Question

我尝试在subtypes中练习Coq，并使用ssreflect来简化操作。但是在重写子类型时我总是遇到一些问题。例如：

Require Import Omega.
From mathcomp Require Import ssreflect ssrfun ssrbool ssrnat eqtype.

(* a type A to build X *)
Inductive A: Set :=
| mkA: nat -> A.

Definition getNat_A (a: A) :=
match a with
| mkA n => n
end.

Inductive X: Set :=
| r1 : A -> X.

(* subtype of X that satisfying some property *)
Definition Instantiated_X (x : X) : bool :=
  match x with
  | r1 a => (getNat_A a) > 10
end.

Definition iX : Set := {x:X | (Instantiated_X x)}.

(* rewrite constructor of X, stating the fact of elements of A, under certain condition creates element of iX *)
Program Definition r1_rewrite : A -> option iX :=
fun a: A =>
 match (Instantiated_X (r1 a)) with 
 | true => Some (exist _ (r1 a) _)
 | false => None
 end.

(* try to prove r1_rewrite is surjective *)
Example r1_rewrite_surj: 
forall t : iX, exists (a : A),
 match (r1_rewrite a) with
 | None => True
 | Some e => eq t e
 end.
 Proof.
  intros.
  destruct t eqn: caseiX.
  destruct x eqn: caseX.
  exists a.
  destruct (r1_rewrite a) eqn: r_res.
   - destruct (10 < getNat_A a) eqn: guard.
     destruct i0.
     destruct x0.
     unfold r1_rewrite in r_res.
     simpl in r_res.
     rewrite <- guard in r_res. (* <- stuck *)
Abort.

我无法理解为什么它会卡在那里。错误消息说：

Error: Abstracting over the term "true" leads to a term: ... 
which is ill-typed.

我认为Coq会在(10 < getNat_A a)中用true替换r_res的每一次出现，这会导致类似：

Some (exist (fun x : X => Instantiated_X x) (r1 a)
          (r1_rewrite_obligation_1 a Heq_anonymous) =
Some (exist (fun x : X => Instantiated_X x) (r1 a0) i0)

并proof irrelevance和r1 injectivity允许我的证明通过。所以，我想知道在这种情况下我可以得到一些关于如何按摩r_res的指针，以便于重写。

编辑：删除Eq类型类及其实例，使示例更简洁

Answer 1

您的证明尝试的问题是您必须小心如何重写。这是一个可能的解决方案。

Example r1_rewrite_surj:
forall t : iX, exists (a : A),
 match (r1_rewrite a) with
 | None => True
 | Some e => eq t e
 end.
Proof.
move=> [[a] Pa]; exists a; rewrite /r1_rewrite.
move: (erefl _); rewrite {1 3}Pa.
by move=> e; rewrite (eq_irrelevance (r1_rewrite_obligation_1 _ _) Pa).
Qed.

看到这里发生的事情有点棘手。在第一行之后，证明状态如下所示：

  a : A
  Pa : Instantiated_X (r1 a)
  ============================
  match
    (if Instantiated_X (r1 a) as b return b = Instantiated_X (r1 a) -> option iX
     then
      fun H : true = Instantiated_X (r1 a) =>
      Some (exist (fun x : X => Instantiated_X x) (r1 a) (r1_rewrite_obligation_1 a H))
     else fun _ : false = Instantiated_X (r1 a) => None) (erefl (Instantiated_X (r1 a)))
  with
  | Some e => exist (fun x : X => Instantiated_X x) (r1 a) Pa = e
  | None => True
  end

如果我们尝试在下面的任何一次出现时使用Pa重写，我们将收到类型错误。例如：

如果我们尝试替换第一次出现的Instantiated_X (r1 a)，则Coq将不允许我们将if的结果应用于(erefl (Instantiated_X (r1 a))。
我们可以通过用erefl替换Instantiated_X (r1 a)出现的第一个，第二个和第六个（true个）来解决上述问题。这也行不通，因为它会使r1_rewrite_obligation_1的应用程序生病。

解决方案是概括erefl（通过调用move: (erefl _)），导致以下证明状态：

  forall e : Instantiated_X (r1 a) = Instantiated_X (r1 a),
  match
    (if Instantiated_X (r1 a) as b return b = Instantiated_X (r1 a) -> option iX
     then
      fun H : true = Instantiated_X (r1 a) =>
      Some (exist (fun x : X => Instantiated_X x) (r1 a) (r1_rewrite_obligation_1 a H))
     else fun _ : false = Instantiated_X (r1 a) => None) e
  with
  | Some e0 => exist (fun x : X => Instantiated_X x) (r1 a) Pa = e0
  | None => True
  end

可能不容易看到，但此时可以安全地使用Pa重写以替换Instantiated_X (r1 a)的第一和第三次出现，并允许if减少。然后我们可以通过诉诸证明与布尔相等无关的证据来结束。

毋庸置疑，以这种方式打字问题的推理是一场噩梦。正如ejgallego指出的那样，在这种情况下重用ssreflect的子类型机制要容易得多。例如：

(* Other definitions remain the same *)
Definition r1_rewrite a : option iX := insub (r1 a).

Example r1_rewrite_surj:
forall t : iX, exists (a : A),
 match (r1_rewrite a) with
 | None => True
 | Some e => eq t e
 end.
Proof.
by move=> [[a] Pa]; exists a; rewrite /r1_rewrite insubT.
Qed.

insub功能是r1_rewrite的通用版本。它检查定义子类型的属性是否成立，如果是，则将该对象与相应的证明配对。 insubT引理说insub在属性成立时返回Some。

Coq

1 个答案: