Theorem Proving in Lean Release 3.23.0 Jeremy Avigad, Leonardo de Moura, and Soonho Kong Apr 25, 2023 CONTENTS 1 Introduction 1 1.1 Computers and Theorem Proving . . . . . . . . . . . . . . . . . . . . . . . . . 163 Bibliography 167 iii iv CHAPTER ONE INTRODUCTION 1.1 Computers and Theorem Proving Formal verification involves the use of logical and computational methods to establish claims correctness becomes a form of theorem proving. Conversely, the proof of a mathematical theorem may require a lengthy computation, in which case verifying the truth of the theorem requires verifying that the

before the loop, the loop must end.if ( b <= e ) { counting_theorem( b, e ); int i = b; while ( i != e ) ++i; } void counting_theorem( const int b, const int e ) interface { extend_stability b ( i != e ) { claim i < e; ++i; } }if ( b <= e ) { counting_theorem( b, e ); int i = b; while ( i != e ) ++i; } void counting_theorem( const int b, const int e ) interface { extend_stability b ( i != e ) { claim i < e; ++i; } }if ( b <= e ) { counting_theorem( b, e ); int i = b; while ( i != e ) ++i; } void counting_theorem( const int b, const int e ) interface { extend_stability b

. . 35 3.6 An Example: Abstract Syntax . . . . . . . . . . . . . . . . . . . . . . . . . 36 4 Theorem Proving in Lean 38 4.1 Assertions in Dependent Type Theory . . . . . . . . . . . . . . . . . . programs can be written in Lean and run by the bytecode interpreter. In fact, a full-blown resolution theorem prover for Lean has been written in Lean itself. You can profile your code by setting the relevant expressed, and any theorem that can be proved using conventional mathematical means can be carried out formally, with enough effort. Here is a proof that the sum of two even numbers is even: theorem even_add :

directory for the project. 1.4 Using the Package Manager leanpkg is the package manager for the Lean theorem prover. It downloads dependencies and manages what modules you can import in your Lean files. This or structure declaration. Similarly, objects can be defined in various ways, such as using def, theorem, or the equation compiler. See Chapter 4 for more information. Writing an expression (t : α) forces Implicit Arguments When declaring arguments to defined objects in Lean (for example, with def, theorem, constant, inductive, or structure; see Chapter 4) or when declaring variables and parameters in

assis- tants, or interactive theorem provers, but a mischievous student coined the phase “proof-preventing beasts,” and dictation software occasionally misunderstands “theorem prover” as “fear improver.” ” Consider yourself warned. Rigorous and Formal Proofs Interactive theorem proving has its own terminol- ogy, already starting with the notion of “proof.” A formal proof is a logical argu- ment expressed ics have been the proof of the four-color theorem by Gonthier et al. [8], the proof 1https://www.scottaaronson.com/teaching.pdf vii of the odd-order theorem by Gonthier et al. [9], and the proof of the

. . . . . 43 i ii CHAPTER ONE INTRODUCTION This tutorial can be viewed as a companion to Theorem Proving in Lean, which presents Lean as a system for building mathematical libraries and stating ” or ff, for “false.” This provides another perspective on Lean: instead of thinking of it as a theorem prover whose language just happens to have a computational interpretation, think of it as a programming tour of some of the terms we can write in Lean. For a more detailed and exhaustive account, see Theorem Proving in Lean. 2.1 Some Basic Types In Lean: • #check can be used a check the type of an expression

distributions Joint probability distribution Independence Conditional probability distribution Bayes’ Theorem ... ... Feng Li (SDU) GDA, NB and EM September 27, 2023 3 / 122 Sample Space, Events and Probability =y(x)dx P(Y = y) = pY (y) Feng Li (SDU) GDA, NB and EM September 27, 2023 16 / 122 Bayes’ Theorem Bayes’ theorem (or Bayes’ rule) describes the probability of an event, based on prior knowledge of conditions A)P(A) P(B) In the Bayesian interpretation, probability measures a “degree of be- lief”, and Bayes’ theorem links the degree of belief in a proposition before and after accounting for evidence. For proposition

thus is a concave function regardless of the original problem; iii) G can be −∞ for some α and β Theorem 1. Lower Bounds Property: If α ⪰ 0, then G(α, β ) ≤ p∗ where p∗ is the optimal value of the (original) We now choose the minimizer of f(˜ω) over all feasible ˜ω’s to get p∗ ≥ G(α, β ). It is shown by Theorem 1 that, the Lagrange dual function provides a non-trivial lower bound to the primal optimization Complementary Slackness Let ω∗ be a primal optimal point and (α∗, β ∗) be a dual optimal point. Theorem 2. Complementary Slackness: If strong duality holds, then α∗ i gi(ω∗) = 0 (16) for ∀i = 1, 2, ·

with rule — matching intermediate values . . . . . . . . . . . . . . . . . . . . . . . . . . 39 9 Theorem Proving 41 9.1 Equality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . gives a ghci style interface which allows evaluation of, as well as type checking of, expressions; theorem proving, compilation; editing; and various other operations. The command :? gives a list of supported Definitions to complete the definition of parity. 40 Chapter 8. Views and the “with” rule CHAPTER 9 Theorem Proving 9.1 Equality Idris allows propositional equalities to be declared, allowing theorems about

Idris Packages 35 8 Example: The Well-Typed Interpreter 37 9 Views and the “with” rule 41 10 Theorem Proving 43 11 Provisional Definitions 47 12 Interactive Editing 51 13 Syntax Extensions 55 14 gives a ghci style interface which allows evaluation of, as well as type checking of, expressions; theorem proving, compilation; editing; and various other operations. The command :? gives a list of supported Definitions to complete the definition of parity. 42 Chapter 9. Views and the “with” rule CHAPTER 10 Theorem Proving 10.1 Equality Idris allows propositional equalities to be declared, allowing theorems about