The Nature of Natural Numbers - Peano Axioms and Arithmetics: A Formal Development in PowerEpsilon

Transcription

1 The Nature of Natural Numbers - Peano Axioms and Arithmetics: A Formal Development in PowerEpsilon Ming-Yuan Zhu CoreTek Systems, Inc. 11 th Floor, 1109, CEC Building 6 South Zhongguancun Street Beijing People s Republic of China September 25, 2012 This article is dedicated to the 87 th birthday of my father. He has contributed his whole life to the development of science and technology of China. He will always live in my memory for his dedication, courage, spirit and love. Abstract PowerEpsilon is my own development of mathematical theorem proof development system. It belongs to a large family of computer-based tools whose purpose is to help in proving theorems, namely, Automath, COQ, Nqthm, Mizar, LCF, Nuprl, Isabelle, Lego, HOL, PVS and ACL2. In this paper, we will present a formal investigation of natural numbers, Peano axioms and arithmetics using PowerEpsilon. 1 Introduction We all know about natural numbers. We are using natural numbers everyday for counting and ordering. However what is the nature of natural numbers and how the natural numbers are formed? These questions are concerned by mathematicians for several hundred years. Properties of the natural numbers related to divisibility, such as the distribution of prime numbers, are studied in number theory. Problems concerning counting and ordering, such as partition enumeration, are studied in combinatorics. Historically, the precise mathematical definition of the natural numbers developed with some difficulty. The Peano axioms state conditions that any successful definition must satisfy. Certain constructions show that, given set theory, models of the Peano postulates must exist. In this paper, we will provide a deep investigation of formal definition of natural numbers in type theory 1. PowerEpsilon, currently developed by author, is a strongly-typed polymorphic functional programming language based on Martin-Löf s type theory [10, 8, 9] and the calculus of constructions [5]. In PowerEpsilon, the concept of limit of type universe hierarchies and a scheme for inductive define types are introduced. The system can be used as both a programming language with a very rich set of data structures and a metalanguage for formalizing constructive mathematics. The system has been implemented using the software development system AUTOSTAR constructed by author [12]. PowerEpsilon is a proof checker much similar to other mechanical proof checkers, such as ACL2[2], COQ[4, 1], LCF[6], Isabelle[11], Nuprl[3] and HOL[7], which are completely formal user-controlled systems. However, PowerEpsilon is more powerful than LCF and Nuprl, in which the equality and induction rules for arbitrary inductive types are definable. 1 This work is supported in part by the TRUSTIE Project of Hi-Tech Research and Development Program of China (863 Program) under Grant No. 2007AA010304, by the Open Fund of the State Key Laboratory of Software Development Environment under Grant No. SKLSDE-2010KF-0X, Beijing University of Aeronautics and Astronautics, and by the National Basic Research Program of China (973 Program) under Grant No. 2005CB

2 2 Peano Axioms 2.1 History of Peano Axioms In mathematical logic, the Peano axioms, also known as the Dedekind-Peano axioms or the Peano postulates, are a set of axioms for the natural numbers presented by the 19th century Italian mathematician Giuseppe Peano. These axioms have been used nearly unchanged in a number of metamathematical investigations, including research into fundamental questions of consistency and completeness of number theory. The need for formalism in arithmetic was not well appreciated until the work of Hermann Grassmann, who showed in the 1860s that many facts in arithmetic could be derived from more basic facts about the successor operation and induction. In 1881, Charles Sanders Peirce provided an axiomatization of natural-number arithmetic. In 1888, Richard Dedekind proposed a collection of axioms about the numbers, and in 1889 Peano published a more precisely formulated version of them as a collection of axioms in his book, The principles of arithmetic presented by a new method (Latin: Arithmetices principia, nova methodo exposita). The Peano axioms contain three types of statements. The first axiom asserts the existence of at least one member of the set number. The next four are general statements about equality; in modern treatments these are often considered axioms of the underlying logic. The next three axioms are first-order statements about natural numbers expressing the fundamental properties of the successor operation. The ninth, final axiom is a second order statement of the principle of mathematical induction over the natural numbers. A weaker first-order system called Peano arithmetic is obtained by explicitly adding the addition and multiplication operation symbols and replacing the second-order induction axiom with a first-order axiom schema. Peano formulated his axioms, the language of mathematical logic was in its infancy. The system of logical notation he created to present the axioms did not prove to be popular, although it was the genesis of the modern notation for set membership (, which is from Peano s ϵ) and implication (, which is from Peano s reversed C.) Peano maintained a clear distinction between mathematical and logical symbols, which was not yet common in mathematics; such a separation had first been introduced in the Begriffsschrift by Gottlob Frege, published in Peano was unaware of Frege s work and independently recreated his logical apparatus based on the work of Boole and Schröder. 2.2 Formulation of Peano Axioms The Peano axioms define the arithmetical properties of natural numbers, usually represented as a set N or The signature (a formal language s non-logical symbols) for the axioms includes a constant symbol 0 and a unary function symbol S. The constant 0 is assumed to be a natural number: 1. 0 is a natural number. The next four axioms describe the equality relation. 2. For every natural number x, x = x. That is, equality is reflexive. 3. For all natural numbers x and y, if x = y, then y = x. That is, equality is symmetric. 4. For all natural numbers x, y and z, if x = y and y = z, then x = z. That is, equality is transitive. 5. For all a and b, if a is a natural number and a = b, then b is also a natural number. That is, the natural numbers are closed under equality. The remaining axioms define the arithmetical properties of the natural numbers. The naturals are assumed to be closed under a single-valued successor function S. 6. For every natural number n, S(n) is a natural number. Peano s original formulation of the axioms used 1 instead of 0 as the first natural number. This choice is arbitrary, as axiom 1 does not endow the constant 0 with any additional properties. However, because 0 is the additive identity in arithmetic, most modern formulations of the Peano axioms start from 0. Axioms 1 and 6 define a unary representation of the natural numbers: the number 1 is S(0), 2 is S(S(0)) (which is also S(1)), and, in general, any natural number n is S n (0). The next two axioms define the properties of this representation. 7. For every natural number n, S(n) = 0 is False. That is, there is no natural number whose successor is For all natural numbers m and n, if S(m) = S(n), then m = n. That is, S is an injection. Axioms 1, 6, 7 and 8 imply that the set of natural numbers is infinite, because it contains at least the infinite subset {0, S(0), S(S(0)),...}, each element of which differs from the rest. To show that every natural number is included in this set requires an additional axiom, which is sometimes called the axiom of induction. This axiom provides a method for reasoning about the set of all natural numbers. 2

