Transcription

1 The Z/EVES Mathematical Toolkit Version 2.2 for Z/EVES Version 1.5 TR a Mark Saaltink Release date: September 1997 ORA Canada 267 Richmond Road, Suite 100 Ottawa, Ontario K1Z 6X3 CANADA

2

3 Z/EVES Project TR a Contents 1 Introduction 1 2 Automation strategies Weakening Ideal rules Facts about function results Computation rules Weakening 6 4 Tuples Two-element tuples Three-element tuples Mu terms 8 6 Applicability 9 7 Negations 10 8 Sets Extensionality Powersets Cross products Empty set Unit sets Non-empty powerset Subsets Union Intersection Set dierence Distribution laws Generalized union and intersection Ordered pairs Relations Relation space Maplets Domain and range Identity relation Composition Domain and range restriction Domain and range anti-restriction Relational inversion Relational image Overriding Transitive closure i

4 ii Z/EVES Project TR a 11 Functions Function spaces Application Injections Surjections Bijections Numbers Arithmetic functions Arithmetic relations Naturals Relational iteration Ranges Finiteness Cardinality Finite function spaces Min and max Induction Sequences Concatenation Sequence decomposition Reversal Filtering Mapping over a sequence Relations between sequences Distributed concatenation Disjointness and partitioning Induction Bags Bag count Subbags Bag scaling Bag union Bag dierence Items

5 Z/EVES Project TR a 1 1 Introduction The Z/EVES Mathematical Toolkit 1 includes the declaration of all the constants of the Standard Mathematical Toolkit as described by Spivey [3] or the proposed ISO Standard for Z [1], and presents useful theorems about these constants. The theorems are divided into two groups. The rst group contains theorems meant for human consumption, which are presented in the most natural way. The second group contains theorems meant for the prover to use automatically, which are presented in whatever way will work best. Often, however, many theorems in the human consumption group are also suitable for automatic use, and are marked as rewrite rules. This report is the specication of the standard \toolkit" section distributed with Z/EVES, Version 1.5 [2]. The toolkit denes operations in several categories, which we summarize here. For each operation, we show its L A TEX markup command, give the page of this report containing its denition (or the main theorems about it), and a brief description of its meaning. General KnownMember KnownMember p. 6 membership (for \weakening" rules) x : S \mu x: S p. 8 denite description terms x 6= y x \neq y p. 10 not equal x =2 y x \notin y p. 10 not a member Sets P X \power X p. 12 powerset X Y X \cross Y p. 13 cross product ; \emptyset p. 14 empty set P 1 X \power_1 X p. 16 non-empty powerset S T S \subseteq T p. 17 subset relation S T S \subset T p. 17 proper subset relation S [ T S \cup T p. 18 set union S \ T S \cap T p. 19 set intersection n S \setminus T S T p. 21 set dierence (relative complement) S ; S \bigcup S, \bigcap S p. 23 generalized union or intersection Ordered Pairs rst first p. 24 rst component of a pair second second p. 24 second component of a pair x 7! y x \mapsto y p. 26 maplets 1 This work was funded by the United States Department of Defense under contract MDA C-2031.

6 2 Z/EVES Project TR a Relations X $ Y X \rel Y p. 25 relation space dom R; ran R \dom R, \ran R p. 27 domain, range of a relation id S \id S p. 29 identity relation Q o 9 R; R Q Q \comp R, R \circ Q p. 30 composition S C R S \dres R p. 32 domain restriction R B S R \rres S p. 32 range restriction S?C R S \ndres R p. 34 domain anti-restriction R?B S R \nrres S p. 34 range anti-restriction R R \inv p. 36 inverse relation R(j S j) R \limg S \rimg p. 38 relational image Q R Q \oplus R p. 40 overriding R + ; R R\plus, R\star p. 41 transitive closure R k R \bsup k \esup p. 52 iterate of a relation Functions 7 7 X 7! Y ; X! Y X \pfun Y, X \fun Y p. 42 function spaces X 7 Y ; X Y X \pinj Y, X \inj Y p. 45 injective (1-1) function spaces X 7! Y ; X! Y X \psurj Y, X \surj Y p. 47 surjective (onto) function spaces X! Y X \bij Y p. 48 bijections X 7! Y ; X 7 Y X \ffun Y, X \finj Y p. 57 nite functions g f g \circ f p. 30 composition f (j S j) f \limg S \rimg p. 38 image f g f \oplus g p. 40 overriding f n f \bsup n \esup p. 52 iterate of a function f applies$to x f~applies\$to~x p. 9 applicability Numbers and niteness N; N 1 \nat, \nat_1 p. 51 natural numbers succ(n) succ(n) p. 51 successor (n + 1) k : : n k \upto n p. 53 ranges min S ; max S min~s, max~s p. 59 minimum and maximum F X \finset X p. 54 nite subsets F 1 X \finset_1 X p. 54 non-empty nite subsets #S \# S p. 56 cardinality

7 Z/EVES Project TR a 3 Sequences seq X ; seq 1 X \seq X, \seq_1 X p. 61 sequences iseq X \iseq X p. 61 injective sequences s a t s \cat t p. 63 concatenation a = s \dcat s p. 72 distributed concatenation head s; last s head~s, last~s p. 64 rst (last) element tail s; front s tail~s, front~s p. 64 parts of a sequence rev s rev~s p. 66 reversal S s S \extract s p. 67 selection of a subsequence s S s \filter S p. 67 selection of a subsequence squash(f ) squash(f) p. 67 creation of a sequence s prex t s \prefix t p. 71 subsequence relations s sux t s \suffix t p. 71 subsequence relations s in t s \inseq t p. 71 subsequence relations disjoint s \disjoint s p. 73 disjointness partition s \partition s p. 73 partitions Bags bag X \bag X p. 75 bags (multisets) count B ; B ] x count~b, B \bcount x p. 77 multiplicity in a bag x in B x \inbag B p. 77 membership in a bag A v B A \subbageq B p. 78 subbag relationship n B n \otimes B p. 79 bag scaling A ] B A \uplus B p. 80 bag union A?[ B A \uminus B p. 81 bag dierence items(s) items(s) p. 82 bag of elements from a sequence

8 4 Z/EVES Project TR a 2 Automation strategies Before presenting the specication of the Toolkit, we will discuss some of the technical issues that inuence the form of its theorems. 2.1 Weakening There is a basic rewriting strategy that colours much of the Toolkit theory. It is a bit tricky to automate \weakening" proofs, where membership in a large set is inferred from membership in a small set. For example, x 2 N N 1 implies x 2 Z N. These sorts of goals arise all the time, and should be trivial to prove. We adopt the following approach: Given a global constant declared as c : T, a grule c 2 T is automatically generated. (Such theorems must be added by hand for constants declared as abbreviations. We give these theorems names of the form x type.) A special \known membership" function is dened, and we add a forward rule x 2 S ) x knownin S and another : x 2 S ) : x knownin S. (Unfortunately, a knownin relation is unsuitable here, as it would need a generic parameter. Therefore, we use a generic schema KnownMember, with the set as the generic actual and component element as the member.) We add the rewrite rule x knownin T ^ T 2 P S ) x 2 S. We similarly add : x knownin T ^ S 2 P T ) : x 2 S. Most weakening proofs give rise to subgoals of the form S 2 P T. If S is itself a global constant, the weakening rule can apply again. We also give rules for such subgoals for interesting cases of S and T below. For example, A 7! B 2 P(A 0 7! B 0 ), A 2 P A 0 ^ B 2 P B 0. These theorems have names ending with \ sub". Generally, these rules express the monotonicity of set constructors such as 7!, F and seq. 2.2 Ideal rules expressing properties inherited by subsets are also worth automating. For example, any subset of a relation is a relation, any subset of a partial function is a partial function, and any subset of a nite set is a nite set. This sort of reasoning plays out as follows: the fact that X is a subset of Y is recorded as X 2 P Y. Thus, if we are trying to show X 2 I, the weakening rule will give a subgoal of the form P Y 2 P I. If I is one of the sets mentioned above (e.g., I = A $ B or..., or I = F A), then P Y 2 P I, Y 2 I. Thus, adding this ideal rule for each dierent set I is enough to allow the automation of these proofs. 2.3 Facts about function results A general rule gives the fact f (x) 2 R if f 2 D 7! R and x 2 dom f that is, function applications have values in the range of the function. In cases where a tighter containing set is available for a function application, it may be useful to give an additional weakening rule. For example, the domain restriction (S C R) is a subset of R, whereas from the declaration of C we can conclude only that it is a subset of X $ Y (where X $ Y is the type of R). This fact about domain restriction could be expressed by the predicate 8 S : P X ; R : X $ Y S C R R:

9 Z/EVES Project TR a 5 It is possible to express this fact in a form that can be used more automatically by EVES, by writing instead the rule 8 S : P X ; RX $ Y j P R 2 P Z S C R 2 Z : This form interacts particularly well with the \ideal" rules. For example, if Z is an ideal set, then the subgoal P R 2 P Z will be rewritten to R 2 Z so, for example, if R is an injection, Z/EVES can conclude that S C R is also an injection. These theorems are given names ending in result. 2.4 Computation rules It is useful to be able to use Z/EVES to calculate the value of a Z expression, such as domf1 7! 1; 2 7! 4; 3 7! 9g. Set constructions, sequence constructions, and bag constructions are in fact formed from three primitives: a constant for the empty value (e.g., fg, hi, or [[]]); a constructor for singletons; and a \join" operation ( [ for sets, a for sequences, and ] for bags). For example, f1; 2; 3g is really just an abbreviation for f1g [ f2g [ f3g). In writing enough rewrite rules to allow for computations of functions applied to constructions, it is therefore necessary to cover the three cases (empty, unit, join). Wherever possible in this Toolkit, we have included enough such rules to allow these computations to be performed. For example, the three rules domempty, domsingleton, and domcup are enough to allow domains of explicitly given relations to be computed by rewriting.

10 6 Z/EVES Project TR a 3 Weakening Here is the denition of the \known membership" relation. As explained in Section 2.1, it is necessary to use a schema rather than a relation. Denitions KnownMember[X ] element : X theorem frule knownmember [X ] element 2 X ) KnownMember[X ] theorem rule weakening KnownMember[X ] ^ X 2 P Y ) element 2 Y

11 Z/EVES Project TR a 7 4 Tuples Tuples are part of the Z notation. We present the main theorems used in proofs. 4.1 Two-element tuples theorem grule select 2 1 (x ; y):1 = x theorem grule select 2 2 (x ; y):2 = y theorem rule eqtuple2 (x ; y) = (x 0 ; y 0 ), x = x 0 ^ y = y 0 theorem rule select 1 member x 2 X Y ) x :1 2 X theorem rule select 2 member x 2 X Y ) x :2 2 Y theorem grule tuplecomposition2 x 2 X Y ) x = (x :1; x :2) 4.2 Three-element tuples theorem grule select 3 1 (x ; y; z):1 = x theorem grule select 3 2 (x ; y; z):2 = y theorem grule select 3 3 (x ; y; z):3 = z theorem rule eqtuple3 (x ; y; z) = (x 0 ; y 0 ; z 0 ), x = x 0 ^ y = y 0 ^ z = z 0

12 8 Z/EVES Project TR a 5 Mu terms Mu terms are treated specially by Z/EVES; a term of the form ST e is converted into m : fst eg (unless it already has this form x : S for some set S). This latter form is treated as a function of S. We present here some of the theorems needed for dealing with mu terms. theorem muinset [S] (9 a : S 8 b : S b = a) ) ( x : S) 2 S theorem muvalue [S] s 2 S ^ (8 s 0 : S s 0 = s) ) ( x : S) = s Automation We generally do not provide much automation for mu terms. When a mu term appears in an equality, we can do a bit better, since we then have a candidate value for the expression. theorem rule muvalue1 [S] 8 s : S j (8 s 0 : S s 0 = s) ( x : S) = s, true theorem rule muvalue2 [S] 8 s : S j (8 s 0 : S s 0 = s) s = ( x : S), true theorem rule musingleton ( x : fyg) = y

13 Z/EVES Project TR a 9 6 Applicability Relation applies$to is used in domain checking conditions. It is declared as applies$to [X ; Y ] : (X $ Y ) $ X : Most of the rules about applies$to appear later in the Toolkit, after \dom" has been introduced. theorem disabled rule appliestodef [X ; Y ] 8 R : X $ Y ; x : X R applies$to x, (9 y : Y j (x ; y) 2 R 8 y 0 : Y j (x ; y 0 ) 2 R y = y 0 )

14 10 Z/EVES Project TR a 7 Negations Denitions syntax 6= inrel syntax =2 inrel \neq \notin [X ] 6= : X $ X =2 : X $ P X [noteqdef] 8 x ; y : X x 6= y, : x = y [notindef] 8 x : X ; S : P X x =2 S, : x 2 S Automation theorem rule noteqrule [X ] x 6= y, (x 2 X ^ y 2 X ^ : x = y) theorem rule notinrule [X ] x =2 S, (x 2 X ^ S 2 P X ^ : x 2 S)

15 Z/EVES Project TR a 11 8 Sets 8.1 Extensionality The extensionality property is disabled, and needs to be enabled or applied manually in those proofs where it is needed. Additional extensionality properties are dened for relations (theorem relationextensionality), functions (theorems pfunextensionality and funextensionality), and bags (theorem bagextensionality). theorem disabled rule extensionality X = Y, (8 x : X x 2 Y ) ^ (8 y : Y y 2 X ) theorem disabled rule extensionality2 X = Y, X 2 P Y ^ Y 2 P X theorem extensionality3 [X ] 8 S ; T : P X S = T, (8 x : X j x 2 S x 2 T ) ^ (8 x 0 : X j x 0 2 T x 0 2 S)

16 12 Z/EVES Project TR a 8.2 Powersets The powerset notation is a predened part of the Z notation. Here are some basic theorems. theorem disabled rule inpower X 2 P Y, (8 e : X e 2 Y ) theorem rule inpowerself X 2 P X theorem rule power sub P X 2 P(P Y ), X 2 P Y The following two facts are automated by the \weakening" rules in Section 3. theorem inpowertransitive X 2 P Y ^ Y 2 P Z ) X 2 P Z theorem insubset x 2 Y ^ Y 2 P Z ) x 2 Z

17 Z/EVES Project TR a Cross products Cross products are part of the Z notation. Here are some basic theorems about two and three-element cross products. theorem disabled rule incross2 p 2 X Y, (9 x : X ; y : Y p = (x ; y)) theorem rule tupleincross2 (x ; y) 2 X Y, x 2 X ^ y 2 Y theorem rule CrossSubsetCross2 A 2 P X ^ B 2 P Y ) A B 2 P(X Y ) theorem rule crossnull 2 1 fg Y = fg theorem rule crossnull 2 2 X fg = fg theorem rule crossequalnull2 X Y = fg, X = fg _ Y = fg theorem disabled rule incross3 p 2 X Y Z, (9 x : X ; y : Y ; z : Z p = (x ; y; z)) theorem rule tupleincross3 (x ; y; z) 2 X Y Z, x 2 X ^ y 2 Y ^ z 2 Z theorem rule CrossSubsetCross3 A 2 P X ^ B 2 P Y ^ C 2 P Z ) A B C 2 P(X Y Z ) theorem rule crossnull 3 1 fg Y Z = fg theorem rule crossnull 3 2 X fg Z = fg theorem rule crossnull 3 3 X Y fg = fg theorem rule crossequalnull3 X Y Z = fg, X = fg _ Y = fg _ Z = fg

18 14 Z/EVES Project TR a 8.4 Empty set Denition syntax word \empty syntax ; word \emptyset The name \empty is a synonym for \emptyset for backward compatibility with some early versions of L A TEX markup for Z. The name \emptyset is preferred, especially for printing, as newer versions of L A TEX markup will not display \empty correctly. ;[X ] == f x : X j false g It is convenient in proofs to use the empty set extension instead of the empty set, as the extension is simpler (since it does not use a generic actual). theorem rule emptydenition [X ] ;[X ] = fg theorem rule innull : x 2 fg theorem rule nullsubset fg 2 P X theorem rule powernull Pfg = ffgg theorem nonemptysethasmember S = fg _ (9 x : S true)

19 Z/EVES Project TR a Unit sets Unit sets can be denoted by set displays. theorem rule inunit x 2 fyg, x = y theorem rule unitsubset fxg 2 P X, x 2 X theorem rule unitequalunit fxg = fyg, x = y theorem rule nullequalunit : (fg = fxg) theorem rule unitequalnull : (fxg = fg) theorem rule inpowerunit x 2 Pfyg, x = fyg _ x = fg

20 16 Z/EVES Project TR a 8.6 Non-empty powerset Denition P 1 X == f S : P X j S 6= ; g theorem grule power1 type [X ] P 1 X 2 P(P X ) theorem rule inpower1 x 2 P 1 X, x 2 P X ^ : x = fg theorem rule power1empty P 1 fg = fg theorem rule power1unit P 1 fxg = ffxgg Automation theorem rule power1 strong type P 1 X 2 P(P Y ), X 2 P Y theorem rule power1 sub P 1 X 2 P(P 1 Y ), X 2 P Y

21 Z/EVES Project TR a Subsets Denition syntax inrel syntax inrel \subseteq \subset [X ] ; : P X $ P X [disabled rule subdef] 8 A; B : P X A B, (8 x : A x 2 B) [disabled rule psubdef] 8 A; B : P X A B, A B ^ A 6= B theorem disabled rule subsetself [X ] 8 S : P X S S theorem disabled rule nullsetsubset [X ] 8 S : P X fg S theorem disabled rule subsettransitive [X ] 8 A; B ; C : P X j A B C A C theorem rule psubsetself [X ] 8 S : P X : S S theorem rule nullsetpsubset [X ] 8 S : P X fg S, : S = fg Automation The subset notation is convenient, but is awkward in expressing theorems because of the generic actual. We cannot express the simple fact that A is a subset of B without at the same time constraining them to be subsets of something else (the generic actual). A dierent notation, A 2 P B, expresses exactly what we mean, although it is uglier than the subset notation. theorem rule subsetdef [X ] A B, A 2 P B ^ B 2 P X theorem rule psubsetdef [X ] A B, A 2 P B ^ B 2 P X ^ : A = B

22 18 Z/EVES Project TR a 8.8 Union Denitions Function [ is predened, as it is needed in the expansion of set extensions. theorem rule incup [X ] 8 A; B : P X x 2 A [ B, x 2 A _ x 2 B theorem rule cupsubsetleft [X ] S [X ]T ) S [ T = T theorem rule cupsubsetright [X ] T [X ]S ) S [ T = S theorem rule cupcommutes [X ] 8 S ; T : P X S [ T = T [ S theorem rule cupassociates [X ] 8 S ; T ; V : P X (S [ T ) [ V = S [ (T [ V ) theorem rule cupsubset [X ] 8 S ; T : P X (S [ T ) 2 P U, S 2 P U ^ T 2 P U Automation The following two rules are needed to compute equalities between set extensions, for example, f1; 2g = fg. However, they are not enough, we would need additional rules to show : f1; 2g = f2; 3g. These additional facts do not appear to make good rewrite rules. theorem rule cupequalnullleft [X ] 8 S ; T : P X S [ T = fg, S = fg ^ T = fg theorem rule cupequalnullright [X ] 8 S ; T : P X fg = S [ T, S = fg ^ T = fg Rule cuppermutes is needed to complement the associative and commutative laws. theorem rule cuppermutes [X ] 8 S ; T ; V : P X S [ (T [ V ) = T [ (S [ V ) theorem rule subsetcup [X ] 8 T ; U : P X (S 2 P T _ S 2 P U ) ) S 2 P(T [ U )

23 Z/EVES Project TR a Intersection Denitions syntax \ infun4 \cap [X ] \ : P X P X! P X [capdenition] 8 x : X ; A; B : P X x 2 A \ B, x 2 A ^ x 2 B theorem rule incap [X ] 8 A; B : P X x 2 A \ B, x 2 A ^ x 2 B theorem rule capsubsetleft [X ] S [X ]T ) S \ T = S theorem rule capsubsetright [X ] T [X ]S ) S \ T = T theorem rule unitcap [X ] 8 x : X ; S : P X fxg \ S = if x 2 S then fxg else fg theorem rule capunit [X ] 8 x : X ; S : P X S \ fxg = if x 2 S then fxg else fg theorem rule capcommutes [X ] 8 S ; T : P X S \ T = T \ S theorem rule capassociates [X ] 8 S ; T ; V : P X (S \ T ) \ V = S \ (T \ V ) theorem disabled rule capsubset [X ] 8 S ; T ; U : P X (S U _ T U ) ) S \ T U theorem rule subsetcap [X ] 8 T ; U : P X S 2 P(T \ U ), S 2 P T ^ S 2 P U Automation Rule cappermutes is needed to complement the associative and commutative laws. theorem rule cappermutes [X ] 8 S ; T ; V : P X S \ (T \ V ) = T \ (S \ V )

24 20 Z/EVES Project TR a theorem rule cap result [X ] 8 S ; T : P X j P S 2 P Z _ P T 2 P Z S \ T 2 Z In order to compute intersections of literals, we need the following two rules. theorem rule computecap1 [X ] 8 x : X ; S ; T : P X j x 2 T (fxg [ S) \ T = fxg [ (S \ T ) theorem rule computecap2 [X ] 8 x : X ; S ; T : P X j : x 2 T (fxg [ S) \ T = S \ T

25 Z/EVES Project TR a Set dierence Denitions syntax n infun3 [X ] n \setminus : P X P X! P X [didenition] 8 x : X ; A; B : P X x 2 A n B, x 2 A ^ : x 2 B theorem rule indi [X ] 8 S ; T : P X x 2 S n T, x 2 S ^ : x 2 T theorem rule didi [X ] 8 S ; T ; U : P X (S n T ) n U = S n (T [ U ) theorem rule disubset [X ] 8 S ; T ; U : P X S n T U, S U [ T theorem rule disuperset [X ] 8 S ; T : P X j S 2 P T S n T = fg theorem rule diemptyright [X ] 8 S : P X S n fg = S theorem rule unitdi [X ] 8 x : X ; S : P X fxg n S = if x 2 S then fg else fxg Automation theorem rule di result [X ] 8 S ; T : P X j P S 2 P Z S n T 2 Z In order to compute dierences of literals, we need the following two rules. theorem rule computedi1 [X ] 8 x : X ; S ; T : P X j x 2 T (fxg [ S) n T = S n T theorem rule computedi2 [X ] 8 x : X ; S ; T : P X j : x 2 T (fxg [ S) n T = fxg [ (S n T )

