15 Predicates, subtypes, and relations

Let us give an introduction to a few notions that are particularly useful to formalise mathematics.

15.1 Predicates

We have encountered predicates informally before. Here is the formal definition.

Definition 15.1 (Predicate) Let \(X\) be a set. A function \(P : X \to \mathrm{Prop}\) is called a predicate on \(X\).

Most of the predicates we have seen have been defined inductively. But this does not have to be the case. Regardless, if \(P : X \to \mathrm{Prop}\) is a predicate on \(X\), then for all \(x : X\), \(P(x)\) is a proposition, representing a property that \(x\) may or may not have. More precisely, we say that \(x\) has the property in question if and only if \(P(x)\) has a proof.

Example 15.1 (Even natural numbers) Let us use an inductively-defined predicate to formalise the property that a natural number is even.

One way to do this is to say that \(n\) is even if there is a natural number \(k\) such that \(n = k + k\). The following definition means that dbl k is evidence for the fac t that k + k is even.
```
Inductive IsEven : nat → Prop :=
| dbl (k : nat)  : IsEven (k + k)
```
Another approach to the predicate IsEven : nat → Prop is as follows. By definition, \(0\) is considred even (which we formalise by giving evidence for it), and, if \(n\) is known to be even, then \(n + 2\) is also even. Note that we use S (S n) instead of n + 2, to facilitate computation (a simple precaution?).
```
Inductive IsEven' : nat → Prop :=
| zero_is_even                     : IsEven' 0
| succ_succ_even_is_even (n : nat) : IsEven' n → IsEven' (S (S n)) 
```

Note that, with both definitions, a proposition such as IsEven 5 typechecks just fine.

Exercise 15.1 Using each of the definitions in Example 15.1, show that \(0, 2\) and \(4\) are even natural numbers.

As mentioned earlier, defining predicates inductively is quite common, and usually convenient. In the case of IsEven : nat → Prop, another approach is possible. Namely, \(0\) is even, \(1\) is not even, and (recursively) \(n + 2\) is even if and only if \(n\) is even.

Fixpoint even (n : nat) : Prop :=
match n with 
| 0       => True
| 1       => False
| S (S n) => even n

The difference with the inductive approach is that, here, the proposition even n is defined explicitly for all n (it evaluates to True or False). If we follow this approach, we can also define the property of being even using a bool-valued predicate, the difference being that evenb is a boolean value, so it does not makes sense to speak of “a proof of evenb n”.

Fixpoint evenb (n : nat) : bool :=
match n with 
| 0       => true
| 1       => false
| S (S n) => evenb n

Finally, there is a definition of the predicate IsEven : nat → Prop that uses mathematical notation as supported in Rocq.

Definition IsEven'' (n : nat) : Prop := ∃ k : nat, n = k + k.

We will not comment on it further at this stage, as it is equivalent to the definition of IsEven in Example 15.1. In particular, we can destruct terms of type IsEven'' n, and do induction on them, exactly as those of type IsEven n.

15.2 Subtypes

Let us go back to abstract predicates. To a predicate \(P : X \to \mathrm{Prop}\), we can associate the following type \(X_P\), called a subtype (or a subset) of \(X\). \[ X_P := \{x : X\ |\ P(x)\} \]

For instance, {n : nat | IsEven n} typechecks as a set.

Check {n : nat | IsEven n}.
  (* : Set *)

The set \(X_P\) represents the subset of \(X\) consisting of all elements \(x\) for which the proposition \(P(x)\) holds. In Rocq, the syntax {x : X | P x} would typecheck. More precisely, we can define a function subset as follows.

Definition subset (X : Set) (P : X → Prop) : Set := {x : X | P x}.

For instance, subset nat IsEven represents the subset of even natural numbers. By definition, the elements of the set subtype nat IsEven are pairs (n, p) where n is a natural number and p is a proof of the proposition IsEven n. For instance (2, dbl 1) is of that form, so the following typechecks and the typechecker shows its type as nat * IsEven (1 + 1) because 2 is of type nat and dbl 1 is of type IsEven (1 + 1).

