))

(eqmap (MapDomRestrBy A B m m′) (MapDomRestrBy A unit m (MapDom B m′))). Lemma MapDomRestrBy m m 1 : (m : (Map A)) (eqmap (MapDomRestrBy A A m m) (M0 A)). Lemma MapDomRestrBy By : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map B))

(eqmap (MapDomRestrBy A B (MapDomRestrBy A B m m′) m′′) (MapDomRestrBy A B m (MapMerge B m′ m′′))).

Lemma MapDomRestrBy By comm : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrBy A C (MapDomRestrBy A B m m′) m′′)

(MapDomRestrBy A B (MapDomRestrBy A C m m′′) m′)).

Lemma MapDomRestrBy To : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrBy A C (MapDomRestrTo A B m m′) m′′)

(MapDomRestrTo A B m (MapDomRestrBy B C m′ m′′))).

Lemma MapDomRestrBy To comm : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrBy A C (MapDomRestrTo A B m m′) m′′)

(MapDomRestrTo A B (MapDomRestrBy A C m m′′) m′)).

Lemma MapDomRestrTo By : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrTo A C (MapDomRestrBy A B m m′) m′′)

(MapDomRestrTo A C m (MapDomRestrBy C B m′′ m′))).

Lemma MapDomRestrTo By comm : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrTo A C (MapDomRestrBy A B m m′) m′′)

(MapDomRestrBy A B (MapDomRestrTo A C m m′′) m′)).

Lemma MapDomRestrTo To comm : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(eqmap (MapDomRestrTo A C (MapDomRestrTo A B m m′) m′′)

(MapDomRestrTo A B (MapDomRestrTo A C m m′′) m′)).

Lemma MapMerge DomRestrTo : (m, m′ : (Map A)) (m′′ : (Map B))

(eqmap (MapDomRestrTo A B (MapMerge A m m′) m′′)

(MapMerge A (MapDomRestrTo A B m m′′) (MapDomRestrTo A B m′ m′′))).

Lemma MapMerge DomRestrBy : (m, m′ : (Map A)) (m′′ : (Map B))

(eqmap (MapDomRestrBy A B (MapMerge A m m′) m′′)

(MapMerge A (MapDomRestrBy A B m m′′) (MapDomRestrBy A B m′ m′′))).

Lemma MapDelta empty m 1 : (m : (Map A)) (MapDelta A (M0 A) m) = m. Lemma MapDelta empty m : (m : (Map A)) (eqmap (MapDelta A (M0 A) m) m). Lemma MapDelta m empty 1 : (m : (Map A)) (MapDelta A m (M0 A)) = m. Lemma MapDelta m empty : (m : (Map A)) (eqmap (MapDelta A m (M0 A)) m). Lemma MapDelta nilpotent : (m : (Map A)) (eqmap (MapDelta A m m) (M0 A)). Lemma MapDelta as Merge : (m, m′ : (Map A)) (eqmap (MapDelta A m m′)

(MapMerge A (MapDomRestrBy A A m m′) (MapDomRestrBy A A m′ m))). Lemma MapDelta as DomRestrBy : (m, m′ : (Map A)) (eqmap (MapDelta A m m′)

(MapDomRestrBy A A (MapMerge A m m′) (MapDomRestrTo A A m m′))). Lemma MapDelta as DomRestrBy 2 : (m, m′ : (Map A)) (eqmap (MapDelta A m m′)

(MapDomRestrBy A A (MapMerge A m m′) (MapDomRestrTo A A m′ m))). Lemma MapDelta sym : (m, m′ : (Map A)) (eqmap (MapDelta A m m′) (MapDelta A m′ m)). Lemma MapDelta ext : (m1 , m2 , m′1 , m′2 : (Map A))

(eqmap m1 m′1 ) → (eqmap m2 m′2 ) → (eqmap (MapDelta A m1 m2 ) (MapDelta A m′1 m′2 )). Lemma MapDelta ext l : (m1 , m′1 , m2 : (Map A))

(eqmap m1 m′1 ) → (eqmap (MapDelta A m1 m2 ) (MapDelta A m′1 m2 )). Lemma MapDelta ext r : (m1 , m2 , m′2 : (Map A))

(eqmap m2 m′2 ) → (eqmap (MapDelta A m1 m2 ) (MapDelta A m1 m′2 )). Lemma MapDom Split 1 : (m : (Map A)) (m′ : (Map B))

(eqmap m (MapMerge A (MapDomRestrTo A B m m′) (MapDomRestrBy A B m m′))). Lemma MapDom Split 2 : (m : (Map A)) (m′ : (Map B))

(eqmap m (MapMerge A (MapDomRestrBy A B m m′) (MapDomRestrTo A B m m′))). Lemma MapDom Split 3 : (m : (Map A)) (m′ : (Map B))

(eqmap (MapDomRestrTo A A (MapDomRestrTo A B m m′) (MapDomRestrBy A B m m′)) (M0 A)). End MapAxioms. Lemma MapDomRestrTo ext : (A, B :Set) (m1 : (Map A)) (m2 : (Map B)) (m′1 : (Map A)) (m′2 : (Map B))

(eqmap A m1 m′1 ) → (eqmap B m2 m′2 ) →

(eqmap A (MapDomRestrTo A B m1 m2 ) (MapDomRestrTo A B m′1 m′2 )). Lemma MapDomRestrTo ext l : (A, B :Set) (m1 : (Map A)) (m2 : (Map B)) (m′1 : (Map A))

(eqmap A m1 m′1 ) →

(eqmap A (MapDomRestrTo A B m1 m2 ) (MapDomRestrTo A B m′1 m2 )). Lemma MapDomRestrTo ext r : (A, B :Set) (m1 : (Map A)) (m2 : (Map B)) (m′2 : (Map B))

(eqmap B m2 m′2 ) →

(eqmap A (MapDomRestrTo A B m1 m2 ) (MapDomRestrTo A B m1 m′2 )). Lemma MapDomRestrBy ext : (A, B :Set) (m1 : (Map A)) (m2 : (Map B)) (m′1 : (Map A)) (m′2 : (Map B))

(eqmap A m1 m′1 ) → (eqmap B m2 m′2 ) →

(eqmap A (MapDomRestrBy A B m1 m2 ) (MapDomRestrBy A B m′1 m′2 )). Lemma MapDomRestrBy ext l : (A, B :Set) (m1 : (Map A)) (m2 : (Map B)) (m′1 : (Map A))

(eqmap A m1 m′1 ) →

(eqmap A (MapDomRestrBy A B m1 m2 ) (MapDomRestrBy A B m′1 m2 )). Lemma MapDomRestrBy ext r : (A, B :Set) (m1 : (Map A)) (m2 : (Map B)) (m′2 : (Map B))

(eqmap B m2 m′2 ) →

(eqmap A (MapDomRestrBy A B m1 m2 ) (MapDomRestrBy A B m1 m′2 )). Lemma MapDomRestrBy m m : (A :Set) (m : (Map A))

(eqmap A (MapDomRestrBy A unit m (MapDom A m)) (M0 A)). Lemma FSetDelta assoc : (s, s′, s′′ : FSet)

(eqmap unit (MapDelta ? (MapDelta ? s s′) s′′) (MapDelta ? s (MapDelta ? s′ s′′))). Lemma FSet ext : (s, s′ : FSet) ((a : ad) (in FSet a s) = (in FSet a s′)) → (eqmap unit s s′). Lemma FSetUnion comm : (s, s′ : FSet) (eqmap unit (FSetUnion s s′) (FSetUnion s′ s)). Lemma FSetUnion assoc : (s, s′, s′′ : FSet) (eqmap unit

(FSetUnion (FSetUnion s s′) s′′) (FSetUnion s (FSetUnion s′ s′′))). Lemma FSetUnion M0 s : (s : FSet) (eqmap unit (FSetUnion (M0 unit) s) s). Lemma FSetUnion s M0 : (s : FSet) (eqmap unit (FSetUnion s (M0 unit)) s). Lemma FSetUnion idempotent : (s : FSet) (eqmap unit (FSetUnion s s) s). Lemma FSetInter comm : (s, s′ : FSet) (eqmap unit (FSetInter s s′) (FSetInter s′ s)). Lemma FSetInter assoc : (s, s′, s′′ : FSet) (eqmap unit

(FSetInter (FSetInter s s′) s′′) (FSetInter s (FSetInter s′ s′′))). Lemma FSetInter M0 s : (s : FSet) (eqmap unit (FSetInter (M0 unit) s) (M0 unit)). Lemma FSetInter s M0 : (s : FSet) (eqmap unit (FSetInter s (M0 unit)) (M0 unit)). Lemma FSetInter idempotent : (s : FSet) (eqmap unit (FSetInter s s) s).

Lemma FSetUnion Inter l : (s, s′, s′′ : FSet) (eqmap unit (FSetUnion (FSetInter s s′) s′′) (FSetInter (FSetUnion s s′′) (FSetUnion s′ s′′))).

Lemma FSetUnion Inter r : (s, s′, s′′ : FSet) (eqmap unit (FSetUnion s (FSetInter s′ s′′)) (FSetInter (FSetUnion s s′) (FSetUnion s s′′))).

Lemma FSetInter Union l : (s, s′, s′′ : FSet) (eqmap unit (FSetInter (FSetUnion s s′) s′′) (FSetUnion (FSetInter s s′′) (FSetInter s′ s′′))).

Lemma FSetInter Union r : (s, s′, s′′ : FSet) (eqmap unit (FSetInter s (FSetUnion s′ s′′)) (FSetUnion (FSetInter s s′) (FSetInter s s′′))).

Module Mapiter

Require Bool. Require Sumbool. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require Mapaxioms. Require Fset. Require PolyList.

Section MapIter.

Variable A : Set.

Section MapSweepDef .

Variable f : ad → A → bool.

Definition MapSweep2 := [a0 : ad; y : A] if (f a0 y) then (SOME ? (a0 , y)) else (NONE ?).

Fixpoint MapSweep1 [pf : ad → ad; m : (Map A)] : (option (ad × A)) :=

Cases m of

M0 ⇒ (NONE ?) | (M1 a y) ⇒ (MapSweep2 (pf a) y) | (M2 m m′) ⇒ Cases (MapSweep1 ([a : ad] (pf (ad double a))) m) of (SOME r) ⇒ (SOME ? r)

| NONE ⇒ (MapSweep1 ([a : ad] (pf (ad double plus un a))) m′) end

end.

Definition MapSweep := [m : (Map A)] (MapSweep1 ([a : ad] a) m).

Lemma MapSweep semantics 1 1 : (m : (Map A)) (pf : ad → ad) (a : ad) (y : A) (MapSweep1 pf m) = (SOME ? (a, y)) → (f a y) = true.

Lemma MapSweep semantics 1 : (m : (Map A)) (a : ad) (y : A)

(MapSweep m) = (SOME ? (a, y)) → (f a y) = true.

Lemma MapSweep semantics 2 1 : (m : (Map A)) (pf : ad → ad) (a : ad) (y : A)

(MapSweep1 pf m) = (SOME ? (a, y)) → {a′ : ad | a = (pf a′)}.

Lemma MapSweep semantics 2 2 : (m : (Map A))

(pf , fp : ad → ad) ((a0 : ad) (fp (pf a0 )) = a0 ) → (a : ad) (y : A)

(MapSweep1 pf m) = (SOME ? (a, y)) → (MapGet A m (fp a)) = (SOME ? y).

Lemma MapSweep semantics 2 : (m : (Map A)) (a : ad) (y : A)

(MapSweep m) = (SOME ? (a, y)) → (MapGet A m a) = (SOME ? y).

Lemma MapSweep semantics 3 1 : (m : (Map A)) (pf : ad → ad)

(MapSweep1 pf m) = (NONE ?) → (a : ad) (y : A) (MapGet A m a) = (SOME ? y) → (f (pf a) y) = false.

Lemma MapSweep semantics 3 : (m : (Map A))

(MapSweep m) = (NONE ?) → (a : ad) (y : A) (MapGet A m a) = (SOME ? y) → (f a y) = false.

Lemma MapSweep semantics 4 1 : (m : (Map A)) (pf : ad → ad) (a : ad) (y : A)

(MapGet A m a) = (SOME A y) → (f (pf a) y) = true → {a′ : ad & {y′ : A | (MapSweep1 pf m) = (SOME ? (a′, y′))}}.

Lemma MapSweep semantics 4 : (m : (Map A)) (a : ad) (y : A)

(MapGet A m a) = (SOME A y) → (f a y) = true → {a′ : ad & {y′ : A | (MapSweep m) = (SOME ? (a′, y′))}}.

End MapSweepDef .

Variable B : Set.

Fixpoint MapCollect1 [f : ad → A → (Map B); pf : ad → ad; m : (Map A)] : (Map B) :=

Cases m of

M0 ⇒ (M0 B) | (M1 a y) ⇒ (f (pf a) y) | (M2 m1 m2 ) ⇒ (MapMerge B (MapCollect1 f [a0 : ad] (pf (ad double a0 )) m1 )

(MapCollect1 f [a0 : ad] (pf (ad double plus un a0 )) m2 ))

end.

Definition MapCollect := [f : ad → A → (Map B); m : (Map A)] (MapCollect1 f [a : ad]a m).

Section MapFoldDef .

Variable M : Set.

Variable neutral : M .

Variable op : M → M → M .

Fixpoint MapFold1 [f : ad → A → M ; pf : ad → ad; m : (Map A)] : M :=

Cases m of

M0 ⇒ neutral | (M1 a y) ⇒ (f (pf a) y) | (M2 m1 m2 ) ⇒ (op (MapFold1 f [a0 : ad] (pf (ad double a0 )) m1 )

(MapFold1 f [a0 : ad] (pf (ad double plus un a0 )) m2 ))

end.

Definition MapFold := [f : ad → A → M ; m : (Map A)] (MapFold1 f [a : ad]a m).

Lemma MapFold empty : (f : ad → A → M ) (MapFold f (M0 A)) = neutral.

Lemma MapFold M1 : (f : ad → A → M ) (a : ad) (y : A) (MapFold f (M1 A a y)) = (f a y).

Variable State : Set.

Variable f : State → ad → A → State × M .

Fixpoint MapFold1 state [state:State; pf : ad → ad; m : (Map A)]

: State × M :=

Cases m of

M0 ⇒ (state, neutral) | (M1 a y) ⇒ (f state (pf a) y) | (M2 m1 m2 ) ⇒

Cases (MapFold1 state state [a0 : ad] (pf (ad double a0 )) m1 ) of (state1 , x1 ) ⇒ Cases (MapFold1 state state1 [a0 : ad] (pf (ad double plus un a0 )) m2 ) of

(state2 , x2 ) ⇒ (state2 , (op x1 x2 )) end

end end.

Definition MapFold state := [state:State] (MapFold1 state state [a : ad]a).

Lemma pair sp : (B, C :Set) (x : B × C ) x = (Fst x, Snd x).

Lemma MapFold state stateless 1 : (m : (Map A)) (g : ad → A → M ) (pf : ad → ad)

((state:State) (a : ad) (y : A) (Snd (f state a y)) = (g a y)) →

(state:State)

(Snd (MapFold1 state state pf m)) = (MapFold1 g pf m).

Lemma MapFold state stateless : (g : ad → A → M )

((state:State) (a : ad) (y : A) (Snd (f state a y)) = (g a y)) →

(state:State) (m : (Map A))

(Snd (MapFold state state m)) = (MapFold g m).

End MapFoldDef .

Lemma MapCollect as Fold : (f : ad → A → (Map B)) (m : (Map A))

(MapCollect f m) = (MapFold (Map B) (M0 B) (MapMerge B) f m).

Definition alist := (list (ad × A)).

Definition anil := (nil (ad × A)).

Definition acons := (!cons (ad × A)).

Definition aapp := (!app (ad × A)).

Definition alist of Map := (MapFold alist anil aapp [a : ad; y : A] (acons (pair ? ? a y) anil)).

Fixpoint alist semantics [l : alist] : ad → (option A) :=

Cases l of

nil ⇒ [ : ad] (NONE A) | (cons (a, y) l′) ⇒ [a0 : ad] if (ad eq a a0 ) then (SOME A y) else (alist semantics l′ a0 )

end.

Lemma alist semantics app : (l, l′ : alist) (a : ad)

(alist semantics (aapp l l′) a) = (Cases (alist semantics l a) of

NONE ⇒ (alist semantics l′ a) | (SOME y) ⇒ (SOME A y)

end).

Lemma alist of Map semantics 1 1 : (m : (Map A)) (pf : ad → ad) (a : ad) (y : A) (alist semantics (MapFold1 alist anil aapp [a0 : ad][y : A](acons (a0 , y) anil) pf m) a) =(SOME A y) → {a′ : ad | a = (pf a′)}.

Definition ad inj := [pf : ad → ad] (a0 , a1 : ad) (pf a0 ) = (pf a1 ) → a0 = a1 .

Lemma ad comp double inj : (pf : ad → ad) (ad inj pf ) → (ad inj [a0 : ad] (pf (ad double a0 ))).

Lemma ad comp double plus un inj : (pf : ad → ad) (ad inj pf ) → (ad inj [a0 : ad] (pf (ad double plus un a0 ))).

Lemma alist of Map semantics 1 : (m : (Map A)) (pf : ad → ad) (ad inj pf ) →

(a : ad) (MapGet A m a) = (alist semantics (MapFold1 alist anil aapp

[a0 : ad; y : A] (acons (pair ? ? a0 y) anil) pf m)

(pf a)).

Lemma alist of Map semantics : (m : (Map A))

(eqm A (MapGet A m) (alist semantics (alist of Map m))).

Fixpoint Map of alist [l : alist] : (Map A) :=

Cases l of

nil ⇒ (M0 A) | (cons (a, y) l′) ⇒ (MapPut A (Map of alist l′) a y)

end.

Lemma Map of alist semantics : (l : alist)

(eqm A (alist semantics l) (MapGet A (Map of alist l))).

Lemma Map of alist of Map : (m : (Map A)) (eqmap A (Map of alist (alist of Map m)) m).

Lemma alist of Map of alist : (l : alist)

(eqm A (alist semantics (alist of Map (Map of alist l))) (alist semantics l)).

Lemma fold right aapp : (M :Set) (neutral : M ) (op : M → M → M )

((a, b, c : M ) (op (op a b) c) = (op a (op b c))) →

((a : M ) (op neutral a) = a) → (f : ad → A → M ) (l, l′ : alist)

(fold right [r : ad × A][m : M ] let (a, y) = r in (op (f a y) m) neutral

(aapp l l′)) =

(op (fold right [r : ad × A][m : M ] let (a, y) = r in (op (f a y) m) neutral l)

(fold right [r : ad × A][m : M ] let (a, y) = r in (op (f a y) m) neutral l′))

.