26 22 Z/EVES Project TR a 8.11 Distribution laws theorem disabled rule distributecupovercapright [X ] 8 A; B ; C : P X A [ (B \ C ) = (A [ B) \ (A [ C ) theorem disabled rule distributecupovercapleft [X ] 8 A; B ; C : P X (A \ B) [ C = (A [ C ) \ (B [ C ) theorem disabled rule distributecapovercupright [X ] 8 A; B ; C : P X A \ (B [ C ) = (A \ B) [ (A \ C ) theorem disabled rule distributecapovercupleft [X ] 8 A; B ; C : P X (A [ B) \ C = (A \ C ) [ (B \ C ) theorem disabled rule distributediovercupright [X ] 8 A; B ; C : P X A n (B [ C ) = (A n B) \ (A n C ) theorem disabled rule distributediovercupleft [X ] 8 A; B ; C : P X (A [ B) n C = (A n C ) [ (B n C ) theorem disabled rule distributediovercapright [X ] 8 A; B ; C : P X A n (B \ C ) = (A n B) [ (A n C ) theorem disabled rule distributediovercapleft [X ] 8 A; B ; C : P X (A \ B) n C = (A n C ) \ (B n C )

27 Z/EVES Project TR a Generalized union and intersection Denitions [X ] S ; T : P(P X )! P X [rule inbigcup] 8 x : X ; A : P(P X ) x 2 S A, (9 B : A x 2 B) [rule inbigcap] 8 x : X ; A : P(P X ) x 2 T A, (8 B : A x 2 B) theorem rule bigcupempty [X ] S [X ]fg = fg theorem rule bigcupunit [X ] S 2 P X ) S fsg = S theorem rule bigcupunion [X ] 8 S ; T : P(P X ) S (S [ T ) = ( S S) [ ( S T ) theorem rule inpowerbigcup [X ] 8 S : P(P X ) x 2 S ) x 2 P( S S) theorem rule bigcupinpower [X ] 8 S : P(P X ) S S 2 P T, S 2 P(P T ) theorem bigcupsubsetbigcup [X ] 8 S ; T : P(P X ) j S T S S S T theorem rule bigcapempty [X ] T [X ]fg = X theorem rule bigcapunit [X ] S 2 P X ) T fsg = S theorem rule bigcapunion [X ] 8 S ; T : P(P X ) T (S [ T ) = ( T S) \ ( T T ) theorem rule bigcapinpower [X ] 8 S : P(P X ) x 2 S ) T S 2 P x theorem disabled rule inpowerbigcap [X ] 8 T : P(P X ) S 2 P( T T ), (8 U : T S 2 P U ) theorem bigcapsubsetbigcap [X ] 8 S ; T : P(P X ) j T S T S T T

28 24 Z/EVES Project TR a 9 Ordered pairs The denitions of rst and second are here for compatibility with the original toolkit. It is usually more convenient to use the numeric projection functions (i.e., write p:1 instead of rst p). This is better in proofs because there are no generic actuals needed. Denitions [X ; Y ] rst : X Y! X second : X Y! Y [rule rstdenition] 8 x : X ; y : Y rst(x ; y) = x [rule seconddenition] 8 x : X ; y : Y second(x ; y) = y [paircomposition] 8 p : X Y p = (rst p; second p) theorem rule rstisdot1 [X ; Y ] 8 p : X Y rst[x ; Y ]p = p:1 theorem rule secondisdot2 [X ; Y ] 8 p : X Y second[x ; Y ]p = p:2

29 Z/EVES Project TR a Relations 10.1 Relation space The function $ is predened by the equation X $ Y = P(X Y ). theorem grule reldenition [X ; Y ] X $ Y = P(X Y ) theorem rule nullinrel fg 2 X $ Y theorem rule unitinrel fpg 2 X $ Y, p 2 X Y theorem rule cupinrel [X ; Y ] 8 Q; R : P(X Y ) Q [ R 2 A $ B, Q 2 A $ B ^ R 2 A $ B theorem subsetofrelisrel [X ; Y ] R 2 X $ Y ^ S R ) S 2 X $ Y theorem rule crossisrel [X ; Y ] 8 A : P X ; B : P Y A B 2 X $ Y theorem rule relequalnull : X $ Y = fg theorem relationextensionality [X ; Y ] 8 Q; R : X $ Y Q = R, (8 x : X ; y : Y x R y, x Q y) Automation theorem rule rel type [X ; Y ] P(X Y ) 2 Z ) X $ Y 2 Z theorem rule rel ideal [X ; Y ] P S 2 P(X $ Y ), S 2 X $ Y theorem rule rel sub [X ; Y ] 8 A : P X ; B : P Y A $ B 2 P(X $ Y )

30 26 Z/EVES Project TR a 10.2 Maplets Maplets provide an alternative notation for ordered pairs. They are usually used in dening functions or relations. The dening axiom is phrased as a rewrite rule to eliminate maplets in favour of pairs. Denitions syntax 7! infun1 \mapsto [X ; Y ] 7! : X Y! X Y [rule mapdef] 8 x : X ; y : Y x 7! y = (x ; y)

31 Z/EVES Project TR a Domain and range syntax dom word syntax ran word Denitions \dom \ran [X ; Y ] dom : (X $ Y )! P X ran : (X $ Y )! P Y [disabled rule domdenition] 8 R : X $ Y dom R = fx : X ; y : Y j (x ; y) 2 R xg [disabled rule randenition] 8 R : X $ Y ran R = fx : X ; y : Y j (x ; y) 2 R yg theorem disabled rule indom [X ; Y ] 8 R : X $ Y x 2 dom R, (9 y : Y (x ; y) 2 R) theorem rule domempty [X ; Y ] dom[x ; Y ]fg = fg theorem rule domsingleton [X ; Y ] 8 p : X Y domfpg = fp:1g theorem rule domcup [X ; Y ] 8 Q; R : X $ Y dom(q [ R) = (dom Q) [ (dom R) theorem rule domcross [X ; Y ] 8 A : P X ; B : P Y j : B = fg dom(a B) = A theorem disabled rule domsubset [X ; Y ] 8 S : X $ Y 8 R : P S dom R 2 P(dom S) theorem disabled rule inran [X ; Y ] 8 R : X $ Y y 2 ran R, (9 x : X (x ; y) 2 R) theorem disabled rule inranfunction [X ; Y ] 8 f : X 7! Y y 2 ran f, (9 x : dom f y = f (x)) theorem rule ranempty [X ; Y ] ran[x ; Y ]fg = fg theorem rule ransingleton [X ; Y ] 8 p : X Y ranfpg = fp:2g

32 28 Z/EVES Project TR a theorem rule rancup [X ; Y ] 8 Q; R : X $ Y ran(q [ R) = (ran Q) [ (ran R) theorem rule rancross [X ; Y ] 8 A : P X ; B : P Y j : A = fg ran(a B) = B theorem disabled rule ransubset [X ; Y ] 8 S : X $ Y 8 R : P S ran R 2 P(ran S) Automation theorem rule dominpower [X ; Y ] S 2 P X ^ R 2 S $ Y ) dom[x ; Y ]R 2 P S theorem rule raninpower [X ; Y ] S 2 P Y ^ R 2 X $ S ) ran[x ; Y ]R 2 P S

33 Z/EVES Project TR a Identity relation Denitions syntax id pregen \id id X == f x : X x 7! x g theorem disabled rule inid [X ] p 2 id X, p 2 X X ^ p:1 = p:2 theorem rule pairinid [X ] (x ; y) 2 id X, x = y ^ x 2 X theorem rule applyid [X ] 8 x : X (id X )(x) = x theorem rule domid [X ] 8 S : P X dom(id S) = S theorem rule ranid [X ] 8 S : P X ran(id S) = S theorem rule idnull idfg = fg theorem rule idunit idfxg = f(x ; x)g theorem rule idcup [X ] 8 A; B : P X id(a [ B) = id A [ id B theorem rule idsubsetid id X 2 P(id Y ), X 2 P Y Automation The next four rules could be replaced by a type rule. Better, though, would be to use X! X as the declared set, if bijections were declared yet. theorem rule idtype [X ] id X 2 P(A B), X 2 P A ^ X 2 P B theorem rule idinrel [X ] id X 2 A $ B, X 2 P A ^ X 2 P B theorem rule idinpfun [X ] id X 2 (A 7! B), X 2 P A ^ X 2 P B theorem rule idinfun [X ] id X 2 (A! B), X = A ^ X 2 P B