Check (2, dbl 1).
  (* (2, dbl 1) : nat * IsEven (1 + 1) *)

Note that, if we use a bool-valued predicate instead, and identify bool with the set \(\{0, 1\}\), then \(P : X \to \{0, 1\}\) is the characteristic function of the subset \(X_P\). Namely, \(P(x) = 1\) if and only if \(x \in X_P\). However, this is not how we think of subsets in Rocq or more generally when we formalise mathematics using a type-theoretic approach.

The precise introduction and elimination rules that define \(X_P\) as a type are a bit involved, so we will skip them for now. Instead, we reason about the predicate \(P : X \to \mathrm{Prop}\) directly. For instance, if we want to prove that the sum of two even natural numbers is even, we write the following.

Theorem 15.1 (A sum of even natural numbers is even) For all \(m, n : \mathbb{N}\), if \(m\) is even and \(n\) is even, then \((m + n)\) is even.

Or, as a (curried) Rocq function:

Theorem add_even : ∀ m n : nat, IsEven m → IsEven n → IsEven (m + n).

Proof. For the proof, let us introduce natural numbers m and n, a proof Hm that m is even and a proof Hn that n is even.

intros m n Hm Hn.

By definition of being even, this means that there exists a p : nat such that m = p + p and a q : nat such that n = q + q. So now m + n = (p + p) + (q + q) and we have to prove that this natural number is even.

destruct Hm as [p], Hn as [q].

By an algebraic manipulation we can replace (p + p) + (q + q) by (p + q) + (p + q), which is even because it is of the form k + k for k = p + q.

assert ((p + p) + (q + q) = (p + q) + (p + q)) as H by admit.
rewrite H.

More precisely, the proposition IsEven ((p + q) + (p + q)) holds because we can give the evidence dbl (p + q) for it.

exact (dbl (p + q)).

And we will leave it at that for now 🙂 .

If we insist on using subsets, we can use Theorem add_even to construct a function add_even_numbers with the following signature.

Definition add_even_numbers : {n : nat | IsEven n} → {n : nat | IsEven n} → {n : nat | IsEven n}.
Proof.
  intros a b.
  destruct a as [m Hm], b as [n Hn].
  exists (m + n).
  exact (add_even m n Hm Hn).
Defined.

This is sometimes useful but unnecessarily complicated for us at this stage. Note in particular that there is more than one function with the same type signature (think of multiplication of even numbers, for instance). Note that we can also provide a definition of the function add_even_numbers without making use of Rocq’s tactical language.

Definition add_even_numbers : {n : nat | IsEven n} → {n : nat | IsEven n} → {n : nat | IsEven n} :=
  fun a b =>
    match a, b with exist _ m Hm, exist _ n Hn => 
      exist _ (m + n) (add_even m n Hm Hn)
    end.

We also point out, without getting into the details, that the proof of Theorem 15.1 is less straightforward if we use the definition IsEven' of Example 15.1. So instead we should prove that the two definitions are equivalent, which we will do in the next lecture.

15.3 Relations

According to the definition we gave above, predicates on a type \(X\) are just unary functions \(P : X \to \mathrm{Prop}\). We now consider binary such functions, which are more commonly called relations on \(X\).

Definition 15.2 (Relations) Let \(X\) be a set. A function \(R : X \to X \to \mathrm{Prop}\) is called a relation on \(X\).

This means that, for all \(x, y : X\), we have a proposition \(R(x, y)\) and a proof of that proposition is evidence for the fact that the relation holds between \(x\) and \(y\). As a running example, we will use the following relation between natural numbers.

Example 15.2 (Ordering on \(\mathbb{N}\)) Let us introduce a relation on nat inductively as follows.

Inductive leq : nat → nat → Prop :=
| zero_leq  : ∀ (n : nat), leq 0 n
| succ_mono : ∀ (m n : nat), leq m n → leq (S m) (S n).

Infix "≤" := leq (at level 70, no associativity).

So, for instance, zero_leq 3 is a proof that 0 ⩽ 3 and succ_mon 0 3 (zero_leq 3) is a proof that 1 ⩽ 4. Similarly, if we want to construct a proof of 2 ⩽ 5, we use succ_mon 1 4 h, where h is a proof of 1 ⩽ 4. In tactical language, this can be written as follows.