Lemma MapFold as fold 1 : (M :Set) (neutral : M ) (op : M → M → M )

((a, b, c : M ) (op (op a b) c) = (op a (op b c))) →

((a : M ) (op neutral a) = a) → ((a : M ) (op a neutral) = a) →

(f : ad → A → M ) (m : (Map A)) (pf : ad → ad)

(MapFold1 M neutral op f pf m) =

(fold right [r : (ad × A)][m : M ] let (a, y) = r in (op (f a y) m) neutral

(MapFold1 alist anil aapp [a : ad; y : A] (acons (pair ? ?

a y) anil) pf m)).

Lemma MapFold as fold : (M :Set) (neutral : M ) (op : M → M → M )

((a, b, c : M ) (op (op a b) c) = (op a (op b c))) →

((a : M ) (op neutral a) = a) → ((a : M ) (op a neutral) = a) →

(f : ad → A → M ) (m : (Map A)) (MapFold M neutral op f m) = (fold right [r : (ad × A)][m : M ] let (a, y) = r in (op (f a y) m) neutral

(alist of Map m)).

Lemma alist MapMerge semantics : (m, m′ : (Map A))

(eqm A (alist semantics (aapp (alist of Map m′) (alist of Map m))) (alist semantics (alist of Map (MapMerge A m m′)))).

Lemma alist MapMerge semantics disjoint : (m, m′ : (Map A))

(eqmap A (MapDomRestrTo A A m m′) (M0 A)) →

(eqm A (alist semantics (aapp (alist of Map m) (alist of Map m′))) (alist semantics (alist of Map (MapMerge A m m′)))).

Lemma alist semantics disjoint comm : (l, l′ : alist)

(eqmap A (MapDomRestrTo A A (Map of alist l) (Map of alist l′)) (M0 A)) → (eqm A (alist semantics (aapp l l′)) (alist semantics (aapp l′ l))).

End MapIter.

Module Lsort

Require Bool. Require Sumbool. Require Arith. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require PolyList. Require Mapiter.

Section LSort.

Variable A : Set.

Fixpoint ad less 1 [a, a′ : ad; p : positive] : bool :=

Cases p of

(xO p′) ⇒ (ad less 1 (ad div 2 a) (ad div 2 a′) p′) | ⇒ (andb (negb (ad bit 0 a)) (ad bit 0 a′))

end.

Definition ad less := [a, a′ : ad] Cases (ad xor a a′) of ad z ⇒ false

| (ad x p) ⇒ (ad less 1 a a′ p) end.

Lemma ad bit 0 less : (a, a′ : ad) (ad bit 0 a) = false → (ad bit 0 a′) = true → (ad less a a′) = true.

Lemma ad bit 0 gt : (a, a′ : ad) (ad bit 0 a) = true → (ad bit 0 a′) = false → (ad less a a′) = false.

Lemma ad less not refl : (a : ad) (ad less a a) = false.

Lemma ad ind double :

(a : ad)(P : ad → Prop) (P ad z) → ((a : ad) (P a) → (P (ad double a))) → ((a : ad) (P a) → (P (ad double plus un a))) → (P a).

Lemma ad rec double :

(a : ad)(P : ad → Set) (P ad z) → ((a : ad) (P a) → (P (ad double a))) → ((a : ad) (P a) → (P (ad double plus un a))) → (P a).

Lemma ad less def 1 : (a, a′ : ad) (ad less (ad double a) (ad double a′)) = (ad less a a′).

Lemma ad less def 2 : (a, a′ : ad)

(ad less (ad double plus un a) (ad double plus un a′)) = (ad less a a′).

Lemma ad less def 3 : (a, a′ : ad) (ad less (ad double a) (ad double plus un a′)) = true.

Lemma ad less def 4 : (a, a′ : ad) (ad less (ad double plus un a) (ad double a′)) = false.

Lemma ad less z : (a : ad) (ad less a ad z) = false.

Lemma ad z less 1 : (a : ad) (ad less ad z a) = true → {p : positive | a = (ad x p)}.

Lemma ad z less 2 : (a : ad) (ad less ad z a) = false → a = ad z.

Lemma ad less trans : (a, a′, a′′ : ad)

(ad less a a′) = true → (ad less a′ a′′) = true → (ad less a a′′) = true.

Fixpoint alist sorted [l : (alist A)] : bool :=

Cases l of

nil ⇒ true | (cons (a, ) l′) ⇒ Cases l′ of

nil ⇒ true | (cons (a′, y′) l′′) ⇒ (andb (ad less a a′)

(alist sorted l′))

end

end.

Fixpoint alist nth ad [n : nat; l : (alist A)] : ad :=

Cases l of

nil ⇒ ad z (∗ dummy ∗) | (cons (a, y) l′) ⇒ Cases n of

O ⇒ a | (S n′) ⇒ (alist nth ad n′ l′)

end

end. Definition alist sorted 1 := [l : (alist A)]

(n : nat) (le (S (S n)) (length l)) →

(ad less (alist nth ad n l) (alist nth ad (S n) l)) = true. Lemma alist sorted imp 1 : (l : (alist A)) (alist sorted l) = true → (alist sorted 1 l). Definition alist sorted 2 := [l : (alist A)]

(m, n : nat) (lt m n) → (le (S n) (length l)) →

(ad less (alist nth ad m l) (alist nth ad n l)) = true. Lemma alist sorted 1 imp 2 : (l : (alist A)) (alist sorted 1 l) → (alist sorted 2 l). Lemma alist sorted 2 imp : (l : (alist A)) (alist sorted 2 l) → (alist sorted l) = true. Lemma app length : (C :Set) (l, l′ : (list C )) (length (app l l′)) = (plus (length l) (length l′)). Lemma aapp length : (l, l′ : (alist A)) (length (aapp A l l′)) = (plus (length l) (length l′)). Lemma alist nth ad aapp 1 : (l, l′ : (alist A)) (n : nat)

(le (S n) (length l)) → (alist nth ad n (aapp A l l′)) = (alist nth ad n l). Lemma alist nth ad aapp 2 : (l, l′ : (alist A)) (n : nat)

(le (S n) (length l′)) →

(alist nth ad (plus (length l) n) (aapp A l l′)) = (alist nth ad n l′). Lemma interval split : (p, q, n : nat) (le (S n) (plus p q)) →

{n′ : nat | (le (S n′) q) ∧ n = (plus p n′)} + {(le (S n) p)}. Lemma alist conc sorted : (l, l′ : (alist A)) (alist sorted 2 l) → (alist sorted 2 l′) →

((n, n′ : nat) (le (S n) (length l)) → (le (S n′) (length l′)) →

(ad less (alist nth ad n l) (alist nth ad n′ l′)) = true) → (alist sorted 2 (aapp A l l′)).

Lemma alist nth ad semantics : (l : (alist A)) (n : nat) (le (S n) (length l)) →

{y : A | (alist semantics A l (alist nth ad n l)) = (SOME A y)}. Lemma alist of Map nth ad : (m : (Map A)) (pf : ad → ad)

(l : (alist A)) l = (MapFold1 A (alist A) (anil A) (aapp A)

[a0 : ad][y : A](acons A (a0 , y) (anil A)) pf m) →

(n : nat) (le (S n) (length l)) → {a′ : ad | (alist nth ad n l) = (pf a′)}. Definition ad monotonic := [pf : ad → ad] (a, a′ : ad)

(ad less a a′) = true → (ad less (pf a) (pf a′)) = true. Lemma ad double monotonic : (ad monotonic ad double). Lemma ad double plus un monotonic : (ad monotonic ad double plus un). Lemma ad comp monotonic : (pf , pf′ : ad → ad) (ad monotonic pf ) → (ad monotonic pf′) →

(ad monotonic [a0 : ad] (pf (pf′ a0 ))). Lemma ad comp double monotonic : (pf : ad → ad) (ad monotonic pf ) →

(ad monotonic [a0 : ad] (pf (ad double a0 ))). Lemma ad comp double plus un monotonic : (pf : ad → ad) (ad monotonic pf ) →

(ad monotonic [a0 : ad] (pf (ad double plus un a0 ))).

Lemma alist of Map sorts 1 : (m : (Map A)) (pf : ad → ad) (ad monotonic pf ) →

(alist sorted 2 (MapFold1 A (alist A) (anil A) (aapp A)

[a : ad][y : A](acons A (a, y) (anil A)) pf m)).

Lemma alist of Map sorts : (m : (Map A)) (alist sorted (alist of Map A m)) = true.

Lemma alist of Map sorts1 : (m : (Map A)) (alist sorted 1 (alist of Map A m)).

Lemma alist of Map sorts2 : (m : (Map A)) (alist sorted 2 (alist of Map A m)).

Lemma ad less total : (a, a′ : ad) {(ad less a a′) = true} + {(ad less a′ a) = true} + {a = a′}.

Lemma alist too low : (l : (alist A)) (a, a′ : ad) (y : A)

(ad less a a′) = true → (alist sorted 2 (cons (a′, y) l)) → (alist semantics A (cons (a′, y) l) a) = (NONE A).

Lemma alist semantics nth ad : (l : (alist A)) (a : ad) (y : A)

(alist semantics A l a) = (SOME A y) → {n : nat | (le (S n) (length l)) ∧ (alist nth ad n l) = a}.

Lemma alist semantics tail : (l : (alist A)) (a : ad) (y : A)

(alist sorted 2 (cons (a, y) l)) →

(eqm A (alist semantics A l) [a0 : ad] if (ad eq a a0 )

then (NONE A)

else (alist semantics A (cons (a, y) l) a0 )).

Lemma alist semantics same tail : (l, l′ : (alist A)) (a : ad) (y : A)

(alist sorted 2 (cons (a, y) l)) → (alist sorted 2 (cons (a, y) l′)) →

(eqm A (alist semantics A (cons (a, y) l)) (alist semantics A (cons (a, y) l′))) → (eqm A (alist semantics A l) (alist semantics A l′)).

Lemma alist sorted tail : (l : (alist A)) (a : ad) (y : A)

(alist sorted 2 (cons (a, y) l)) → (alist sorted 2 l).

Lemma alist canonical : (l, l′ : (alist A))

(eqm A (alist semantics A l) (alist semantics A l′)) → (alist sorted 2 l) → (alist sorted 2 l′) → l = l′.

End LSort.

Module Mapsubset

Require Bool. Require Sumbool. Require Arith. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require Fset. Require Mapaxioms. Require Mapiter.

Section MapSubsetDef . Variable A, B : Set. Definition MapSubset := [m : (Map A)] [m′ : (Map B)]

(a : ad) (in dom A a m) = true → (in dom B a m′) = true. Definition MapSubset 1 := [m : (Map A)] [m′ : (Map B)]

Cases (MapSweep A [a : ad][ : A] (negb (in dom B a m′)) m) of

NONE ⇒ true | ⇒ false

end. Definition MapSubset 2 := [m : (Map A)] [m′ : (Map B)] (eqmap A (MapDomRestrBy A B m m′) (M0 A)). Lemma MapSubset imp 1 : (m : (Map A)) (m′ : (Map B))

(MapSubset m m′) → (MapSubset 1 m m′) = true. Lemma MapSubset 1 imp : (m : (Map A)) (m′ : (Map B))

(MapSubset 1 m m′) = true → (MapSubset m m′). Lemma map dom empty 1 : (m : (Map A)) (eqmap A m (M0 A)) → (a : ad) (in dom ? a m) = false. Lemma map dom empty 2 : (m : (Map A)) ((a : ad) (in dom ? a m) = false) → (eqmap A m (M0 A)). Lemma MapSubset imp 2 : (m : (Map A)) (m′ : (Map B)) (MapSubset m m′) → (MapSubset 2 m m′). Lemma MapSubset 2 imp : (m : (Map A)) (m′ : (Map B)) (MapSubset 2 m m′) → (MapSubset m m′). End MapSubsetDef . Section MapSubsetOrder. Variable A, B, C : Set. Lemma MapSubset refl : (m : (Map A)) (MapSubset A A m m). Lemma MapSubset antisym : (m : (Map A)) (m′ : (Map B))

(MapSubset A B m m′) → (MapSubset B A m′ m) → (eqmap unit (MapDom A m) (MapDom B m′)). Lemma MapSubset trans : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(MapSubset A B m m′) → (MapSubset B C m′ m′′) → (MapSubset A C m m′′). End MapSubsetOrder. Section FSubsetOrder. Lemma FSubset refl : (s : FSet) (MapSubset ? ? s s). Lemma FSubset antisym : (s, s′ : FSet)

(MapSubset ? ? s s′) → (MapSubset ? ? s′ s) → (eqmap unit s s′). Lemma FSubset trans : (s, s′, s′′ : FSet)

(MapSubset ? ? s s′) → (MapSubset ? ? s′ s′′) → (MapSubset ? ? s s′′). End FSubsetOrder. Section MapSubsetExtra. Variable A, B : Set.

Lemma MapSubset Dom 1 : (m : (Map A)) (m′ : (Map B))

(MapSubset A B m m′) → (MapSubset unit unit (MapDom A m) (MapDom B m′)).

Lemma MapSubset Dom 2 : (m : (Map A)) (m′ : (Map B))

(MapSubset unit unit (MapDom A m) (MapDom B m′)) → (MapSubset A B m m′).

Lemma MapSubset 1 Dom : (m : (Map A)) (m′ : (Map B))

(MapSubset 1 A B m m′) = (MapSubset 1 unit unit (MapDom A m) (MapDom B m′)).

Lemma MapSubset Put : (m : (Map A)) (a : ad) (y : A) (MapSubset A A m (MapPut A m a y)).

Lemma MapSubset Put mono : (m : (Map A)) (m′ : (Map B)) (a : ad) (y : A) (y′ : B)

(MapSubset A B m m′) → (MapSubset A B (MapPut A m a y) (MapPut B m′ a y′)).

Lemma MapSubset Put behind : (m : (Map A)) (a : ad) (y : A) (MapSubset A A m (MapPut behind A m a y)).

Lemma MapSubset Put behind mono : (m : (Map A)) (m′ : (Map B)) (a : ad) (y : A) (y′ : B) (MapSubset A B m m′) → (MapSubset A B (MapPut behind A m a y) (MapPut behind B m′ a y′)).

Lemma MapSubset Remove : (m : (Map A)) (a : ad) (MapSubset A A (MapRemove A m a) m).

Lemma MapSubset Remove mono : (m : (Map A)) (m′ : (Map B)) (a : ad)

(MapSubset A B m m′) → (MapSubset A B (MapRemove A m a) (MapRemove B m′ a)).

Lemma MapSubset Merge l : (m, m′ : (Map A)) (MapSubset A A m (MapMerge A m m′)).

Lemma MapSubset Merge r : (m, m′ : (Map A)) (MapSubset A A m′ (MapMerge A m m′)).

Lemma MapSubset Merge mono : (m, m′ : (Map A)) (m′′, m′′′ : (Map B))

(MapSubset A B m m′′) → (MapSubset A B m′ m′′′) → (MapSubset A B (MapMerge A m m′) (MapMerge B m′′ m′′′)).

Lemma MapSubset DomRestrTo l : (m : (Map A)) (m′ : (Map B))

(MapSubset A A (MapDomRestrTo A B m m′) m).

Lemma MapSubset DomRestrTo r : (m : (Map A)) (m′ : (Map B))

(MapSubset A B (MapDomRestrTo A B m m′) m′).

Lemma MapSubset ext : (m0 , m1 : (Map A)) (m2 , m3 : (Map B))

(eqmap A m0 m1 ) → (eqmap B m2 m3 ) → (MapSubset A B m0 m2 ) → (MapSubset A B m1 m3 ).

Variable C , D : Set.

Lemma MapSubset DomRestrTo mono : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (m′′′ : (Map D))

(MapSubset ? ? m m′′) → (MapSubset ? ? m′ m′′′) → (MapSubset ? ? (MapDomRestrTo ? ? m m′) (MapDomRestrTo ? ? m′′ m′′′)).

Lemma MapSubset DomRestrBy l : (m : (Map A)) (m′ : (Map B))

(MapSubset A A (MapDomRestrBy A B m m′) m).

Lemma MapSubset DomRestrBy mono : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (m′′′ : (Map D))

(MapSubset ? ? m m′′) → (MapSubset ? ? m′′′ m′) → (MapSubset ? ? (MapDomRestrBy ? ? m m′) (MapDomRestrBy ? ? m′′ m′′′)).

End MapSubsetExtra.

Section MapDisjointDef . Variable A, B : Set. Definition MapDisjoint := [m : (Map A)] [m′ : (Map B)]

(a : ad) (in dom A a m) = true → (in dom B a m′) = true → False. Definition MapDisjoint 1 := [m : (Map A)] [m′ : (Map B)]

Cases (MapSweep A [a : ad][ : A] (in dom B a m′) m) of

NONE ⇒ true | ⇒ false

end. Definition MapDisjoint 2 := [m : (Map A)] [m′ : (Map B)] (eqmap A (MapDomRestrTo A B m m′) (M0 A)). Lemma MapDisjoint imp 1 : (m : (Map A)) (m′ : (Map B))

(MapDisjoint m m′) → (MapDisjoint 1 m m′) = true. Lemma MapDisjoint 1 imp : (m : (Map A)) (m′ : (Map B))

(MapDisjoint 1 m m′) = true → (MapDisjoint m m′). Lemma MapDisjoint imp 2 : (m : (Map A)) (m′ : (Map B)) (MapDisjoint m m′) → (MapDisjoint 2 m m′). Lemma MapDisjoint 2 imp : (m : (Map A)) (m′ : (Map B)) (MapDisjoint 2 m m′) → (MapDisjoint m m′). Lemma Map M0 disjoint : (m : (Map B)) (MapDisjoint (M0 A) m). Lemma Map disjoint M0 : (m : (Map A)) (MapDisjoint m (M0 B)). End MapDisjointDef . Section MapDisjointExtra. Variable A, B : Set. Lemma MapDisjoint ext : (m0 , m1 : (Map A)) (m2 , m3 : (Map B))

(eqmap A m0 m1 ) → (eqmap B m2 m3 ) → (MapDisjoint A B m0 m2 ) → (MapDisjoint A B m1 m3 ). Lemma MapMerge disjoint : (m, m′ : (Map A)) (MapDisjoint A A m m′) →

(a : ad) (in dom A a (MapMerge A m m′)) =

(orb (andb (in dom A a m) (negb (in dom A a m′)))

(andb (in dom A a m′) (negb (in dom A a m)))).