34 30 Z/EVES Project TR a 10.5 Composition Two composition operators are dened; they are identical except for the order of their arguments. Rather than have two sets of rules, one for each composition operator, we use rule circdef to replace g f by f o 9 g. Denitions syntax o 9 infun4 syntax infun4 \comp \circ [X ; Y ; Z ] o 9 : (X $ Y ) (Y $ Z )! (X $ Z ) : (Y $ Z ) (X $ Y )! (X $ Z ) [disabled rule compdef] 8 Q : X $ Y ; R : Y $ Z Q o 9 R = f x : X ; y : Y ; z : Z j x Q y R z (x ; z) g [rule circdef] 8 Q : X $ Y ; R : Y $ Z R Q = Q o 9 R theorem rule pairincomp [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z (x ; z) 2 Q o 9 R, (9 y : Y x Q y R z) theorem rule compassociates [W ; X ; Y ; Z ] 8 P : W $ X ; Q : X $ Y ; R : Y $ Z (P o 9 Q) o 9 R = P o 9 (Q o 9 R) The domain of a composition Q o 9 R is Q (j dom R j), but this fact cannot be legally stated this early in the Toolkit. A similar fact (and problem) applies to the range of a composition. See Section 10.9, where these theorems appear. theorem domcompsmaller [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z dom(q o 9 R) dom Q theorem rule easydomcomp [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z j ran Q 2 P(dom R) dom(q o 9 R) = dom Q theorem rancompsmaller [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z ran(q o 9 R) ran R theorem rule easyrancomp [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z j dom R 2 P(ran Q) ran(q o 9 R) = ran R theorem rule applycomp [X ; Y ; Z ] f 2 X 7! Y ^ g 2 Y 7! Z ^ x 2 dom f ^ f (x) 2 dom g ) (f o 9 g)(x) = g(f (x))

35 Z/EVES Project TR a 31 It is hard to make a stronger rule than the following, because a composition may apply to a value in cases where its rst member does not. For example, if f = Z Z and g = f0 7! 0g, then f does not apply to anything, while f o 9 g is a function with domain Z. theorem rule compappliesto [X ; Y ; Z ] 8 f : X $ Y ; g : Y $ Z f applies$to x ) ((f o 9 g) applies$to x, g applies$to f (x)) theorem compmonitone [X ; Y ; Z ] 8 Q; Q 0 : X $ Y ; R; R 0 : Y $ Z j Q 0 Q ^ R 0 R Q 0 o 9 R 0 (Q o 9 R) theorem rule compinrel [X ; Y ; Z ] 8 A : P X ; B : P Z j Q 2 A $ Y ^ R 2 Y $ B Q o 9 R 2 A $ B theorem rule compinpfun [X ; Y ; Z ] 8 A : P X ; B : P Z j f 2 A 7! Y ^ g 2 Y 7! B f o 9 g 2 A 7! B theorem rule compinfun [X ; Y ; Z ] 8 A : P X ; B : P Z j f 2 X 7! Y ^ g 2 Y 7! Z f o 9 g 2 A! B, (dom(f o 9 g) = A ^ ran(f o 9 g) B) Automation theorem rule applycompknownfunctions [X ; Y ; Z ] KnownMember[A! B][f =element] ^ KnownMember[C! D][g=element] ^ x 2 A ^ A 2 P X ^ B 2 P C ^ C 2 P Y ^ D 2 P Z ) (f o 9 g)(x) = g(f (x)) We could add domcompresult and RanCompResult here.

36 32 Z/EVES Project TR a 10.6 Domain and range restriction Denitions syntax C infun6 syntax B infun6 \dres \rres [X ; Y ] C : P X (X $ Y )! (X $ Y ) B : (X $ Y ) P Y! (X $ Y ) [disabled rule dresdef] 8 S : P X ; R : X $ Y S C R = f p : R j p:1 2 S g [disabled rule rresdef] 8 R : X $ Y ; S : P Y R B S = f p : R j p:2 2 S g theorem rule indres [X ; Y ] 8 S : P X ; R : X $ Y x 2 S C R, x 2 R ^ x :1 2 S theorem rule inrres [X ; Y ] 8 R : X $ Y ; S : P Y x 2 R B S, x 2 R ^ x :2 2 S theorem rule domdres [X ; Y ] 8 R : X $ Y ; S : P X dom(s C R) = S \ dom R theorem rule ranrres [X ; Y ] 8 R : X $ Y ; S : P Y ran(r B S) = (ran R) \ S theorem dresissubset [X ; Y ] 8 R : X $ Y ; S : P X S C R R theorem rresissubset [X ; Y ] 8 R : X $ Y ; S : P Y R B S R theorem rule compidleft [X ; Y ] 8 S : P X ; R : X $ Y (id S) o 9 R = S C R theorem rule compidright [X ; Y ] 8 R : X $ Y ; S : P Y R o 9 (id S) = R B S theorem rule dresid [X ] 8 S ; T : P X S C (id T ) = id(s \ T ) theorem rule rresid [X ] 8 S ; T : P X (id S) B T = id(s \ T )

37 Z/EVES Project TR a 33 theorem rule dresdres [X ; Y ] 8 S ; T : P X ; R : X $ Y S C (T C R) = (S \ T ) C R theorem rule rresrres [X ; Y ] 8 S ; T : P Y ; R : X $ Y (R B S) B T = R B (S \ T ) We should normalize S C R B T, as the order of association does not matter. theorem rule dreseverything [X ; Y ] 8 R : X $ Y ; S : P X S \ dom R = fg ) S C R = fg theorem rule nulldres [X ; Y ] 8 R : X $ Y fg C R = fg Theorem dreselimination implies S C fg = fg, so we do not have a separate rule for that. theorem rule dreselimination [X ; Y ] 8 R : X $ Y ; S : P X dom R 2 P S ) S C R = R theorem rule dresunit [X ; Y ] 8 x : X ; y : Y ; S : P X S C f(x ; y)g = if x 2 S then f(x ; y)g else fg theorem rule unitdres [X ; Y ] 8 R : X $ Y ; x : X (: x 2 dom R) ) fxg C R = fg theorem rule drescup [X ; Y ] 8 S : P X ; Q; R : X $ Y S C (Q [ R) = (S C Q) [ (S C R) theorem rule rrescup [X ; Y ] 8 Q; R : X $ Y ; S : P Y (Q [ R) B S = (Q B S) [ (R B S) There should be theorems about restricting compositions. theorem rule applydres [X ; Y ] 8 f : X 7! Y ; S : P X x 2 S ^ x 2 dom f ) (S C f )(x) = f (x) theorem rule applyrres [X ; Y ] 8 f : X 7! Y ; S : P Y x 2 dom f ^ f (x) 2 S ) (f B S)(x) = f (x) Automation theorem rule dres result [X ; Y ] 8 S : P X ; R : X $ Y P R 2 P Z ) S C R 2 Z theorem rule rres result [X ; Y ] 8 S : P Y ; R : X $ Y P R 2 P Z ) R B S 2 Z