Goal (2 ≤ 5).
Proof.
  apply succ_mono.
  apply succ_mono.
  apply zero_leq.
Qed.

Let us now see how to study properties of a relation R : X → X → Prop. For instance, how can we express, in our meta-language (i.e. Rocq), that the relation ≤ : nat → nat → Prop is:

reflexive?
transitive?
anti-symmetric?

Definition 15.3 (Properties of relations) Let \(X\) be a type and let \(R : X \to X \to \mathrm{Prop}\) be a relation. The relation \(R\) is called:

reflexive if the following proposition holds: \(\forall x : X, R(x,x)\).
transitive if \(\forall x, y, z : X, R(x,y) \to R(y,z) \to R(x,z)\).
symmetric if \(\forall x, y : X, R(x,y) \to R(y,x)\).
anti-symmetric if \(\forall x, y : X, R(x,y) \to R(y,x) \to x =_X y\).

If \(R\) is reflexive, transitive and symmetric, we say that \(R\) is an equivalence relation. If \(R\) is reflexive,transitive and anti-symmetric, we say that \(R\) is an ordering (or order relation) on \(X\). A relation that is reflexive and transitive is called a pre-ordering.

Note that the anti-symmetry property of \(R\) involves the equality relation on \(X\) and is a kind of extensionality property for \(R\). Let us now prove informally that the relation leq : nat → nat → Prop is reflexive and transitive. We will see formal proofs of these facts later on.

Theorem 15.2 (≤ is reflexive) For all n : nat, n ≤ n.

Proof. To prove this, we introduce n : nat and we reason by induction on n.

The base case is n = 0, for which the goal becomes 0 ≤ 0, which is proved by zero_leq 0.
For the induction step, we assume that n ≤ n and we want to prove that n + 1 ≤ n + 1. This is proven by applying succ_mono n n, because the latter is a proof of n ≤ n → n + 1 ≤ n + 1.

Theorem 15.3 (≤ is transitive) For all p q r : nat, p ≤ q → q ≤ r → p ≤ r.

Proof. To prove this, we introduce natural numbers p q r : nat and proofs H1 : p ≤ q and H2 : q ≤ r. Contrary to Theorem 15.2, we will not reason by induction on a natural number but by induction on the proof H1 of the proposition p ≤ q.

The base case is when H1 = zero_leq q, which forces p = 0. But then the goal is 0 ≤ r, so we can prove it by zero_leq r.
The inductive step is when H1 = succ_mono p' q' H', where H' is a proof of p' ≤ q'. In this case, we necessarily have p = S p' and q = S q'. So q ≤ r is of the form S q' ≤ r, which forces r to be of the form S r'. So H2 is now a proof of S q' ≤ S r'. This can only occur if H2 is of the form succ_mono q' r' H'', where H'' is a proof of q' ≤ r'. We should now be able to apply the induction hypothesis to H' : p' ≤ q' and H'' : q' ≤ r' to obtain a proof of p' ≤ r'. Next, applying succ_mono p' r' to the proof of p' ≤ r' that we have just constructed, we obtain a proof of S p' ≤ S r', i.e. p ≤ r, which concludes the induction.

Generalized induction

Convincing as this may seem, the proof above does not quite go through if we try to formalise it as such, because of the shape of the induction hypothesis IH. We want to apply it to H' : p' ≤ q' and H'' : q' ≤ r', but the issue is the argument r'. The way we wrote the proof, the induction hypothesis will be of the form q' ≤ S r' → p' ≤ S r', because r was fixed when we started the induction. So we should in fact have reverted r (hence also H2) to the context before starting the induction on H1, which then gives an induction hypothesis of the form ∀ r, q' ≤ r → p' ≤ r and the latter can be applied with r = r'. We will see the details later, when we formalise this in Rocq.

We leave the anti-symmetry property of leq as an exercise. A formal proof will be given later on.

Exercise 15.2 (≤ is anti-symmetric) Show that, for all m n : nat, m ≤ n → n ≤ m → m = n.