3 9. If K is a set such that: 0 is in K, and for every natural number n, if n is in K, then S(n) is in K, then K contains every natural number. The induction axiom is sometimes stated in the following form: 9. If ϕ is a unary predicate such that: ϕ(0) is true, and for every natural number n, if ϕ(n) is true, then ϕ(s(n)) is true, then ϕ(n) is true for every natural number n. In Peano s original formulation, the induction axiom is a second-order axiom. It is now common to replace this secondorder principle with a weaker first-order induction scheme. There are important differences between the second-order and first-order formulations, as discussed in the section below. Without the axiom of induction, the remaining Peano axioms give a theory equivalent to Robinson arithmetic, which can be expressed without second-order logic. 2.3 Natural Number in Type Theory Definition of Nat Inductive Type Nat def Nat =!(T : Prop) [T -> [T -> T] -> T]; Constructors of Nat def OO = \(T : Prop, x : T, y : [T -> T]) x; def SS = \(t : T : Prop, x : T, y : [T T, x, y)); Canonical Functions of Nat def IS_ZERO Bool, TT, \(x : Bool) FF); def ADD = \(n1 : n2 : n2, SS); def TIMES = \(n1 : n2 : n2)); def EXP = \(n1 : n2 n2)); def EQUAL = \(n1 : n2 : Nat) 3

4 n2), n2)))); def LESS = \(n1 : n2 @(IS_ZERO, n2), n2)))); def LESSEQ = \(n1 : n2 n2)))); def NLE = \(n1 : n2 n1, n1, n2)); def NGE = \(n1 : n2 : n2, n1); Predecessor Function Inductive Definition of Predecessor Function def T = \(x : y : Nat) x; def F = \(x : y : Nat) y; def PP [[Nat -> Nat -> Nat] -> Nat], \(u : [Nat -> Nat -> OO, OO), \(p : [[Nat -> Nat -> Nat] -> Nat], v : [Nat -> Nat @(p, T)), F); 4

5 Predecessor Function Defined by Pattern Matching dec PP : [Nat -> Nat]; def PP = pattern n is OO => m) => m end; Strong Specification of Predecessor Function def PredSpec =?(m n, m, m))); def MkPredSpec = \(n : m : n, m, m)))) <m, p>; dec PRED n); dec PredLem1 OO); def PredLem1 = let n = OO, m = OO, p n), q m) @(Equal, n, m, @(Equal, n, m, OO), p, q))); dec PredLem2 : [@(PredSpec, n))]; def PredLem2 = \(H n)) let m H), p H) 5

6 n, m, @(SS, n)), p, n, m, OO))) let P1 n, OO), P2 m, OO) in let p1 P1, P2, q), p2 P1, P2, q) in let u1 m, OO, p2), u2 n, OO, m, p1, u1) in let Q = \(z z)) in let u3 Q, n), m)), u3)), \(q m))) let Q = \(z z)) in let u Q, @(SS, @(SS, m))), u))); def PRED PredSpec, PredLem1, PredLem2); def n)); Properties of PP dec @(SS, n)), n); def @(SS, n))); dec n)); def PPSSEqLem2 = 6