38 34 Z/EVES Project TR a 10.7 Domain and range anti-restriction Denitions syntax?c infun6 syntax?b infun6 \ndres \nrres [X ; Y ]?C : P X (X $ Y )! (X $ Y )?B : (X $ Y ) P Y! (X $ Y ) [disabled rule ndresdef] 8 S : P X ; R : X $ Y S?C R = f p : R j : p:1 2 S g [disabled rule nrresdef] 8 R : X $ Y ; S : P Y R?B S = f p : R j : p:2 2 S g theorem rule inndres [X ; Y ] 8 S : P X ; R : X $ Y x 2 S?C R, x 2 R ^ : x :1 2 S theorem rule innrres [X ; Y ] 8 R : X $ Y ; S : P Y x 2 R?B S, x 2 R ^ : x :2 2 S theorem rule domndres [X ; Y ] 8 R : X $ Y ; S : P X dom(s?c R) = (dom R) n S theorem rule rannrres [X ; Y ] 8 R : X $ Y ; S : P Y ran(r?b S) = (ran R) n S theorem ndresissubset [X ; Y ] 8 R : X $ Y ; S : P X S?C R R theorem nrresissubset [X ; Y ] 8 R : X $ Y ; S : P Y R?B S R theorem rule ndresid [X ] 8 S ; T : P X S?C (id T ) = id(t n S) theorem rule nrresid [X ] 8 S ; T : P X (id S)?B T = id(s n T ) theorem rule ndresndres [X ; Y ] 8 S ; T : P X ; R : X $ Y S?C (T?C R) = (S [ T )?C R theorem rule nrresnrres [X ; Y ] 8 S ; T : P Y ; R : X $ Y (R?B S)?B T = R?B (S [ T )

39 Z/EVES Project TR a 35 More similar rules are possible, for various combinations of C,?C, B, and?b. theorem rule ndresnothing [X ; Y ] 8 R : X $ Y ; S : P X S \ dom R = fg ) S?C R = R theorem rule nullndres [X ; Y ] 8 R : X $ Y fg?c R = R Theorem dreselimination implies S C fg = fg, so we do not have a separate rule for that. theorem rule ndreseverything [X ; Y ] 8 R : X $ Y ; S : P X dom R 2 P S ) S?C R = fg theorem rule ndresunit [X ; Y ] 8 x : X ; y : Y ; S : P X S?C f(x ; y)g = if x 2 S then fg else f(x ; y)g theorem rule ndrescup [X ; Y ] 8 S : P X ; Q; R : X $ Y S?C (Q [ R) = (S?C Q) [ (S?C R) theorem rule nrrescup [X ; Y ] 8 Q; R : X $ Y ; S : P Y (Q [ R)?B S = (Q?B S) [ (R?B S) There should be theorems about anti-restricting compositions. theorem rule applyndres [X ; Y ] 8 f : X 7! Y ; S : P X : x 2 S ^ x 2 dom f ) (S?C f )(x) = f (x) theorem rule applynrres [X ; Y ] 8 f : X 7! Y ; S : P Y x 2 dom f ^ : f (x) 2 S ) (f?b S)(x) = f (x) Automation theorem rule ndres result [X ; Y ] 8 S : P X ; R : X $ Y P R 2 P Z ) S?C R 2 Z theorem rule nrres result [X ; Y ] 8 S : P Y ; R : X $ Y P R 2 P Z ) R?B S 2 Z

40 36 Z/EVES Project TR a 10.8 Relational inversion Denitions syntax postfun \inv [X ; Y ] : (X $ Y )! (Y $ X ) [disabled rule invdef] 8 R : X $ Y R = fp : R (p:2; p:1)g theorem rule invinpowercross [X ; Y ] 8 A : P Y ; B : P X ; R : X $ Y R 2 P(A B), R 2 P(B A) theorem rule invinrel [X ; Y ] 8 A : P Y ; B : P X ; R : X $ Y R 2 A $ B, R 2 B $ A theorem rule pairininv [X ; Y ] 8 R : X $ Y (x ; y) 2 R, (y; x) 2 R theorem disabled rule inversesequal [X ; Y ] 8 Q; R : X $ Y Q = R, Q = R theorem disabled rule inversessubseteq [X ; Y ] 8 Q; R : X $ Y Q R, Q R theorem rule invcross [X ; Y ] 8 A : P X ; B : P Y (A B) = B A theorem rule invempty [X ; Y ] ( )[X ; Y ]fg = fg theorem rule invunit [X ; Y ] 8 x : X ; y : Y f(x ; y)g = f(y; x)g theorem rule invcup [X ; Y ] 8 Q; R : X $ Y (Q [ R) = (Q ) [ (R ) theorem rule invcap [X ; Y ] 8 Q; R : X $ Y (Q \ R) = (Q ) \ (R ) theorem rule invsetminus [X ; Y ] 8 Q; R : X $ Y (Q n R) = (Q ) n (R )

41 Z/EVES Project TR a 37 theorem rule invinv [X ; Y ] 8 R : X $ Y (R ) = R theorem rule invcomp [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z (Q o 9 R) = (R ) o 9 (Q ) theorem rule invid [X ] 8 S : P X (id S) = id S theorem rule invdres [X ; Y ] 8 S : P X ; R : X $ Y (S C R) = (R ) B S theorem rule invrres [X ; Y ] 8 S : P Y ; R : X $ Y (R B S) = S C (R ) theorem rule invndres [X ; Y ] 8 S : P X ; R : X $ Y (S?C R) = (R )?B S theorem rule invnrres [X ; Y ] 8 S : P Y ; R : X $ Y (R?B S) = S?C (R ) theorem rule dominv [X ; Y ] 8 R : X $ Y dom(r ) = ran R theorem rule raninv [X ; Y ] 8 R : X $ Y ran(r ) = dom R

42 38 Z/EVES Project TR a 10.9 Relational image Denitions [X ; Y ] (j j) : (X $ Y ) P X! P Y [disabled rule imagedef] 8 R : X $ Y ; S : P X R(j S j) = ran(s C R) theorem disabled rule inimage [X ; Y ] 8 R : X $ Y ; S : P X y 2 R(j S j), (9 x : S x R y) theorem imagesubsetrange [X ; Y ] 8 R : X $ Y ; S : P X R(j S j) ran R theorem imagemonotonic1 [X ; Y ] 8 R : X $ Y ; S ; T : P X j S T R(j S j) R(j T j) theorem imagemonotonic2 [X ; Y ] 8 Q; R : X $ Y ; S : P X j Q R Q(j S j) R(j S j) theorem rule imagenull [X ; Y ] 8 R : X $ Y R(j fg j) = fg theorem rule nullimage [X ; Y ] 8 S : P X ( (j j))[x ; Y ](fg; S) = fg The following rule should perhaps be disabled, as it can lead to ugly formulas (e.g., R(j f1; 2g j) will be greatly expanded). On the other hand, it is needed for calculating functional images (e.g., succ(j f1; 2g j)). theorem rule imagecup [X ; Y ] 8 R : X $ Y ; S ; T : P X R(j S [ T j) = R(j S j) [ R(j T j) theorem rule fullimage [X ; Y ] 8 R : X $ Y j dom R 2 P S R(j S j) = ran R theorem rule rstimage [X ; Y ] 8 S : X $ Y rst(j S j) = dom S theorem rule secondimage [X ; Y ] 8 S : X $ Y second(j S j) = ran S theorem rule idimage [X ] 8 S ; T : P X (id S)(j T j) = S \ T

43 Z/EVES Project TR a 39 theorem rule imagedres [X ; Y ] 8 R : X $ Y ; S ; T : P X (S C R)(j T j) = R(j S \ T j) theorem rule imagerres [X ; Y ] 8 R : X $ Y ; S : P Y ; T : P T (R B S)(j T j) = R(j T j) \ S theorem rule imagendres [X ; Y ] 8 R : X $ Y ; S ; T : P X (S?C R)(j T j) = R(j T n S j) theorem rule imagenrres [X ; Y ] 8 R : X $ Y ; S : P Y ; T : P T (R?B S)(j T j) = R(j T j) n S There are more interesting facts to be added, e.g. imagecomp. theorem rule inimageinv [X ; Y ] 8 f : Y 7! X ; S : P X x 2 f (j S j), x 2 dom f ^ f (x) 2 S theorem disabled rule domcomp [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z dom(q o 9 R) = Q (j dom R j) theorem disabled rule rancomp [X ; Y ; Z ] 8 Q : X $ Y ; R : Y $ Z ran(q o 9 R) = R(j ran Q j) Automation The following rules allow simple relational images to be calculated, e.g., succ(j f1; 2; 3g j). The rst rule is disabled because of the if-form it introduces. theorem disabled rule functionimageunit [X ; Y ] 8 f : X 7! Y f (j fxg j) = if x 2 dom f then ff (x)g else fg theorem rule functionimageunitondom [X ; Y ] 8 f : X 7! Y j x 2 dom f f (j fxg j) = ff (x)g theorem rule functionimageunitodom [X ; Y ] 8 f : X 7! Y j : x 2 dom f f (j fxg j) = fg theorem rule image result [X ; Y ] 8 R : X $ Y ; S : P X P(ran R) 2 P Z ) R(j S j) 2 Z

44 40 Z/EVES Project TR a Overriding Denitions syntax infun5 \oplus [X ; Y ] : (X $ Y ) (X $ Y )! (X $ Y ) [disabled rule oplusdef] 8 Q; R : X $ Y Q R = ((dom R)?C Q) [ R theorem rule overrideinpowercross [X ; Y ] 8 A : P X ; B : P Y 8 Q; R : A $ B Q R 2 P(A B) theorem rule overrideinrel [X ; Y ] 8 A : P X ; B : P Y 8 Q; R : A $ B Q R 2 A $ B theorem rule overrideinpfun [X ; Y ] 8 A : P X ; B : P Y 8 f ; g : A 7! B f g 2 A 7! B theorem rule overrideinfun [X ; Y ] 8 A : P X ; B : P Y 8 f : A! B; g : A 7! B f g 2 A! B theorem rule overrideassociates [X ; Y ] 8 Q; R; S : X $ Y (Q R) S = Q (R S) theorem rule overridewithnull [X ; Y ] 8 R : X $ Y R fg = R The following theorem has as a special case fg R = R. theorem rule overrideeverything [X ; Y ] 8 Q; R : X $ Y j dom Q dom R Q R = R theorem rule domoverride [X ; Y ] 8 Q; R : X $ Y dom(q R) = (dom Q) [ (dom R) theorem rule overrideappliesto [X ; Y ] 8 f ; g : X $ Y (f g) applies$to x, g applies$to x _ (: x 2 dom g ^ f applies$to x) theorem rule applyoverride1 [X ; Y ] 8 f ; g : X $ Y ; x : X j g applies$to x (f g)(x) = g(x) theorem rule applyoverride2 [X ; Y ] 8 f ; g : X $ Y ; x : X j : x 2 dom g ^ f applies$to x (f g)(x) = f (x)

45 Z/EVES Project TR a Transitive closure Denitions syntax + postfun \plus syntax postfun \star [X ] + ; : (X $ X )! (X $ X ) [disabled rule plusdef] 8 R : X $ X R + = T f Q : X $ X j R Q ^ Q o 9 Q Q g [disabled rule stardef] 8 R : X $ X R + = T f Q : X $ X j id X Q ^ R Q ^ Q o 9 Q Q g theorem rule domplus [X ] 8 R : X $ X dom(r + ) = dom R theorem rule ranplus [X ] 8 R : X $ X ran(r + ) = ran R theorem rule plusinrel [X ] 8 A; B : P X ; R : X $ X R + 2 A $ B, R 2 A $ B theorem rule domstar [X ] 8 R : X $ X dom(r ) = X theorem rule ranstar [X ] 8 R : X $ X ran(r ) = X theorem rule starinrel [X ] 8 R : X $ X R 2 A $ B, X 2 P A ^ X 2 P B theorem rule nullplus [X ] fg + [X ] = fg theorem rule nullstar [X ] fg = id X theorem plusmonotonic [X ] 8 Q; R : X $ X j Q R Q + R + theorem starmonotonic [X ] 8 Q; R : X $ X j Q R Q R Many more theorems should be added!

46 42 Z/EVES Project TR a 11 Functions 11.1 Function spaces Denitions Partial and total function spaces are predened; the denitions are and X 7! Y == f f : X $ Y j 8 x : X ; y; y 0 : Y j (x ; y) 2 f ^ (x ; y 0 ) 2 f y = y 0 g X! Y == f f : X 7! Y j 8 x : X 9 y : Y (x ; y) 2 f g: theorem disabled rule pfundef [X ; Y ] 8 R : X $ Y R 2 X 7! Y, R o 9 R id Y theorem rule nullinpfun fg 2 A 7! B theorem rule nullinfun fg 2 A! B, A = fg theorem rule unitinpfun fpg 2 A 7! B, p 2 A B theorem rule cupinpfun [X ; Y ] 8 f ; g : P(X Y ); A : P X ; B : P Y (f [ g) 2 A 7! B, f 2 A 7! B ^ g 2 A 7! B ^ (8 x : A j x 2 dom f ^ x 2 dom g f (x) = g(x)) theorem disabled rule cupinfun [X ; Y ] 8 f ; g : P(X Y ); A : P X ; B : P Y (f [ g) 2 A! B, f 2 A 7! B ^ g 2 A 7! B ^ (8 x : A j x 2 dom f ^ x 2 dom g f (x) = g(x)) ^ (dom f ) [ (dom g) = A theorem subsetofpfun f 2 A 7! B ^ g 2 P f ) g 2 A 7! B theorem pfunextensionality [X ; Y ] 8 f ; g : X 7! Y f = g, dom f = dom g ^ (8 x : dom f f (x) = g(x)) theorem funextensionality [X ; Y ] 8 f ; g : X! Y f = g, (8 x : X f (x) = g(x))

47 Z/EVES Project TR a 43 Automation theorem grule pfun type [X ; Y ] X 7! Y 2 P(X $ Y ) theorem rule pfun sub [X ; Y ] 8 A : P X ; B : P Y A 7! B 2 P(X 7! Y ) theorem rule pfun ideal [X ; Y ] P Z 2 P(X 7! Y ), Z 2 X 7! Y theorem grule fun type [X ; Y ] X! Y 2 P(X 7! Y ) theorem rule fun sub [X ; Y ] 8 B : P Y X! B 2 P(X! Y ) theorem rule domfunction KnownMember[A! B] ^ A 2 P X ^ B 2 P Y ) dom[x ; Y ]element = A theorem rule applicationindeclaredrangepfun [A; B] KnownMember[A 7! B] ^ x 2 dom element ^ B 2 P X ) element(x) 2 X theorem rule applicationindeclaredrangefun [A; B] KnownMember[A! B] ^ x 2 A ^ B 2 P X ) element(x) 2 X

48 44 Z/EVES Project TR a 11.2 Application Function application is part of the Z syntax, so no denitions are needed. theorem rule pfunappliesto [X ; Y ] 8 f : X 7! Y f applies$to x, x 2 dom f theorem applyinranpfun [X ; Y ] 8 f : X 7! Y 8 a : dom f f (a) 2 ran f ^ f (a) 2 Y theorem applyinranfun [X ; Y ] 8 f : X! Y ; a : X f (a) 2 Y theorem pairinfunction [X ; Y ] 8 f : X 7! Y (x ; y) 2 f ) y = f (x) theorem rule applyunit z = x ) f(x ; y)g(z) = y theorem rule applycupleft [X ; Y ] 8 f ; g : X $ Y (f [ g) 2 X 7! Y ^ x 2 dom f ) (f [ g)(x) = f (x) theorem rule applycupright [X ; Y ] 8 f ; g : X $ Y (f [ g) 2 X 7! Y ^ x 2 dom g ) (f [ g)(x) = g(x) theorem applysubset [X ; Y ] 8 f ; g : X 7! Y ; x : X j f g ^ x 2 dom f f (x) = g(x)

