diff --git a/metadata/metadata b/metadata/metadata --- a/metadata/metadata +++ b/metadata/metadata @@ -1,8696 +1,8701 @@ [Fourier] title = Fourier Series author = Lawrence C Paulson topic = Mathematics/Analysis date = 2019-09-06 notify = lp15@cam.ac.uk abstract = This development formalises the square integrable functions over the reals and the basics of Fourier series. It culminates with a proof that every well-behaved periodic function can be approximated by a Fourier series. The material is ported from HOL Light: https://github.com/jrh13/hol-light/blob/master/100/fourier.ml [Generic_Deriving] title = Deriving generic class instances for datatypes author = Jonas Rädle , Lars Hupel topic = Computer Science/Data Structures date = 2018-11-06 notify = jonas.raedle@gmail.com abstract =

We provide a framework for automatically deriving instances for generic type classes. Our approach is inspired by Haskell's generic-deriving package and Scala's shapeless library. In addition to generating the code for type class functions, we also attempt to automatically prove type class laws for these instances. As of now, however, some manual proofs are still required for recursive datatypes.

Note: There are already articles in the AFP that provide automatic instantiation for a number of classes. Concretely, Deriving allows the automatic instantiation of comparators, linear orders, equality, and hashing. Show instantiates a Haskell-style show class.

Our approach works for arbitrary classes (with some Isabelle/HOL overhead for each class), but a smaller set of datatypes.

[Partial_Order_Reduction] title = Partial Order Reduction author = Julian Brunner topic = Computer Science/Automata and Formal Languages date = 2018-06-05 notify = brunnerj@in.tum.de abstract = This entry provides a formalization of the abstract theory of ample set partial order reduction. The formalization includes transition systems with actions, trace theory, as well as basics on finite, infinite, and lazy sequences. We also provide a basic framework for static analysis on concurrent systems with respect to the ample set condition. [CakeML] title = CakeML author = Lars Hupel , Yu Zhang <> contributors = Johannes Åman Pohjola <> topic = Computer Science/Programming Languages/Language Definitions date = 2018-03-12 notify = hupel@in.tum.de abstract = CakeML is a functional programming language with a proven-correct compiler and runtime system. This entry contains an unofficial version of the CakeML semantics that has been exported from the Lem specifications to Isabelle. Additionally, there are some hand-written theory files that adapt the exported code to Isabelle and port proofs from the HOL4 formalization, e.g. termination and equivalence proofs. [CakeML_Codegen] title = A Verified Code Generator from Isabelle/HOL to CakeML author = Lars Hupel topic = Computer Science/Programming Languages/Compiling, Logic/Rewriting date = 2019-07-08 notify = lars@hupel.info abstract = This entry contains the formalization that accompanies my PhD thesis (see https://lars.hupel.info/research/codegen/). I develop a verified compilation toolchain from executable specifications in Isabelle/HOL to CakeML abstract syntax trees. This improves over the state-of-the-art in Isabelle by providing a trustworthy procedure for code generation. [DiscretePricing] title = Pricing in discrete financial models author = Mnacho Echenim topic = Mathematics/Probability Theory, Mathematics/Economics date = 2018-07-16 notify = mnacho.echenim@univ-grenoble-alpes.fr abstract = We have formalized the computation of fair prices for derivative products in discrete financial models. As an application, we derive a way to compute fair prices of derivative products in the Cox-Ross-Rubinstein model of a financial market, thus completing the work that was presented in this paper. extra-history = Change history: [2019-05-12]: Renamed discr_mkt predicate to stk_strict_subs and got rid of predicate A for a more natural definition of the type discrete_market; renamed basic quantity processes for coherent notation; renamed value_process into val_process and closing_value_process to cls_val_process; relaxed hypothesis of lemma CRR_market_fair_price. Added functions to price some basic options. (revision 0b813a1a833f)
[Pell] title = Pell's Equation author = Manuel Eberl topic = Mathematics/Number Theory date = 2018-06-23 notify = eberlm@in.tum.de abstract =

This article gives the basic theory of Pell's equation x2 = 1 + D y2, where D ∈ ℕ is a parameter and x, y are integer variables.

The main result that is proven is the following: If D is not a perfect square, then there exists a fundamental solution (x0, y0) that is not the trivial solution (1, 0) and which generates all other solutions (x, y) in the sense that there exists some n ∈ ℕ such that |x| + |y| √D = (x0 + y0 √D)n. This also implies that the set of solutions is infinite, and it gives us an explicit and executable characterisation of all the solutions.

Based on this, simple executable algorithms for computing the fundamental solution and the infinite sequence of all non-negative solutions are also provided.

[WebAssembly] title = WebAssembly author = Conrad Watt topic = Computer Science/Programming Languages/Language Definitions date = 2018-04-29 notify = caw77@cam.ac.uk abstract = This is a mechanised specification of the WebAssembly language, drawn mainly from the previously published paper formalisation of Haas et al. Also included is a full proof of soundness of the type system, together with a verified type checker and interpreter. We include only a partial procedure for the extraction of the type checker and interpreter here. For more details, please see our paper in CPP 2018. [Knuth_Morris_Pratt] title = The string search algorithm by Knuth, Morris and Pratt author = Fabian Hellauer , Peter Lammich topic = Computer Science/Algorithms date = 2017-12-18 notify = hellauer@in.tum.de, lammich@in.tum.de abstract = The Knuth-Morris-Pratt algorithm is often used to show that the problem of finding a string s in a text t can be solved deterministically in O(|s| + |t|) time. We use the Isabelle Refinement Framework to formulate and verify the algorithm. Via refinement, we apply some optimisations and finally use the Sepref tool to obtain executable code in Imperative/HOL. [Minkowskis_Theorem] title = Minkowski's Theorem author = Manuel Eberl topic = Mathematics/Geometry, Mathematics/Number Theory date = 2017-07-13 notify = eberlm@in.tum.de abstract =

Minkowski's theorem relates a subset of ℝn, the Lebesgue measure, and the integer lattice ℤn: It states that any convex subset of ℝn with volume greater than 2n contains at least one lattice point from ℤn\{0}, i. e. a non-zero point with integer coefficients.

A related theorem which directly implies this is Blichfeldt's theorem, which states that any subset of ℝn with a volume greater than 1 contains two different points whose difference vector has integer components.

The entry contains a proof of both theorems.

[Name_Carrying_Type_Inference] title = Verified Metatheory and Type Inference for a Name-Carrying Simply-Typed Lambda Calculus author = Michael Rawson topic = Computer Science/Programming Languages/Type Systems date = 2017-07-09 notify = mr644@cam.ac.uk, michaelrawson76@gmail.com abstract = I formalise a Church-style simply-typed \(\lambda\)-calculus, extended with pairs, a unit value, and projection functions, and show some metatheory of the calculus, such as the subject reduction property. Particular attention is paid to the treatment of names in the calculus. A nominal style of binding is used, but I use a manual approach over Nominal Isabelle in order to extract an executable type inference algorithm. More information can be found in my undergraduate dissertation. [Propositional_Proof_Systems] title = Propositional Proof Systems author = Julius Michaelis , Tobias Nipkow topic = Logic date = 2017-06-21 notify = maintainafpppt@liftm.de abstract = We formalize a range of proof systems for classical propositional logic (sequent calculus, natural deduction, Hilbert systems, resolution) and prove the most important meta-theoretic results about semantics and proofs: compactness, soundness, completeness, translations between proof systems, cut-elimination, interpolation and model existence. [Optics] title = Optics author = Simon Foster , Frank Zeyda topic = Computer Science/Functional Programming, Mathematics/Algebra date = 2017-05-25 notify = simon.foster@york.ac.uk abstract = Lenses provide an abstract interface for manipulating data types through spatially-separated views. They are defined abstractly in terms of two functions, get, the return a value from the source type, and put that updates the value. We mechanise the underlying theory of lenses, in terms of an algebraic hierarchy of lenses, including well-behaved and very well-behaved lenses, each lens class being characterised by a set of lens laws. We also mechanise a lens algebra in Isabelle that enables their composition and comparison, so as to allow construction of complex lenses. This is accompanied by a large library of algebraic laws. Moreover we also show how the lens classes can be applied by instantiating them with a number of Isabelle data types. [Game_Based_Crypto] title = Game-based cryptography in HOL author = Andreas Lochbihler , S. Reza Sefidgar <>, Bhargav Bhatt topic = Computer Science/Security/Cryptography date = 2017-05-05 notify = mail@andreas-lochbihler.de abstract =

In this AFP entry, we show how to specify game-based cryptographic security notions and formally prove secure several cryptographic constructions from the literature using the CryptHOL framework. Among others, we formalise the notions of a random oracle, a pseudo-random function, an unpredictable function, and of encryption schemes that are indistinguishable under chosen plaintext and/or ciphertext attacks. We prove the random-permutation/random-function switching lemma, security of the Elgamal and hashed Elgamal public-key encryption scheme and correctness and security of several constructions with pseudo-random functions.

Our proofs follow the game-hopping style advocated by Shoup and Bellare and Rogaway, from which most of the examples have been taken. We generalise some of their results such that they can be reused in other proofs. Thanks to CryptHOL's integration with Isabelle's parametricity infrastructure, many simple hops are easily justified using the theory of representation independence.

extra-history = Change history: [2018-09-28]: added the CryptHOL tutorial for game-based cryptography (revision 489a395764ae) [Multi_Party_Computation] title = Multi-Party Computation author = David Aspinall , David Butler topic = Computer Science/Security date = 2019-05-09 notify = dbutler@turing.ac.uk abstract = We use CryptHOL to consider Multi-Party Computation (MPC) protocols. MPC was first considered by Yao in 1983 and recent advances in efficiency and an increased demand mean it is now deployed in the real world. Security is considered using the real/ideal world paradigm. We first define security in the semi-honest security setting where parties are assumed not to deviate from the protocol transcript. In this setting we prove multiple Oblivious Transfer (OT) protocols secure and then show security for the gates of the GMW protocol. We then define malicious security, this is a stronger notion of security where parties are assumed to be fully corrupted by an adversary. In this setting we again consider OT, as it is a fundamental building block of almost all MPC protocols. [Sigma_Commit_Crypto] title = Sigma Protocols and Commitment Schemes author = David Butler , Andreas Lochbihler topic = Computer Science/Security/Cryptography date = 2019-10-07 notify = dbutler@turing.ac.uk abstract = We use CryptHOL to formalise commitment schemes and Sigma-protocols. Both are widely used fundamental two party cryptographic primitives. Security for commitment schemes is considered using game-based definitions whereas the security of Sigma-protocols is considered using both the game-based and simulation-based security paradigms. In this work, we first define security for both primitives and then prove secure multiple case studies: the Schnorr, Chaum-Pedersen and Okamoto Sigma-protocols as well as a construction that allows for compound (AND and OR statements) Sigma-protocols and the Pedersen and Rivest commitment schemes. We also prove that commitment schemes can be constructed from Sigma-protocols. We formalise this proof at an abstract level, only assuming the existence of a Sigma-protocol; consequently, the instantiations of this result for the concrete Sigma-protocols we consider come for free. [CryptHOL] title = CryptHOL author = Andreas Lochbihler topic = Computer Science/Security/Cryptography, Computer Science/Functional Programming, Mathematics/Probability Theory date = 2017-05-05 notify = mail@andreas-lochbihler.de abstract =

CryptHOL provides a framework for formalising cryptographic arguments in Isabelle/HOL. It shallowly embeds a probabilistic functional programming language in higher order logic. The language features monadic sequencing, recursion, random sampling, failures and failure handling, and black-box access to oracles. Oracles are probabilistic functions which maintain hidden state between different invocations. All operators are defined in the new semantic domain of generative probabilistic values, a codatatype. We derive proof rules for the operators and establish a connection with the theory of relational parametricity. Thus, the resuting proofs are trustworthy and comprehensible, and the framework is extensible and widely applicable.

The framework is used in the accompanying AFP entry "Game-based Cryptography in HOL". There, we show-case our framework by formalizing different game-based proofs from the literature. This formalisation continues the work described in the author's ESOP 2016 paper.