7 n)))); Induction Rules dec NatInduct :!(P : [Nat -> Prop]) [@(P, OO) ->!(u : Nat) [@(P, u))] n)]; def NatInduct = \(P : [Nat -> Prop]) \(a OO)) \(f :!(u : Nat) [@(P, u))]) \(*n *n), *n)); dec PatternMatch :!(P : [Nat -> Prop]) [@(P, OO) ->!(p p)) n)]; def PatternMatch = \(P : [Nat -> Prop]) \(a OO), b :!(p p))) \(*n *n), a, \(x *n)); 3 Peano Arithmetic The Peano axioms can be augmented with the operations of addition and multiplication and the usual total (linear) ordering on N. The respective functions and relations are constructed in second-order logic, and are shown to be unique using the Peano axioms. 3.1 Addition Addition is the function +: N N N (written in the usual infix notation, mapping elements of N to other elements of N ), defined recursively as: For example, a + 0 = a a + S(b) = S(a + b) a + 1 = a + S(0) = S(a + 0) = S(a). The structure (N, +) is a commutative semigroup with identity element 0. (N, +) is also a cancellative magma, and thus embeddable in a group. The smallest group embedding N is the integers. 7

8 3.1.1 Basic Properties of Addition 0 + n = n dec OO, n), n); (n + 1) + m = (n + m) + 1 dec AddLLem1 :!(m : n @(SS, n, m))); n + 0 = n dec n, OO), n); m + (n + 1) + m = (m + n) + 1 dec AddRLem1 :!(m : n n)), m, n))); Proofs of AddLLem0 The proof of AddLLem0 is conducted by induction on n. dec OO, OO), OO); def OO, OO)); dec AddL0IndLem : let OO, n), n) in [@(P, n))]; def AddL0IndLem = let OO, n), n) in \(n : p n)) @(ADD, OO, n), 8

9 @(AddRLem1, OO, n), n, SS, p)); def AddLLem0 = let OO, n), n) P, AddL0BasLem, AddL0IndLem); A simplified proof using reflexivity of ADD directly. def OO, n)); Proofs of AddRLem0 The proof of AddRLem0 is conducted by induction on n. dec OO, OO), OO); def OO, OO)); dec AddR0IndLem : let n, OO), n) in [@(P, n))]; def AddR0IndLem = let n, OO), n) in \(n : p n, n, OO), n, SS, p)); def AddRLem0 = let n, OO), n) P, AddR0BasLem, AddR0IndLem); Proofs of AddLLem1 The proof of AddLLem1 is conducted by induction on m. dec @(SS, n, OO))); def AddL1BasLem = 9

10 @(Tran_Eq, n), n), n, n, OO), n)))); dec AddL1IndLem : let P = \(m @(SS, n, m))) in [@(P, m))]; def AddL1IndLem = let P = \(m @(SS, n, m))) in \(m : p m), n @(SS, @(ADD, m))), @(SS, n, m)), n, m)), n, n, m)))); def AddLLem1 = let P = \(m @(SS, n, m))) P, AddL1BasLem, AddL1IndLem); Proofs of AddRLem1 The proof of AddRLem1 is conducted by induction on m. dec n)), OO, n))); 10

11 def n))); dec AddR1IndLem : let P = \(m n)), m, n))) in [@(P, m))]; def AddR1IndLem = let P = \(m n)), m, n))) in \(m : p m), n @(SS, n)), @(SS, n)), m, n)), m), @(SS, m, n, m)))); def AddRLem1 = let P = \(m n)), m, n))) P, AddR1BasLem, AddR1IndLem); Commutativity of Addition a + b = b + c dec AddCommLem :!(n : m n, m, n)); dec OO, m, OO)); def OO, n), 11

12 n, n), n, OO), n))); dec AddCommLem2 : let n, m, n)) in [@(P, n))]; def AddCommLem2 = let n, m, n)) in \(p n)) \(m @(SS, m, n, m, n), m)), @(ADD, m, m, n))); def AddCommLem = let n, m, n)) P, AddCommLem1, AddCommLem2); Associativity of Addition (a + b) + c = a + (b + c) dec AddAssoLem :!(m : n : e @(ADD, m, n), n, e))); dec AssoBasLem :!(n : e @(ADD, OO, n), n, e))); def AssoBaseLem = \(n : e @(ADD, OO, n), e), 12

13 @(ADD, n, OO, n), n, \(m : m, n)), n, n, e)))); dec AssoIndLem : let P = \(m : Nat)!(n : e @(ADD, m, n), n, e))) in [@(P, m))]; def AssoIndLem = let P = \(m : Nat)!(n : e @(ADD, m, n), n, e))) in \(m : p m), n : e m), @(ADD, m, m), @(ADD, m, @(ADD, m, @(SS, m, n)), \(m : m, n, @(ADD, m, n), n, e)), @(SS, n, e), m))); def AddAssoLem = let P = \(m : Nat)!(n : e @(ADD, m, n), n, e))) P, AssoBasLem, AssoIndLem); a + (b + c) = b + (a + c) dec AddAssComLem : 13