Lemma MapDisjoint M2 l : (m0 , m1 : (Map A)) (m2 , m3 : (Map B))

(MapDisjoint A B (M2 A m0 m1 ) (M2 B m2 m3 )) → (MapDisjoint A B m0 m2 ). Lemma MapDisjoint M2 r : (m0 , m1 : (Map A)) (m2 , m3 : (Map B))

(MapDisjoint A B (M2 A m0 m1 ) (M2 B m2 m3 )) → (MapDisjoint A B m1 m3 ). Lemma MapDisjoint M2 : (m0 , m1 : (Map A)) (m2 , m3 : (Map B))

(MapDisjoint A B m0 m2 ) → (MapDisjoint A B m1 m3 ) →

(MapDisjoint A B (M2 A m0 m1 ) (M2 B m2 m3 )). Lemma MapDisjoint M1 l : (m : (Map A)) (a : ad) (y : B)

(MapDisjoint B A (M1 B a y) m) → (in dom A a m) = false. Lemma MapDisjoint M1 r : (m : (Map A)) (a : ad) (y : B)

(MapDisjoint A B m (M1 B a y)) → (in dom A a m) = false.

Lemma MapDisjoint M1 conv l : (m : (Map A)) (a : ad) (y : B)

(in dom A a m) = false → (MapDisjoint B A (M1 B a y) m).

Lemma MapDisjoint M1 conv r : (m : (Map A)) (a : ad) (y : B)

(in dom A a m) = false → (MapDisjoint A B m (M1 B a y)).

Lemma MapDisjoint sym : (m : (Map A)) (m′ : (Map B))

(MapDisjoint A B m m′) → (MapDisjoint B A m′ m).

Lemma MapDisjoint empty : (m : (Map A)) (MapDisjoint A A m m) → (eqmap A m (M0 A)).

Lemma MapDelta disjoint : (m, m′ : (Map A)) (MapDisjoint A A m m′) → (eqmap A (MapDelta A m m′) (MapMerge A m m′)).

Variable C : Set.

Lemma MapDomRestr disjoint : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(MapDisjoint A B (MapDomRestrTo A C m m′′) (MapDomRestrBy B C m′ m′′)).

Lemma MapDelta RestrTo disjoint : (m, m′ : (Map A))

(MapDisjoint A A (MapDelta A m m′) (MapDomRestrTo A A m m′)).

Lemma MapDelta RestrTo disjoint 2 : (m, m′ : (Map A))

(MapDisjoint A A (MapDelta A m m′) (MapDomRestrTo A A m′ m)).

Variable D : Set.

Lemma MapSubset Disjoint : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (m′′′ : (Map D))

(MapSubset ? ? m m′) → (MapSubset ? ? m′′ m′′′) → (MapDisjoint ? ? m′ m′′′) → (MapDisjoint ? ? m m′′).

Lemma MapSubset Disjoint l : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(MapSubset ? ? m m′) → (MapDisjoint ? ? m′ m′′) → (MapDisjoint ? ? m m′′).

Lemma MapSubset Disjoint r : (m : (Map A)) (m′′ : (Map C )) (m′′′ : (Map D))

(MapSubset ? ? m′′ m′′′) → (MapDisjoint ? ? m m′′′) → (MapDisjoint ? ? m m′′).

End MapDisjointExtra.

Module Mapcard

Require Bool. Require Sumbool. Require Arith. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require Mapaxioms. Require Mapiter. Require Fset.

Require Mapsubset. Require PolyList. Require Lsort. Require Peano dec.

Section MapCard.

Variable A, B : Set.

Lemma MapCard M0 : (MapCard A (M0 A)) = O.

Lemma MapCard M1 : (a : ad) (y : A) (MapCard A (M1 A a y)) = (1).

Lemma MapCard is O : (m : (Map A)) (MapCard A m) = O → (a : ad) (MapGet A m a) = (NONE A).

Lemma MapCard is not O : (m : (Map A)) (a : ad) (y : A) (MapGet A m a) = (SOME A y) → {n : nat | (MapCard A m) = (S n)}.

Lemma MapCard is one : (m : (Map A)) (MapCard A m) = (1) → {a : ad & {y : A | (MapGet A m a) = (SOME A y)}}.

Lemma MapCard is one unique : (m : (Map A)) (MapCard A m) = (1) →

(a, a′ : ad) (y, y′ : A) (MapGet A m a) = (SOME A y) → (MapGet A m a′) = (SOME A y′) →

a = a′ ∧ y = y′.

Lemma length as fold : (C :Set) (l : (list C )) (length l) = (fold right [ : C ][n : nat](S n) O l).

Lemma length as fold 2 : (l : (alist A)) (length l) = (fold right [r : ad × A][n : nat]let (a, y) = r in (plus (1) n) O l).

Lemma MapCard as Fold 1 : (m : (Map A)) (pf : ad → ad)

(MapCard A m) = (MapFold1 A nat O plus [ : ad][ : A](1) pf m).

Lemma MapCard as Fold : (m : (Map A)) (MapCard A m) = (MapFold A nat O plus [ : ad][ : A](1) m).

Lemma MapCard as length : (m : (Map A)) (MapCard A m) = (length (alist of Map A m)).

Lemma MapCard Put1 equals 2 : (p : positive) (a, a′ : ad) (y, y′ : A)

(MapCard A (MapPut1 A a y a′ y′ p)) = (2).

Lemma MapCard Put sum : (m, m′ : (Map A)) (a : ad) (y : A) (n, n′ : nat)

m′ = (MapPut A m a y) → n = (MapCard A m) → n′ = (MapCard A m′) → {n′ = n} + {n′ = (S n)}.

Lemma MapCard Put lb : (m : (Map A)) (a : ad) (y : A)

(ge (MapCard A (MapPut A m a y)) (MapCard A m)).

Lemma MapCard Put ub : (m : (Map A)) (a : ad) (y : A)

(le (MapCard A (MapPut A m a y)) (S (MapCard A m))).

Lemma MapCard Put 1 : (m : (Map A)) (a : ad) (y : A)

(MapCard A (MapPut A m a y)) = (MapCard A m) → {y : A | (MapGet A m a) = (SOME A y)}.

Lemma MapCard Put 2 : (m : (Map A)) (a : ad) (y : A)

(MapCard A (MapPut A m a y)) = (S (MapCard A m)) → (MapGet A m a) = (NONE A).

Lemma MapCard Put 1 conv : (m : (Map A)) (a : ad) (y, y′ : A)

(MapGet A m a) = (SOME A y) → (MapCard A (MapPut A m a y′)) = (MapCard A m).

Lemma MapCard Put 2 conv : (m : (Map A)) (a : ad) (y : A)

(MapGet A m a) = (NONE A) → (MapCard A (MapPut A m a y)) = (S (MapCard A m)).

Lemma MapCard ext : (m, m′ : (Map A))

(eqm A (MapGet A m) (MapGet A m′)) → (MapCard A m) = (MapCard A m′).

Lemma MapCard Dom : (m : (Map A)) (MapCard A m) = (MapCard unit (MapDom A m)).

Lemma MapCard Dom Put behind : (m : (Map A)) (a : ad) (y : A)

(MapDom A (MapPut behind A m a y)) = (MapDom A (MapPut A m a y)).

Lemma MapCard Put behind Put : (m : (Map A)) (a : ad) (y : A)

(MapCard A (MapPut behind A m a y)) = (MapCard A (MapPut A m a y)).

Lemma MapCard Put behind sum : (m, m′ : (Map A)) (a : ad) (y : A) (n, n′ : nat)

m′ = (MapPut behind A m a y) → n = (MapCard A m) → n′ = (MapCard A m′) → {n′ = n} + {n′ = (S n)}.

Lemma MapCard makeM2 : (m, m′ : (Map A))

(MapCard A (makeM2 A m m′)) = (plus (MapCard A m) (MapCard A m′)).

Lemma MapCard Remove sum : (m, m′ : (Map A)) (a : ad) (n, n′ : nat)

m′ = (MapRemove A m a) → n = (MapCard A m) → n′ = (MapCard A m′) → {n = n′} + {n = (S n′)}.

Lemma MapCard Remove ub : (m : (Map A)) (a : ad)

(le (MapCard A (MapRemove A m a)) (MapCard A m)).

Lemma MapCard Remove lb : (m : (Map A)) (a : ad)

(ge (S (MapCard A (MapRemove A m a))) (MapCard A m)).

Lemma MapCard Remove 1 : (m : (Map A)) (a : ad)

(MapCard A (MapRemove A m a)) = (MapCard A m) → (MapGet A m a) = (NONE A).

Lemma MapCard Remove 2 : (m : (Map A)) (a : ad)

(S (MapCard A (MapRemove A m a))) = (MapCard A m) → {y : A | (MapGet A m a) = (SOME A y)}.

Lemma MapCard Remove 1 conv : (m : (Map A)) (a : ad)

(MapGet A m a) = (NONE A) → (MapCard A (MapRemove A m a)) = (MapCard A m).

Lemma MapCard Remove 2 conv : (m : (Map A)) (a : ad) (y : A)

(MapGet A m a) = (SOME A y) → (S (MapCard A (MapRemove A m a))) = (MapCard A m).

Lemma MapMerge Restr Card : (m, m′ : (Map A))

(plus (MapCard A m) (MapCard A m′)) =

(plus (MapCard A (MapMerge A m m′)) (MapCard A (MapDomRestrTo A A m m′))).

Lemma MapMerge disjoint Card : (m, m′ : (Map A)) (MapDisjoint A A m m′) → (MapCard A (MapMerge A m m′)) = (plus (MapCard A m) (MapCard A m′)).

Lemma MapSplit Card : (m : (Map A)) (m′ : (Map B))

(MapCard A m) = (plus (MapCard A (MapDomRestrTo A B m m′))

(MapCard A (MapDomRestrBy A B m m′))).

Lemma MapMerge Card ub : (m, m′ : (Map A))

(le (MapCard A (MapMerge A m m′)) (plus (MapCard A m) (MapCard A m′))). Lemma MapDomRestrTo Card ub l : (m : (Map A)) (m′ : (Map B))

(le (MapCard A (MapDomRestrTo A B m m′)) (MapCard A m)). Lemma MapDomRestrBy Card ub l : (m : (Map A)) (m′ : (Map B))

(le (MapCard A (MapDomRestrBy A B m m′)) (MapCard A m)). Lemma MapMerge Card disjoint : (m, m′ : (Map A))

(MapCard A (MapMerge A m m′)) = (plus (MapCard A m) (MapCard A m′)) →

(MapDisjoint A A m m′). Lemma MapCard is Sn : (m : (Map A)) (n : nat) (MapCard ? m) = (S n) → {a : ad | (in dom ? a m) = true}. End MapCard. Section MapCard2 . Variable A, B : Set. Lemma MapSubset card eq 1 : (n : nat) (m : (Map A)) (m′ : (Map B))

(MapSubset ? ? m m′) → (MapCard ? m) = n → (MapCard ? m′) = n →

(MapSubset ? ? m′ m). Lemma MapDomRestrTo Card ub r : (m : (Map A)) (m′ : (Map B))

(le (MapCard A (MapDomRestrTo A B m m′)) (MapCard B m′)). End MapCard2 . Section MapCard3 . Variable A, B : Set. Lemma MapMerge Card lb l : (m, m′ : (Map A))

(ge (MapCard A (MapMerge A m m′)) (MapCard A m)). Lemma MapMerge Card lb r : (m, m′ : (Map A))

(ge (MapCard A (MapMerge A m m′)) (MapCard A m′)). Lemma MapDomRestrBy Card lb : (m : (Map A)) (m′ : (Map B))

(ge (plus (MapCard B m′) (MapCard A (MapDomRestrBy A B m m′))) (MapCard A m)). Lemma MapSubset Card le : (m : (Map A)) (m′ : (Map B))

(MapSubset A B m m′) → (le (MapCard A m) (MapCard B m′)). Lemma MapSubset card eq : (m : (Map A)) (m′ : (Map B))

(MapSubset ? ? m m′) → (le (MapCard ? m′) (MapCard ? m)) →

(eqmap ? (MapDom ? m) (MapDom ? m′)). End MapCard3 .

Module Mapcanon

Require Bool. Require Sumbool. Require Arith. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require Mapaxioms. Require Mapiter. Require Fset. Require PolyList. Require Lsort. Require Mapsubset. Require Mapcard.

Section MapCanon.

Variable A : Set.

Inductive mapcanon : (Map A) → Prop :=

M0 canon : (mapcanon (M0 A)) | M1 canon : (a : ad) (y : A) (mapcanon (M1 A a y)) | M2 canon : (m1 , m2 : (Map A)) (mapcanon m1 ) → (mapcanon m2 ) → (le (2) (MapCard A (M2 A m1 m2 ))) → (mapcanon (M2 A m1 m2 )).

Lemma mapcanon M2 : (m1 , m2 : (Map A)) (mapcanon (M2 A m1 m2 )) → (le (2) (MapCard A (M2 A m1 m2 ))).

Lemma mapcanon M2 1 : (m1 , m2 : (Map A)) (mapcanon (M2 A m1 m2 )) → (mapcanon m1 ).

Lemma mapcanon M2 2 : (m1 , m2 : (Map A)) (mapcanon (M2 A m1 m2 )) → (mapcanon m2 ).

Lemma M2 eqmap 1 : (m0 , m1 , m2 , m3 : (Map A)) (eqmap A (M2 A m0 m1 ) (M2 A m2 m3 )) → (eqmap A m0 m2 ).

Lemma M2 eqmap 2 : (m0 , m1 , m2 , m3 : (Map A)) (eqmap A (M2 A m0 m1 ) (M2 A m2 m3 )) → (eqmap A m1 m3 ).

Lemma mapcanon unique : (m, m′ : (Map A)) (mapcanon m) → (mapcanon m′) → (eqmap A m m′) → m = m′.

Lemma MapPut1 canon : (p : positive) (a, a′ : ad) (y, y′ : A) (mapcanon (MapPut1 A a y a′ y′ p)).

Lemma MapPut canon : (m : (Map A)) (mapcanon m) → (a : ad) (y : A) (mapcanon (MapPut A m a y)).

Lemma MapPut behind canon : (m : (Map A)) (mapcanon m) → (a : ad) (y : A) (mapcanon (MapPut behind A m a y)).

Lemma makeM2 canon : (m, m′ : (Map A)) (mapcanon m) → (mapcanon m′) → (mapcanon (makeM2 A m m′)).

Fixpoint MapCanonicalize [m : (Map A)] : (Map A) :=

Cases m of

(M2 m0 m1 ) ⇒ (makeM2 A (MapCanonicalize m0 ) (MapCanonicalize m1 )) | ⇒ m

end. Lemma mapcanon exists 1 : (m : (Map A)) (eqmap A m (MapCanonicalize m)). Lemma mapcanon exists 2 : (m : (Map A)) (mapcanon (MapCanonicalize m)). Lemma mapcanon exists : (m : (Map A)) {m′ : (Map A) | (eqmap A m m′) ∧ (mapcanon m′)}. Lemma MapRemove canon : (m : (Map A)) (mapcanon m) → (a : ad) (mapcanon (MapRemove A m a)). Lemma MapMerge canon : (m, m′ : (Map A)) (mapcanon m) → (mapcanon m′) →

(mapcanon (MapMerge A m m′)). Lemma MapDelta canon : (m, m′ : (Map A)) (mapcanon m) → (mapcanon m′) →

(mapcanon (MapDelta A m m′)). Variable B : Set. Lemma MapDomRestrTo canon : (m : (Map A)) (mapcanon m) →

(m′ : (Map B)) (mapcanon (MapDomRestrTo A B m m′)). Lemma MapDomRestrBy canon : (m : (Map A)) (mapcanon m) →

(m′ : (Map B)) (mapcanon (MapDomRestrBy A B m m′)). Lemma Map of alist canon : (l : (alist A)) (mapcanon (Map of alist A l)). Lemma MapSubset c 1 : (m : (Map A)) (m′ : (Map B)) (mapcanon m) →

(MapSubset A B m m′) → (MapDomRestrBy A B m m′) = (M0 A). Lemma MapSubset c 2 : (m : (Map A)) (m′ : (Map B))

(MapDomRestrBy A B m m′) = (M0 A) → (MapSubset A B m m′). End MapCanon. Section FSetCanon. Variable A : Set. Lemma MapDom canon : (m : (Map A)) (mapcanon A m) → (mapcanon unit (MapDom A m)). End FSetCanon. Section MapFoldCanon. Variable A, B : Set. Lemma MapFold canon 1 : (m0 : (Map B)) (mapcanon B m0 ) →

(op : (Map B) → (Map B) → (Map B))

((m1 : (Map B)) (mapcanon B m1 ) → (m2 : (Map B)) (mapcanon B m2 ) →

(mapcanon B (op m1 m2 ))) → (f : ad → A → (Map B)) ((a : ad) (y : A) (mapcanon B (f a y))) →

(m : (Map A)) (pf : ad → ad) (mapcanon B (MapFold1 A (Map B) m0 op f pf m)). Lemma MapFold canon : (m0 : (Map B)) (mapcanon B m0 ) →

(op : (Map B) → (Map B) → (Map B))

((m1 : (Map B)) (mapcanon B m1 ) → (m2 : (Map B)) (mapcanon B m2 ) →

(mapcanon B (op m1 m2 ))) → (f : ad → A → (Map B)) ((a : ad) (y : A) (mapcanon B (f a y))) → (m : (Map A)) (mapcanon B (MapFold A (Map B) m0 op f m)).

Lemma MapCollect canon : (f : ad → A → (Map B)) ((a : ad) (y : A) (mapcanon B (f a y))) → (m : (Map A)) (mapcanon B (MapCollect A B f m)).

End MapFoldCanon.

Module Mapc

Require Bool. Require Sumbool. Require Arith. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require Mapaxioms. Require Fset. Require Mapiter. Require Mapsubset. Require PolyList. Require Lsort. Require Mapcard. Require Mapcanon.

Section MapC .

Variable A, B, C : Set.

Lemma MapPut as Merge c : (m : (Map A)) (mapcanon A m) → (a : ad) (y : A) (MapPut A m a y) = (MapMerge A m (M1 A a y)).

Lemma MapPut behind as Merge c : (m : (Map A)) (mapcanon A m) → (a : ad) (y : A) (MapPut behind A m a y) = (MapMerge A (M1 A a y) m).

Lemma MapMerge empty m c : (m : (Map A)) (MapMerge A (M0 A) m) = m.