[Constructive_Cryptography] title = Constructive Cryptography in HOL author = Andreas Lochbihler , S. Reza Sefidgar<> topic = Computer Science/Security/Cryptography, Mathematics/Probability Theory date = 2018-12-17 notify = mail@andreas-lochbihler.de, reza.sefidgar@inf.ethz.ch abstract = Inspired by Abstract Cryptography, we extend CryptHOL, a framework for formalizing game-based proofs, with an abstract model of Random Systems and provide proof rules about their composition and equality. This foundation facilitates the formalization of Constructive Cryptography proofs, where the security of a cryptographic scheme is realized as a special form of construction in which a complex random system is built from simpler ones. This is a first step towards a fully-featured compositional framework, similar to Universal Composability framework, that supports formalization of simulation-based proofs. [Probabilistic_While] title = Probabilistic while loop author = Andreas Lochbihler topic = Computer Science/Functional Programming, Mathematics/Probability Theory, Computer Science/Algorithms date = 2017-05-05 notify = mail@andreas-lochbihler.de abstract = This AFP entry defines a probabilistic while operator based on sub-probability mass functions and formalises zero-one laws and variant rules for probabilistic loop termination. As applications, we implement probabilistic algorithms for the Bernoulli, geometric and arbitrary uniform distributions that only use fair coin flips, and prove them correct and terminating with probability 1. extra-history = Change history: [2018-02-02]: Added a proof that probabilistic conditioning can be implemented by repeated sampling. (revision 305867c4e911)
[Monad_Normalisation] title = Monad normalisation author = Joshua Schneider <>, Manuel Eberl , Andreas Lochbihler topic = Tools, Computer Science/Functional Programming, Logic/Rewriting date = 2017-05-05 notify = mail@andreas-lochbihler.de abstract = The usual monad laws can directly be used as rewrite rules for Isabelle’s simplifier to normalise monadic HOL terms and decide equivalences. In a commutative monad, however, the commutativity law is a higher-order permutative rewrite rule that makes the simplifier loop. This AFP entry implements a simproc that normalises monadic expressions in commutative monads using ordered rewriting. The simproc can also permute computations across control operators like if and case. [Monomorphic_Monad] title = Effect polymorphism in higher-order logic author = Andreas Lochbihler topic = Computer Science/Functional Programming date = 2017-05-05 notify = mail@andreas-lochbihler.de abstract = The notion of a monad cannot be expressed within higher-order logic (HOL) due to type system restrictions. We show that if a monad is used with values of only one type, this notion can be formalised in HOL. Based on this idea, we develop a library of effect specifications and implementations of monads and monad transformers. Hence, we can abstract over the concrete monad in HOL definitions and thus use the same definition for different (combinations of) effects. We illustrate the usefulness of effect polymorphism with a monadic interpreter for a simple language. extra-history = Change history: [2018-02-15]: added further specifications and implementations of non-determinism; more examples (revision bc5399eea78e)
[Constructor_Funs] title = Constructor Functions author = Lars Hupel topic = Tools date = 2017-04-19 notify = hupel@in.tum.de abstract = Isabelle's code generator performs various adaptations for target languages. Among others, constructor applications have to be fully saturated. That means that for constructor calls occuring as arguments to higher-order functions, synthetic lambdas have to be inserted. This entry provides tooling to avoid this construction altogether by introducing constructor functions. [Lazy_Case] title = Lazifying case constants author = Lars Hupel topic = Tools date = 2017-04-18 notify = hupel@in.tum.de abstract = Isabelle's code generator performs various adaptations for target languages. Among others, case statements are printed as match expressions. Internally, this is a sophisticated procedure, because in HOL, case statements are represented as nested calls to the case combinators as generated by the datatype package. Furthermore, the procedure relies on laziness of match expressions in the target language, i.e., that branches guarded by patterns that fail to match are not evaluated. Similarly, if-then-else is printed to the corresponding construct in the target language. This entry provides tooling to replace these special cases in the code generator by ignoring these target language features, instead printing case expressions and if-then-else as functions. [Dict_Construction] title = Dictionary Construction author = Lars Hupel topic = Tools date = 2017-05-24 notify = hupel@in.tum.de abstract = Isabelle's code generator natively supports type classes. For targets that do not have language support for classes and instances, it performs the well-known dictionary translation, as described by Haftmann and Nipkow. This translation happens outside the logic, i.e., there is no guarantee that it is correct, besides the pen-and-paper proof. This work implements a certified dictionary translation that produces new class-free constants and derives equality theorems. [Higher_Order_Terms] title = An Algebra for Higher-Order Terms author = Lars Hupel contributors = Yu Zhang <> topic = Computer Science/Programming Languages/Lambda Calculi date = 2019-01-15 notify = lars@hupel.info abstract = In this formalization, I introduce a higher-order term algebra, generalizing the notions of free variables, matching, and substitution. The need arose from the work on a verified compiler from Isabelle to CakeML. Terms can be thought of as consisting of a generic (free variables, constants, application) and a specific part. As example applications, this entry provides instantiations for de-Bruijn terms, terms with named variables, and Blanchette’s λ-free higher-order terms. Furthermore, I implement translation functions between de-Bruijn terms and named terms and prove their correctness. [Subresultants] title = Subresultants author = Sebastiaan Joosten , René Thiemann , Akihisa Yamada topic = Mathematics/Algebra date = 2017-04-06 notify = rene.thiemann@uibk.ac.at abstract = We formalize the theory of subresultants and the subresultant polynomial remainder sequence as described by Brown and Traub. As a result, we obtain efficient certified algorithms for computing the resultant and the greatest common divisor of polynomials. [Comparison_Sort_Lower_Bound] title = Lower bound on comparison-based sorting algorithms author = Manuel Eberl topic = Computer Science/Algorithms date = 2017-03-15 notify = eberlm@in.tum.de abstract =

This article contains a formal proof of the well-known fact that number of comparisons that a comparison-based sorting algorithm needs to perform to sort a list of length n is at least log2 (n!) in the worst case, i. e. Ω(n log n).

For this purpose, a shallow embedding for comparison-based sorting algorithms is defined: a sorting algorithm is a recursive datatype containing either a HOL function or a query of a comparison oracle with a continuation containing the remaining computation. This makes it possible to force the algorithm to use only comparisons and to track the number of comparisons made.

[Quick_Sort_Cost] title = The number of comparisons in QuickSort author = Manuel Eberl topic = Computer Science/Algorithms date = 2017-03-15 notify = eberlm@in.tum.de abstract =

We give a formal proof of the well-known results about the number of comparisons performed by two variants of QuickSort: first, the expected number of comparisons of randomised QuickSort (i. e. QuickSort with random pivot choice) is 2 (n+1) Hn - 4 n, which is asymptotically equivalent to 2 n ln n; second, the number of comparisons performed by the classic non-randomised QuickSort has the same distribution in the average case as the randomised one.

[Random_BSTs] title = Expected Shape of Random Binary Search Trees author = Manuel Eberl topic = Computer Science/Data Structures date = 2017-04-04 notify = eberlm@in.tum.de abstract =

This entry contains proofs for the textbook results about the distributions of the height and internal path length of random binary search trees (BSTs), i. e. BSTs that are formed by taking an empty BST and inserting elements from a fixed set in random order.

In particular, we prove a logarithmic upper bound on the expected height and the Θ(n log n) closed-form solution for the expected internal path length in terms of the harmonic numbers. We also show how the internal path length relates to the average-case cost of a lookup in a BST.

[Randomised_BSTs] title = Randomised Binary Search Trees author = Manuel Eberl topic = Computer Science/Data Structures date = 2018-10-19 notify = eberlm@in.tum.de abstract =

This work is a formalisation of the Randomised Binary Search Trees introduced by Martínez and Roura, including definitions and correctness proofs.

Like randomised treaps, they are a probabilistic data structure that behaves exactly as if elements were inserted into a non-balancing BST in random order. However, unlike treaps, they only use discrete probability distributions, but their use of randomness is more complicated.

[E_Transcendental] title = The Transcendence of e author = Manuel Eberl topic = Mathematics/Analysis, Mathematics/Number Theory date = 2017-01-12 notify = eberlm@in.tum.de abstract =

This work contains a proof that Euler's number e is transcendental. The proof follows the standard approach of assuming that e is algebraic and then using a specific integer polynomial to derive two inconsistent bounds, leading to a contradiction.

This kind of approach can be found in many different sources; this formalisation mostly follows a PlanetMath article by Roger Lipsett.

[Pi_Transcendental] title = The Transcendence of π author = Manuel Eberl topic = Mathematics/Number Theory date = 2018-09-28 notify = eberlm@in.tum.de abstract =

This entry shows the transcendence of π based on the classic proof using the fundamental theorem of symmetric polynomials first given by von Lindemann in 1882, but the formalisation mostly follows the version by Niven. The proof reuses much of the machinery developed in the AFP entry on the transcendence of e.

[DFS_Framework] title = A Framework for Verifying Depth-First Search Algorithms author = Peter Lammich , René Neumann notify = lammich@in.tum.de date = 2016-07-05 topic = Computer Science/Algorithms abstract =

This entry presents a framework for the modular verification of DFS-based algorithms, which is described in our [CPP-2015] paper. It provides a generic DFS algorithm framework, that can be parameterized with user-defined actions on certain events (e.g. discovery of new node). It comes with an extensible library of invariants, which can be used to derive invariants of a specific parameterization. Using refinement techniques, efficient implementations of the algorithms can easily be derived. Here, the framework comes with templates for a recursive and a tail-recursive implementation, and also with several templates for implementing the data structures required by the DFS algorithm. Finally, this entry contains a set of re-usable DFS-based algorithms, which illustrate the application of the framework.

[CPP-2015] Peter Lammich, René Neumann: A Framework for Verifying Depth-First Search Algorithms. CPP 2015: 137-146

[Flow_Networks] title = Flow Networks and the Min-Cut-Max-Flow Theorem author = Peter Lammich , S. Reza Sefidgar <> topic = Mathematics/Graph Theory date = 2017-06-01 notify = lammich@in.tum.de abstract = We present a formalization of flow networks and the Min-Cut-Max-Flow theorem. Our formal proof closely follows a standard textbook proof, and is accessible even without being an expert in Isabelle/HOL, the interactive theorem prover used for the formalization. [Prpu_Maxflow] title = Formalizing Push-Relabel Algorithms author = Peter Lammich , S. Reza Sefidgar <> topic = Computer Science/Algorithms, Mathematics/Graph Theory date = 2017-06-01 notify = lammich@in.tum.de abstract = We present a formalization of push-relabel algorithms for computing the maximum flow in a network. We start with Goldberg's et al.~generic push-relabel algorithm, for which we show correctness and the time complexity bound of O(V^2E). We then derive the relabel-to-front and FIFO implementation. Using stepwise refinement techniques, we derive an efficient verified implementation. Our formal proof of the abstract algorithms closely follows a standard textbook proof. It is accessible even without being an expert in Isabelle/HOL, the interactive theorem prover used for the formalization. [Buildings] title = Chamber Complexes, Coxeter Systems, and Buildings author = Jeremy Sylvestre notify = jeremy.sylvestre@ualberta.ca date = 2016-07-01 topic = Mathematics/Algebra, Mathematics/Geometry abstract = We provide a basic formal framework for the theory of chamber complexes and Coxeter systems, and for buildings as thick chamber complexes endowed with a system of apartments. Along the way, we develop some of the general theory of abstract simplicial complexes and of groups (relying on the group_add class for the basics), including free groups and group presentations, and their universal properties. The main results verified are that the deletion condition is both necessary and sufficient for a group with a set of generators of order two to be a Coxeter system, and that the apartments in a (thick) building are all uniformly Coxeter. [Algebraic_VCs] title = Program Construction and Verification Components Based on Kleene Algebra author = Victor B. F. Gomes , Georg Struth notify = victor.gomes@cl.cam.ac.uk, g.struth@sheffield.ac.uk date = 2016-06-18 topic = Mathematics/Algebra abstract = Variants of Kleene algebra support program construction and verification by algebraic reasoning. This entry provides a verification component for Hoare logic based on Kleene algebra with tests, verification components for weakest preconditions and strongest postconditions based on Kleene algebra with domain and a component for step-wise refinement based on refinement Kleene algebra with tests. In addition to these components for the partial correctness of while programs, a verification component for total correctness based on divergence Kleene algebras and one for (partial correctness) of recursive programs based on domain quantales are provided. Finally we have integrated memory models for programs with pointers and a program trace semantics into the weakest precondition component. [C2KA_DistributedSystems] title = Communicating Concurrent Kleene Algebra for Distributed Systems Specification author = Maxime Buyse , Jason Jaskolka topic = Computer Science/Automata and Formal Languages, Mathematics/Algebra date = 2019-08-06 notify = maxime.buyse@polytechnique.edu, jason.jaskolka@carleton.ca abstract = Communicating Concurrent Kleene Algebra (C²KA) is a mathematical framework for capturing the communicating and concurrent behaviour of agents in distributed systems. It extends Hoare et al.'s Concurrent Kleene Algebra (CKA) with communication actions through the notions of stimuli and shared environments. C²KA has applications in studying system-level properties of distributed systems such as safety, security, and reliability. In this work, we formalize results about C²KA and its application for distributed systems specification. We first formalize the stimulus structure and behaviour structure (CKA). Next, we combine them to formalize C²KA and its properties. Then, we formalize notions and properties related to the topology of distributed systems and the potential for communication via stimuli and via shared environments of agents, all within the algebraic setting of C²KA. [Card_Equiv_Relations] title = Cardinality of Equivalence Relations author = Lukas Bulwahn notify = lukas.bulwahn@gmail.com date = 2016-05-24 topic = Mathematics/Combinatorics abstract = This entry provides formulae for counting the number of equivalence relations and partial equivalence relations over a finite carrier set with given cardinality. To count the number of equivalence relations, we provide bijections between equivalence relations and set partitions, and then transfer the main results of the two AFP entries, Cardinality of Set Partitions and Spivey's Generalized Recurrence for Bell Numbers, to theorems on equivalence relations. To count the number of partial equivalence relations, we observe that counting partial equivalence relations over a set A is equivalent to counting all equivalence relations over all subsets of the set A. From this observation and the results on equivalence relations, we show that the cardinality of partial equivalence relations over a finite set of cardinality n is equal to the n+1-th Bell number. [Twelvefold_Way] title = The Twelvefold Way author = Lukas Bulwahn topic = Mathematics/Combinatorics date = 2016-12-29 notify = lukas.bulwahn@gmail.com abstract = This entry provides all cardinality theorems of the Twelvefold Way. The Twelvefold Way systematically classifies twelve related combinatorial problems concerning two finite sets, which include counting permutations, combinations, multisets, set partitions and number partitions. This development builds upon the existing formal developments with cardinality theorems for those structures. It provides twelve bijections from the various structures to different equivalence classes on finite functions, and hence, proves cardinality formulae for these equivalence classes on finite functions. [Chord_Segments] title = Intersecting Chords Theorem author = Lukas Bulwahn notify = lukas.bulwahn@gmail.com date = 2016-10-11 topic = Mathematics/Geometry abstract = This entry provides a geometric proof of the intersecting chords theorem. The theorem states that when two chords intersect each other inside a circle, the products of their segments are equal. After a short review of existing proofs in the literature, I decided to use a proof approach that employs reasoning about lengths of line segments, the orthogonality of two lines and the Pythagoras Law. Hence, one can understand the formalized proof easily with the knowledge of a few general geometric facts that are commonly taught in high-school. This theorem is the 55th theorem of the Top 100 Theorems list. [Category3] title = Category Theory with Adjunctions and Limits author = Eugene W. Stark notify = stark@cs.stonybrook.edu date = 2016-06-26 topic = Mathematics/Category Theory abstract = This article attempts to develop a usable framework for doing category theory in Isabelle/HOL. Our point of view, which to some extent differs from that of the previous AFP articles on the subject, is to try to explore how category theory can be done efficaciously within HOL, rather than trying to match exactly the way things are done using a traditional approach. To this end, we define the notion of category in an "object-free" style, in which a category is represented by a single partial composition operation on arrows. This way of defining categories provides some advantages in the context of HOL, including the ability to avoid the use of records and the possibility of defining functors and natural transformations simply as certain functions on arrows, rather than as composite objects. We define various constructions associated with the basic notions, including: dual category, product category, functor category, discrete category, free category, functor composition, and horizontal and vertical composite of natural transformations. A "set category" locale is defined that axiomatizes the notion "category of all sets at a type and all functions between them," and a fairly extensive set of properties of set categories is derived from the locale assumptions. The notion of a set category is used to prove the Yoneda Lemma in a general setting of a category equipped with a "hom embedding," which maps arrows of the category to the "universe" of the set category. We also give a treatment of adjunctions, defining adjunctions via left and right adjoint functors, natural bijections between hom-sets, and unit and counit natural transformations, and showing the equivalence of these definitions. We also develop the theory of limits, including representations of functors, diagrams and cones, and diagonal functors. We show that right adjoint functors preserve limits, and that limits can be constructed via products and equalizers. We characterize the conditions under which limits exist in a set category. We also examine the case of limits in a functor category, ultimately culminating in a proof that the Yoneda embedding preserves limits. extra-history = Change history: [2018-05-29]: Revised axioms for the category locale. Introduced notation for composition and "in hom". (revision 8318366d4575)
[MonoidalCategory] title = Monoidal Categories author = Eugene W. Stark topic = Mathematics/Category Theory date = 2017-05-04 notify = stark@cs.stonybrook.edu abstract = Building on the formalization of basic category theory set out in the author's previous AFP article, the present article formalizes some basic aspects of the theory of monoidal categories. Among the notions defined here are monoidal category, monoidal functor, and equivalence of monoidal categories. The main theorems formalized are MacLane's coherence theorem and the constructions of the free monoidal category and free strict monoidal category generated by a given category. The coherence theorem is proved syntactically, using a structurally recursive approach to reduction of terms that might have some novel aspects. We also give proofs of some results given by Etingof et al, which may prove useful in a formal setting. In particular, we show that the left and right unitors need not be taken as given data in the definition of monoidal category, nor does the definition of monoidal functor need to take as given a specific isomorphism expressing the preservation of the unit object. Our definitions of monoidal category and monoidal functor are stated so as to take advantage of the economy afforded by these facts. extra-history = Change history: [2017-05-18]: Integrated material from MonoidalCategory/Category3Adapter into Category3/ and deleted adapter. (revision 015543cdd069)
[2018-05-29]: Modifications required due to 'Category3' changes. Introduced notation for "in hom". (revision 8318366d4575)
[Card_Multisets] title = Cardinality of Multisets author = Lukas Bulwahn notify = lukas.bulwahn@gmail.com date = 2016-06-26 topic = Mathematics/Combinatorics abstract =