14 !(m : n : e n, m, e))); def AddAssComLem = \(m : n : e : Nat) let p1 m, n, e), @(ADD, m, n), n, e)), p1), p3 m, n), m, n, m), \(z : z, e), p3), p5 n, m, e), m, n, m), m, e)), p2, p4, p5) in p6; Identity of Addition OO is an identity element for ADD. dec OO, n), n); def AddUnitLLem = AddLLem0; dec n, OO), n); def AddUnitRLem = AddRLem0; Nat with ADD as a Semi-Group def SMGProof = \(c : a : b @(ADD, a, b), b, a, b, c)); def NatSMG < ADD>, SMGProof); Nat with ADD as a Monoi def MOProof 14

15 @(Ass_ax, OO, ADD), \(c : a : b @(ADD, a, b), b, a, @(ADD, n, OO, n), n))); def NatMonoi < OO, ADD>, MOProof); Nat with ADD as a Commutative Monoi def CMOProof = let P1 ADD), P2 ADD), P3 OO, ADD) in let p1 = \(c : a : b @(ADD, a, b), b, a, b, c)), p2 = AddCommLem, @(ADD, n, OO, n), n)) P1, P2), P1, P2, p1, p2)); def NatCMonoi OO, ADD, CMOProof); 3.2 Multiplication Given addition, multiplication is the function : N N N defined recursively as: a 0 = 0 a S(b) = a + S(a b) It is easy to see that 1 is the multiplicative identity: a 1 = a S(0) = a + (a 0) = a + 0 = a Moreover, multiplication distributes over addition: a (b + c) = (a b) + (a c). Thus, (N, +, 0,, 1) is a commutative semi-ring. 15

16 3.2.1 Basic Properties of Multiplication 0 n = 0 dec OO, n), OO); (n + 1) m = m + (n m) dec TimesLLem1 :!(m : n @(SS, n), n, m))); n 0 = 0 dec n, OO), OO); m (n + 1) = m + (m n) dec TimesRLem1 :!(m : n m, n))); Proofs of TimesLLem0 def OO, n)); Proofs of TimesLLem1 dec @(SS, n), n, OO))); def TimesLBasLem1 = let n)), n, OO), OO, \(z : OO, z), 16

17 @(TimesRLem0, n)), n, OO)), OO, @(SS, n), OO), n, OO)), p1, p3); dec TimesLIndLem1 : let P = \(m @(SS, n), n, m))) in [@(P, m))]; def TimesLIndLem1 = let P = \(m @(SS, n), n, m))) in \(m : p m), n : Nat) let n), m), @(SS, n), m), n), @(SS, n), n, m)), \(z n, n)), @(SS, m)), n), @(SS, n, m)))), p1, p2, p3), p5 n, n, m)), n, n, m))), SS, p5), @(SS, m)), n, m)))), p4, p6), p8 n, m), n, m)), p8), n, m)), \(z m, z)), 17

18 p9), @(SS, m)), m)))), p7, pa) in pb; def TimesLLem1 = let P = \(m @(SS, n), n, m))) P, TimesLBasLem1, TimesLIndLem1); Proofs of TimesRLem0 dec OO, OO), OO); def OO, OO)); dec TimesRIndLem0 : let n, OO), OO) in [@(P, n))]; def TimesRIndLem0 = let n, OO), OO) in \(p n)) let p1 OO, n), @(SS, n), n, OO)), OO, p1, p) in p2; def TimesRLem0 = let n, OO), OO) P, TimesRBasLem0, TimesRIndLem0); Proofs of TimesRLem1 dec OO, n))); 18

19 def TimesRBasLem1 = let n)), OO, n), OO, \(z : OO, n)), OO, n)), OO, n)), OO, n)), p1, p3); dec TimesRIndLem1 : let P = \(m m, n))) in [@(P, m))]; def TimesRIndLem1 = let P = \(m m, n))) in \(m : p m), n : Nat) let n), m), n)), n), m, n)), \(z n, n)), @(SS, n)), n))), n)))), m, n)))), p1, p2, p3), p5 n, m, n)), m, m, n))), SS, p5), @(SS, n)), m, n)))), p4, 19

20 p6), p8 n, m), @(SS, m), m, n)), p8), m), n), \(z m, z)), p9), @(SS, n)), @(SS, m), n))), p7, pa) in pb; def TimesRLem1 = let P = \(m m, n))) P, TimesRBasLem1, TimesRIndLem1); Commutativity of Addition dec TimesCommLem :!(n : m n, m, n)); dec OO, m, OO)); def OO, n), n, n), n, OO), n))); dec TimesCommLem2 : let n, m, n)) in [@(P, n))]; def TimesCommLem2 = let P = 20

21 n, m, n)) in \(p n)) \(m @(SS, n), n, m, n, m, @(TIMES, m, m, n))); def TimesCommLem = let n, m, n)) P, TimesCommLem1, TimesCommLem2) Associativity of Multiplication (a b) c = a (b c) dec TimesAssoLem :!(m : n : e @(TIMES, m, n), n, e))); dec TAssoBasLem :!(n : e @(TIMES, OO, n), n, e))); def TAssoBaseLem = \(n : e @(TIMES, OO, n), OO, OO, n), OO, \(m : m, n)), n, n, e)))); dec TAssoIndLem : let P = \(m : Nat)!(n : e @(TIMES, m, n), n, e))) in [@(P, m))]; 21

22 def TAssoIndLem = let P = \(m : Nat)!(n : e @(TIMES, m, n), n, e))) in \(m : p m), n : e : Nat) let u1 n, m), @(SS, m), m, n)), \(z : z, e), u1), u3 e, m, n)), m), m, m, n), e)), u2, u3), m, n), e)), m), m, @(TIMES, m, n), n, e)), u4, u5) in let Q = \(z m, n), n, n, e))) in let u7 n, m, n), n, e)))), m), @(TIMES, m, n), n, n, e)), u6, u7), n, n, e)), m), n, n, n, e))), u8, u9) in ua; 22

23 def TimesAssoLem = let P = \(m : Nat)!(n : e @(TIMES, m, n), n, e))) P, TAssoBasLem, TAssoIndLem); Identity of OO) is an identity element for TIMES. dec @(SS, OO), n), n); def TimesUnitLLem = let p n, OO) in let q n, @(SS, OO), OO, n)), n, p, q); dec OO)), n); def TimesUnitRLem = let p1 OO)), p2 OO)), OO), n), n, p1, p2); Distribution of Multiplication over Addition l (m + n) = (l m) + (l n) dec DistrLLem :!(l : m : n l, l, n))); dec DistrLLem1 :!(m : n : Nat) 23

24 OO, OO, n))); def DistrLLem1 = \(m : n : Nat) let m, n))), @(TIMES, OO, OO, m, OO, OO, n)), p1, p2); dec DistrLLem2 : let P = \(l : Nat)!(m : n l, l, n))) in!(l : Nat) [@(P, l))]; dec AddTimesDistLem1 :!(l : m : n @(ADD, l, l, l, n)))); def AddTimesDistLem1 = \(l : m : n : Nat) let p1 l, l, n))), p2 l, l, n)), @(ADD, l, l, n, l, l, n))), p2), @(TIMES, l, l, l, n)), \(z : m, z), p3), @(ADD, l, l, @(TIMES, l, l, m, l, l, n))), p1, p4), p6 l, m)), l, m), n), \(z : l, n)), p6), p8 24

25 l, @(TIMES, l, m), l, n)), \(z : m, z), p7), l, m), l, n)), l, m), l, l, n))), \(z : m, z), p9), @(ADD, l, l, m, l, l, l, m), l, m, l, l, n)))), p5, p8, pa), pc l, l, n))), @(ADD, l, l, m, l, l, n)))), pc), @(ADD, l, l, m, l, l, l, n))), pb, pd) in pe; dec AddTimesDistLem2 :!(l : m : n @(ADD, l, @(SS, l), n))); dec AddEqLem :!(a1 : b1 : a2 : b2 : Nat) [@(Equal, a1, b1) a2, a1, b1, b2))]; def AddEqLem = \(a1 : b1 : a2 : b2 : Nat) \(p1 a1, b1), p2 a2, b2)) let Q = \(z a1, z, a2)) in let q Q, a1, a2))) in 25

26 let P = \(z a1, b1, z)) P, q); def AddTimesDistLem2 = \(l : m : n : Nat) let p1 m, l), p2 n, l), @(SS, l), l, m)), p1), @(SS, l), l, n)), l), l), n), p3, p4); def DistrLLem2 = let P = \(l : Nat)!(m : n l, l, n))) in \(l : p l), m : n : Nat) let m, n), l) in let Q = \(z @(ADD, m, m, n), z)) in let p2 m, @(ADD, m, m, n))))), @(SS, m, l, l, n))), p1, p2), p4 l, m, n), p5 l, m, n), @(SS, l, l, @(SS, l), n)), p3, p4, p5) in p6; def DistrLLem = let P = \(l : Nat)!(m : n l, l, n))) P, DistrLLem1, 26

27 DistrLLem2); (m + n) l = (m l) + (n l) dec DistrRLem :!(l : m : n @(ADD, m, m, n, l))); dec AddLREqLem :!(a1 : b1 : a2 : b2 : Nat) [@(Equal, a1, a2) b1, a1, a2, b2))]; def AddLREqLem = \(a1 : b1 : a2 : b2 : Nat) \(p1 a1, a2), p2 b1, b2)) let Q1 = \(a : Nat)!(b a1, a, b)) in let q Q1, \(b a1, b))) in let Q2 = \(b a1, a2, b)) b1)); def DistrRLem = \(l : m : n : Nat) let p l, m, n) in let m, n), l), @(ADD, m, n), l, l, n)), q1, p), q3 l, m), q4 l, n), l, l, m, n, l), q3, @(ADD, m, l, m, n, l)), q2, q5); 27