Lemma MapMerge assoc c : (m, m′, m′′ : (Map A))

(mapcanon A m) → (mapcanon A m′) → (mapcanon A m′′) → (MapMerge A (MapMerge A m m′) m′′) = (MapMerge A m (MapMerge A m′ m′′)).

Lemma MapMerge idempotent c : (m : (Map A)) (mapcanon A m) → (MapMerge A m m) = m.

Lemma MapMerge RestrTo l c : (m, m′, m′′ : (Map A)) (mapcanon A m) → (mapcanon A m′′) →

(MapMerge A (MapDomRestrTo A A m m′) m′′)

=(MapDomRestrTo A A (MapMerge A m m′′) (MapMerge A m′ m′′)).

Lemma MapRemove as RestrBy c : (m : (Map A)) (mapcanon A m) → (a : ad) (y : B) (MapRemove A m a) = (MapDomRestrBy A B m (M1 B a y)).

Lemma MapDomRestrTo assoc c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C ))

(mapcanon A m) → (MapDomRestrTo A C (MapDomRestrTo A B m m′) m′′) =

(MapDomRestrTo A B m (MapDomRestrTo B C m′ m′′)).

Lemma MapDomRestrTo idempotent c : (m : (Map A)) (mapcanon A m) → (MapDomRestrTo A A m m) = m.

Lemma MapDomRestrTo Dom c : (m : (Map A)) (m′ : (Map B)) (mapcanon A m) → (MapDomRestrTo A B m m′) = (MapDomRestrTo A unit m (MapDom B m′)).

Lemma MapDomRestrBy Dom c : (m : (Map A)) (m′ : (Map B)) (mapcanon A m) → (MapDomRestrBy A B m m′) = (MapDomRestrBy A unit m (MapDom B m′)).

Lemma MapDomRestrBy By c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map B)) (mapcanon A m) →

(MapDomRestrBy A B (MapDomRestrBy A B m m′) m′′) = (MapDomRestrBy A B m (MapMerge B m′ m′′)).

Lemma MapDomRestrBy By comm c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (mapcanon A m) →

(MapDomRestrBy A C (MapDomRestrBy A B m m′) m′′) = (MapDomRestrBy A B (MapDomRestrBy A C m m′′) m′).

Lemma MapDomRestrBy To c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (mapcanon A m) →

(MapDomRestrBy A C (MapDomRestrTo A B m m′) m′′) = (MapDomRestrTo A B m (MapDomRestrBy B C m′ m′′)).

Lemma MapDomRestrBy To comm c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (mapcanon A m) →

(MapDomRestrBy A C (MapDomRestrTo A B m m′) m′′) = (MapDomRestrTo A B (MapDomRestrBy A C m m′′) m′).

Lemma MapDomRestrTo By c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (mapcanon A m) →

(MapDomRestrTo A C (MapDomRestrBy A B m m′) m′′) = (MapDomRestrTo A C m (MapDomRestrBy C B m′′ m′)).

Lemma MapDomRestrTo By comm c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (mapcanon A m) →

(MapDomRestrTo A C (MapDomRestrBy A B m m′) m′′) = (MapDomRestrBy A B (MapDomRestrTo A C m m′′) m′).

Lemma MapDomRestrTo To comm c : (m : (Map A)) (m′ : (Map B)) (m′′ : (Map C )) (mapcanon A m) →

(MapDomRestrTo A C (MapDomRestrTo A B m m′) m′′) = (MapDomRestrTo A B (MapDomRestrTo A C m m′′) m′).

Lemma MapMerge DomRestrTo c : (m, m′ : (Map A)) (m′′ : (Map B))

(mapcanon A m) → (mapcanon A m′) → (MapDomRestrTo A B (MapMerge A m m′) m′′) = (MapMerge A (MapDomRestrTo A B m m′′) (MapDomRestrTo A B m′ m′′)).

Lemma MapMerge DomRestrBy c : (m, m′ : (Map A)) (m′′ : (Map B))

(mapcanon A m) → (mapcanon A m′) → (MapDomRestrBy A B (MapMerge A m m′) m′′) =

(MapMerge A (MapDomRestrBy A B m m′′) (MapDomRestrBy A B m′ m′′)).

Lemma MapDelta nilpotent c : (m : (Map A)) (mapcanon A m) → (MapDelta A m m) = (M0 A).

Lemma MapDelta as Merge c : (m, m′ : (Map A))

(mapcanon A m) → (mapcanon A m′) → (MapDelta A m m′) = (MapMerge A (MapDomRestrBy A A m m′) (MapDomRestrBy A A m′ m)).

Lemma MapDelta as DomRestrBy c : (m, m′ : (Map A))

(mapcanon A m) → (mapcanon A m′) → (MapDelta A m m′) = (MapDomRestrBy A A (MapMerge A m m′) (MapDomRestrTo A A m m′)).

Lemma MapDelta as DomRestrBy 2 c : (m, m′ : (Map A))

(mapcanon A m) → (mapcanon A m′) → (MapDelta A m m′) = (MapDomRestrBy A A (MapMerge A m m′) (MapDomRestrTo A A m′ m)).

Lemma MapDelta sym c : (m, m′ : (Map A))

(mapcanon A m) → (mapcanon A m′) → (MapDelta A m m′) = (MapDelta A m′ m).

Lemma MapDom Split 1 c : (m : (Map A)) (m′ : (Map B)) (mapcanon A m) → m = (MapMerge A (MapDomRestrTo A B m m′) (MapDomRestrBy A B m m′)).

Lemma MapDom Split 2 c : (m : (Map A)) (m′ : (Map B)) (mapcanon A m) → m = (MapMerge A (MapDomRestrBy A B m m′) (MapDomRestrTo A B m m′)).

Lemma MapDom Split 3 c : (m : (Map A)) (m′ : (Map B)) (mapcanon A m) →

(MapDomRestrTo A A (MapDomRestrTo A B m m′) (MapDomRestrBy A B m m′)) = (M0 A).

Lemma Map of alist of Map c : (m : (Map A)) (mapcanon A m) → (Map of alist A (alist of Map A m)) = m.

Lemma alist of Map of alist c : (l : (alist A)) (alist sorted 2 A l) → (alist of Map A (Map of alist A l)) = l.

Lemma MapSubset antisym c : (m : (Map A)) (m′ : (Map B))

(mapcanon A m) → (mapcanon B m′) →

(MapSubset A B m m′) → (MapSubset B A m′ m) → (MapDom A m) = (MapDom B m′).

Lemma FSubset antisym c : (s, s′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → (MapSubset ? ? s s′) → (MapSubset ? ? s′ s) → s = s′.

Lemma MapDisjoint empty c : (m : (Map A)) (mapcanon A m) → (MapDisjoint A A m m) → m = (M0 A).

Lemma MapDelta disjoint c : (m, m′ : (Map A)) (mapcanon A m) → (mapcanon A m′) → (MapDisjoint A A m m′) → (MapDelta A m m′) = (MapMerge A m m′).

End MapC .

Lemma FSetDelta assoc c : (s, s′, s′′ : FSet)

(mapcanon unit s) → (mapcanon unit s′) → (mapcanon unit s′′) → (MapDelta ? (MapDelta ? s s′) s′′) = (MapDelta ? s (MapDelta ? s′ s′′)).

Lemma FSet ext c : (s, s′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → ((a : ad) (in FSet a s) = (in FSet a s′)) → s = s′.

Lemma FSetUnion comm c : (s, s′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → (FSetUnion s s′) = (FSetUnion s′ s).

Lemma FSetUnion assoc c : (s, s′, s′′ : FSet)

(mapcanon unit s) → (mapcanon unit s′) → (mapcanon unit s′′) → (FSetUnion (FSetUnion s s′) s′′) = (FSetUnion s (FSetUnion s′ s′′)).

Lemma FSetUnion M0 s c : (s : FSet) (FSetUnion (M0 unit) s) = s.

Lemma FSetUnion s M0 c : (s : FSet) (FSetUnion s (M0 unit)) = s.

Lemma FSetUnion idempotent : (s : FSet) (mapcanon unit s) → (FSetUnion s s) = s.

Lemma FSetInter comm c : (s, s′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → (FSetInter s s′) = (FSetInter s′ s).

Lemma FSetInter assoc c : (s, s′, s′′ : FSet)

(mapcanon unit s) → (FSetInter (FSetInter s s′) s′′) = (FSetInter s (FSetInter s′ s′′)).

Lemma FSetInter M0 s c : (s : FSet) (FSetInter (M0 unit) s) = (M0 unit).

Lemma FSetInter s M0 c : (s : FSet) (FSetInter s (M0 unit)) = (M0 unit).

Lemma FSetInter idempotent : (s : FSet) (mapcanon unit s) → (FSetInter s s) = s.

Lemma FSetUnion Inter l c : (s, s′, s′′ : FSet) (mapcanon unit s) → (mapcanon unit s′′) → (FSetUnion (FSetInter s s′) s′′) = (FSetInter (FSetUnion s s′′) (FSetUnion s′ s′′)).

Lemma FSetUnion Inter r : (s, s′, s′′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → (FSetUnion s (FSetInter s′ s′′)) = (FSetInter (FSetUnion s s′) (FSetUnion s s′′)).

Lemma FSetInter Union l c : (s, s′, s′′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → (FSetInter (FSetUnion s s′) s′′) = (FSetUnion (FSetInter s s′′) (FSetInter s′ s′′)).

Lemma FSetInter Union r : (s, s′, s′′ : FSet) (mapcanon unit s) → (mapcanon unit s′) → (FSetInter s (FSetUnion s′ s′′)) = (FSetUnion (FSetInter s s′) (FSetInter s s′′)).

Module Mapfold

Require Bool. Require Sumbool. Require ZArith. Require Addr. Require Adist. Require Addec. Require Map. Require Fset. Require Mapaxioms. Require Mapiter. Require Lsort. Require Mapsubset. Require PolyList.

Section MapFoldResults.

Variable A : Set.

Variable M : Set.

Variable neutral : M .

Variable op : M → M → M .

Variable nleft : (a : M ) (op neutral a) = a.

Variable nright : (a : M ) (op a neutral) = a.

Variable assoc : (a, b, c : M ) (op (op a b) c) = (op a (op b c)).

Lemma MapFold ext : (f : ad → A → M ) (m, m′ : (Map A)) (eqmap A m m′) → (MapFold ? ? neutral op f m) = (MapFold ? ? neutral op f m′).

Lemma MapFold ext f 1 : (m : (Map A)) (f , g : ad → A → M ) (pf : ad → ad)

((a : ad) (y : A) (MapGet ? m a) = (SOME ? y) → (f (pf a) y) = (g (pf a) y)) → (MapFold1 ? ? neutral op f pf m) = (MapFold1 ? ? neutral op g pf m).

Lemma MapFold ext f : (f , g : ad → A → M ) (m : (Map A))

((a : ad) (y : A) (MapGet ? m a) = (SOME ? y) → (f a y) = (g a y)) → (MapFold ? ? neutral op f m) = (MapFold ? ? neutral op g m).

Lemma MapFold1 as Fold 1 : (m : (Map A)) (f , f′ : ad → A → M ) (pf , pf′ : ad → ad)

((a : ad) (y : A) (f (pf a) y) = (f′ (pf′ a) y)) → (MapFold1 ? ? neutral op f pf m) = (MapFold1 ? ? neutral op f′ pf′ m).

Lemma MapFold1 as Fold : (f : ad → A → M ) (pf : ad → ad) (m : (Map A))

(MapFold1 ? ? neutral op f pf m) = (MapFold ? ? neutral op [a : ad][y : A] (f (pf a) y) m).

Lemma MapFold1 ext : (f : ad → A → M ) (m, m′ : (Map A)) (eqmap A m m′) → (pf : ad → ad) (MapFold1 ? ? neutral op f pf m) = (MapFold1 ? ? neutral op f pf m′).

Variable comm : (a, b : M ) (op a b) = (op b a).

Lemma MapFold Put disjoint 1 : (p : positive)

(f : ad → A → M ) (pf : ad → ad) (a1 , a2 : ad) (y1 , y2 : A) (ad xor a1 a2 ) = (ad x p) →

(MapFold1 A M neutral op f pf (MapPut1 A a1 y1 a2 y2 p)) =

(op (f (pf a1 ) y1 ) (f (pf a2 ) y2 )).

Lemma MapFold Put disjoint 2 :

(f : ad → A → M ) (m : (Map A)) (a : ad) (y : A) (pf : ad → ad)

(MapGet A m a) = (NONE A) → (MapFold1 A M neutral op f pf (MapPut A m a y)) = (op (f (pf a) y) (MapFold1 A M neutral op f pf m)).

Lemma MapFold Put disjoint :

(f : ad → A → M ) (m : (Map A)) (a : ad) (y : A)

(MapGet A m a) = (NONE A) → (MapFold A M neutral op f (MapPut A m a y)) = (op (f a y) (MapFold A M neutral op f m)).

Lemma MapFold Put behind disjoint 2 :

(f : ad → A → M ) (m : (Map A)) (a : ad) (y : A) (pf : ad → ad)

(MapGet A m a) = (NONE A) → (MapFold1 A M neutral op f pf (MapPut behind A m a y)) = (op (f (pf a) y) (MapFold1 A M neutral op f pf m)).

Lemma MapFold Put behind disjoint :

(f : ad → A → M ) (m : (Map A)) (a : ad) (y : A)

(MapGet A m a) = (NONE A) → (MapFold A M neutral op f (MapPut behind A m a y)) =(op (f a y) (MapFold A M neutral op f m)).

Lemma MapFold Merge disjoint 1 :

(f : ad → A → M ) (m1 , m2 : (Map A)) (pf : ad → ad)

(MapDisjoint A A m1 m2 ) → (MapFold1 A M neutral op f pf (MapMerge A m1 m2 )) = (op (MapFold1 A M neutral op f pf m1 ) (MapFold1 A M neutral op f pf m2 )).

Lemma MapFold Merge disjoint :

(f : ad → A → M ) (m1 , m2 : (Map A)) (MapDisjoint A A m1 m2 ) →

(MapFold A M neutral op f (MapMerge A m1 m2 )) =

(op (MapFold A M neutral op f m1 ) (MapFold A M neutral op f m2 )).

End MapFoldResults.

Section MapFoldDistr.

Variable A : Set.

Variable M : Set.

Variable neutral : M .

Variable op : M → M → M .

Variable M′ : Set.

Variable neutral′ : M′.

Variable op′ : M′ → M′ → M′.

Variable N : Set.

Variable times : M → N → M′.

Variable absorb : (c : N )(times neutral c) = neutral′.

Variable distr : (a, b : M ) (c : N ) (times (op a b) c) = (op′ (times a c) (times b c)).

Lemma MapFold distr r 1 : (f : ad → A → M ) (m : (Map A)) (c : N ) (pf : ad → ad) (times (MapFold1 A M neutral op f pf m) c) = (MapFold1 A M′ neutral′ op′ [a : ad][y : A] (times (f a y) c) pf m).

Lemma MapFold distr r : (f : ad → A → M ) (m : (Map A)) (c : N )

(times (MapFold A M neutral op f m) c) =

(MapFold A M′ neutral′ op′ [a : ad][y : A] (times (f a y) c) m).

End MapFoldDistr.

Section MapFoldDistrL.

Variable A : Set.

Variable M : Set.

Variable neutral : M .

Variable op : M → M → M .

Variable M′ : Set.

Variable neutral′ : M′.

Variable op′ : M′ → M′ → M′.

Variable N : Set.

Variable times : N → M → M′.

Variable absorb : (c : N )(times c neutral) = neutral′.

Variable distr : (a, b : M ) (c : N ) (times c (op a b)) = (op′ (times c a) (times c b)).

Lemma MapFold distr l : (f : ad → A → M ) (m : (Map A)) (c : N )

(times c (MapFold A M neutral op f m)) =

(MapFold A M′ neutral′ op′ [a : ad][y : A] (times c (f a y)) m).

End MapFoldDistrL.

Section MapFoldExists.

Variable A : Set.

Lemma MapFold orb 1 : (f : ad → A → bool) (m : (Map A)) (pf : ad → ad)

(MapFold1 A bool false orb f pf m) = (Cases (MapSweep1 A f pf m) of (SOME ) ⇒ true

| ⇒ false

end).

Lemma MapFold orb : (f : ad → A → bool) (m : (Map A)) (MapFold A bool false orb f m) =

(Cases (MapSweep A f m) of (SOME ) ⇒ true

| ⇒ false

end).

End MapFoldExists.

Section DMergeDef .

Variable A : Set.

Definition DMerge := (MapFold (Map A) (Map A) (M0 A) (MapMerge A) [ : ad][m : (Map A)] m).

Lemma in dom DMerge 1 : (m : (Map (Map A))) (a : ad) (in dom A a (DMerge m)) =

(Cases (MapSweep ? [ : ad][m0 : (Map A)] (in dom A a m0 ) m) of

(SOME ) ⇒ true | ⇒ false

end).

Lemma in dom DMerge 2 : (m : (Map (Map A))) (a : ad) (in dom A a (DMerge m)) = true →

{b : ad & {m0 : (Map A) | (MapGet ? m b) = (SOME ? m0 ) ∧ (in dom A a m0 ) = true}}.

Lemma in dom DMerge 3 : (m : (Map (Map A))) (a, b : ad) (m0 : (Map A))

(MapGet ? m a) = (SOME ? m0 ) → (in dom A b m0 ) = true → (in dom A b (DMerge m)) = true.

End DMergeDef .

Module Maplists

Require Addr. Require Addec. Require Map. Require Fset. Require Mapaxioms. Require Mapsubset. Require Mapcard. Require Mapcanon. Require Mapc. Require Bool. Require Sumbool. Require PolyList. Require Arith. Require Mapiter. Require Mapfold.

Section MapLists.

Fixpoint ad in list [a : ad; l : (list ad)] : bool :=

Cases l of

nil ⇒ false | (cons a′ l′) ⇒ (orb (ad eq a a′) (ad in list a l′))

end.

Fixpoint ad list stutters [l : (list ad)] : bool :=

Cases l of

nil ⇒ false | (cons a l′) ⇒ (orb (ad in list a l′) (ad list stutters l′))

end.

Lemma ad in list forms circuit : (x : ad) (l : (list ad)) (ad in list x l) = true → {l1 : (list ad) & {l2 : (list ad) | l = (app l1 (cons x l2 ))}}.

Lemma ad list stutters has circuit : (l : (list ad)) (ad list stutters l) = true →

{x : ad & {l0 : (list ad) & {l1 : (list ad) & {l2 : (list ad) | l = (app l0 (cons x (app l1 (cons x l2 ))))}}}}.

Fixpoint Elems [l : (list ad)] : FSet :=

Cases l of

nil ⇒ (M0 unit) | (cons a l′) ⇒ (MapPut ? (Elems l′) a tt)

end.

Lemma Elems canon : (l : (list ad)) (mapcanon ? (Elems l)).

Lemma Elems app : (l, l′ : (list ad)) (Elems (app l l′)) = (FSetUnion (Elems l) (Elems l′)).

Lemma Elems rev : (l : (list ad)) (Elems (rev l)) = (Elems l).

Lemma ad in elems in list : (l : (list ad)) (a : ad) (in FSet a (Elems l)) = (ad in list a l).

Lemma ad list not stutters card : (l : (list ad)) (ad list stutters l) = false →

(length l) = (MapCard ? (Elems l)).

Lemma ad list card : (l : (list ad)) (le (MapCard ? (Elems l)) (length l)). Lemma ad list stutters card : (l : (list ad)) (ad list stutters l) = true →

(lt (MapCard ? (Elems l)) (length l)).

Lemma ad list not stutters card conv : (l : (list ad)) (length l) = (MapCard ? (Elems l)) →

(ad list stutters l) = false. Lemma ad list stutters card conv : (l : (list ad)) (lt (MapCard ? (Elems l)) (length l)) →

(ad list stutters l) = true. Lemma ad in list l : (l, l′ : (list ad)) (a : ad) (ad in list a l) = true →

(ad in list a (app l l′)) = true. Lemma ad list stutters app l : (l, l′ : (list ad)) (ad list stutters l) = true

→ (ad list stutters (app l l′)) = true.

Lemma ad in list r : (l, l′ : (list ad)) (a : ad) (ad in list a l′) = true →

(ad in list a (app l l′)) = true. Lemma ad list stutters app r : (l, l′ : (list ad)) (ad list stutters l′) = true

→ (ad list stutters (app l l′)) = true.

Lemma ad list stutters app conv l : (l, l′ : (list ad)) (ad list stutters (app l l′)) = false

→ (ad list stutters l) = false.

Lemma ad list stutters app conv r : (l, l′ : (list ad)) (ad list stutters (app l l′)) = false

→ (ad list stutters l′) = false.

Lemma ad in list app 1 : (l, l′ : (list ad)) (x : ad) (ad in list x (app l (cons x l′))) = true. Lemma ad in list app : (l, l′ : (list ad)) (x : ad)

(ad in list x (app l l′)) = (orb (ad in list x l) (ad in list x l′)).

Lemma ad in list rev : (l : (list ad)) (x : ad)

(ad in list x (rev l)) = (ad in list x l). Lemma ad list has circuit stutters : (l0 , l1 , l2 : (list ad)) (x : ad)

(ad list stutters (app l0 (cons x (app l1 (cons x l2 ))))) = true. Lemma ad list stutters prev l : (l, l′ : (list ad)) (x : ad) (ad in list x l) = true →

(ad list stutters (app l (cons x l′))) = true.

Lemma ad list stutters prev conv l : (l, l′ : (list ad)) (x : ad)

(ad list stutters (app l (cons x l′))) = false → (ad in list x l) = false.

Lemma ad list stutters prev r : (l, l′ : (list ad)) (x : ad) (ad in list x l′) = true →

(ad list stutters (app l (cons x l′))) = true.

Lemma ad list stutters prev conv r : (l, l′ : (list ad)) (x : ad)

(ad list stutters (app l (cons x l′))) = false → (ad in list x l′) = false.

Lemma ad list Elems : (l, l′ : (list ad)) (MapCard ? (Elems l)) = (MapCard ? (Elems l′)) →

(length l) = (length l′) →

(ad list stutters l) = (ad list stutters l′). Lemma ad list app length : (l, l′ : (list ad)) (length (app l l′)) = (plus (length l) (length l′)).

Lemma ad list stutters permute : (l, l′ : (list ad))

(ad list stutters (app l l′)) = (ad list stutters (app l′ l)).

Lemma ad list rev length : (l : (list ad)) (length (rev l)) = (length l).

Lemma ad list stutters rev : (l : (list ad)) (ad list stutters (rev l)) = (ad list stutters l).

Lemma ad list app rev : (l, l′ : (list ad)) (x : ad)

(app (rev l) (cons x l′)) = (app (rev (cons x l)) l′).

Section ListOfDomDef .

Variable A : Set.

Definition ad list of dom := (MapFold A (list ad) (nil ad) (!app ad) [a : ad][ : A] (cons a (nil ad))).

Lemma ad in list of dom in dom : (m : (Map A)) (a : ad)

(ad in list a (ad list of dom m)) = (in dom A a m).

Lemma Elems of list of dom : (m : (Map A)) (eqmap unit (Elems (ad list of dom m)) (MapDom A m)).

Lemma Elems of list of dom c : (m : (Map A)) (mapcanon A m) → (Elems (ad list of dom m)) = (MapDom A m).

Lemma ad list of dom card 1 : (m : (Map A)) (pf : ad → ad)

(length (MapFold1 A (list ad) (nil ad) (app 1!ad) [a : ad][ : A](cons a (nil ad)) pf m)) =(MapCard A m).

Lemma ad list of dom card : (m : (Map A)) (length (ad list of dom m)) = (MapCard A m).

Lemma ad list of dom not stutters : (m : (Map A)) (ad list stutters (ad list of dom m)) = false.

End ListOfDomDef .

Lemma ad list of dom Dom 1 : (A :Set)

(m : (Map A)) (pf : ad → ad)

(MapFold1 A (list ad) (nil ad) (app 1!ad) [a : ad][ : A](cons a (nil ad)) pf m) =(MapFold1 unit (list ad) (nil ad) (app 1!ad)

[a : ad][ : unit](cons a (nil ad)) pf (MapDom A m)).

Lemma ad list of dom Dom : (A :Set) (m : (Map A))

(ad list of dom A m) = (ad list of dom unit (MapDom A m)).

End MapLists.

Module Allmaps

Require Export Addr. Require Export Adist. Require Export Addec. Require Export Map.

Require Export Fset. Require Export Mapaxioms.

Require Export Mapiter.

Require Export Mapsubset. Require Export Lsort. Require Export Mapfold. Require Export Mapcard. Require Export Mapcanon. Require Export Mapc. Require Export Maplists. Require Export Adalloc.

Index

\underline{INDEX 190}

a0 (variable), 87 aapp (definition), 163 aapp length, 167 absolu (definition), 40 absolu lt, 61 absoption andb, 14 absoption orb, 14 absorb (variable), 183, 184 acc app, 134 acc A B lexprod, 136 acc A sum, 132 acc B sum, 132 Acc clos trans, 133 Acc incl, 132 Acc inverse image, 133 Acc inv trans, 133 Acc swapprod, 136 Acc symprod, 136 Acc union, 135 acons (definition), 163 ad (inductive), 137 add (definition), 30 Add (definition), 97 add assoc, 36 add carry (definition), 30 Add commutative, 108 Add commutative′, 108 Add covers, 110 Add distributes, 108 Add intro1 , 98 Add intro2 , 98 Add inv, 98 Add not Empty, 98 Add preserves Finite, 112 add soustr 1 , 110 add soustr 2 , 110 add soustr xy, 110 add sub one, 32 add sym, 36 add un (definition), 30 add un Zs, 45 add verif , 31 add x x, 47 adf xor (definition), 139 adf xor assoc, 139 adf xor eq, 139 adhDa (definition), 77 ad alloc opt (definition), 155 ad alloc opt allocates, 155 ad alloc opt allocates 1 , 155 ad alloc opt optimal, 156 ad alloc opt optimal 1 , 156 ad bit (definition), 138 ad bit 0 (definition), 140 ad bit 0 0 not double plus un, 144 ad bit 0 1 not double, 143 ad bit 0 correct, 140 ad bit 0 gt, 166 ad bit 0 less, 166 ad bit 0 neq, 144 ad bit 1 (definition), 138 ad comp double inj , 164 ad comp double monotonic, 167 ad comp double plus un inj , 164 ad comp double plus un monotonic, 167 ad comp monotonic, 167 ad div 2 (definition), 140 ad div 2 correct, 140 ad div 2 double, 140 ad div 2 double plus un, 140 ad div bit eq, 144 ad div bit neq, 144 ad div eq, 144 ad div neq, 144 ad double (definition), 140 ad double bit 0 , 140 ad double div 2 , 140 ad double inj , 140 ad double monotonic, 167 ad double or double plus un, 144 ad double plus un (definition), 140 ad double plus un bit 0 , 140 ad double plus un div 2 , 140 ad double plus un inj , 140 ad double plus un monotonic, 167 ad eq (definition), 143 ad eq 1 (definition), 143 ad eq comm, 143 ad eq complete, 143 ad eq correct, 143 ad faithful, 139 ad faithful 1 , 139 ad faithful 2 , 139 ad faithful 3 , 139 ad faithful 4 , 139 ad ind double, 166 ad inj (definition), 164 ad in elems in list, 185 ad in list (definition), 185 ad in list app, 186 ad in list app 1 , 186 ad in list forms circuit, 185 ad in list l, 186 ad in list of dom in dom, 187 ad in list r, 186 ad in list rev, 186 ad le (definition), 155 ad less (definition), 165 ad less 1 (definition), 165 ad less def 1 , 166 ad less def 2 , 166 ad less def 3 , 166 ad less def 4 , 166 ad less not refl, 166 ad less total, 168 ad less trans, 166 ad less z, 166 ad le antisym, 155 ad le double mono, 156 ad le double mono conv, 156 ad le double plus un mono, 156 ad le double plus un mono conv, 156 ad le lt trans, 155 ad le refl, 155 ad le trans, 155 ad list app length, 186 ad list app rev, 187 ad list card, 186 ad list Elems, 186 ad list has circuit stutters, 186 ad list not stutters card, 185 ad list not stutters card conv, 186 ad list of dom (definition), 187 ad list of dom card, 187 ad list of dom card 1 , 187 ad list of dom Dom, 187 ad list of dom Dom 1 , 187 ad list of dom not stutters, 187 ad list rev length, 187 ad list stutters (definition), 185 ad list stutters app conv l, 186 ad list stutters app conv r, 186 ad list stutters app l, 186 ad list stutters app r, 186 ad list stutters card, 186 ad list stutters card conv, 186 ad list stutters has circuit, 185 ad list stutters permute, 187 ad list stutters prev conv l, 186 ad list stutters prev conv r, 186 ad list stutters prev l, 186 ad list stutters prev r, 186 ad list stutters rev, 187 ad lt double mono, 156 ad lt double mono conv, 156 ad lt double plus un mono, 156 ad lt double plus un mono conv, 156 ad lt le trans, 155 ad lt le weak, 155 ad lt trans, 155 ad min (definition), 155 ad min choice, 155 ad min le 1 , 155 ad min le 2 , 155 ad min le 3 , 155 ad min le 4 , 155 ad min le 5 , 155 ad min lt 3 , 155 ad min lt 4 , 155 ad monotonic (definition), 167 ad neg bit 0 , 141 ad neg bit 0 1 , 141 ad neg bit 0 2 , 141 ad neq, 144 ad not div 2 not double, 143 ad not div 2 not double plus un, 144 ad of nat (definition), 154 ad of nat of ad, 154 ad pdist (definition), 142 ad pdist comm, 142 ad pdist eq 1 , 142 ad pdist eq 2 , 142 ad pdist ultra, 143 ad plength (definition), 141 ad plength 1 (definition), 141 ad plength first one, 141 ad plength infty, 141 ad plength lb, 142 ad plength one, 141 ad plength ub, 142 ad plength ultra, 143 ad plength ultra 1 , 143 ad plength zeros, 141 ad rec double, 166 ad same bit 0 , 141 ad sum, 137 ad x (constructor), 137 ad xor (definition), 138 ad xor assoc, 140 ad xor bit 0 , 140 ad xor comm, 138 ad xor div 2 , 140 ad xor eq, 139 ad xor eq false, 143 ad xor eq true, 143 ad xor neutral left, 138 ad xor neutral right, 138 ad xor nilpotent, 138 ad xor semantics, 139 ad xor sem 1 , 139 ad xor sem 2 , 139 ad xor sem 3 , 139 ad xor sem 4 , 139 ad xor sem 5 , 139 ad xor sem 6 , 139 ad z (constructor), 137 ad z less 1 , 166 ad z less 2 , 166 alist (definition), 163 alist canonical, 168 alist conc sorted, 167 alist MapMerge semantics, 165 alist MapMerge semantics disjoint, 165 alist nth ad (definition), 166 alist nth ad aapp 1 , 167 alist nth ad aapp 2 , 167 alist nth ad semantics, 167 alist of Map (definition), 163 alist of Map nth ad, 167 alist of Map of alist, 164 alist of Map of alist c, 180 alist of Map semantics, 164 alist of Map semantics 1 , 164 alist of Map semantics 1 1 , 164 alist of Map sorts, 168 alist of Map sorts1 , 168 alist of Map sorts2 , 168 alist of Map sorts 1 , 168 alist semantics (definition), 163 alist semantics app, 163 alist semantics disjoint comm, 165 alist semantics nth ad, 168 alist semantics same tail, 168 alist semantics tail, 168 alist sorted (definition), 166 alist sorted 1 (definition), 167 alist sorted 1 imp 2 , 167 alist sorted 2 (definition), 167 alist sorted 2 imp, 167 alist sorted imp 1 , 167 alist sorted tail, 168 alist too low, 168 AllS (inductive), 93 AllS assoc (inductive), 95 allS assoc cons (constructor), 95 allS assoc nil (constructor), 95 allS cons (constructor), 93 allS nil (constructor), 93 all not not ex, 5, 6 andb (definition), 11 andb assoc, 13 andb b false, 13 andb b true, 13 andb false b, 13 andb false elim, 13 andb false intro1 , 13 andb false intro2 , 13 andb neg b, 13 andb prop, 13 andb prop2 , 13 andb sym, 13 andb true b, 13 andb true intro, 13 andb true intro2 , 13 and not or, 5 anil (definition), 163 antisymmetric (definition), 127 Antisymmetric (definition), 101 anti convert (definition), 31 app (definition), 81, 83 Approximant (inductive), 116 approximants grow, 116 approximants grow′, 116 approximant can be any size, 116 app ass, 81, 83 app comm cons, 83 app cons not nil, 83 app eq nil, 83 app eq unit, 83 app inj tail, 83 app length, 167 app nil end, 81, 83 archimed (axiom), 65 assoc (definition), 95 assoc (variable), 182 Assoc, 96 ass app, 81, 83 atisation (axiom), 102 Bag (constructor), 120 base fp, 73 base Int part, 73 beq nat (definition), 28 beq nat eq (definition), 28 beq nat refl, 28 between (inductive), 22 between in int, 22 between le, 22 between not exists, 23 between or exists, 22 between restr, 22 between Sk l, 22 bet emp (constructor), 22 bet eq, 22 bet S (constructor), 22 bij1 , 32 bij2 , 32 bij3 , 36 Bottom (inductive), 104 Bottom definition (constructor), 104 bound (definition), 65 cardinal (inductive), 111 cardinalO empty, 113 cardinal decreases, 115 cardinal elim, 112 cardinal Empty, 113 cardinal finite, 112 cardinal Im intro, 114 cardinal invert, 112 cardinal is functional, 113 cardinal unicity, 113 card add (constructor), 111 card Add gen, 113 card empty (constructor), 111 card soustr 1 , 113 Carrier (definition), 103 caseRxy, 126 case Rabsolu, 75 charac (definition), 123 Charac (constructor), 123 classic (axiom), 4 clos refl sym trans (inductive), 129 clos refl trans (inductive), 128 clos refl trans ind left, 131 clos rst idempotent, 131 clos rst is equiv, 131 clos rt clos rst, 131 clos rt idempotent, 131 clos rt is preorder, 131 clos trans (inductive), 128 coherence (definition), 126 coherence intro, 126 coherence sym, 126 coherent (definition), 118 coherent symmetric, 122 CoInduction (definition), 88 comm (variable), 182 commut (definition), 125, 128 comm left, 102 comm right, 102 compare (definition), 27, 32 compare convert1 , 33 compare convert EGAL, 33 compare convert INFERIEUR, 33 compare convert O, 32 compare convert SUPERIEUR, 33 compare positive to nat O, 32 Compatible (definition), 104 Complement (definition), 97, 100 Complement Complement, 100 complet (axiom), 65 Complete (inductive), 104 Conditionally complete (inductive), 104 confluence (definition), 126 confluent (definition), 118 Confluent (definition), 118 cong (variable), 102 cong antisymmetric same relation, 101 cong congr, 102 cong reflexive same relation, 101 cong symmetric same relation, 101 cong transitive same relation, 101 cons (constructor), 81, 83 Cons (definition), 134 Cons (constructor), 87 const (definition), 89 contains (definition), 101 contains is preorder, 100 continue in (definition), 79 cont deriv, 79 convert (definition), 31 convert add, 32 convert add carry, 31 convert add un, 31 convert compare EGAL, 34 convert compare INFERIEUR, 34 convert compare SUPERIEUR, 34 convert intro, 36 convert xH , 155 convert xI , 156 convert xO, 156 Couple (inductive), 97 Couple as union, 107 Couple inv, 99 Couple l (constructor), 97 Couple r (constructor), 97 covers (inductive), 103 covers Add, 110 covers is Add, 111 cvt carry, 31 Dadd, 79 Dcomp, 80 Dcompare, 33 Dcompare inf , 55 Dconst, 79 decidable (definition), 8 Decidable (module), 8 dec and, 8 dec eq, 45 dec eq nat, 23, 46 dec False, 8 dec ge, 26 dec gt, 25 dec imp, 8 dec le, 25 dec lt, 25 dec not, 8 dec not not, 8 dec or, 8 dec True, 8 dec Zge, 46 dec Zgt, 46 dec Zle, 46 dec Zlt, 46 dec Zne, 46 Definition of Complete (constructor), 104 Definition of Conditionally complete (construc-