This entry provides three lemmas to count the number of multisets of a given size and finite carrier set. The first lemma provides a cardinality formula assuming that the multiset's elements are chosen from the given carrier set. The latter two lemmas provide formulas assuming that the multiset's elements also cover the given carrier set, i.e., each element of the carrier set occurs in the multiset at least once.

The proof of the first lemma uses the argument of the recurrence relation for counting multisets. The proof of the second lemma is straightforward, and the proof of the third lemma is easily obtained using the first cardinality lemma. A challenge for the formalization is the derivation of the required induction rule, which is a special combination of the induction rules for finite sets and natural numbers. The induction rule is derived by defining a suitable inductive predicate and transforming the predicate's induction rule.

[Posix-Lexing] title = POSIX Lexing with Derivatives of Regular Expressions author = Fahad Ausaf , Roy Dyckhoff , Christian Urban notify = christian.urban@kcl.ac.uk date = 2016-05-24 topic = Computer Science/Automata and Formal Languages abstract = Brzozowski introduced the notion of derivatives for regular expressions. They can be used for a very simple regular expression matching algorithm. Sulzmann and Lu cleverly extended this algorithm in order to deal with POSIX matching, which is the underlying disambiguation strategy for regular expressions needed in lexers. In this entry we give our inductive definition of what a POSIX value is and show (i) that such a value is unique (for given regular expression and string being matched) and (ii) that Sulzmann and Lu's algorithm always generates such a value (provided that the regular expression matches the string). We also prove the correctness of an optimised version of the POSIX matching algorithm. [LocalLexing] title = Local Lexing author = Steven Obua topic = Computer Science/Automata and Formal Languages date = 2017-04-28 notify = steven@recursivemind.com abstract = This formalisation accompanies the paper Local Lexing which introduces a novel parsing concept of the same name. The paper also gives a high-level algorithm for local lexing as an extension of Earley's algorithm. This formalisation proves the algorithm to be correct with respect to its local lexing semantics. As a special case, this formalisation thus also contains a proof of the correctness of Earley's algorithm. The paper contains a short outline of how this formalisation is organised. [MFMC_Countable] title = A Formal Proof of the Max-Flow Min-Cut Theorem for Countable Networks author = Andreas Lochbihler date = 2016-05-09 topic = Mathematics/Graph Theory abstract = This article formalises a proof of the maximum-flow minimal-cut theorem for networks with countably many edges. A network is a directed graph with non-negative real-valued edge labels and two dedicated vertices, the source and the sink. A flow in a network assigns non-negative real numbers to the edges such that for all vertices except for the source and the sink, the sum of values on incoming edges equals the sum of values on outgoing edges. A cut is a subset of the vertices which contains the source, but not the sink. Our theorem states that in every network, there is a flow and a cut such that the flow saturates all the edges going out of the cut and is zero on all the incoming edges. The proof is based on the paper The Max-Flow Min-Cut theorem for countable networks by Aharoni et al. Additionally, we prove a characterisation of the lifting operation for relations on discrete probability distributions, which leads to a concise proof of its distributivity over relation composition. notify = mail@andreas-lochbihler.de extra-history = Change history: [2017-09-06]: derive characterisation for the lifting operations on discrete distributions from finite version of the max-flow min-cut theorem (revision a7a198f5bab0)
[Liouville_Numbers] title = Liouville numbers author = Manuel Eberl date = 2015-12-28 topic = Mathematics/Analysis, Mathematics/Number Theory abstract =

Liouville numbers are a class of transcendental numbers that can be approximated particularly well with rational numbers. Historically, they were the first numbers whose transcendence was proven.

In this entry, we define the concept of Liouville numbers as well as the standard construction to obtain Liouville numbers (including Liouville's constant) and we prove their most important properties: irrationality and transcendence.

The proof is very elementary and requires only standard arithmetic, the Mean Value Theorem for polynomials, and the boundedness of polynomials on compact intervals.

notify = eberlm@in.tum.de [Triangle] title = Basic Geometric Properties of Triangles author = Manuel Eberl date = 2015-12-28 topic = Mathematics/Geometry abstract =

This entry contains a definition of angles between vectors and between three points. Building on this, we prove basic geometric properties of triangles, such as the Isosceles Triangle Theorem, the Law of Sines and the Law of Cosines, that the sum of the angles of a triangle is π, and the congruence theorems for triangles.

The definitions and proofs were developed following those by John Harrison in HOL Light. However, due to Isabelle's type class system, all definitions and theorems in the Isabelle formalisation hold for all real inner product spaces.

notify = eberlm@in.tum.de [Prime_Harmonic_Series] title = The Divergence of the Prime Harmonic Series author = Manuel Eberl date = 2015-12-28 topic = Mathematics/Number Theory abstract =

In this work, we prove the lower bound ln(H_n) - ln(5/3) for the partial sum of the Prime Harmonic series and, based on this, the divergence of the Prime Harmonic Series ∑[p prime] · 1/p.

The proof relies on the unique squarefree decomposition of natural numbers. This is similar to Euler's original proof (which was highly informal and morally questionable). Its advantage over proofs by contradiction, like the famous one by Paul Erdős, is that it provides a relatively good lower bound for the partial sums.

notify = eberlm@in.tum.de [Descartes_Sign_Rule] title = Descartes' Rule of Signs author = Manuel Eberl date = 2015-12-28 topic = Mathematics/Analysis abstract =

Descartes' Rule of Signs relates the number of positive real roots of a polynomial with the number of sign changes in its coefficient sequence.

Our proof follows the simple inductive proof given by Rob Arthan, which was also used by John Harrison in his HOL Light formalisation. We proved most of the lemmas for arbitrary linearly-ordered integrity domains (e.g. integers, rationals, reals); the main result, however, requires the intermediate value theorem and was therefore only proven for real polynomials.

notify = eberlm@in.tum.de [Euler_MacLaurin] title = The Euler–MacLaurin Formula author = Manuel Eberl topic = Mathematics/Analysis date = 2017-03-10 notify = eberlm@in.tum.de abstract =

The Euler-MacLaurin formula relates the value of a discrete sum to that of the corresponding integral in terms of the derivatives at the borders of the summation and a remainder term. Since the remainder term is often very small as the summation bounds grow, this can be used to compute asymptotic expansions for sums.

This entry contains a proof of this formula for functions from the reals to an arbitrary Banach space. Two variants of the formula are given: the standard textbook version and a variant outlined in Concrete Mathematics that is more useful for deriving asymptotic estimates.

As example applications, we use that formula to derive the full asymptotic expansion of the harmonic numbers and the sum of inverse squares.

[Card_Partitions] title = Cardinality of Set Partitions author = Lukas Bulwahn date = 2015-12-12 topic = Mathematics/Combinatorics abstract = The theory's main theorem states that the cardinality of set partitions of size k on a carrier set of size n is expressed by Stirling numbers of the second kind. In Isabelle, Stirling numbers of the second kind are defined in the AFP entry `Discrete Summation` through their well-known recurrence relation. The main theorem relates them to the alternative definition as cardinality of set partitions. The proof follows the simple and short explanation in Richard P. Stanley's `Enumerative Combinatorics: Volume 1` and Wikipedia, and unravels the full details and implicit reasoning steps of these explanations. notify = lukas.bulwahn@gmail.com [Card_Number_Partitions] title = Cardinality of Number Partitions author = Lukas Bulwahn date = 2016-01-14 topic = Mathematics/Combinatorics abstract = This entry provides a basic library for number partitions, defines the two-argument partition function through its recurrence relation and relates this partition function to the cardinality of number partitions. The main proof shows that the recursively-defined partition function with arguments n and k equals the cardinality of number partitions of n with exactly k parts. The combinatorial proof follows the proof sketch of Theorem 2.4.1 in Mazur's textbook `Combinatorics: A Guided Tour`. This entry can serve as starting point for various more intrinsic properties about number partitions, the partition function and related recurrence relations. notify = lukas.bulwahn@gmail.com [Multirelations] title = Binary Multirelations author = Hitoshi Furusawa , Georg Struth date = 2015-06-11 topic = Mathematics/Algebra abstract = Binary multirelations associate elements of a set with its subsets; hence they are binary relations from a set to its power set. Applications include alternating automata, models and logics for games, program semantics with dual demonic and angelic nondeterministic choices and concurrent dynamic logics. This proof document supports an arXiv article that formalises the basic algebra of multirelations and proposes axiom systems for them, ranging from weak bi-monoids to weak bi-quantales. notify = [Noninterference_Generic_Unwinding] title = The Generic Unwinding Theorem for CSP Noninterference Security author = Pasquale Noce date = 2015-06-11 topic = Computer Science/Security, Computer Science/Concurrency/Process Calculi abstract =

The classical definition of noninterference security for a deterministic state machine with outputs requires to consider the outputs produced by machine actions after any trace, i.e. any indefinitely long sequence of actions, of the machine. In order to render the verification of the security of such a machine more straightforward, there is a need of some sufficient condition for security such that just individual actions, rather than unbounded sequences of actions, have to be considered.