28 3.2.6 Nat with TIMES as a Monoi def II, TIMES), \(c : a : b @(TIMES, a, b), b, a, @(TIMES, n, II, n), n))); def NatTimesMonoi < II, TIMES>, TMOProof); Nat with ADD and TIMES as a Semi-Ring def SMRProof = let P1 OO, ADD), P2 II, TIMES), P3 ADD, TIMES), P4 OO, TIMES) in let p1 = CMOProof, p2 = TMOProof, p3 = \(a : b : c : Nat) let a, a, c))), @(ADD, a, a, b, c))) in let p1 a, b, c), p2 c, a, b) P1, P2, p1, p2), @(TIMES, OO, n, OO), n)) P3, P4)), P3, P4), 28

29 P3, P4, p3, p4))); def NatSemiRing < OO, II, ADD, TIMES>, SMRProof); 3.3 Equality Two natural numbers are equal if and only if they are exactly the same in every way. This defines a binary relation, equality, marked by the sign of equality = in such a way that the statement x = y means that x and y are equal Equality Defined as Reflexive Relation Definition of NatEq def NatEq = \(n : m : Nat)!(T : [Nat -> Nat -> Prop]) n, n) n, m)]; Production Rule of NatEq dec NatEqN n, n); def NatEqN = \(T : [Nat -> Nat -> Prop]) \(x n, n); Induction Rule of NatEq dec NatEqInduct :!(x : P : [Nat -> Prop]) [@(P, x) ->!(y : Nat) [@(NatEq, y, x) y)]]; def NatEqInduct = \(x : P : [Nat -> Prop]) \(p x)) \(y : Nat) \(q y, x)) let T = \(a : b : Nat) [@(P, b) a)] in let u T, \(a : r a)) r) p); 29

30 3.3.5 Equivalence Properties Reflexive Property of NatEq dec NatEqReflLem n, n); def NatEqReflLem = NatEqN; Symmetrical Property of NatEq dec NatEqSymmLem :!(x : y : Nat) [@(NatEq, x, y) y, x)]; def NatEqSymmLem = \(x : y : Nat) \(H x, y)) let P = \(z : y, z) y, y), x, H); Transitivity Property of NatEq dec NatEqTranLem :!(x : y : z : Nat) [@(NatEq, x, y) y, z) x, z)]; def NatEqTranLem = \(x : y : z : Nat) \(H1 x, y), H2 y, z)) let P = \(w x, w, z)) in let u x, y, z), H1, H2), y, z, x, z, z), u); Successor Lemma for NatEq NatEqSuccLem is inhabited. However, I don t know why it has to be used as a definition in COQ. dec NatEqSuccLem :!(n : m : Nat) [@(NatEq, n, m))]; 30

31 def NatEqSuccLem = \(n : m : Nat) \(H n, m)) let P = \(z z)) n)), n, m, H)); Function Application Lemma for NatEq dec NatEqFunLem :!(f : [Nat -> Nat])!(x : y : Nat) [@(NatEq, x, y))]; def NatEqFunLem = \(f : [Nat -> Nat]) \(x : y : Nat) \(H x, y)) let P = \(z z)) x)), x, y, H)); Equality Negation Lemma for NatEq dec NegNatEqLem :!(x : y : Nat) x, y, x))]; def NegNatEqLem = \(x : y : Nat) x, y))) \(p y, x, p)); Successor Lemma Nat) dec EqNatSuccLem :!(n : m : Nat) [@(Equal, n, m))]; def EqNatSuccLem = 31

32 \(n : m : Nat) \(h n, m)) let P = \(z z)) P, n))); Equivalence of NatEq Nat) dec NatEq2EqNatLem :!(n : m : Nat) [@(NatEq, n, m) n, m)]; def NatEq2EqNatLem = \(n : m : Nat) \(h Nat)); dec EqNat2NatEqLem :!(n : m : Nat) [@(Equal, n, m) n, m)]; def EqNat2NatEqLem = \(n : m : Nat) \(h n, m)) let P = \(z : n, z) n)); 3.4 Inequalities The usual total order relation : N N can be defined as follows, assuming 0 is a natural number: For all a, b N, a b if and only if there exists some c N such that a + c = b. This relation is stable under addition and multiplication: for, if a b, then: and a + c b + c, a c b c. Thus, the structure (N, +,, 1, 0, ) is an ordered semi-ring; because there is no natural number between 0 and 1, it is a discrete ordered semi-ring. The axiom of induction is sometimes stated in the following strong form, making use of the order: For any predicate ϕ, if ϕ(0) is true, and for every n, k N, if k n implies ϕ(k) is true, then ϕ(s(n)) is true, then for every n N, ϕ(n) is true. This form of the induction axiom is a simple consequence of the standard formulation, but is often better suited for reasoning about the order. For example, to show that the naturals are well-orderedevery nonempty subset of N has a least elementone can reason as follows. Let a nonempty X N be given and assume X has no least element. Because 0 is the least element of N, it must be that 0 X. For any n N, suppose for every k n, k X. Then S(n) X, for otherwise it would be the least element of X. Thus, by the strong induction principle, for every n N, n X. Thus, X N =, which contradicts X being a nonempty subset of N. Thus X has a least element. 32

33 3.4.1 Inequality Defined as a Reflexive Relation Inductive Definition of NatLe def NatLe = \(n : m : Nat)!(T : [Nat -> Nat -> Prop]) n, n) ->!(n : m : Nat) [@(T, n, m) m))] n, m)]; Production Rules of NatLe dec NatLeN n, n); def NatLeN = \(T : [Nat -> Nat -> Prop]) \(x n, n), y :!(n : m : Nat) [@(T, n, m) n); dec NatLeS :!(n : m : Nat) [@(NatLe, n, m) m))]; def NatLeS = \(n : m : p n, m)) \(T : [Nat -> Nat -> Prop]) \(x n, n), y :!(n : m : Nat) [@(T, n, m) n, T, x, y)); Conditions for NatLe For all a, b N, a b if and only if there exists some c N such that a + c = b. def NatLeCond1 = \(n : m : Nat) [@(NatLe, n, m) ->?(d : n, d))]; def MkNatLeCond1 = \(n : m : Nat) \(H n, m)) \(d : p n, d))) <d, p>; def NatLeCond2 = \(n : m : Nat) 33

34 [?(d : n, d)) n, m)]; def NatLeCond = \(n : m n, n, m)); dec NatLeCondLem :!(n : m : n, m); dec NatLeCondLem1 :!(n : m : n, m); dec NatLeCondLem11 OO, m); dec NatLeCondLem110 : [@(NatLe, OO, m) -> let d = m OO, d))]; def NatLeCondLem110 = \(m : Nat) \(h OO, m)) let d = OO, d)); def NatLeCondLem11 = \(m : Nat) \(H OO, m)) let d = m in let q m, H) OO, m, H, d, q); dec NatLeCondLem12 : let P n, m) in [@(P, n))]; dec NatLeSSLeLem :!(n : m : Nat) n), m) n, m)]; dec SnNatLeNegEq0Lem :!(n : m : d : Nat) n), m) n, d, OO))]; dec NatAddSSPPEqLem :!(n : d : Nat) d, d)))]; 34

35 dec NatLeCondLem120 : let P n, m) in!(h n), m)) let q n, m, p)) in let d q), r q) in let ds d) m, n), ds)); def NatLtCondLem120 = let P n, m) in \(h n)) \(m : Nat) n), m)) let q n, m, p)) in let d q), r q) in let ds d) in let Q = \(z : m, z) in let u0 n, m, d, p, r), u1 n, d, u0) Q, r); def NatLtCondLem12 = let P n, m) in \(h n)) \(m : Nat) n), m)) let q n, m, p)) in let d q), r q) in let ds d) in let u n, h, m, n), m, p, ds, u); def NatLeCondLem1 = let P n, m) P, NatLeCondLem11, NatLeCondLem12); dec NatLeCondLem2 :!(n : m : n, m); dec nnatleaddnlem :!(n : d : n, d)); def NatLeCondLem2 = \(n : m : Nat) \(p :?(d : n, d))) let d p), q p) in 35

36 let P = \(z : n, z) in let r n, d), q) n, d)); def NatLeCondLem = \(n : m : Nat) let P1 n, m), P2 n, m) in let p1 n, m), p2 n, m) P1, P2, p1, p2); Induction Rule of NatLe NatLeInduct is interpreted as follows: assume that P be a set and y is in P, if for every x, x y then x is in P. dec NatLeInduct :!(y : P : [Nat -> Prop]) [@(P, y) ->!(x : Nat) [@(NatLe, x, y) x)]]; def NatLeInduct = \(*y : P : [Nat -> Prop]) \(h *y)) \(x : Nat) \(p x, *y)) h; def NatLeInduct = \(y : P : [Nat -> Prop]) \(p y)) \(x : Nat) \(q x, y)) let T = \(a : b : Nat) [@(P, b) a)] in let u T, \(a : p a)) p, \(a : *b : h1 a, *b), h2)) p); Reflexive and Transitive Property NatLe Reflexivity of NatLe n n dec NatLeReflLem n, n); def NatLeReflLem = NatLeN; 36

37 Successor Lemma of NatLe n m n S(m) dec NatLeSuccLem :!(n : m : Nat) [@(NatLe, n, m) m))]; def NatLeSuccLem = NatLeS; Transitivity of NatLe n m m l n l dec NatLeTranLem :!(n : m : l : Nat) [@(NatLe, n, m) m, l) n, l)]; dec NatLeTranCondLem :!(n : m : l : Nat)!(d1 : d2 : Nat) [@(Equal, n, d1)) m, d2)) -> let d d1, d2) n, d))]; dec NatLeTrCondLem2 :!(n : m : l : Nat)!(d1 : d2 : Nat) [@(Equal, n, d1)) m, d2)) -> let d d1, d2) n, d))]; dec NatAddAssLem :!(n : d1 : d2 @(ADD, n, d1), d1, d2))); def NatLeTrCondLem2 = \(n : m : l : Nat) \(d1 : d2 : Nat) \(h1 n, d1)), h2 m, d2))) let d d1, d2) in let Q = \(z : z, d2)) in let q Q, h2) in let R = \(z : l, z) in let r n, d1, d2) R, q); def NatLeTranCondLem = 37