tor), 104 Definition of covers (constructor), 103 Definition of Directed (constructor), 104 Definition of equivalence (constructor), 101 Definition of Le nat (constructor), 119 definition of noetherian (constructor), 118 Definition of order (constructor), 101 Definition of PER (constructor), 101 Definition of Power set (constructor), 105 Definition of preorder (constructor), 101 Defn of Approximant (constructor), 116 demorgan1 , 14 demorgan2 , 14 demorgan3 , 14 demorgan4 , 14 Desc (inductive), 130 Descl (definition), 134 desc end, 134 desc prefix, 134 desc tail, 134 Dgf (definition), 77 Diagram, 126 diff false true, 10 diff true false, 10 Directed (inductive), 104 discrete nat, 27 Disjoint (inductive), 97 Disjoint intro (constructor), 97 distr (variable), 183, 184 Distributivity, 108 Distributivity′, 108 distr rev, 85 dist aux, 134 dist Desc concat, 134 div2 (definition), 28 div2 even, 29 div2 odd, 29 diveucl (inductive), 27 divex (constructor), 27 DMerge (definition), 184 Dminus, 80 Dmult, 79 Dmult const, 79 Dopp, 79 double (definition), 29 double even, 29 double moins deux (definition), 34 double moins un (definition), 32 double odd, 29 double S, 29 Dx, 79 Dx pow n, 80 d conc (constructor), 130 D in (definition), 79 d nil (constructor), 130 d one (constructor), 130 D x (definition), 79 EGAL (constructor), 30 Elems (definition), 185 Elems app, 185 Elems canon, 185 Elems of list of dom, 187 Elems of list of dom c, 187 Elems rev, 185 ElimCompare (definition), 40 EmptyBag (definition), 120 Emptyset (definition), 123 Empty is finite (constructor), 111 empty set (definition), 89 Empty set (inductive), 96 Empty set is Bottom, 106 Empty set minimal, 105 Empty set zero, 107 Empty set zero′, 107 Ensemble (definition), 96 entier (inductive), 34 entier of Z (definition), 57 eps2 , 76 eps2 Rgt R0 , 76 eps4 , 76 eq2eqT (definition), 7 eqA (variable), 120, 122 eqb (definition), 11 eqb eq, 11 eqb negb1 , 12 eqb negb2 , 12 eqb prop, 11 eqb refl, 11 eqb reflx, 11 eqb subst, 11 eqf (definition), 139 eqf refl, 139 eqf sym, 139 eqf trans, 139 eqf xor 1 , 139 eqm (definition), 145 eqmap (definition), 157 eqmap refl, 157 eqmap sym, 157 eqmap trans, 157 eqm refl, 157 eqm sym, 157 eqm trans, 157 eqst (constructor), 88 EqSt (inductive), 88 eqst ntheq, 88 EqSt reflex, 88 eqT2eq (definition), 7 eqT eq bij , 7 equiv (definition), 127 Equivalence (inductive), 101 equiv eqex eqdep, 6 Equiv from order, 100 Equiv from preorder, 100 eq dec (variable), 7 eq dep (inductive), 5 eq dep1 (inductive), 5 eq dep1 dep, 6 eq dep1 eq, 6 eq dep1 intro (constructor), 5 eq dep dep1 , 6 eq dep eq, 6 eq dep intro (constructor), 5 eq dep sym, 5 eq dep trans, 5 eq eqT bij , 7 eq eq nat, 28 eq IZR, 73 eq IZR R0 , 73 eq nat (definition), 27 eq nat dec, 23 eq nat decide, 28 eq nat elim, 28 eq nat eq, 28 eq nat refl, 27 eq proofs unicity, 8 eq rec eq (axiom), 6 eq Rge, 66 eq Rge sym, 66 eq Rle, 66 eq Rle sym, 66 eq Rminus, 68 eq Ropp, 68 eq RoppO, 68 eq true false abs, 10 eucl dev, 29 even (inductive), 26 eventually (definition), 23 event O, 23 even 2n, 29 even div2 , 29 even double, 29 even O (constructor), 26 even odd dec, 26 even odd div2 , 28 even odd double, 29 even or odd, 26 even S (constructor), 26 exists (inductive), 22 Exists (inductive), 88 exists in int, 22 exists le (constructor), 22 exists le S, 22 exists lt, 22 exists S (constructor), 22 exists S le, 22 existT (constructor), 61 existTT (constructor), 61 Extension, 98 Extensionality Ensembles (axiom), 97 ex not not all, 5, 6 fact (definition), 78 fact neq 0 , 78 false xorb, 13 fast OMEGA10 (definition), 50 fast OMEGA11 (definition), 50 fast OMEGA12 (definition), 50 fast OMEGA13 (definition), 51 fast OMEGA14 (definition), 51 fast OMEGA15 (definition), 50 fast OMEGA16 (definition), 50 fast Zmult assoc r (definition), 52 fast Zmult plus distr (definition), 52 fast Zmult sym (definition), 51 fast Zmult Zopp left (definition), 52 fast Zopp one (definition), 51 fast Zopp Zmult r (definition), 52 fast Zopp Zopp (definition), 52 fast Zopp Zplus (definition), 51 fast Zplus assoc l (definition), 49 fast Zplus assoc r (definition), 49 fast Zplus permute (definition), 50 fast Zplus sym (definition), 49 fast Zred factor0 (definition), 51 fast Zred factor1 (definition), 52 fast Zred factor2 (definition), 53 fast Zred factor3 (definition), 53 fast Zred factor4 (definition), 53 fast Zred factor5 (definition), 53 fast Zred factor6 (definition), 53 find (definition), 95 Find, 95 Finite (inductive), 111 finite cardinal, 112 Finite downward closed, 112 finite image, 114 Finite subset has lub, 120 flat map (definition), 86 fold left (definition), 87 fold right (definition), 87 fold right aapp, 164 forall (constructor), 89 ForAll (inductive), 89 ForAll coind, 89 for base fp, 73 fp nat, 73 fp R0 , 73 frac part (definition), 73 FSet (definition), 153 FSetDelta (definition), 154 FSetDelta assoc, 160 FSetDelta assoc c, 180 FSetDiff (definition), 153 FSetInter (definition), 153 FSetInter assoc, 160 FSetInter assoc c, 181 FSetInter comm, 160 FSetInter comm c, 181 FSetInter idempotent, 160, 181 FSetInter M0 s, 160 FSetInter M0 s c, 181 FSetInter s M0 , 160 FSetInter s M0 c, 181 FSetInter Union l, 161 FSetInter Union l c, 181 FSetInter Union r, 161, 181 FSetUnion (definition), 153 FSetUnion assoc, 160 FSetUnion assoc c, 181 FSetUnion comm, 160 FSetUnion comm c, 181 FSetUnion idempotent, 160, 181 FSetUnion Inter l, 161 FSetUnion Inter l c, 181 FSetUnion Inter r, 161, 181 FSetUnion M0 s, 160 FSetUnion M0 s c, 181 FSetUnion s M0 , 160 FSetUnion s M0 c, 181 FSet Dom, 154 FSet ext, 160 FSet ext c, 180 fst nth nth, 94 fst nth O (constructor), 94 fst nth S (constructor), 94 fst nth spec (inductive), 94 FSubset antisym, 169 FSubset antisym c, 180 FSubset refl, 169 FSubset trans, 169 Fullset (definition), 123 Full intro (constructor), 96 Further (constructor), 88 Generalized induction on finite sets, 113 Glb (inductive), 104 Glb definition (constructor), 104 gtof (definition), 24 gt antirefl, 19 gt eq gt dec, 25 gt le S, 19 gt le trans, 19 gt not le, 19 gt not sym, 19 gt n S, 19 gt O eq, 20 gt pred, 20 gt reg l, 20 gt S, 20 gt Sn n, 19 gt Sn O, 19 gt S le, 19 gt S n, 19 gt trans, 19 gt trans S, 19 gt wf ind, 25 gt wf rec, 25 G aux, 113 hd (definition), 87 Hd, 93 head (definition), 83 Here (constructor), 88 idempot rev, 85 ifb (definition), 11 ifdec (definition), 10 ifdec left, 10 ifdec right, 10 Iffalse (constructor), 9 Iffalse inv, 9 IfProp (inductive), 9 Ifprop false, 10 IfProp or, 10 IfProp sum, 10 IfProp true, 10 Iftrue (constructor), 9 Iftrue inv, 9 if negb, 12 Im (inductive), 114 image empty, 114 Image set continuous, 116 Image set continuous′, 117 implb (definition), 11 imply and or, 5 imply and or2 , 5 imply to and, 4 imply to or, 4 imp not Req, 65 imp simp, 9 Im add, 114 Im def , 114 Im intro (constructor), 114 Im inv, 114 In (definition), 81, 84, 96, 123 incl (definition), 82, 84, 123 Included (definition), 96 Included Add, 110 Included Empty, 98 Included Strict Included, 100 inclusion (definition), 127 Inclusion is an order, 105 Inclusion is transitive, 105 incl add, 108 incl add x, 108 incl app, 82, 85 incl appl, 82, 84 incl appr, 82, 84 incl card le, 113 incl clos trans, 133 incl cons, 82, 84 incl left, 123 incl refl, 82, 84 incl right, 123 incl soustr, 109 incl soustr add l, 110 incl soustr add r, 110 incl soustr in, 109 incl st add soustr, 110 incl st card lt, 113 incl tl, 82, 84 incl tran, 82, 84 Index, 94 index p (definition), 94 Index p, 94 induction gtof1 , 24 induction gtof2 , 24 induction ltof1 , 24 induction ltof2 , 24 ind 0 1 SS, 28 Ind proof , 126 INFERIEUR (constructor), 30 infinit sum (definition), 79 infty (constructor), 141 Inhabited (inductive), 97 Inhabited add, 98 Inhabited intro (constructor), 97 Inhabited not empty, 98 Inhabited Setminus, 99 inh card gt O, 113 injective (definition), 114 injective preserves cardinal, 114 inject nat (definition), 40 inject nat complete, 56 inject nat complete inf , 56 inject nat prop, 56 inj eq, 45 inj ge, 45 inj gt, 45 inj le, 45 inj lt, 45 inj minus1 , 45 inj minus2 , 45 inj minus aux, 21 inj mult, 45 inj neq, 45 inj pair2 , 6 inj plus, 45 inj right pair, 8 inj S, 45 inleftT (constructor), 61 InR (inductive), 94 INR (definition), 64 inrightT (constructor), 61 InR app or, 95 InR cons inv, 95 INR fact neq 0 , 78 inR hd (constructor), 94 InR inv (definition), 95 InR INV , 95 INR IZR INZ , 72 INR le, 72 INR le nm, 72 INR lt 0 , 72 InR or app, 95 INR pos, 72 inR tl (constructor), 94 inser trans R, 66 Integers (inductive), 119 Integers defn (constructor), 119 Integers has no ub, 120 Integers infinite, 120 Intersection (inductive), 97 Intersection commutative, 108 Intersection decreases l, 106 Intersection decreases r, 106 Intersection intro (constructor), 97 Intersection inv, 98 Intersection is Glb, 106 Intersection maximal, 106 Intersection preserves finite, 113 interval split, 167 intro Z , 45 Int part (definition), 73 Inv (variable), 89 inverse image of eq, 131 inverse image of equivalence, 131 INZ (definition), 72 in app or, 82, 84 in cons, 82, 84 In dec, 84 in dom (definition), 152 in dom delta, 153 in dom DMerge 1 , 184 in dom DMerge 2 , 184 in dom DMerge 3 , 184 in dom M0 , 152 in dom M1 , 152 in dom M1 1 , 152 in dom M1 2 , 152 in dom merge, 152 in dom none, 152 in dom put, 152 in dom put behind, 152 in dom remove, 152 in dom restrby, 153 in dom restrto, 153 in dom some, 152 in eq, 82, 84 in FSet (definition), 153 in FSet delta, 154 in FSet diff , 153 in FSet inter, 153 in FSet union, 153 in hd (constructor), 93 In Image elim, 114 in int (definition), 22 in int between, 22 in int exists, 22 in int intro, 22 in int lt, 22 in int p Sq, 22 in int S, 22 in int Sp q, 22 in inv, 84 In In spec, 93 in map, 86 in nil, 84 in or app, 82, 84 in prod, 86 in prod aux, 86 In singleton (constructor), 97 In spec (inductive), 93 in tl (constructor), 93 Isnil (definition), 92 Isnil dec, 93 Isnil nil, 92 is double moins un, 32 is lub (definition), 65 Is true (definition), 10 Is true eq left, 10 Is true eq right, 10 Is true eq true, 11 Is true eq true2 , 11 is upper bound (definition), 65 Item, 94 iter (definition), 58 iter convert, 58 iter nat (definition), 58 iter nat invariant, 58 iter nat plus, 58 iter pos (definition), 58 iter pos add, 58 iter pos invariant, 58 IZN , 72 IZR (definition), 64 IZR ge, 73 K dec, 8 K dec set, 8 leA (variable), 85, 129, 130, 132, 134, 135,

136 leb (definition), 11 leB (variable), 129, 130, 132, 136 leb refl, 123 leftT (constructor), 61 left lex (constructor), 129 left prefix, 134 left sym (constructor), 130 lel (definition), 81, 83 lel cons, 81, 84 lel cons cons, 81, 84 lel nil, 81, 84 lel refl, 81, 84 lel tail, 81, 84 lel trans, 81, 84 Lemma1 , 118 length (definition), 81, 83 Length, 93 length as fold, 173 length as fold 2 , 173 Length l (definition), 93 Length l pf , 93 less than empty, 107 less than singleton, 111 lexprod (inductive), 129 LexProd (definition), 136 lex exp (definition), 130 Lex Exp (definition), 134 le aa (constructor), 129 le ab (constructor), 129 le antisym, 16 le AsB (inductive), 129 Le AsB (definition), 132 le bb (constructor), 129 le dec, 27 le decide, 27 le elim rel, 16 le ge dec, 25 le gt dec, 25 le gt S, 19 le gt trans, 19 le IZR, 73 le IZR R1 , 73 le le S dec, 25 le le S eq, 27 le lt dec, 25 le lt eq dec, 25 le lt n Sm, 17 le lt or eq, 17 le lt plus plus, 18 le lt trans, 17 le minus, 39 le min l, 26 le min r, 26 Le Nat (inductive), 119 Le Nat antisym, 119 Le Nat direct, 119 Le Nat Order, 119 Le Nat Reflexive, 119 Le Nat total order, 120 Le Nat trans, 119 le ni le, 142 le not gt, 19 le not lt, 17 le n O eq, 16 le n S, 16 le n Sn, 16 le or le S (definition), 27 le or lt, 17 le O IZR, 73 le O n, 16 le plus l, 18 le plus minus, 20 le plus minus r, 20 le plus plus, 18 le plus r, 18 le plus trans, 18 le pred n, 16 le reg l, 18 le reg r, 18 le Sn n, 16 le Sn O, 16 le sup (constructor), 135 le S gt, 19 le S n, 16 le trans, 16 le trans S, 16 le WO (inductive), 135 limit1 in (definition), 77 limit comp, 77 limit free, 77 limit in (definition), 76 limit minus, 77 limit mul, 77 limit plus, 77 limit Ropp, 77 lim x, 77 list (inductive), 81, 83 List (definition), 134 List Dom (axiom), 81 list power (definition), 87 list prod (definition), 86 locally confluent (definition), 118 Locally confluent (definition), 118 local confluence (definition), 126 Lower Bound (inductive), 104 Lower Bound definition (constructor), 104 ltl (definition), 134 Ltl (inductive), 130 ltl unit, 134 ltof (definition), 24 lt div2 , 28 lt eq lt dec, 25 Lt hd (constructor), 130 lt IZR, 72 lt le plus plus, 18 lt le S, 17 lt le trans, 17 lt le weak, 17 lt minus, 20 lt mult left, 38 Lt nil (constructor), 130 lt not le, 17 lt not sym, 17 lt n n, 17 lt n O, 17 lt n S, 16 lt n Sm le, 17 lt n Sn, 16 lt or eq (definition), 27 lt O IZR, 72 lt O minus lt, 20 lt O neq, 17 lt O Sn, 16 lt plus plus, 18 lt plus trans, 18 lt pred, 17 lt pred n n, 17 lt reg l, 18 lt reg r, 18 lt S, 16 lt S n, 16 Lt tl (constructor), 130 lt trans, 17 lt wf , 24 lt wf double ind, 25 lt wf double rec, 25 lt wf ind, 25 lt wf rec, 25 lt wf rec1 , 24 Lub (inductive), 104 Lub definition (constructor), 104 M′ (variable), 183 M0 (constructor), 144 M0 canon (constructor), 176 M1 (constructor), 144 M1 canon (constructor), 176 M1 semantics 1 , 145 M1 semantics 2 , 145 M2 (constructor), 144 M2 canon (constructor), 176 M2 eqmap 1 , 176 M2 eqmap 2 , 176 makeM2 (definition), 148 makeM2 canon, 176 makeM2 M2 , 148 make new approximant, 116 map (definition), 86, 89 Map (inductive), 144 Map2 semantics 1 , 145 Map2 semantics 1 eq, 145 Map2 semantics 2 , 145 Map2 semantics 2 eq, 145 Map2 semantics 3 , 146 Map2 semantics 3 eq, 146 mapcanon (inductive), 176 MapCanonicalize (definition), 176 mapcanon exists, 177 mapcanon exists 1 , 177 mapcanon exists 2 , 177 mapcanon M2 , 176 mapcanon M2 1 , 176 mapcanon M2 2 , 176 mapcanon unique, 176 MapCard (definition), 149 MapCard as Fold, 173 MapCard as Fold 1 , 173 MapCard as length, 173 MapCard Dom, 174 MapCard Dom Put behind, 174 MapCard ext, 174 MapCard is not O, 173 MapCard is O, 173 MapCard is one, 173 MapCard is one unique, 173 MapCard is Sn, 175 MapCard M0 , 173 MapCard M1 , 173 MapCard makeM2 , 174 MapCard Put1 equals 2 , 173 MapCard Put 1 , 173 MapCard Put 1 conv, 174 MapCard Put 2 , 173 MapCard Put 2 conv, 174 MapCard Put behind Put, 174 MapCard Put behind sum, 174 MapCard Put lb, 173 MapCard Put sum, 173 MapCard Put ub, 173 MapCard Remove 1 , 174 MapCard Remove 1 conv, 174 MapCard Remove 2 , 174 MapCard Remove 2 conv, 174 MapCard Remove lb, 174 MapCard Remove sum, 174 MapCard Remove ub, 174 MapCollect (definition), 162 MapCollect1 (definition), 162 MapCollect as Fold, 163 MapCollect canon, 177 MapDelta (definition), 149 MapDelta as DomRestrBy, 159 MapDelta as DomRestrBy 2 , 159 MapDelta as DomRestrBy 2 c, 180 MapDelta as DomRestrBy c, 180 MapDelta as Merge, 159 MapDelta as Merge c, 180 MapDelta canon, 177 MapDelta disjoint, 172 MapDelta disjoint c, 180 MapDelta empty m, 159 MapDelta empty m 1 , 159 MapDelta ext, 159 MapDelta ext l, 159 MapDelta ext r, 159 MapDelta m empty, 159 MapDelta m empty 1 , 159 MapDelta nilpotent, 159 MapDelta nilpotent c, 180 MapDelta RestrTo disjoint, 172 MapDelta RestrTo disjoint 2 , 172 MapDelta semantics, 150 MapDelta semantics 1 , 150 MapDelta semantics 1 1 , 150 MapDelta semantics 2 , 150 MapDelta semantics 2 1 , 150 MapDelta semantics 2 2 , 150 MapDelta semantics 3 , 150 MapDelta semantics 3 1 , 150 MapDelta semantics comm, 150 MapDelta sym, 159 MapDelta sym c, 180 MapDisjoint (definition), 171 MapDisjoint 1 (definition), 171 MapDisjoint 1 imp, 171 MapDisjoint 2 (definition), 171 MapDisjoint 2 imp, 171 MapDisjoint empty, 172 MapDisjoint empty c, 180 MapDisjoint ext, 171 MapDisjoint imp 1 , 171 MapDisjoint imp 2 , 171 MapDisjoint M1 conv l, 172 MapDisjoint M1 conv r, 172 MapDisjoint M1 l, 171 MapDisjoint M1 r, 171 MapDisjoint M2 , 171 MapDisjoint M2 l, 171 MapDisjoint M2 r, 171 MapDisjoint sym, 172 MapDom (definition), 153 MapDomRestrBy (definition), 152 MapDomRestrBy By, 158 MapDomRestrBy By c, 179 MapDomRestrBy By comm, 158 MapDomRestrBy By comm c, 179 MapDomRestrBy canon, 177 MapDomRestrBy Card lb, 175 MapDomRestrBy Card ub l, 175 MapDomRestrBy Dom, 158 MapDomRestrBy Dom c, 179 MapDomRestrBy empty m, 158 MapDomRestrBy empty m 1 , 158 MapDomRestrBy ext, 160 MapDomRestrBy ext l, 160 MapDomRestrBy ext r, 160 MapDomRestrBy m empty, 158 MapDomRestrBy m empty 1 , 158 MapDomRestrBy m m, 160 MapDomRestrBy m m 1 , 158 MapDomRestrBy semantics, 152 MapDomRestrBy To, 158 MapDomRestrBy To c, 179 MapDomRestrBy To comm, 158 MapDomRestrBy To comm c, 179 MapDomRestrTo (definition), 151 MapDomRestrTo assoc, 158 MapDomRestrTo assoc c, 178 MapDomRestrTo By, 159 MapDomRestrTo By c, 179 MapDomRestrTo By comm, 159 MapDomRestrTo By comm c, 179 MapDomRestrTo canon, 177 MapDomRestrTo Card ub l, 175 MapDomRestrTo Card ub r, 175 MapDomRestrTo Dom, 158 MapDomRestrTo Dom c, 179 MapDomRestrTo empty m, 158 MapDomRestrTo empty m 1 , 158 MapDomRestrTo ext, 160 MapDomRestrTo ext l, 160 MapDomRestrTo ext r, 160 MapDomRestrTo idempotent, 158 MapDomRestrTo idempotent c, 179 MapDomRestrTo m empty, 158 MapDomRestrTo m empty 1 , 158 MapDomRestrTo semantics, 151 MapDomRestrTo To comm, 159 MapDomRestrTo To comm c, 179 MapDomRestr disjoint, 172 MapDom canon, 177 MapDom Dom, 153 MapDom semantics 1 , 153 MapDom semantics 2 , 153 MapDom semantics 3 , 153 MapDom semantics 4 , 153 MapDom Split 1 , 159 MapDom Split 1 c, 180 MapDom Split 2 , 159 MapDom Split 2 c, 180 MapDom Split 3 , 159 MapDom Split 3 c, 180 MapEmptyp (definition), 150 MapEmptyp complete, 151 MapEmptyp correct, 151 MapFold (definition), 162 MapFold1 (definition), 162 MapFold1 as Fold, 182 MapFold1 as Fold 1 , 182 MapFold1 ext, 182 MapFold1 state (definition), 163 MapFold as fold, 165 MapFold as fold 1 , 164 MapFold canon, 177 MapFold canon 1 , 177 MapFold distr l, 184 MapFold distr r, 183 MapFold distr r 1 , 183 MapFold empty, 162 MapFold ext, 182 MapFold ext f , 182 MapFold ext f 1 , 182 MapFold M1 , 163 MapFold Merge disjoint, 183 MapFold Merge disjoint 1 , 183 MapFold orb, 184 MapFold orb 1 , 184 MapFold Put behind disjoint, 183 MapFold Put behind disjoint 2 , 182 MapFold Put disjoint, 182 MapFold Put disjoint 1 , 182 MapFold Put disjoint 2 , 182 MapFold state (definition), 163 MapFold state stateless, 163 MapFold state stateless 1 , 163 MapGet (definition), 145 MapGet if commute, 146 MapGet if same, 146 MapGet M2 bit 0 , 145 MapGet M2 bit 0 0 , 145 MapGet M2 bit 0 1 , 145 MapGet M2 bit 0 2 , 146 MapGet M2 bit 0 if , 145 MapGet M2 both NONE, 146 MapMerge (definition), 149 MapMerge assoc, 157 MapMerge assoc c, 178 MapMerge canon, 177 MapMerge Card disjoint, 175 MapMerge Card lb l, 175 MapMerge Card lb r, 175 MapMerge Card ub, 175 MapMerge disjoint, 171 MapMerge disjoint Card, 174 MapMerge DomRestrBy, 159 MapMerge DomRestrBy c, 179 MapMerge DomRestrTo, 159 MapMerge DomRestrTo c, 179 MapMerge empty l, 157 MapMerge empty m, 157 MapMerge empty m 1 , 157 MapMerge empty m c, 178 MapMerge empty r, 157 MapMerge ext, 157 MapMerge ext l, 157 MapMerge ext r, 157 MapMerge idempotent, 157 MapMerge idempotent c, 178 MapMerge m empty, 157 MapMerge m empty 1 , 157 MapMerge RestrTo l, 158 MapMerge RestrTo l c, 178 MapMerge Restr Card, 174 MapMerge semantics, 149 MapPut (definition), 147 MapPut1 (definition), 146 MapPut1 canon, 176 MapPut1 semantics, 147 MapPut1 semantics′, 147 MapPut1 semantics 1 , 146 MapPut1 semantics 2 , 146 MapPut1 semantics 3 , 146 MapPut as Merge, 157 MapPut as Merge c, 178 MapPut behind (definition), 147 MapPut behind as before, 148 MapPut behind as before 1 , 148 MapPut behind as Merge, 157 MapPut behind as Merge c, 178 MapPut behind canon, 176 MapPut behind ext, 157 MapPut behind new, 148 MapPut behind semantics, 148 MapPut behind semantics 3 1 , 148 MapPut canon, 176 MapPut ext, 157 MapPut semantics, 147 MapPut semantics 1 , 147 MapPut semantics 2 , 147 MapPut semantics 2 1 , 147 MapPut semantics 2 2 , 147 MapPut semantics 3 1 , 147 MapRemove (definition), 148 MapRemove as RestrBy, 158 MapRemove as RestrBy c, 178 MapRemove canon, 177 MapRemove ext, 158 MapRemove semantics, 149 MapSingleton (definition), 145 MapSingleton semantics, 145 MapSplit Card, 174 MapSubset (definition), 169 MapSubset 1 (definition), 169 MapSubset 1 Dom, 170 MapSubset 1 imp, 169 MapSubset 2 (definition), 169 MapSubset 2 imp, 169 MapSubset antisym, 169 MapSubset antisym c, 180 MapSubset card eq, 175 MapSubset card eq 1 , 175 MapSubset Card le, 175 MapSubset c 1 , 177 MapSubset c 2 , 177 MapSubset Disjoint, 172 MapSubset Disjoint l, 172 MapSubset Disjoint r, 172 MapSubset DomRestrBy l, 170 MapSubset DomRestrBy mono, 170 MapSubset DomRestrTo l, 170 MapSubset DomRestrTo mono, 170 MapSubset DomRestrTo r, 170 MapSubset Dom 1 , 170 MapSubset Dom 2 , 170 MapSubset ext, 170 MapSubset imp 1 , 169 MapSubset imp 2 , 169 MapSubset Merge l, 170 MapSubset Merge mono, 170 MapSubset Merge r, 170 MapSubset Put, 170 MapSubset Put behind, 170 MapSubset Put behind mono, 170 MapSubset Put mono, 170 MapSubset refl, 169 MapSubset Remove, 170 MapSubset Remove mono, 170 MapSubset trans, 169 MapSweep (definition), 161 MapSweep1 (definition), 161 MapSweep2 (definition), 161 MapSweep semantics 1 , 161 MapSweep semantics 1 1 , 161 MapSweep semantics 2 , 162 MapSweep semantics 2 1 , 161 MapSweep semantics 2 2 , 162 MapSweep semantics 3 , 162 MapSweep semantics 3 1 , 162 MapSweep semantics 4 , 162 MapSweep semantics 4 1 , 162 Map disjoint M0 , 171 map dom empty 1 , 169 map dom empty 2 , 169 Map M0 disjoint, 171 Map of alist (definition), 164 Map of alist canon, 177 Map of alist of Map, 164 Map of alist of Map c, 180 Map of alist semantics, 164 mem (definition), 93 Mem, 93 meq (definition), 120 meq congr, 121 meq left, 121 meq refl, 120 meq right, 121 meq sym, 121 meq trans, 120 min (definition), 26 minus (definition), 20 minus INR, 72 minus n n, 20 minus n O, 20 minus plus, 20 minus plus simpl, 20 minus R0 , 68 minus Rge, 71 minus Rgt, 71 minus Sn m, 20 min case, 26 min SS, 26 mkNat (constructor), 119 mkNat injective, 119 modulo, 29 multiplicity (definition), 120 multiset (inductive), 120 multiset twist1 , 121 multiset twist2 , 121 mult 1 n, 21 mult assoc l, 21 mult assoc r, 21 mult INR, 72 mult le, 21 mult le conv 1 , 21 mult lt, 21 mult minus distr, 21 mult non zero, 67 mult n 1 , 21 mult O le, 21 mult plus distr, 21 mult plus distr r, 21 mult sym, 21 mul factor (definition), 76 mul factor gt, 76 mul factor gt f , 76 mul factor wd, 76 munion (definition), 121 munion ass, 121 munion comm, 121 munion empty left, 121 munion empty right, 121 munion perm left, 121 munion rotate, 121 My special variable (axiom), 23 My special variable0 (axiom), 54 My special variable1 (axiom), 54 Nat (inductive), 119 natinf (inductive), 141 natlike ind, 57 nat le (definition), 154 nat le complete, 154 nat le complete conv, 154 nat le correct, 154 nat le correct conv, 154 Nat O (definition), 119 nat of ad (definition), 154 nat of ad double, 156 nat of ad double plus un, 156 nat of ad of nat, 155 nat of Nat (axiom), 119 nat of nat returns (axiom), 119 Nat po (definition), 120 nat total order, 17 NEG (constructor), 30 negb (definition), 12 negb andb, 12 negb elim, 12 negb intro, 12 negb orb, 12 negb sym, 12 NEG add, 57 NEG xI , 57 NEG xO, 57 neq (definition), 45 neq O lt, 17 neutral (variable), 162, 182, 183 neutral′ (variable), 183 Newman, 122, 127 newMap (definition), 145 newMap semantics, 145 new var, 46 ni (constructor), 141 nil (constructor), 81, 83 Nil (definition), 134 nil cons, 81, 83 ni le (definition), 142 ni le antisym, 142 ni le le, 142 ni le min 1 , 142 ni le min 2 , 142 ni le min induc, 142 ni le refl, 142 ni le total, 142 ni le trans, 142 ni min (definition), 141 ni min assoc, 142 ni min case, 142 ni min comm, 142 ni min idemp, 142 ni min inf l, 142 ni min inf r, 142 ni min O l, 142 ni min O r, 142 nleft (variable), 182 NNPP, 4 noetherian (definition), 126 noetherian (inductive), 118 Noetherian (definition), 118 Noetherian contains Noetherian, 122 NONE (constructor), 144 Non disjoint union, 108 Non disjoint union′, 108 Noone in empty, 98 not all ex not, 5, 6 not all not ex, 5, 6 not and, 9 not and or, 4 not Empty Add, 98 not empty Inhabited, 99 not eq, 26 not eq sym, 27 not even and odd, 26 not ex all not, 5, 6 not ex not all, 5, 6 not false is true, 11 not ge, 26 not gt, 26 not imp, 9 not imply elim, 4 not imply elim2 , 4 not included empty Inhabited, 99 not injective elim, 114 not INR O, 72 not Isnil cons, 92 not le, 26 not lt, 26 not not, 8 not or, 8 not or and, 5 not O INR, 72 not Req, 65 not Rle, 66 not SIncl empty, 100 not true is false, 11 not Zeq, 46 not Zge, 46 not Zgt, 46 not Zle, 46 not Zlt, 46 no fixpoint negb, 12 nright (variable), 182 NRplus (axiom), 62 nth (definition), 85 nth (inductive), 23 Nth, 94 ntheq eqst, 88 Nth func (definition), 94 nth in or default, 85 nth le, 23 nth le length, 94 nth lt O, 94 nth O (constructor), 23 nth ok (definition), 85 nth S (constructor), 23 nth spec (inductive), 94 nth spec O (constructor), 94 nth spec S (constructor), 94 nth S cons, 85 Nul (constructor), 34 odd (inductive), 26 odd div2 , 29 odd double, 29 odd S (constructor), 26 odd S2n, 29 OMEGA1 , 48 OMEGA10 , 48 OMEGA11 , 49 OMEGA12 , 49 OMEGA13 , 49 OMEGA14 , 49 OMEGA15 , 49 OMEGA16 , 49 OMEGA17 , 49 OMEGA18 , 49 OMEGA19 , 49 OMEGA2 , 48 OMEGA20 , 49 OMEGA3 , 48 OMEGA4 , 48 OMEGA5 , 48 OMEGA6 , 48 OMEGA7 , 48 OMEGA8 , 48 OMEGA9 , 48 one IZR lt1 , 73 one IZR r R1 , 73 op (variable), 102, 162, 182, 183 Op (definition), 35 op′ (variable), 183 option (inductive), 144 option sum, 144 op rotate, 102 orb (definition), 11 orb assoc, 13 orb b false, 12 orb b true, 12 orb false b, 12 orb false elim, 12 orb false intro, 12 orb neg b, 13 orb prop, 12 orb prop2 , 12 orb sym, 13 orb true b, 12 orb true elim, 12 orb true intro, 12 Order (inductive), 101 or not and, 5 or to imply, 4 O or S, 23 pair sp, 163 PER (inductive), 101 perm left, 102 perm right, 102 Pigeonhole, 115 Pigeonhole bis, 117 Pigeonhole principle, 115 Pigeonhole ter, 117 plus assoc l, 18 plus assoc r, 18 plus frac part1 , 74 plus frac part2 , 74 plus INR, 72 plus Int part1 , 74 plus Int part2 , 74 plus is O, 18 plus is one, 19 plus IZR, 72 plus IZR NEG POS, 72 plus minus, 20 plus permute, 18 plus permute 2 in 4 , 19 plus Snm nSm, 18 plus sym, 18 Pos (constructor), 34 POS (constructor), 30 positive (inductive), 30 positive to nat (definition), 31 positive to nat 2 , 156 positive to nat 4 , 156 positive to nat mult, 156 POS add, 57 POS gt ZERO, 59 pos Rsqr, 70 pos Rsqr1 , 70 POS xI , 57 POS xO, 57 pow (definition), 78 Pow (definition), 130 Power (definition), 134 Power set (inductive), 105 Power set Inhabited, 105 Power set PO (definition), 105 pred of minus, 20 Preorder (inductive), 101 prop eps, 76 p xor (definition), 137 quotient, 29 R0 (axiom), 63 R0 fp O, 73 R1 (variable), 129, 132, 135 R1 (axiom), 63 R1 neq R0 (axiom), 64 R2 (variable), 129, 132, 135 Rabsolu (definition), 75 Rabsolu def1 , 75 Rabsolu def2 , 75 Rabsolu left, 75 Rabsolu minus sym, 75 Rabsolu mult, 75 Rabsolu no R0 , 75 Rabsolu pos, 75 Rabsolu pos eq, 75 Rabsolu pos lt, 75 Rabsolu R0 , 75 Rabsolu Rabsolu, 75 Rabsolu right, 75 Rabsolu Rinv, 75 Rabsolu triang, 75 Rabsolu triang inv, 75 Rdiv (definition), 63 reflexive (definition), 127 Reflexive (definition), 101 Rel (definition), 103 relation (definition), 127 relation (inductive), 30 Relation (definition), 101 rename, 57 Req EM , 65 rev (definition), 85 rev ind, 85 Rge (definition), 63 Rge ge eq, 70 Rge gt trans, 71 Rge le, 65 Rge minus, 71 Rge monotony, 71 Rge plus plus r, 71 Rge Ropp, 69 Rge RO Ropp, 69 Rge r plus plus, 71 Rge trans, 71 Rgt (definition), 63 Rgt ge, 71 Rgt ge trans, 71 Rgt minus, 71 Rgt not eq, 65 Rgt not le, 71 Rgt plus plus r, 71 Rgt Ropp, 69 Rgt RoppO, 71 Rgt RO Ropp, 69 Rgt r plus plus, 71 Rgt trans, 71 rightT (constructor), 61 right lex (constructor), 129 right prefix, 134 right sym (constructor), 130 Rinv (axiom), 63 Rinv l (axiom), 64 Rinv lt, 70 Rinv l sym, 67 Rinv neq R0 , 68 Rinv r, 67 Rinv R1 , 68 Rinv Rinv, 68 Rinv Rmult, 69 Rinv Rmult simpl, 69 Rinv r simpl l, 69 Rinv r simpl m, 69 Rinv r simpl r, 69 Rinv r sym, 67 Rle (definition), 63 Rle antisym, 66 Rle anti compatibility, 69 Rle anti monotony, 70 Rle compatibility, 69 Rle compatibility r, 69 Rle ge, 65 Rle le eq, 66 Rle lt trans, 66 Rle minus, 70 Rle monotony, 70 Rle monotony r, 70 Rle not, 66 Rle Ropp, 69 Rle RO Ropp, 69 Rle sym, 71 Rle sym1 , 71 Rle sym2 , 71 Rle trans, 66 Rlt (axiom), 63 Rlt antirefl, 65 Rlt antisym (axiom), 64 Rlt anti compatibility, 69 Rlt anti monotony, 70 Rlt compatibility (axiom), 64 Rlt compatibility r, 69 Rlt eps2 eps, 76 Rlt eps4 eps, 76 Rlt ge not, 66 Rlt le, 65 Rlt le not, 66 Rlt le trans, 66 Rlt minus, 70 Rlt monotony (axiom), 64 Rlt monotony r, 70 Rlt monotony rev, 70 Rlt not eq, 65 Rlt not ge, 71 Rlt R0 R1 , 70 Rlt Rinv, 70 Rlt Rinv2 , 70 Rlt Ropp, 69 Rlt RoppO, 71 Rlt RO Ropp, 69 Rlt r plus R1 , 71 Rlt r r plus R1 , 71 Rlt sym, 71 Rlt trans (axiom), 64 Rmax (definition), 74 Rmax Rle, 75 Rmin (definition), 74 Rminus (definition), 63 Rminus distr, 68 Rminus eq, 68 Rminus eq contra, 68 Rminus fp1 , 74 Rminus fp2 , 74 Rminus Int part1 , 74 Rminus Int part2 , 74 Rminus le, 70 Rminus lt, 70 Rmin Rgt, 74 Rmin Rgt l, 74 Rmin Rgt r, 74 Rmult (axiom), 63 Rmult 1l (axiom), 64 Rmult 1r, 67 Rmult assoc (axiom), 64 Rmult gt, 71 Rmult lt, 70 Rmult lt 0 , 71 Rmult lt pos, 71 Rmult mult r, 67 Rmult ne, 67 Rmult Ol, 67 Rmult Or, 67 Rmult Rplus distr (axiom), 64 Rmult Rplus distrl, 67 Rmult sym (axiom), 64 Ropp (axiom), 63 Ropp distr1 , 68 Ropp distr2 , 68 Ropp mul1 , 68 Ropp mul2 , 68 Ropp neq, 68 Ropp O, 68 Ropp Rinv, 69 Ropp Ropp, 68 Ropp Ropp IZR, 72 Rplus (inductive), 115 Rplus (axiom), 63 Rplus 0 (constructor), 115 Rplus assoc (axiom), 64 Rplus contains R, 117 Rplus eq R0 , 72 Rplus eq R0 l, 72 Rplus le lt lt, 69 Rplus lt, 69 Rplus lt le lt, 69 Rplus n (constructor), 115 Rplus ne, 66 Rplus ne i, 67 Rplus Ol (axiom), 64 Rplus Or, 66 Rplus plus r, 67 Rplus Ropp, 67 Rplus Ropp l, 67 Rplus Ropp r (axiom), 64 Rplus Rsr eq R0 , 72 Rplus Rsr eq R0 l, 72 Rplus sym (axiom), 63 Rsqr (definition), 67 Rsqr O, 68 Rsqr r R0 , 68 Rstar (definition), 125 Rstar (inductive), 115 Rstar′ (definition), 125 Rstar′ R, 125 Rstar′ reflexive, 125 Rstar′ Rstar, 125 Rstar1 (inductive), 115 Rstar1 0 (constructor), 115 Rstar1 1 (constructor), 115 Rstar1 n (constructor), 115 RstarRplus RRstar, 117 Rstar 0 (constructor), 115 Rstar cases, 117 Rstar coherence, 126 Rstar contains R, 117 Rstar contains Rplus, 117 Rstar equiv Rstar1 , 117 Rstar imp coherent, 122 Rstar n (constructor), 115 Rstar R, 125 Rstar reflexive, 117, 125 Rstar Rstar′, 125 Rstar transitive, 117, 125 rst refl (constructor), 129 rst step (constructor), 129 rst sym (constructor), 129 rst trans (constructor), 129 Rsym imp notRsym, 100 Rsym imp Rstarsym, 117 RTheory, 65 rt refl (constructor), 128 rt step (constructor), 128 rt trans (constructor), 128 R dist (definition), 76 R dist plus, 77 R dist pos, 77 R dist refl, 77 R dist sym, 77 R dist tri, 77 R met (definition), 77 r Rmult mult, 67 r Rplus plus, 67 same relation (definition), 101, 128 same relation is equivalence, 100 Same set (definition), 97 seq (definition), 123 seq congr, 124 seq left, 124 seq refl, 123 seq right, 124 seq sym, 123 seq trans, 123 set (definition), 89 Set (inductive), 87 setcover intro, 109 setcover inv, 110 Setminus (definition), 97 Setminus intro, 99 set add (definition), 90 set add elim, 91 set add intro, 91 set add intro1 , 91 set add intro2 , 91 set add not empty, 91 set diff (definition), 90 set diff elim1 , 92 set diff intro, 92 set fold left (definition), 92 set fold right (definition), 92 set In (definition), 91 set inter (definition), 90 set inter elim, 92 set inter elim1 , 91 set inter elim2 , 92 set inter intro, 91 set In dec, 91 set map (definition), 92 set mem (definition), 90 set mem complete1 , 91 set mem complete2 , 91 set mem correct1 , 91 set mem correct2 , 91 set mem ind, 91 set power (definition), 92 set prod (definition), 92 set remove (definition), 90 set union (definition), 90 set union elim, 91 set union intro, 91 set union intro1 , 91 set union intro2 , 91 sigT (inductive), 61 sigTT (inductive), 61 Simplify add, 110 simpl add l, 36 simpl add r, 36 simpl fact, 78 simpl gt plus l, 20 simpl le plus l, 18 simpl lt plus l, 18 simpl plus l, 18 sincl add x, 109 Singleton (definition), 123 Singleton (inductive), 97 SingletonBag (definition), 120 Singleton atomic, 111 Singleton intro, 98 Singleton inv, 98 Singleton is finite, 112 single limit, 77 single z r R1 , 73 singlx, 108 SOME (constructor), 144 sp noswap (constructor), 130 sp swap (constructor), 130 Sstar contains Rstar, 117 star monotone, 117 State (variable), 163 Strict Included (definition), 97 Strict Included intro, 99 Strict Included inv, 100 Strict Included strict, 99 Strict inclusion is transitive, 106 Strict inclusion is transitive with inclusion,