By extending previous results applying to transitive noninterference policies, Rushby has proven an unwinding theorem that provides a sufficient condition of this kind in the general case of a possibly intransitive policy. This condition has to be satisfied by a generic function mapping security domains into equivalence relations over machine states.

An analogous problem arises for CSP noninterference security, whose definition requires to consider any possible future, i.e. any indefinitely long sequence of subsequent events and any indefinitely large set of refused events associated to that sequence, for each process trace.

This paper provides a sufficient condition for CSP noninterference security, which indeed requires to just consider individual accepted and refused events and applies to the general case of a possibly intransitive policy. This condition follows Rushby's one for classical noninterference security, and has to be satisfied by a generic function mapping security domains into equivalence relations over process traces; hence its name, Generic Unwinding Theorem. Variants of this theorem applying to deterministic processes and trace set processes are also proven. Finally, the sufficient condition for security expressed by the theorem is shown not to be a necessary condition as well, viz. there exists a secure process such that no domain-relation map satisfying the condition exists.

notify = [Noninterference_Ipurge_Unwinding] title = The Ipurge Unwinding Theorem for CSP Noninterference Security author = Pasquale Noce date = 2015-06-11 topic = Computer Science/Security abstract =

The definition of noninterference security for Communicating Sequential Processes requires to consider any possible future, i.e. any indefinitely long sequence of subsequent events and any indefinitely large set of refused events associated to that sequence, for each process trace. In order to render the verification of the security of a process more straightforward, there is a need of some sufficient condition for security such that just individual accepted and refused events, rather than unbounded sequences and sets of events, have to be considered.

Of course, if such a sufficient condition were necessary as well, it would be even more valuable, since it would permit to prove not only that a process is secure by verifying that the condition holds, but also that a process is not secure by verifying that the condition fails to hold.

This paper provides a necessary and sufficient condition for CSP noninterference security, which indeed requires to just consider individual accepted and refused events and applies to the general case of a possibly intransitive policy. This condition follows Rushby's output consistency for deterministic state machines with outputs, and has to be satisfied by a specific function mapping security domains into equivalence relations over process traces. The definition of this function makes use of an intransitive purge function following Rushby's one; hence the name given to the condition, Ipurge Unwinding Theorem.

Furthermore, in accordance with Hoare's formal definition of deterministic processes, it is shown that a process is deterministic just in case it is a trace set process, i.e. it may be identified by means of a trace set alone, matching the set of its traces, in place of a failures-divergences pair. Then, variants of the Ipurge Unwinding Theorem are proven for deterministic processes and trace set processes.

notify = [List_Interleaving] title = Reasoning about Lists via List Interleaving author = Pasquale Noce date = 2015-06-11 topic = Computer Science/Data Structures abstract =

Among the various mathematical tools introduced in his outstanding work on Communicating Sequential Processes, Hoare has defined "interleaves" as the predicate satisfied by any three lists such that the first list may be split into sublists alternately extracted from the other two ones, whatever is the criterion for extracting an item from either one list or the other in each step.

This paper enriches Hoare's definition by identifying such criterion with the truth value of a predicate taking as inputs the head and the tail of the first list. This enhanced "interleaves" predicate turns out to permit the proof of equalities between lists without the need of an induction. Some rules that allow to infer "interleaves" statements without induction, particularly applying to the addition or removal of a prefix to the input lists, are also proven. Finally, a stronger version of the predicate, named "Interleaves", is shown to fulfil further rules applying to the addition or removal of a suffix to the input lists.

notify = [Residuated_Lattices] title = Residuated Lattices author = Victor B. F. Gomes , Georg Struth date = 2015-04-15 topic = Mathematics/Algebra abstract = The theory of residuated lattices, first proposed by Ward and Dilworth, is formalised in Isabelle/HOL. This includes concepts of residuated functions; their adjoints and conjugates. It also contains necessary and sufficient conditions for the existence of these operations in an arbitrary lattice. The mathematical components for residuated lattices are linked to the AFP entry for relation algebra. In particular, we prove Jonsson and Tsinakis conditions for a residuated boolean algebra to form a relation algebra. notify = g.struth@sheffield.ac.uk [ConcurrentGC] title = Relaxing Safely: Verified On-the-Fly Garbage Collection for x86-TSO author = Peter Gammie , Tony Hosking , Kai Engelhardt <> date = 2015-04-13 topic = Computer Science/Algorithms/Concurrent abstract =

We use ConcurrentIMP to model Schism, a state-of-the-art real-time garbage collection scheme for weak memory, and show that it is safe on x86-TSO.

This development accompanies the PLDI 2015 paper of the same name.

notify = peteg42@gmail.com [List_Update] title = Analysis of List Update Algorithms author = Maximilian P.L. Haslbeck , Tobias Nipkow date = 2016-02-17 topic = Computer Science/Algorithms/Online abstract =

These theories formalize the quantitative analysis of a number of classical algorithms for the list update problem: 2-competitiveness of move-to-front, the lower bound of 2 for the competitiveness of deterministic list update algorithms and 1.6-competitiveness of the randomized COMB algorithm, the best randomized list update algorithm known to date. The material is based on the first two chapters of Online Computation and Competitive Analysis by Borodin and El-Yaniv.

For an informal description see the FSTTCS 2016 publication Verified Analysis of List Update Algorithms by Haslbeck and Nipkow.

notify = nipkow@in.tum.de [ConcurrentIMP] title = Concurrent IMP author = Peter Gammie date = 2015-04-13 topic = Computer Science/Programming Languages/Logics abstract = ConcurrentIMP extends the small imperative language IMP with control non-determinism and constructs for synchronous message passing. notify = peteg42@gmail.com [TortoiseHare] title = The Tortoise and Hare Algorithm author = Peter Gammie date = 2015-11-18 topic = Computer Science/Algorithms abstract = We formalize the Tortoise and Hare cycle-finding algorithm ascribed to Floyd by Knuth, and an improved version due to Brent. notify = peteg42@gmail.com [UPF] title = The Unified Policy Framework (UPF) author = Achim D. Brucker , Lukas Brügger , Burkhart Wolff date = 2014-11-28 topic = Computer Science/Security abstract = We present the Unified Policy Framework (UPF), a generic framework for modelling security (access-control) policies. UPF emphasizes the view that a policy is a policy decision function that grants or denies access to resources, permissions, etc. In other words, instead of modelling the relations of permitted or prohibited requests directly, we model the concrete function that implements the policy decision point in a system. In more detail, UPF is based on the following four principles: 1) Functional representation of policies, 2) No conflicts are possible, 3) Three-valued decision type (allow, deny, undefined), 4) Output type not containing the decision only. notify = adbrucker@0x5f.org, wolff@lri.fr, lukas.a.bruegger@gmail.com [UPF_Firewall] title = Formal Network Models and Their Application to Firewall Policies author = Achim D. Brucker , Lukas Brügger<>, Burkhart Wolff topic = Computer Science/Security, Computer Science/Networks date = 2017-01-08 notify = adbrucker@0x5f.org abstract = We present a formal model of network protocols and their application to modeling firewall policies. The formalization is based on the Unified Policy Framework (UPF). The formalization was originally developed with for generating test cases for testing the security configuration actual firewall and router (middle-boxes) using HOL-TestGen. Our work focuses on modeling application level protocols on top of tcp/ip. [AODV] title = Loop freedom of the (untimed) AODV routing protocol author = Timothy Bourke , Peter Höfner date = 2014-10-23 topic = Computer Science/Concurrency/Process Calculi abstract =

The Ad hoc On-demand Distance Vector (AODV) routing protocol allows the nodes in a Mobile Ad hoc Network (MANET) or a Wireless Mesh Network (WMN) to know where to forward data packets. Such a protocol is ‘loop free’ if it never leads to routing decisions that forward packets in circles.

This development mechanises an existing pen-and-paper proof of loop freedom of AODV. The protocol is modelled in the Algebra of Wireless Networks (AWN), which is the subject of an earlier paper and AFP mechanization. The proof relies on a novel compositional approach for lifting invariants to networks of nodes.

We exploit the mechanization to analyse several variants of AODV and show that Isabelle/HOL can re-establish most proof obligations automatically and identify exactly the steps that are no longer valid.

notify = tim@tbrk.org [Show] title = Haskell's Show Class in Isabelle/HOL author = Christian Sternagel , René Thiemann date = 2014-07-29 topic = Computer Science/Functional Programming license = LGPL abstract = We implemented a type class for "to-string" functions, similar to Haskell's Show class. Moreover, we provide instantiations for Isabelle/HOL's standard types like bool, prod, sum, nats, ints, and rats. It is further possible, to automatically derive show functions for arbitrary user defined datatypes similar to Haskell's "deriving Show". extra-history = Change history: [2015-03-11]: Adapted development to new-style (BNF-based) datatypes.
[2015-04-10]: Moved development for old-style datatypes into subdirectory "Old_Datatype".
notify = christian.sternagel@uibk.ac.at, rene.thiemann@uibk.ac.at [Certification_Monads] title = Certification Monads author = Christian Sternagel , René Thiemann date = 2014-10-03 topic = Computer Science/Functional Programming abstract = This entry provides several monads intended for the development of stand-alone certifiers via code generation from Isabelle/HOL. More specifically, there are three flavors of error monads (the sum type, for the case where all monadic functions are total; an instance of the former, the so called check monad, yielding either success without any further information or an error message; as well as a variant of the sum type that accommodates partial functions by providing an explicit bottom element) and a parser monad built on top. All of this monads are heavily used in the IsaFoR/CeTA project which thus provides many examples of their usage. notify = c.sternagel@gmail.com, rene.thiemann@uibk.ac.at [CISC-Kernel] title = Formal Specification of a Generic Separation Kernel author = Freek Verbeek , Sergey Tverdyshev , Oto Havle , Holger Blasum , Bruno Langenstein , Werner Stephan , Yakoub Nemouchi , Abderrahmane Feliachi , Burkhart Wolff , Julien Schmaltz date = 2014-07-18 topic = Computer Science/Security abstract =

Intransitive noninterference has been a widely studied topic in the last few decades. Several well-established methodologies apply interactive theorem proving to formulate a noninterference theorem over abstract academic models. In joint work with several industrial and academic partners throughout Europe, we are helping in the certification process of PikeOS, an industrial separation kernel developed at SYSGO. In this process, established theories could not be applied. We present a new generic model of separation kernels and a new theory of intransitive noninterference. The model is rich in detail, making it suitable for formal verification of realistic and industrial systems such as PikeOS. Using a refinement-based theorem proving approach, we ensure that proofs remain manageable.

This document corresponds to the deliverable D31.1 of the EURO-MILS Project http://www.euromils.eu.

notify = [pGCL] title = pGCL for Isabelle author = David Cock date = 2014-07-13 topic = Computer Science/Programming Languages/Language Definitions abstract =

pGCL is both a programming language and a specification language that incorporates both probabilistic and nondeterministic choice, in a unified manner. Program verification is by refinement or annotation (or both), using either Hoare triples, or weakest-precondition entailment, in the style of GCL.

This package provides both a shallow embedding of the language primitives, and an annotation and refinement framework. The generated document includes a brief tutorial.

notify = [Noninterference_CSP] title = Noninterference Security in Communicating Sequential Processes author = Pasquale Noce date = 2014-05-23 topic = Computer Science/Security abstract =

An extension of classical noninterference security for deterministic state machines, as introduced by Goguen and Meseguer and elegantly formalized by Rushby, to nondeterministic systems should satisfy two fundamental requirements: it should be based on a mathematically precise theory of nondeterminism, and should be equivalent to (or at least not weaker than) the classical notion in the degenerate deterministic case.

This paper proposes a definition of noninterference security applying to Hoare's Communicating Sequential Processes (CSP) in the general case of a possibly intransitive noninterference policy, and proves the equivalence of this security property to classical noninterference security for processes representing deterministic state machines.