38 \(n : m : l : Nat) \(d1 : d2 : Nat) \(p2 n, d1)), q2 m, d2))) let d d1, d2) n, m, l, d1, d2, p2, q2); def NatLeTranLem = \(n : m : l : Nat) \(h1 n, m), h2 m, l)) let p1 n, m, h1), p2 m, l, h2) in let d1 p1), q1 p1), d2 p2), q2 p2) in let d d1, d2), q n, m, l, d1, d2, q1, q2) n, l, <d, q>); Other Properties of NatLe Predecessor Lemma of NatLe S(n) S(m) n m dec NatLePredLem :!(n : m : Nat) m)) n, m)]; dec EqNatSSAddLem :!(n : m : d : Nat) m), n), @(ADD, n, d)))]; def NatLePredLem = \(n : m : Nat) m))) let m), H) in let d p), q p) in let u1 n, m, d, q), @(ADD, n, d)), u1), u3 @(ADD, n, d)), u2), u4 n, d), u3) n, m, <d, u4>); Double Successor Lemma of NatLe n m S(n) S(m) dec NatLeSuccSuccLem :!(n : m : Nat) [@(NatLe, n, m))]; dec EqNatAddSSLem : 38

39 !(n : m : d : Nat) [@(Equal, n, @(SS, n), d))]; def EqNatAddSSLem = \(n : m : d : Nat) \(h n, d))) let P = \(z z)) in let p1 P, m))), p2 d, n), @(SS, n, d)), @(ADD, n), d), p1, p3); def NatLeSuccSuccLem = \(n : m : Nat) \(H n, m)) let p n, m, H) in let d p), q p) in let u n, m, d, m), <d, u>); (S(n) 0) There is no production m), OO) for any natural number m. It has the type Null. We treat this as an axiom instead. dec NatLeSnOAxm Prop, m), OO), Null); dec NatLeSnOLem : m), OO) -> Null]; def NatLeSnOLem = \(m : Nat) m), OO)) let P = \(Z : Prop) Z m, P, H); dec NatLeSnmLem : m), m) -> Null]; dec NatLeSnmLem1 : OO), OO) -> Null]; def NatLeSnmLem1 OO); dec NatLeSnmLem2 : let P = \(m : Nat) m), m) -> Null] in [@(P, n))]; def NatLeSnmLem2 = let P = \(m : Nat) 39

40 @(SS, m), m) -> Null] in \(m : h m)) @(SS, m))) let m), m, p) q); def NatLeSnmLem = let P = \(m : Nat) m), m) -> Null] P, NatLeSnmLem1, NatLeSnmLem2); 0 1 dec ZeroLEqOneLem OO)); def ZeroLEqOneLem = \(T : [Nat -> Nat -> Prop]) \(x n, n), y :!(n : m : Nat) [@(T, n, m) OO, OO)); 0 2 dec ZeroLEqTwoLem OO, OO))); def ZeroLEqTwoLem = \(T : [Nat -> Nat -> Prop]) \(x n, n), y :!(n : m : Nat) [@(T, n, m) T, x, y)); 0 3 dec ZeroLEqThreeLem OO)))); def ZeroLEqThreeLem = \(T : [Nat -> Nat -> Prop]) \(x n, n), y :!(n : m : Nat) [@(T, n, m) OO, T, x, y)); n m n m dec NatLeNegGtLem : 40

41 !(n : m : Nat) [@(NatLe, n, n, m))]; n < m n m dec NatLt2NatLeLem :!(n : m : Nat) [@(NatLt, n, m) n, m)]; def NatLt2NatLeLem = \(n : m : Nat) \(h n, m)) \(T : [Nat -> Nat -> Prop]) \(x n, n), y :!(n : m : Nat) [@(T, n, m) n, n)), y); a < b b = c a < c dec NatLtEqLtTranLem :!(a : b : c : Nat) [@(NatLt, a, b) b, c) a, c)]; def NatLtEqLtTranLem = \(a : b : c : Nat) \(h1 a, b), h2 b, c)) let p b, c, h2) in let P = \(z : a, z) P, h1); a = b b < c a < c dec NatEqLtLtTranLem :!(a : b : c : Nat) [@(NatEq, a, b) b, c) a, c)]; def NatEqLtLtTranLem = \(a : b : c : Nat) \(h1 a, b), h2 b, c)) let p a, b, h1) in let q a, b, p) in let P = \(z : z, c) P, h2); n = m n < S(m) dec NatEqLeSSLem :!(n : m : Nat) [@(NatEq, n, m) m))]; 41