49 Z/EVES Project TR a Injections Denitions syntax 7 ingen syntax ingen \pinj \inj X 7 Y == f f : X 7! Y j f 2 Y 7! X g X Y == (X 7 Y ) \ (X! Y ) theorem rule nullinpinj fg 2 A 7 B theorem rule unitinpinj fpg 2 A 7 B, p 2 A B theorem rule nullininj fg 2 A B, A = fg theorem disabled rule cupinpinj [X ; Y ] 8 f ; g : P(X Y ); A : P X ; B : P Y (f [ g) 2 A 7 B, f 2 A 7! B ^ g 2 A 7! B ^ (8 x : A j x 2 dom f ^ x 2 dom g f (x) = g(x)) ^ (8 y : B j y 2 ran f ^ y 2 ran g f (y) = g (y)) theorem pinjapplicationsequal [X ; Y ] 8 A : P X ; B : P Y 8 f : A 7 B 8 x ; y : dom f f (x) = f (y) ) x = y theorem subsetofpinjispinj [X ; Y ] 8 f : X 7 Y 8 g : P f g 2 X 7 Y There should be some theorems about inverting injections. Automation theorem grule pinj type X 7 Y 2 P(X 7! Y ) theorem rule inj type (X 7 Y 2 P Z _ X! Y 2 P Z ) ) X Y 2 P Z theorem rule pinj sub [X ; Y ] 8 A : P X ; B : P Y A 7 B 2 P(X 7 Y )

50 46 Z/EVES Project TR a theorem rule inj sub [X ; Y ] 8 B : P Y X B 2 P(X Y ) theorem rule pinj ideal P R 2 P(A 7 B), R 2 A 7 B theorem rule applicationindeclaredrangepinj [A; B] KnownMember[A 7 B] ^ x 2 dom element ^ B 2 P X ) element(x) 2 X theorem rule dominjection KnownMember[A B] ^ A 2 P X ^ B 2 P Y ) dom[x ; Y ]element = A theorem rule applicationindeclaredrangeinj [A; B] KnownMember[A B] ^ x 2 A ^ B 2 P X ) element(x) 2 X We do not have enough rules to \compute" membership of a set construction in A B.

51 Z/EVES Project TR a Surjections Denitions syntax 7! ingen syntax! ingen \psurj \surj X 7! Y == f f : X 7! Y j ran f = Y g X! Y == (X 7! Y ) \ (X! Y ) theorem nullinpsurj fg 2 A 7! B, B = fg theorem unitinpsurj fpg 2 A 7! B, (p 2 A B ^ B = fp:2g) theorem rule cupinpsurj [X ; Y ] 8 f ; g : P(X Y ); A : P X ; B : P Y (f [ g) 2 A 7! B, f 2 A 7! B ^ g 2 A 7! B ^ (8 x : A j x 2 dom f ^ x 2 dom g f (x) = g(x)) ^ (ran f ) [ (ran g) = B Automation theorem grule psurj type X 7! Y 2 P(X 7! Y ) theorem rule psurj sub [X ; Y ] 8 A : P X A 7! Y 2 P(X 7! Y ) theorem rule surj type (X 7! Y 2 P Z _ X! Y 2 P Z ) ) X 7! Y 2 P Z theorem rule ranpsurj [X ; Y ] KnownMember[A 7! B] ^ A 2 P X ^ B 2 P Y ) ran[x ; Y ]element = B theorem rule applicationindeclaredrangepsurj [A; B] KnownMember[A 7! B] ^ x 2 dom element ^ B 2 P X ) element(x) 2 X theorem rule domsurjection [X ; Y ] KnownMember[A! B] ^ A 2 P X ^ B 2 P Y ) dom[x ; Y ]element = A theorem rule ransurjection [X ; Y ] KnownMember[A! B] ^ A 2 P X ^ B 2 P Y ) ran[x ; Y ]element = B theorem rule applicationindeclaredrangesurj [A; B] KnownMember[A! B] ^ x 2 A ^ B 2 P X ) element(x) 2 X We do not have enough rules to \compute" membership of a set construction in A! B.

52 48 Z/EVES Project TR a 11.5 Bijections Denitions syntax! ingen \bij X! Y == (X! Y ) \ (X Y ) theorem rule nullinbij fg 2 A! B, (A = fg ^ B = fg) theorem rule unitinbij fpg 2 A! B, (A = fp:1g ^ B = fp:2g) theorem rule inversebij [X ; Y ] 8 A : P Y ; B : P X ; f : X $ Y f 2 A! B, f 2 B! A Automation theorem rule bij type (X Y 2 P Z _ X! Y 2 P Z ) ) X! Y 2 P Z theorem grule id type id X 2 X! X theorem rule dombijection [X ; Y ] KnownMember[A! B] ^ A 2 P X ^ B 2 P Y ) dom[x ; Y ]element = A theorem rule ranbijection [X ; Y ] KnownMember[A! B] ^ A 2 P X ^ B 2 P Y ) ran[x ; Y ]element = B theorem rule applicationindeclaredrangebij [A; B] KnownMember[A! B] ^ x 2 A ^ B 2 P X ) element(x) 2 X We do not have enough rules to \compute" membership of a set construction in A! B.

53 Z/EVES Project TR a Numbers theorem integersexist : (Z = fg) Function the$integer can be generated by a proof step; it is applied to some expression whose value could not be determined to be integer. theorem rule theintegerelimination 8 i : Z the$integer(i) = i 12.1 Arithmetic functions The arithmetic functions +,?, (?),, div and mod are predened. theorem rule domdiv dom( div ) = Z (Z n f0g) theorem rule dommod dom( mod ) = Z (Z n f0g) theorem grule divmodrelation 8 x ; y : Z j : y = 0 x = (x div y) y + (x mod y) theorem modrange1 8 x ; y : Z j y > 0 0 x mod y < y theorem modrange2 8 x ; y : Z j y < 0 y < x mod y 0

54 50 Z/EVES Project TR a 12.2 Arithmetic relations The relations <,,, and > are predened. theorem rule lessthaninv ( < ) = ( > ) theorem rule leqinv ( ) = ( ) theorem rule greaterthaninv ( > ) = ( < ) theorem rule geqinv ( ) = ( ) We could also have a number of theorems about composition of the arithmetic relations.

55 Z/EVES Project TR a Naturals Denitions N == f n : Z j n 0 g N 1 == f n : N j n 1 g succ : N! N 1 [rule succdef] 8 n : N succ(n) = n + 1 theorem rule innat x 2 N, x 2 Z ^ x 0 theorem rule innat1 x 2 N 1, x 2 Z ^ x 1 theorem natsexist : N = fg theorem nat1sexist : N 1 = fg The following theorem shows that functions on the naturals can be dened inductively. theorem primitiverecursion [X ] 8 base : X ; step : X N! X 9 f : N! X f (0) = base ^ (8 n : N f (n + 1) = step(f (n); n)) Here is another version of the primitive recursion theorem, where we allow the dened function to have additional parameters. theorem generalprimitiverecursion [Result; Parameter] 8 base : Parameter! Result; step : Result N Parameter! Result 9 f : N Parameter! Result 8 p : Parameter f (0; p) = base(p) ^ (8 n : N f (n + 1; p) = step(f (n; p); n; p)) Automation theorem grule nattype N 2 P Z theorem grule nat1 type N 1 2 P N