Furthermore, McCullough's generalized noninterference security is shown to be weaker than both the proposed notion of CSP noninterference security for a generic process, and classical noninterference security for processes representing deterministic state machines. This renders CSP noninterference security preferable as an extension of classical noninterference security to nondeterministic systems.

notify = pasquale.noce.lavoro@gmail.com [Floyd_Warshall] title = The Floyd-Warshall Algorithm for Shortest Paths author = Simon Wimmer , Peter Lammich topic = Computer Science/Algorithms date = 2017-05-08 notify = wimmers@in.tum.de abstract = The Floyd-Warshall algorithm [Flo62, Roy59, War62] is a classic dynamic programming algorithm to compute the length of all shortest paths between any two vertices in a graph (i.e. to solve the all-pairs shortest path problem, or APSP for short). Given a representation of the graph as a matrix of weights M, it computes another matrix M' which represents a graph with the same path lengths and contains the length of the shortest path between any two vertices i and j. This is only possible if the graph does not contain any negative cycles. However, in this case the Floyd-Warshall algorithm will detect the situation by calculating a negative diagonal entry. This entry includes a formalization of the algorithm and of these key properties. The algorithm is refined to an efficient imperative version using the Imperative Refinement Framework. [Roy_Floyd_Warshall] title = Transitive closure according to Roy-Floyd-Warshall author = Makarius Wenzel <> date = 2014-05-23 topic = Computer Science/Algorithms abstract = This formulation of the Roy-Floyd-Warshall algorithm for the transitive closure bypasses matrices and arrays, but uses a more direct mathematical model with adjacency functions for immediate predecessors and successors. This can be implemented efficiently in functional programming languages and is particularly adequate for sparse relations. notify = [GPU_Kernel_PL] title = Syntax and semantics of a GPU kernel programming language author = John Wickerson date = 2014-04-03 topic = Computer Science/Programming Languages/Language Definitions abstract = This document accompanies the article "The Design and Implementation of a Verification Technique for GPU Kernels" by Adam Betts, Nathan Chong, Alastair F. Donaldson, Jeroen Ketema, Shaz Qadeer, Paul Thomson and John Wickerson. It formalises all of the definitions provided in Sections 3 and 4 of the article. notify = [AWN] title = Mechanization of the Algebra for Wireless Networks (AWN) author = Timothy Bourke date = 2014-03-08 topic = Computer Science/Concurrency/Process Calculi abstract =

AWN is a process algebra developed for modelling and analysing protocols for Mobile Ad hoc Networks (MANETs) and Wireless Mesh Networks (WMNs). AWN models comprise five distinct layers: sequential processes, local parallel compositions, nodes, partial networks, and complete networks.

This development mechanises the original operational semantics of AWN and introduces a variant 'open' operational semantics that enables the compositional statement and proof of invariants across distinct network nodes. It supports labels (for weakening invariants) and (abstract) data state manipulations. A framework for compositional invariant proofs is developed, including a tactic (inv_cterms) for inductive invariant proofs of sequential processes, lifting rules for the open versions of the higher layers, and a rule for transferring lifted properties back to the standard semantics. A notion of 'control terms' reduces proof obligations to the subset of subterms that act directly (in contrast to operators for combining terms and joining processes).

notify = tim@tbrk.org [Selection_Heap_Sort] title = Verification of Selection and Heap Sort Using Locales author = Danijela Petrovic date = 2014-02-11 topic = Computer Science/Algorithms abstract = Stepwise program refinement techniques can be used to simplify program verification. Programs are better understood since their main properties are clearly stated, and verification of rather complex algorithms is reduced to proving simple statements connecting successive program specifications. Additionally, it is easy to analyze similar algorithms and to compare their properties within a single formalization. Usually, formal analysis is not done in educational setting due to complexity of verification and a lack of tools and procedures to make comparison easy. Verification of an algorithm should not only give correctness proof, but also better understanding of an algorithm. If the verification is based on small step program refinement, it can become simple enough to be demonstrated within the university-level computer science curriculum. In this paper we demonstrate this and give a formal analysis of two well known algorithms (Selection Sort and Heap Sort) using proof assistant Isabelle/HOL and program refinement techniques. notify = [Real_Impl] title = Implementing field extensions of the form Q[sqrt(b)] author = René Thiemann date = 2014-02-06 license = LGPL topic = Mathematics/Analysis abstract = We apply data refinement to implement the real numbers, where we support all numbers in the field extension Q[sqrt(b)], i.e., all numbers of the form p + q * sqrt(b) for rational numbers p and q and some fixed natural number b. To this end, we also developed algorithms to precisely compute roots of a rational number, and to perform a factorization of natural numbers which eliminates duplicate prime factors.

Our results have been used to certify termination proofs which involve polynomial interpretations over the reals. extra-history = Change history: [2014-07-11]: Moved NthRoot_Impl to Sqrt-Babylonian. notify = rene.thiemann@uibk.ac.at [ShortestPath] title = An Axiomatic Characterization of the Single-Source Shortest Path Problem author = Christine Rizkallah date = 2013-05-22 topic = Mathematics/Graph Theory abstract = This theory is split into two sections. In the first section, we give a formal proof that a well-known axiomatic characterization of the single-source shortest path problem is correct. Namely, we prove that in a directed graph with a non-negative cost function on the edges the single-source shortest path function is the only function that satisfies a set of four axioms. In the second section, we give a formal proof of the correctness of an axiomatic characterization of the single-source shortest path problem for directed graphs with general cost functions. The axioms here are more involved because we have to account for potential negative cycles in the graph. The axioms are summarized in three Isabelle locales. notify = [Launchbury] title = The Correctness of Launchbury's Natural Semantics for Lazy Evaluation author = Joachim Breitner date = 2013-01-31 topic = Computer Science/Programming Languages/Lambda Calculi, Computer Science/Semantics abstract = In his seminal paper "Natural Semantics for Lazy Evaluation", John Launchbury proves his semantics correct with respect to a denotational semantics, and outlines an adequacy proof. We have formalized both semantics and machine-checked the correctness proof, clarifying some details. Furthermore, we provide a new and more direct adequacy proof that does not require intermediate operational semantics. extra-history = Change history: [2014-05-24]: Added the proof of adequacy, as well as simplified and improved the existing proofs. Adjusted abstract accordingly. [2015-03-16]: Booleans and if-then-else added to syntax and semantics, making this entry suitable to be used by the entry "Call_Arity". notify = [Call_Arity] title = The Safety of Call Arity author = Joachim Breitner date = 2015-02-20 topic = Computer Science/Programming Languages/Transformations abstract = We formalize the Call Arity analysis, as implemented in GHC, and prove both functional correctness and, more interestingly, safety (i.e. the transformation does not increase allocation).

We use syntax and the denotational semantics from the entry "Launchbury", where we formalized Launchbury's natural semantics for lazy evaluation.

The functional correctness of Call Arity is proved with regard to that denotational semantics. The operational properties are shown with regard to a small-step semantics akin to Sestoft's mark 1 machine, which we prove to be equivalent to Launchbury's semantics.

We use Christian Urban's Nominal2 package to define our terms and make use of Brian Huffman's HOLCF package for the domain-theoretical aspects of the development. extra-history = Change history: [2015-03-16]: This entry now builds on top of the Launchbury entry, and the equivalency proof of the natural and the small-step semantics was added. notify = [CCS] title = CCS in nominal logic author = Jesper Bengtson date = 2012-05-29 topic = Computer Science/Concurrency/Process Calculi abstract = We formalise a large portion of CCS as described in Milner's book 'Communication and Concurrency' using the nominal datatype package in Isabelle. Our results include many of the standard theorems of bisimulation equivalence and congruence, for both weak and strong versions. One main goal of this formalisation is to keep the machine-checked proofs as close to their pen-and-paper counterpart as possible.

This entry is described in detail in Bengtson's thesis. notify = [Pi_Calculus] title = The pi-calculus in nominal logic author = Jesper Bengtson date = 2012-05-29 topic = Computer Science/Concurrency/Process Calculi abstract = We formalise the pi-calculus using the nominal datatype package, based on ideas from the nominal logic by Pitts et al., and demonstrate an implementation in Isabelle/HOL. The purpose is to derive powerful induction rules for the semantics in order to conduct machine checkable proofs, closely following the intuitive arguments found in manual proofs. In this way we have covered many of the standard theorems of bisimulation equivalence and congruence, both late and early, and both strong and weak in a uniform manner. We thus provide one of the most extensive formalisations of a the pi-calculus ever done inside a theorem prover.

A significant gain in our formulation is that agents are identified up to alpha-equivalence, thereby greatly reducing the arguments about bound names. This is a normal strategy for manual proofs about the pi-calculus, but that kind of hand waving has previously been difficult to incorporate smoothly in an interactive theorem prover. We show how the nominal logic formalism and its support in Isabelle accomplishes this and thus significantly reduces the tedium of conducting completely formal proofs. This improves on previous work using weak higher order abstract syntax since we do not need extra assumptions to filter out exotic terms and can keep all arguments within a familiar first-order logic.

This entry is described in detail in Bengtson's thesis. notify = [Psi_Calculi] title = Psi-calculi in Isabelle author = Jesper Bengtson date = 2012-05-29 topic = Computer Science/Concurrency/Process Calculi abstract = Psi-calculi are extensions of the pi-calculus, accommodating arbitrary nominal datatypes to represent not only data but also communication channels, assertions and conditions, giving it an expressive power beyond the applied pi-calculus and the concurrent constraint pi-calculus.

We have formalised psi-calculi in the interactive theorem prover Isabelle using its nominal datatype package. One distinctive feature is that the framework needs to treat binding sequences, as opposed to single binders, in an efficient way. While different methods for formalising single binder calculi have been proposed over the last decades, representations for such binding sequences are not very well explored.

The main effort in the formalisation is to keep the machine checked proofs as close to their pen-and-paper counterparts as possible. This includes treating all binding sequences as atomic elements, and creating custom induction and inversion rules that to remove the bulk of manual alpha-conversions.

This entry is described in detail in Bengtson's thesis. notify = [Encodability_Process_Calculi] title = Analysing and Comparing Encodability Criteria for Process Calculi author = Kirstin Peters , Rob van Glabbeek date = 2015-08-10 topic = Computer Science/Concurrency/Process Calculi abstract = Encodings or the proof of their absence are the main way to compare process calculi. To analyse the quality of encodings and to rule out trivial or meaningless encodings, they are augmented with quality criteria. There exists a bunch of different criteria and different variants of criteria in order to reason in different settings. This leads to incomparable results. Moreover it is not always clear whether the criteria used to obtain a result in a particular setting do indeed fit to this setting. We show how to formally reason about and compare encodability criteria by mapping them on requirements on a relation between source and target terms that is induced by the encoding function. In particular we analyse the common criteria full abstraction, operational correspondence, divergence reflection, success sensitiveness, and respect of barbs; e.g. we analyse the exact nature of the simulation relation (coupled simulation versus bisimulation) that is induced by different variants of operational correspondence. This way we reduce the problem of analysing or comparing encodability criteria to the better understood problem of comparing relations on processes. notify = kirstin.peters@tu-berlin.de [Circus] title = Isabelle/Circus author = Abderrahmane Feliachi , Burkhart Wolff , Marie-Claude Gaudel contributors = Makarius Wenzel date = 2012-05-27 topic = Computer Science/Concurrency/Process Calculi, Computer Science/System Description Languages abstract = The Circus specification language combines elements for complex data and behavior specifications, using an integration of Z and CSP with a refinement calculus. Its semantics is based on Hoare and He's Unifying Theories of Programming (UTP). Isabelle/Circus is a formalization of the UTP and the Circus language in Isabelle/HOL. It contains proof rules and tactic support that allows for proofs of refinement for Circus processes (involving both data and behavioral aspects).

The Isabelle/Circus environment supports a syntax for the semantic definitions which is close to textbook presentations of Circus. This article contains an extended version of corresponding VSTTE Paper together with the complete formal development of its underlying commented theories. extra-history = Change history: [2014-06-05]: More polishing, shorter proofs, added Circus syntax, added Makarius Wenzel as contributor. notify = [Dijkstra_Shortest_Path] title = Dijkstra's Shortest Path Algorithm author = Benedikt Nordhoff , Peter Lammich topic = Computer Science/Algorithms date = 2012-01-30 abstract = We implement and prove correct Dijkstra's algorithm for the single source shortest path problem, conceived in 1956 by E. Dijkstra. The algorithm is implemented using the data refinement framework for monadic, nondeterministic programs. An efficient implementation is derived using data structures from the Isabelle Collection Framework. notify = lammich@in.tum.de [Refine_Monadic] title = Refinement for Monadic Programs author = Peter Lammich topic = Computer Science/Programming Languages/Logics date = 2012-01-30 abstract = We provide a framework for program and data refinement in Isabelle/HOL. The framework is based on a nondeterminism-monad with assertions, i.e., the monad carries a set of results or an assertion failure. Recursion is expressed by fixed points. For convenience, we also provide while and foreach combinators.

The framework provides tools to automatize canonical tasks, such as verification condition generation, finding appropriate data refinement relations, and refine an executable program to a form that is accepted by the Isabelle/HOL code generator.