106 Strict inclusion is transitive with inclusion left,

106 Strict Rel is Strict Included, 105 Strict Rel of (definition), 103 Strict Rel Transitive, 103 Strict Rel Transitive with Rel, 103 Strict Rel Transitive with Rel left, 103 Strict super set contains new element, 99 Strongly confluent (definition), 115 Strong confluence, 122 Strong confluence direct, 122 Str nth (definition), 88 Str nth plus, 88 Str nth tl (definition), 88 Str nth tl plus, 88 Subtract (definition), 97 Subtract intro, 100 Subtract inv, 100 sub add, 36 Sub Add new, 110 sub add one, 32 sub neg (definition), 34 sub pos (definition), 34 sub pos SUPERIEUR, 35 sub pos x x, 35 sub un (definition), 32 sumboolT (inductive), 61 sumbool and, 15 sumbool not, 15 sumbool of bool, 14 sumbool or, 15 sumorT (inductive), 61 sum f (definition), 79 sum f R0 (definition), 78 sum inequa Rle lt, 69 sum nat (definition), 78 sum nat f (definition), 78 sum nat f O (definition), 78 sum nat O (definition), 78 sup (constructor), 135 SUPERIEUR (constructor), 30 SUPERIEUR POS, 40 swapprod (inductive), 130 SwapProd (definition), 136 swap Acc, 136 symmetric (definition), 127 Symmetric (definition), 101 symprod (inductive), 130 Symprod (definition), 136 sym EqSt, 88 S INR, 72 S O plus INR, 72 S pred, 17 tail (definition), 81, 83 tech limit, 77 tech limit contr, 77 tech pow Rmult, 78 tech pow Rplus, 78 tech Rgt minus, 71 tech Rplus, 70 tech single z r R1 , 73 tech up, 73 times (variable), 183, 184 times1 (definition), 37 times1 convert, 37 times add distr, 38 times assoc, 38 times convert, 37 times sym, 38 times true sub distr, 38 tl (definition), 87 Tl, 93 tl nth tl, 88 Totally ordered (inductive), 104 Totally ordered definition (constructor), 104 total order, 65 total order Rge, 66 total order Rgt, 66 total order Rle, 66 total order Rle Rlt eq, 66 total order Rlt, 66 total order Rlt Rle, 66 total order T (axiom), 64 transitive (definition), 127 Transitive (definition), 101 transp (definition), 129 trans clos (definition), 133 trans EqSt, 88 treesort twist1 , 121, 124 treesort twist2 , 121, 124 Triple (inductive), 97 Triple as Couple, 108 Triple as Couple Singleton, 108 Triple as union, 108 Triple l (constructor), 97 Triple m (constructor), 97 Triple r (constructor), 97 triv Nat, 119 true sub convert, 36 true xorb, 14 try find (definition), 95 Try find, 95 TS dec (variable), 95 twist, 102 t step (constructor), 128 t trans (constructor), 128 Uncons, 93 unfold Stream, 88 union (definition), 123, 129 Union (definition), 135 Union (inductive), 97 Union absorbs, 107 Union add, 108 union ass, 124 Union associative, 107 union comm, 124 Union commutative, 107 union empty left, 123 union empty right, 123 Union idempotent, 107 Union increases l, 106 Union increases r, 106 Union introl (constructor), 97 Union intror (constructor), 97 Union inv, 98 Union is finite (constructor), 111 Union is Lub, 106 Union minimal, 106 union perm left, 124 Union preserves Finite, 112 union rotate, 124 uniset (inductive), 123 uniset twist1 , 124 uniset twist2 , 124 Un suivi de (definition), 34 up (axiom), 63 Upper Bound (inductive), 104 Upper Bound definition (constructor), 104 up tech, 73 US, 34 USH , 34 weaken Zcompare Zplus compatible, 39 weak assoc, 37 weak Zcompare Zplus compatible, 39 weak Zmult plus distr r, 39 well founded gtof , 24 well founded ltof , 24 well founded lt compat, 24 wf clos trans, 133 wf disjoint sum, 132 wf incl, 132 wf inverse image, 133 wf lexprod, 136 wf lex exp, 134 wf swapprod, 137 wf symprod, 136 wf union, 135 wf WO, 135 without div Od, 67 without div Oi, 67 without div Oi1 , 67 without div Oi2 , 67 without div O contr, 67 WO (inductive), 135 wof (definition), 135 xH (constructor), 30 xI (constructor), 30 xO (constructor), 30 xorb (definition), 11 xorb assoc, 14 xorb comm, 14 xorb eq, 14 xorb false, 13 xorb move l r 1 , 14 xorb move l r 2 , 14 xorb move r l 1 , 14 xorb move r l 2 , 14 xorb nilpotent, 14 xorb true, 13 Zabs (definition), 40 Zabs eq, 40 ZC1 , 35 ZC2 , 35 ZC3 , 35 ZC4 , 36 Zcompare (definition), 39 Zcompare ANTISYM , 39 Zcompare EGAL, 39 Zcompare egal dec, 60 Zcompare elim, 60 Zcompare eq case, 60 Zcompare et un, 41 Zcompare n S, 41 Zcompare rec, 55 Zcompare trans SUPERIEUR, 40 Zcompare x x, 60 Zcompare Zmult compatible, 47 Zcompare Zopp, 39 Zcompare Zplus compatible, 40 Zcompare Zplus compatible2 , 47 Zdiv2 (definition), 60 Zdiv2 pos (definition), 59 Zegal left, 46 Zeq add S, 42 Zeq bool (definition), 57 Zeq S, 42 ZERO (constructor), 30 zerob (definition), 9 zerob false elim, 9 zerob false intro, 9 zerob true elim, 9 zerob true intro, 9 zerop, 25 Zero left, 37 ZERO le inj , 56 ZERO le POS, 59 Zero mult left, 38 Zero mult right, 38 Zero right, 37 Zero suivi de (definition), 34 Zeven (definition), 59 Zeven bool (definition), 59 Zeven dec, 59 Zeven div2 , 60 Zeven not Zodd, 59 Zeven odd dec, 59 Zge (definition), 40 Zge bool (definition), 57 Zge le, 42 Zge left, 46 Zge mult simpl, 48 Zge trans, 42 Zge Zcompare, 60 Zge Zmult pos compat, 48 Zge Zmult pos left, 48 Zge Zmult pos right, 48 Zgt (definition), 40 Zgt antirefl, 41 Zgt bool (definition), 57 Zgt left, 46 Zgt left gt, 46 Zgt left rev, 46 Zgt le S, 41 Zgt le trans, 41 Zgt lt, 42 Zgt mult simpl, 48 Zgt not le, 41 Zgt not sym, 41 Zgt n S, 41 Zgt pred, 41 Zgt reg l, 41 Zgt reg r, 41 Zgt S, 42 Zgt Sn n, 41 Zgt square simpl, 48 Zgt S le, 41 Zgt S n, 41 Zgt trans, 41 Zgt trans S, 42 Zgt Zcompare, 60 Zgt ZERO mult, 47 ZL0 , 32 ZL1 , 32 ZL10 , 35 ZL11 , 35 ZL12 , 35 ZL12bis, 35 ZL13 , 35 ZL14 , 35 ZL15 , 35 ZL16 , 39 ZL17 , 39 ZL2 , 32 ZL3 , 32 ZL4 , 32 ZL4 inf , 56 ZL5 , 32 ZL6 , 33 ZL7 , 33 ZL8 , 33 Zle (definition), 40 Zle antisym, 42 Zle bool (definition), 57 Zle ge, 42 Zle gt S, 41 Zle gt trans, 41 Zle left, 46 Zle left rev, 46 Zle le S, 43 Zle lt n Sm, 43 Zle lt or eq, 43 Zle lt reg, 44 Zle lt trans, 43 Zle min l, 43 Zle min r, 43 Zle mult, 47 Zle mult approx, 47 Zle mult simpl, 48 Zle n, 42 Zle not gt, 41 Zle not lt, 43 Zle n S, 42 Zle n Sn, 42 Zle or lt, 43 Zle plus minus, 44 Zle plus plus, 44 Zle pred n, 42 Zle refl, 42 Zle reg l, 44 Zle reg r, 44 Zle Sn n, 42 Zle S gt, 41 Zle S n, 41 Zle trans, 42 Zle trans S, 42 Zle Zcompare, 60 Zle ZERO mult, 47 Zle Zmult pos left, 47 Zle Zmult pos right, 47 ZLII , 33 ZLIS, 33 ZLSI , 33 ZLSS, 33 Zlt (definition), 40 Zlt bool (definition), 57 Zlt gt, 42 Zlt left, 46 Zlt left lt, 46 Zlt left rev, 46 Zlt le reg, 44 Zlt le S, 43 Zlt le trans, 43 Zlt le weak, 43 Zlt minus, 44 Zlt not eq, 60 Zlt not le, 43 Zlt not sym, 43 Zlt n n, 43 Zlt n S, 43 Zlt n Sm le, 43 Zlt n Sn, 42 Zlt O minus lt, 44 Zlt pred, 43 Zlt pred n n, 43 Zlt reg l, 44 Zlt reg r, 44 Zlt S, 42 Zlt S n, 43 Zlt trans, 43 Zlt Zcompare, 60 Zlt ZERO pred le ZERO, 59 Zmin (definition), 43 Zminus (definition), 44 Zminus n n, 44 Zminus n O, 44 Zminus plus, 44 Zminus plus simpl, 44 Zminus Sn m, 44 Zminus Zplus compatible, 60 Zmin case, 43 Zmin n n, 43 Zmin or, 43 Zmin plus, 61 Zmin SS, 43 Zmult (definition), 38 Zmult 1 n, 44 Zmult assoc, 38 Zmult assoc l, 44 Zmult assoc r, 44 Zmult eq, 47 Zmult gt, 47 Zmult le, 47 Zmult le approx, 48 Zmult lt, 47 Zmult minus distr, 44 Zmult n 1 , 44 Zmult n O, 42 Zmult n Sm, 42 Zmult one, 38 Zmult permute, 44 Zmult plus distr (definition), 45 Zmult plus distr l, 44 Zmult plus distr r, 39 Zmult Sm n, 45 Zmult sym, 38 Zmult Zopp left, 46 Zmult Zopp Zopp, 38 Zmult Zplus distr (definition), 45 Zne (definition), 45 Zneq bool (definition), 57 Zne left, 46 Znot eq S, 42 Zn Sn, 42 Zodd (definition), 59 Zodd bool (definition), 59 Zodd dec, 59 Zodd div2 , 60 Zodd not Zeven, 59 Zopp (definition), 37 Zopp intro, 37 Zopp NEG, 37 Zopp one, 46 Zopp Zmult, 38 Zopp Zmult l, 46 Zopp Zmult r, 46 Zopp Zopp, 37 Zopp Zplus, 37 Zplus (definition), 36 Zplus assoc, 37 Zplus assoc l, 43 Zplus assoc r, 43 Zplus inverse l, 37 Zplus inverse r, 37 Zplus minus, 44 Zplus n O, 42 Zplus n Sm, 42 Zplus permute, 43 Zplus simpl, 37 Zplus Snm nSm, 44 Zplus sym, 37 Zplus S n, 45 Zplus unit left, 42 Zplus unit right, 42 Zpred (definition), 41 Zpred Sn, 42 Zred factor0 , 46 Zred factor1 , 47 Zred factor2 , 47 Zred factor3 , 47 Zred factor4 , 47 Zred factor5 , 47 Zred factor6 , 47 Zs (definition), 41 ZS, 34 ZSH , 34 Zsimpl gt plus l, 41 Zsimpl gt plus r, 41 Zsimpl le plus l, 43 Zsimpl le plus r, 43 Zsimpl lt plus l, 44 Zsimpl lt plus r, 44 Zsimpl plus l, 42 Zs pred, 42 Z eq dec, 55 Z eq mult, 47 Z ge dec, 55 Z ge lt dec, 56 Z gt dec, 55 Z gt le dec, 56 Z le dec, 55 Z le gt dec, 56 Z le lt eq dec, 56 Z lt dec, 55 Z lt ge dec, 55 Z lt induction, 57 Z modulo 2 , 60 Z noteq dec (definition), 56 Z notzerop (definition), 56 Z of entier (definition), 57 Z R minus, 72 Z zerop, 56 of chain (definition), 105 of Complete (definition), 104 of Conditionally complete (definition), 104 of covers (definition), 103 of cpo (definition), 105 of equivalence (definition), 102 of order (definition), 102 of PER (definition), 102 of PO (definition), 103 of Power set (definition), 105 of preorder (definition), 102