This submission comes with a collection of examples and a user-guide, illustrating the usage of the framework. extra-history = Change history: [2012-04-23] Introduced ordered FOREACH loops
[2012-06] New features: REC_rule_arb and RECT_rule_arb allow for generalizing over variables. prepare_code_thms - command extracts code equations for recursion combinators.
[2012-07] New example: Nested DFS for emptiness check of Buchi-automata with witness.
New feature: fo_rule method to apply resolution using first-order matching. Useful for arg_conf, fun_cong.
[2012-08] Adaptation to ICF v2.
[2012-10-05] Adaptations to include support for Automatic Refinement Framework.
[2013-09] This entry now depends on Automatic Refinement
[2014-06] New feature: vc_solve method to solve verification conditions. Maintenace changes: VCG-rules for nfoldli, improved setup for FOREACH-loops.
[2014-07] Now defining recursion via flat domain. Dropped many single-valued prerequisites. Changed notion of data refinement. In single-valued case, this matches the old notion. In non-single valued case, the new notion allows for more convenient rules. In particular, the new definitions allow for projecting away ghost variables as a refinement step.
[2014-11] New features: le-or-fail relation (leof), modular reasoning about loop invariants. notify = lammich@in.tum.de [Refine_Imperative_HOL] title = The Imperative Refinement Framework author = Peter Lammich notify = lammich@in.tum.de date = 2016-08-08 topic = Computer Science/Programming Languages/Transformations,Computer Science/Data Structures abstract = We present the Imperative Refinement Framework (IRF), a tool that supports a stepwise refinement based approach to imperative programs. This entry is based on the material we presented in [ITP-2015, CPP-2016]. It uses the Monadic Refinement Framework as a frontend for the specification of the abstract programs, and Imperative/HOL as a backend to generate executable imperative programs. The IRF comes with tool support to synthesize imperative programs from more abstract, functional ones, using efficient imperative implementations for the abstract data structures. This entry also includes the Imperative Isabelle Collection Framework (IICF), which provides a library of re-usable imperative collection data structures. Moreover, this entry contains a quickstart guide and a reference manual, which provide an introduction to using the IRF for Isabelle/HOL experts. It also provids a collection of (partly commented) practical examples, some highlights being Dijkstra's Algorithm, Nested-DFS, and a generic worklist algorithm with subsumption. Finally, this entry contains benchmark scripts that compare the runtime of some examples against reference implementations of the algorithms in Java and C++. [ITP-2015] Peter Lammich: Refinement to Imperative/HOL. ITP 2015: 253--269 [CPP-2016] Peter Lammich: Refinement based verification of imperative data structures. CPP 2016: 27--36 [Automatic_Refinement] title = Automatic Data Refinement author = Peter Lammich topic = Computer Science/Programming Languages/Logics date = 2013-10-02 abstract = We present the Autoref tool for Isabelle/HOL, which automatically refines algorithms specified over abstract concepts like maps and sets to algorithms over concrete implementations like red-black-trees, and produces a refinement theorem. It is based on ideas borrowed from relational parametricity due to Reynolds and Wadler. The tool allows for rapid prototyping of verified, executable algorithms. Moreover, it can be configured to fine-tune the result to the user~s needs. Our tool is able to automatically instantiate generic algorithms, which greatly simplifies the implementation of executable data structures.

This AFP-entry provides the basic tool, which is then used by the Refinement and Collection Framework to provide automatic data refinement for the nondeterminism monad and various collection datastructures. notify = lammich@in.tum.de [EdmondsKarp_Maxflow] title = Formalizing the Edmonds-Karp Algorithm author = Peter Lammich , S. Reza Sefidgar<> notify = lammich@in.tum.de date = 2016-08-12 topic = Computer Science/Algorithms abstract = We present a formalization of the Ford-Fulkerson method for computing the maximum flow in a network. Our formal proof closely follows a standard textbook proof, and is accessible even without being an expert in Isabelle/HOL--- the interactive theorem prover used for the formalization. We then use stepwise refinement to obtain the Edmonds-Karp algorithm, and formally prove a bound on its complexity. Further refinement yields a verified implementation, whose execution time compares well to an unverified reference implementation in Java. This entry is based on our ITP-2016 paper with the same title. [VerifyThis2018] title = VerifyThis 2018 - Polished Isabelle Solutions author = Peter Lammich , Simon Wimmer topic = Computer Science/Algorithms date = 2018-04-27 notify = lammich@in.tum.de abstract = VerifyThis 2018 was a program verification competition associated with ETAPS 2018. It was the 7th event in the VerifyThis competition series. In this entry, we present polished and completed versions of our solutions that we created during the competition. [PseudoHoops] title = Pseudo Hoops author = George Georgescu <>, Laurentiu Leustean <>, Viorel Preoteasa topic = Mathematics/Algebra date = 2011-09-22 abstract = Pseudo-hoops are algebraic structures introduced by B. Bosbach under the name of complementary semigroups. In this formalization we prove some properties of pseudo-hoops and we define the basic concepts of filter and normal filter. The lattice of normal filters is isomorphic with the lattice of congruences of a pseudo-hoop. We also study some important classes of pseudo-hoops. Bounded Wajsberg pseudo-hoops are equivalent to pseudo-Wajsberg algebras and bounded basic pseudo-hoops are equivalent to pseudo-BL algebras. Some examples of pseudo-hoops are given in the last section of the formalization. notify = viorel.preoteasa@aalto.fi [MonoBoolTranAlgebra] title = Algebra of Monotonic Boolean Transformers author = Viorel Preoteasa topic = Computer Science/Programming Languages/Logics date = 2011-09-22 abstract = Algebras of imperative programming languages have been successful in reasoning about programs. In general an algebra of programs is an algebraic structure with programs as elements and with program compositions (sequential composition, choice, skip) as algebra operations. Various versions of these algebras were introduced to model partial correctness, total correctness, refinement, demonic choice, and other aspects. We formalize here an algebra which can be used to model total correctness, refinement, demonic and angelic choice. The basic model of this algebra are monotonic Boolean transformers (monotonic functions from a Boolean algebra to itself). notify = viorel.preoteasa@aalto.fi [LatticeProperties] title = Lattice Properties author = Viorel Preoteasa topic = Mathematics/Order date = 2011-09-22 abstract = This formalization introduces and collects some algebraic structures based on lattices and complete lattices for use in other developments. The structures introduced are modular, and lattice ordered groups. In addition to the results proved for the new lattices, this formalization also introduces theorems about latices and complete lattices in general. extra-history = Change history: [2012-01-05]: Removed the theory about distributive complete lattices which is in the standard library now. Added a theory about well founded and transitive relations and a result about fixpoints in complete lattices and well founded relations. Moved the results about conjunctive and disjunctive functions to a new theory. Removed the syntactic classes for inf and sup which are in the standard library now. notify = viorel.preoteasa@aalto.fi [Impossible_Geometry] title = Proving the Impossibility of Trisecting an Angle and Doubling the Cube author = Ralph Romanos , Lawrence C. Paulson topic = Mathematics/Algebra, Mathematics/Geometry date = 2012-08-05 abstract = Squaring the circle, doubling the cube and trisecting an angle, using a compass and straightedge alone, are classic unsolved problems first posed by the ancient Greeks. All three problems were proved to be impossible in the 19th century. The following document presents the proof of the impossibility of solving the latter two problems using Isabelle/HOL, following a proof by Carrega. The proof uses elementary methods: no Galois theory or field extensions. The set of points constructible using a compass and straightedge is defined inductively. Radical expressions, which involve only square roots and arithmetic of rational numbers, are defined, and we find that all constructive points have radical coordinates. Finally, doubling the cube and trisecting certain angles requires solving certain cubic equations that can be proved to have no rational roots. The Isabelle proofs require a great many detailed calculations. notify = ralph.romanos@student.ecp.fr, lp15@cam.ac.uk [IP_Addresses] title = IP Addresses author = Cornelius Diekmann , Julius Michaelis , Lars Hupel notify = diekmann@net.in.tum.de date = 2016-06-28 topic = Computer Science/Networks abstract = This entry contains a definition of IP addresses and a library to work with them. Generic IP addresses are modeled as machine words of arbitrary length. Derived from this generic definition, IPv4 addresses are 32bit machine words, IPv6 addresses are 128bit words. Additionally, IPv4 addresses can be represented in dot-decimal notation and IPv6 addresses in (compressed) colon-separated notation. We support toString functions and parsers for both notations. Sets of IP addresses can be represented with a netmask (e.g. 192.168.0.0/255.255.0.0) or in CIDR notation (e.g. 192.168.0.0/16). To provide executable code for set operations on IP address ranges, the library includes a datatype to work on arbitrary intervals of machine words. [Simple_Firewall] title = Simple Firewall author = Cornelius Diekmann , Julius Michaelis , Maximilian Haslbeck notify = diekmann@net.in.tum.de, max.haslbeck@gmx.de date = 2016-08-24 topic = Computer Science/Networks abstract = We present a simple model of a firewall. The firewall can accept or drop a packet and can match on interfaces, IP addresses, protocol, and ports. It was designed to feature nice mathematical properties: The type of match expressions was carefully crafted such that the conjunction of two match expressions is only one match expression. This model is too simplistic to mirror all aspects of the real world. In the upcoming entry "Iptables Semantics", we will translate the Linux firewall iptables to this model. For a fixed service (e.g. ssh, http), we provide an algorithm to compute an overview of the firewall's filtering behavior. The algorithm computes minimal service matrices, i.e. graphs which partition the complete IPv4 and IPv6 address space and visualize the allowed accesses between partitions. For a detailed description, see Verified iptables Firewall Analysis, IFIP Networking 2016. [Iptables_Semantics] title = Iptables Semantics author = Cornelius Diekmann , Lars Hupel notify = diekmann@net.in.tum.de, hupel@in.tum.de date = 2016-09-09 topic = Computer Science/Networks abstract = We present a big step semantics of the filtering behavior of the Linux/netfilter iptables firewall. We provide algorithms to simplify complex iptables rulests to a simple firewall model (c.f. AFP entry Simple_Firewall) and to verify spoofing protection of a ruleset. Internally, we embed our semantics into ternary logic, ultimately supporting every iptables match condition by abstracting over unknowns. Using this AFP entry and all entries it depends on, we created an easy-to-use, stand-alone haskell tool called fffuu. The tool does not require any input —except for the iptables-save dump of the analyzed firewall— and presents interesting results about the user's ruleset. Real-Word firewall errors have been uncovered, and the correctness of rulesets has been proved, with the help of our tool. [Routing] title = Routing author = Julius Michaelis , Cornelius Diekmann notify = afp@liftm.de date = 2016-08-31 topic = Computer Science/Networks abstract = This entry contains definitions for routing with routing tables/longest prefix matching. A routing table entry is modelled as a record of a prefix match, a metric, an output port, and an optional next hop. A routing table is a list of entries, sorted by prefix length and metric. Additionally, a parser and serializer for the output of the ip-route command, a function to create a relation from output port to corresponding destination IP space, and a model of a Linux-style router are included. [KBPs] title = Knowledge-based programs author = Peter Gammie topic = Computer Science/Automata and Formal Languages date = 2011-05-17 abstract = Knowledge-based programs (KBPs) are a formalism for directly relating agents' knowledge and behaviour. Here we present a general scheme for compiling KBPs to executable automata with a proof of correctness in Isabelle/HOL. We develop the algorithm top-down, using Isabelle's locale mechanism to structure these proofs, and show that two classic examples can be synthesised using Isabelle's code generator. extra-history = Change history: [2012-03-06]: Add some more views and revive the code generation. notify = kleing@cse.unsw.edu.au [Tarskis_Geometry] title = The independence of Tarski's Euclidean axiom author = T. J. M. Makarios topic = Mathematics/Geometry date = 2012-10-30 abstract = Tarski's axioms of plane geometry are formalized and, using the standard real Cartesian model, shown to be consistent. A substantial theory of the projective plane is developed. Building on this theory, the Klein-Beltrami model of the hyperbolic plane is defined and shown to satisfy all of Tarski's axioms except his Euclidean axiom; thus Tarski's Euclidean axiom is shown to be independent of his other axioms of plane geometry.

An earlier version of this work was the subject of the author's MSc thesis, which contains natural-language explanations of some of the more interesting proofs. notify = tjm1983@gmail.com [General-Triangle] title = The General Triangle Is Unique author = Joachim Breitner topic = Mathematics/Geometry date = 2011-04-01 abstract = Some acute-angled triangles are special, e.g. right-angled or isoscele triangles. Some are not of this kind, but, without measuring angles, look as if they were. In that sense, there is exactly one general triangle. This well-known fact is proven here formally. notify = mail@joachim-breitner.de [LightweightJava] title = Lightweight Java author = Rok Strniša , Matthew Parkinson topic = Computer Science/Programming Languages/Language Definitions date = 2011-02-07 abstract = A fully-formalized and extensible minimal imperative fragment of Java. notify = rok@strnisa.com [Lower_Semicontinuous] title = Lower Semicontinuous Functions author = Bogdan Grechuk topic = Mathematics/Analysis date = 2011-01-08 abstract = We define the notions of lower and upper semicontinuity for functions from a metric space to the extended real line. We prove that a function is both lower and upper semicontinuous if and only if it is continuous. We also give several equivalent characterizations of lower semicontinuity. In particular, we prove that a function is lower semicontinuous if and only if its epigraph is a closed set. Also, we introduce the notion of the lower semicontinuous hull of an arbitrary function and prove its basic properties. notify = hoelzl@in.tum.de [RIPEMD-160-SPARK] title = RIPEMD-160 author = Fabian Immler topic = Computer Science/Programming Languages/Static Analysis date = 2011-01-10 abstract = This work presents a verification of an implementation in SPARK/ADA of the cryptographic hash-function RIPEMD-160. A functional specification of RIPEMD-160 is given in Isabelle/HOL. Proofs for the verification conditions generated by the static-analysis toolset of SPARK certify the functional correctness of the implementation. extra-history = Change history: [2015-11-09]: Entry is now obsolete, moved to Isabelle distribution. notify = immler@in.tum.de [Regular-Sets] title = Regular Sets and Expressions author = Alexander Krauss , Tobias Nipkow contributors = Manuel Eberl topic = Computer Science/Automata and Formal Languages date = 2010-05-12 abstract = This is a library of constructions on regular expressions and languages. It provides the operations of concatenation, Kleene star and derivative on languages. Regular expressions and their meaning are defined. An executable equivalence checker for regular expressions is verified; it does not need automata but works directly on regular expressions. By mapping regular expressions to binary relations, an automatic and complete proof method for (in)equalities of binary relations over union, concatenation and (reflexive) transitive closure is obtained.

Extended regular expressions with complement and intersection are also defined and an equivalence checker is provided. extra-history = Change history: [2011-08-26]: Christian Urban added a theory about derivatives and partial derivatives of regular expressions
[2012-05-10]: Tobias Nipkow added extended regular expressions
[2012-05-10]: Tobias Nipkow added equivalence checking with partial derivatives notify = nipkow@in.tum.de, krauss@in.tum.de, christian.urban@kcl.ac.uk [Regex_Equivalence] title = Unified Decision Procedures for Regular Expression Equivalence author = Tobias Nipkow , Dmitriy Traytel topic = Computer Science/Automata and Formal Languages date = 2014-01-30 abstract = We formalize a unified framework for verified decision procedures for regular expression equivalence. Five recently published formalizations of such decision procedures (three based on derivatives, two on marked regular expressions) can be obtained as instances of the framework. We discover that the two approaches based on marked regular expressions, which were previously thought to be the same, are different, and one seems to produce uniformly smaller automata. The common framework makes it possible to compare the performance of the different decision procedures in a meaningful way. The formalization is described in a paper of the same name presented at Interactive Theorem Proving 2014. notify = nipkow@in.tum.de, traytel@in.tum.de [MSO_Regex_Equivalence] title = Decision Procedures for MSO on Words Based on Derivatives of Regular Expressions author = Dmitriy Traytel , Tobias Nipkow topic = Computer Science/Automata and Formal Languages, Logic date = 2014-06-12 abstract = Monadic second-order logic on finite words (MSO) is a decidable yet expressive logic into which many decision problems can be encoded. Since MSO formulas correspond to regular languages, equivalence of MSO formulas can be reduced to the equivalence of some regular structures (e.g. automata). We verify an executable decision procedure for MSO formulas that is not based on automata but on regular expressions.

Decision procedures for regular expression equivalence have been formalized before, usually based on Brzozowski derivatives. Yet, for a straightforward embedding of MSO formulas into regular expressions an extension of regular expressions with a projection operation is required. We prove total correctness and completeness of an equivalence checker for regular expressions extended in that way. We also define a language-preserving translation of formulas into regular expressions with respect to two different semantics of MSO.

The formalization is described in this ICFP 2013 functional pearl. notify = traytel@in.tum.de, nipkow@in.tum.de [Formula_Derivatives] title = Derivatives of Logical Formulas author = Dmitriy Traytel topic = Computer Science/Automata and Formal Languages, Logic date = 2015-05-28 abstract = We formalize new decision procedures for WS1S, M2L(Str), and Presburger Arithmetics. Formulas of these logics denote regular languages. Unlike traditional decision procedures, we do not translate formulas into automata (nor into regular expressions), at least not explicitly. Instead we devise notions of derivatives (inspired by Brzozowski derivatives for regular expressions) that operate on formulas directly and compute a syntactic bisimulation using these derivatives. The treatment of Boolean connectives and quantifiers is uniform for all mentioned logics and is abstracted into a locale. This locale is then instantiated by different atomic formulas and their derivatives (which may differ even for the same logic under different encodings of interpretations as formal words).

The WS1S instance is described in the draft paper A Coalgebraic Decision Procedure for WS1S by the author. notify = traytel@in.tum.de [Myhill-Nerode] title = The Myhill-Nerode Theorem Based on Regular Expressions author = Chunhan Wu <>, Xingyuan Zhang <>, Christian Urban contributors = Manuel Eberl topic = Computer Science/Automata and Formal Languages date = 2011-08-26 abstract = There are many proofs of the Myhill-Nerode theorem using automata. In this library we give a proof entirely based on regular expressions, since regularity of languages can be conveniently defined using regular expressions (it is more painful in HOL to define regularity in terms of automata). We prove the first direction of the Myhill-Nerode theorem by solving equational systems that involve regular expressions. For the second direction we give two proofs: one using tagging-functions and another using partial derivatives. We also establish various closure properties of regular languages. Most details of the theories are described in our ITP 2011 paper. notify = christian.urban@kcl.ac.uk [Universal_Turing_Machine] title = Universal Turing Machine author = Jian Xu<>, Xingyuan Zhang<>, Christian Urban , Sebastiaan J. C. Joosten topic = Logic, Computer Science/Automata and Formal Languages date = 2019-02-08 notify = sjcjoosten@gmail.com, christian.urban@kcl.ac.uk abstract = We formalise results from computability theory: recursive functions, undecidability of the halting problem, and the existence of a universal Turing machine. This formalisation is the AFP entry corresponding to the paper Mechanising Turing Machines and Computability Theory in Isabelle/HOL, ITP 2013. [CYK] title = A formalisation of the Cocke-Younger-Kasami algorithm author = Maksym Bortin date = 2016-04-27 topic = Computer Science/Algorithms, Computer Science/Automata and Formal Languages abstract = The theory provides a formalisation of the Cocke-Younger-Kasami algorithm (CYK for short), an approach to solving the word problem for context-free languages. CYK decides if a word is in the languages generated by a context-free grammar in Chomsky normal form. The formalized algorithm is executable. notify = maksym.bortin@nicta.com.au [Boolean_Expression_Checkers] title = Boolean Expression Checkers author = Tobias Nipkow date = 2014-06-08 topic = Computer Science/Algorithms, Logic abstract = This entry provides executable checkers for the following properties of boolean expressions: satisfiability, tautology and equivalence. Internally, the checkers operate on binary decision trees and are reasonably efficient (for purely functional algorithms). extra-history = Change history: [2015-09-23]: Salomon Sickert added an interface that does not require the usage of the Boolean formula datatype. Furthermore the general Mapping type is used instead of an association list. notify = nipkow@in.tum.de [Presburger-Automata] title = Formalizing the Logic-Automaton Connection author = Stefan Berghofer , Markus Reiter <> date = 2009-12-03 topic = Computer Science/Automata and Formal Languages, Logic abstract = This work presents a formalization of a library for automata on bit strings. It forms the basis of a reflection-based decision procedure for Presburger arithmetic, which is efficiently executable thanks to Isabelle's code generator. With this work, we therefore provide a mechanized proof of a well-known connection between logic and automata theory. The formalization is also described in a publication [TPHOLs 2009]. notify = berghofe@in.tum.de [Functional-Automata] title = Functional Automata author = Tobias Nipkow date = 2004-03-30 topic = Computer Science/Automata and Formal Languages abstract = This theory defines deterministic and nondeterministic automata in a functional representation: the transition function/relation and the finality predicate are just functions. Hence the state space may be infinite. It is shown how to convert regular expressions into such automata. A scanner (generator) is implemented with the help of functional automata: the scanner chops the input up into longest recognized substrings. Finally we also show how to convert a certain subclass of functional automata (essentially the finite deterministic ones) into regular sets. notify = nipkow@in.tum.de [Statecharts] title = Formalizing Statecharts using Hierarchical Automata author = Steffen Helke , Florian Kammüller topic = Computer Science/Automata and Formal Languages date = 2010-08-08 abstract = We formalize in Isabelle/HOL the abtract syntax and a synchronous step semantics for the specification language Statecharts. The formalization is based on Hierarchical Automata which allow a structural decomposition of Statecharts into Sequential Automata. To support the composition of Statecharts, we introduce calculating operators to construct a Hierarchical Automaton in a stepwise manner. Furthermore, we present a complete semantics of Statecharts including a theory of data spaces, which enables the modelling of racing effects. We also adapt CTL for Statecharts to build a bridge for future combinations with model checking. However the main motivation of this work is to provide a sound and complete basis for reasoning on Statecharts. As a central meta theorem we prove that the well-formedness of a Statechart is preserved by the semantics. notify = nipkow@in.tum.de [Stuttering_Equivalence] title = Stuttering Equivalence author = Stephan Merz topic = Computer Science/Automata and Formal Languages date = 2012-05-07 abstract =

Two omega-sequences are stuttering equivalent if they differ only by finite repetitions of elements. Stuttering equivalence is a fundamental concept in the theory of concurrent and distributed systems. Notably, Lamport argues that refinement notions for such systems should be insensitive to finite stuttering. Peled and Wilke showed that all PLTL (propositional linear-time temporal logic) properties that are insensitive to stuttering equivalence can be expressed without the next-time operator. Stuttering equivalence is also important for certain verification techniques such as partial-order reduction for model checking.

We formalize stuttering equivalence in Isabelle/HOL. Our development relies on the notion of stuttering sampling functions that may skip blocks of identical sequence elements. We also encode PLTL and prove the theorem due to Peled and Wilke.

extra-history = Change history: [2013-01-31]: Added encoding of PLTL and proved Peled and Wilke's theorem. Adjusted abstract accordingly. notify = Stephan.Merz@loria.fr [Coinductive_Languages] title = A Codatatype of Formal Languages author = Dmitriy Traytel topic = Computer Science/Automata and Formal Languages date = 2013-11-15 abstract =

We define formal languages as a codataype of infinite trees branching over the alphabet. Each node in such a tree indicates whether the path to this node constitutes a word inside or outside of the language. This codatatype is isormorphic to the set of lists representation of languages, but caters for definitions by corecursion and proofs by coinduction.

Regular operations on languages are then defined by primitive corecursion. A difficulty arises here, since the standard definitions of concatenation and iteration from the coalgebraic literature are not primitively corecursive-they require guardedness up-to union/concatenation. Without support for up-to corecursion, these operation must be defined as a composition of primitive ones (and proved being equal to the standard definitions). As an exercise in coinduction we also prove the axioms of Kleene algebra for the defined regular operations.

Furthermore, a language for context-free grammars given by productions in Greibach normal form and an initial nonterminal is constructed by primitive corecursion, yielding an executable decision procedure for the word problem without further ado.

notify = traytel@in.tum.de [Tree-Automata] title = Tree Automata author = Peter Lammich date = 2009-11-25 topic = Computer Science/Automata and Formal Languages abstract = This work presents a machine-checked tree automata library for Standard-ML, OCaml and Haskell. The algorithms are efficient by using appropriate data structures like RB-trees. The available algorithms for non-deterministic automata include membership query, reduction, intersection, union, and emptiness check with computation of a witness for non-emptiness. The executable algorithms are derived from less-concrete, non-executable algorithms using data-refinement techniques. The concrete data structures are from the Isabelle Collections Framework. Moreover, this work contains a formalization of the class of tree-regular languages and its closure properties under set operations. notify = peter.lammich@uni-muenster.de, nipkow@in.tum.de [Depth-First-Search] title = Depth First Search author = Toshiaki Nishihara <>, Yasuhiko Minamide <> date = 2004-06-24 topic = Computer Science/Algorithms abstract = Depth-first search of a graph is formalized with recdef. It is shown that it visits all of the reachable nodes from a given list of nodes. Executable ML code of depth-first search is obtained using the code generation feature of Isabelle/HOL. notify = lp15@cam.ac.uk, krauss@in.tum.de [FFT] title = Fast Fourier Transform author = Clemens Ballarin date = 2005-10-12 topic = Computer Science/Algorithms abstract = We formalise a functional implementation of the FFT algorithm over the complex numbers, and its inverse. Both are shown equivalent to the usual definitions of these operations through Vandermonde matrices. They are also shown to be inverse to each other, more precisely, that composition of the inverse and the transformation yield the identity up to a scalar. notify = ballarin@in.tum.de [Gauss-Jordan-Elim-Fun] title = Gauss-Jordan Elimination for Matrices Represented as Functions author = Tobias Nipkow date = 2011-08-19 topic = Computer Science/Algorithms, Mathematics/Algebra abstract = This theory provides a compact formulation of Gauss-Jordan elimination for matrices represented as functions. Its distinctive feature is succinctness. It is not meant for large computations. notify = nipkow@in.tum.de [UpDown_Scheme] title = Verification of the UpDown Scheme author = Johannes Hölzl date = 2015-01-28 topic = Computer Science/Algorithms abstract = The UpDown scheme is a recursive scheme used to compute the stiffness matrix on a special form of sparse grids. Usually, when discretizing a Euclidean space of dimension d we need O(n^d) points, for n points along each dimension. Sparse grids are a hierarchical representation where the number of points is reduced to O(n * log(n)^d). One disadvantage of such sparse grids is that the algorithm now operate recursively in the dimensions and levels of the sparse grid.

The UpDown scheme allows us to compute the stiffness matrix on such a sparse grid. The stiffness matrix represents the influence of each representation function on the L^2 scalar product. For a detailed description see Dirk Pflüger's PhD thesis. This formalization was developed as an interdisciplinary project (IDP) at the Technische Universität München. notify = hoelzl@in.tum.de [GraphMarkingIBP] title = Verification of the Deutsch-Schorr-Waite Graph Marking Algorithm using Data Refinement author = Viorel Preoteasa , Ralph-Johan Back date = 2010-05-28 topic = Computer Science/Algorithms abstract = The verification of the Deutsch-Schorr-Waite graph marking algorithm is used as a benchmark in many formalizations of pointer programs. The main purpose of this mechanization is to show how data refinement of invariant based programs can be used in verifying practical algorithms. The verification starts with an abstract algorithm working on a graph given by a relation next on nodes. Gradually the abstract program is refined into Deutsch-Schorr-Waite graph marking algorithm where only one bit per graph node of additional memory is used for marking. extra-history = Change history: [2012-01-05]: Updated for the new definition of data refinement and the new syntax for demonic and angelic update statements notify = viorel.preoteasa@aalto.fi [Efficient-Mergesort] title = Efficient Mergesort topic = Computer Science/Algorithms date = 2011-11-09 author = Christian Sternagel abstract = We provide a formalization of the mergesort algorithm as used in GHC's Data.List module, proving correctness and stability. Furthermore, experimental data suggests that generated (Haskell-)code for this algorithm is much faster than for previous algorithms available in the Isabelle distribution. extra-history = Change history: [2012-10-24]: Added reference to journal article.
[2018-09-17]: Added theory Efficient_Mergesort that works exclusively with the mutual induction schemas generated by the function package.
[2018-09-19]: Added theory Mergesort_Complexity that proves an upper bound on the number of comparisons that are required by mergesort.
[2018-09-19]: Theory Efficient_Mergesort replaces theory Efficient_Sort but keeping the old name Efficient_Sort. notify = c.sternagel@gmail.com [SATSolverVerification] title = Formal Verification of Modern SAT Solvers author = Filip Maric date = 2008-07-23 topic = Computer Science/Algorithms abstract = This document contains formal correctness proofs of modern SAT solvers. Following (Krstic et al, 2007) and (Nieuwenhuis et al., 2006), solvers are described using state-transition systems. Several different SAT solver descriptions are given and their partial correctness and termination is proved. These include:

  • a solver based on classical DPLL procedure (using only a backtrack-search with unit propagation),
  • a very general solver with backjumping and learning (similar to the description given in (Nieuwenhuis et al., 2006)), and
  • a solver with a specific conflict analysis algorithm (similar to the description given in (Krstic et al., 2007)).
Within the SAT solver correctness proofs, a large number of lemmas about propositional logic and CNF formulae are proved. This theory is self-contained and could be used for further exploring of properties of CNF based SAT algorithms. notify = [Transitive-Closure] title = Executable Transitive Closures of Finite Relations topic = Computer Science/Algorithms date = 2011-03-14 author = Christian Sternagel , René Thiemann license = LGPL abstract = We provide a generic work-list algorithm to compute the transitive closure of finite relations where only successors of newly detected states are generated. This algorithm is then instantiated for lists over arbitrary carriers and red black trees (which are faster but require a linear order on the carrier), respectively. Our formalization was performed as part of the IsaFoR/CeTA project where reflexive transitive closures of large tree automata have to be computed. extra-history = Change history: [2014-09-04] added example simprocs in Finite_Transitive_Closure_Simprocs notify = c.sternagel@gmail.com, rene.thiemann@uibk.ac.at [Transitive-Closure-II] title = Executable Transitive Closures topic = Computer Science/Algorithms date = 2012-02-29 author = René Thiemann license = LGPL abstract =

We provide a generic work-list algorithm to compute the (reflexive-)transitive closure of relations where only successors of newly detected states are generated. In contrast to our previous work, the relations do not have to be finite, but each element must only have finitely many (indirect) successors. Moreover, a subsumption relation can be used instead of pure equality. An executable variant of the algorithm is available where the generic operations are instantiated with list operations.

This formalization was performed as part of the IsaFoR/CeTA project, and it has been used to certify size-change termination proofs where large transitive closures have to be computed.

notify = rene.thiemann@uibk.ac.at [MuchAdoAboutTwo] title = Much Ado About Two author = Sascha Böhme date = 2007-11-06 topic = Computer Science/Algorithms abstract = This article is an Isabelle formalisation of a paper with the same title. In a similar way as Knuth's 0-1-principle for sorting algorithms, that paper develops a 0-1-2-principle for parallel prefix computations. notify = boehmes@in.tum.de [DiskPaxos] title = Proving the Correctness of Disk Paxos date = 2005-06-22 author = Mauro Jaskelioff , Stephan Merz topic = Computer Science/Algorithms/Distributed abstract = Disk Paxos is an algorithm for building arbitrary fault-tolerant distributed systems. The specification of Disk Paxos has been proved correct informally and tested using the TLC model checker, but up to now, it has never been fully formally verified. In this work we have formally verified its correctness using the Isabelle theorem prover and the HOL logic system, showing that Isabelle is a practical tool for verifying properties of TLA+ specifications. notify = kleing@cse.unsw.edu.au [GenClock] title = Formalization of a Generalized Protocol for Clock Synchronization author = Alwen Tiu date = 2005-06-24 topic = Computer Science/Algorithms/Distributed abstract = We formalize the generalized Byzantine fault-tolerant clock synchronization protocol of Schneider. This protocol abstracts from particular algorithms or implementations for clock synchronization. This abstraction includes several assumptions on the behaviors of physical clocks and on general properties of concrete algorithms/implementations. Based on these assumptions the correctness of the protocol is proved by Schneider. His proof was later verified by Shankar using the theorem prover EHDM (precursor to PVS). Our formalization in Isabelle/HOL is based on Shankar's formalization. notify = kleing@cse.unsw.edu.au [ClockSynchInst] title = Instances of Schneider's generalized protocol of clock synchronization author = Damián Barsotti date = 2006-03-15 topic = Computer Science/Algorithms/Distributed abstract = F. B. Schneider ("Understanding protocols for Byzantine clock synchronization") generalizes a number of protocols for Byzantine fault-tolerant clock synchronization and presents a uniform proof for their correctness. In Schneider's schema, each processor maintains a local clock by periodically adjusting each value to one computed by a convergence function applied to the readings of all the clocks. Then, correctness of an algorithm, i.e. that the readings of two clocks at any time are within a fixed bound of each other, is based upon some conditions on the convergence function. To prove that a particular clock synchronization algorithm is correct it suffices to show that the convergence function used by the algorithm meets Schneider's conditions. Using the theorem prover Isabelle, we formalize the proofs that the convergence functions of two algorithms, namely, the Interactive Convergence Algorithm (ICA) of Lamport and Melliar-Smith and the Fault-tolerant Midpoint algorithm of Lundelius-Lynch, meet Schneider's conditions. Furthermore, we experiment on handling some parts of the proofs with fully automatic tools like ICS and CVC-lite. These theories are part of a joint work with Alwen Tiu and Leonor P. Nieto "Verification of Clock Synchronization Algorithms: Experiments on a combination of deductive tools" in proceedings of AVOCS 2005. In this work the correctness of Schneider schema was also verified using Isabelle (entry GenClock in AFP). notify = kleing@cse.unsw.edu.au [Heard_Of] title = Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model date = 2012-07-27 author = Henri Debrat , Stephan Merz topic = Computer Science/Algorithms/Distributed abstract = Distributed computing is inherently based on replication, promising increased tolerance to failures of individual computing nodes or communication channels. Realizing this promise, however, involves quite subtle algorithmic mechanisms, and requires precise statements about the kinds and numbers of faults that an algorithm tolerates (such as process crashes, communication faults or corrupted values). The landmark theorem due to Fischer, Lynch, and Paterson shows that it is impossible to achieve Consensus among N asynchronously communicating nodes in the presence of even a single permanent failure. Existing solutions must rely on assumptions of "partial synchrony".

Indeed, there have been numerous misunderstandings on what exactly a given algorithm is supposed to realize in what kinds of environments. Moreover, the abundance of subtly different computational models complicates comparisons between different algorithms. Charron-Bost and Schiper introduced the Heard-Of model for representing algorithms and failure assumptions in a uniform framework, simplifying comparisons between algorithms.

In this contribution, we represent the Heard-Of model in Isabelle/HOL. We define two semantics of runs of algorithms with different unit of atomicity and relate these through a reduction theorem that allows us to verify algorithms in the coarse-grained semantics (where proofs are easier) and infer their correctness for the fine-grained one (which corresponds to actual executions). We instantiate the framework by verifying six Consensus algorithms that differ in the underlying algorithmic mechanisms and the kinds of faults they tolerate. notify = Stephan.Merz@loria.fr [Consensus_Refined] title = Consensus Refined date = 2015-03-18 author = Ognjen Maric <>, Christoph Sprenger topic = Computer Science/Algorithms/Distributed abstract = Algorithms for solving the consensus problem are fundamental to distributed computing. Despite their brevity, their ability to operate in concurrent, asynchronous and failure-prone environments comes at the cost of complex and subtle behaviors. Accordingly, understanding how they work and proving their correctness is a non-trivial endeavor where abstraction is immensely helpful. Moreover, research on consensus has yielded a large number of algorithms, many of which appear to share common algorithmic ideas. A natural question is whether and how these similarities can be distilled and described in a precise, unified way. In this work, we combine stepwise refinement and lockstep models to provide an abstract and unified view of a sizeable family of consensus algorithms. Our models provide insights into the design choices underlying the different algorithms, and classify them based on those choices. notify = sprenger@inf.ethz.ch [Key_Agreement_Strong_Adversaries] title = Refining Authenticated Key Agreement with Strong Adversaries author = Joseph Lallemand , Christoph Sprenger topic = Computer Science/Security license = LGPL date = 2017-01-31 notify = joseph.lallemand@loria.fr, sprenger@inf.ethz.ch abstract = We develop a family of key agreement protocols that are correct by construction. Our work substantially extends prior work on developing security protocols by refinement. First, we strengthen the adversary by allowing him to compromise different resources of protocol participants, such as their long-term keys or their session keys. This enables the systematic development of protocols that ensure strong properties such as perfect forward secrecy. Second, we broaden the class of protocols supported to include those with non-atomic keys and equationally defined cryptographic operators. We use these extensions to develop key agreement protocols including signed Diffie-Hellman and the core of IKEv1 and SKEME. [Security_Protocol_Refinement] title = Developing Security Protocols by Refinement author = Christoph Sprenger , Ivano Somaini<> topic = Computer Science/Security license = LGPL date = 2017-05-24 notify = sprenger@inf.ethz.ch abstract = We propose a development method for security protocols based on stepwise refinement. Our refinement strategy transforms abstract security goals into protocols that are secure when operating over an insecure channel controlled by a Dolev-Yao-style intruder. As intermediate levels of abstraction, we employ messageless guard protocols and channel protocols communicating over channels with security properties. These abstractions provide insights on why protocols are secure and foster the development of families of protocols sharing common structure and properties. We have implemented our method in Isabelle/HOL and used it to develop different entity authentication and key establishment protocols, including realistic features such as key confirmation, replay caches, and encrypted tickets. Our development highlights that guard protocols and channel protocols provide fundamental abstractions for bridging the gap between security properties and standard protocol descriptions based on cryptographic messages. It also shows that our refinement approach scales to protocols of nontrivial size and complexity. [Abortable_Linearizable_Modules] title = Abortable Linearizable Modules author = Rachid Guerraoui , Viktor Kuncak , Giuliano Losa date = 2012-03-01 topic = Computer Science/Algorithms/Distributed abstract = We define the Abortable Linearizable Module automaton (ALM for short) and prove its key composition property using the IOA theory of HOLCF. The ALM is at the heart of the Speculative Linearizability framework. This framework simplifies devising correct speculative algorithms by enabling their decomposition into independent modules that can be analyzed and proved correct in isolation. It is particularly useful when working in a distributed environment, where the need to tolerate faults and asynchrony has made current monolithic protocols so intricate that it is no longer tractable to check their correctness. Our theory contains a typical example of a refinement proof in the I/O-automata framework of Lynch and Tuttle. notify = giuliano@losa.fr, nipkow@in.tum.de [Amortized_Complexity] title = Amortized Complexity Verified author = Tobias Nipkow date = 2014-07-07 topic = Computer Science/Data Structures abstract = A framework for the analysis of the amortized complexity of functional data structures is formalized in Isabelle/HOL and applied to a number of standard examples and to the folowing non-trivial ones: skew heaps, splay trees, splay heaps and pairing heaps.

A preliminary version of this work (without pairing heaps) is described in a paper published in the proceedings of the conference on Interactive Theorem Proving ITP 2015. An extended version of this publication is available here. extra-history = Change history: [2015-03-17]: Added pairing heaps by Hauke Brinkop.
[2016-07-12]: Moved splay heaps from here to Splay_Tree
[2016-07-14]: Moved pairing heaps from here to the new Pairing_Heap notify = nipkow@in.tum.de [Dynamic_Tables] title = Parameterized Dynamic Tables author = Tobias Nipkow date = 2015-06-07 topic = Computer Science/Data Structures abstract = This article formalizes the amortized analysis of dynamic tables parameterized with their minimal and maximal load factors and the expansion and contraction factors.

A full description is found in a companion paper. notify = nipkow@in.tum.de [AVL-Trees] title = AVL Trees author = Tobias Nipkow , Cornelia Pusch <> date = 2004-03-19 topic = Computer Science/Data Structures abstract = Two formalizations of AVL trees with room for extensions. The first formalization is monolithic and shorter, the second one in two stages, longer and a bit simpler. The final implementation is the same. If you are interested in developing this further, please contact gerwin.klein@nicta.com.au. extra-history = Change history: [2011-04-11]: Ondrej Kuncar added delete function notify = kleing@cse.unsw.edu.au [BDD] title = BDD Normalisation author = Veronika Ortner <>, Norbert Schirmer <> date = 2008-02-29 topic = Computer Science/Data Structures abstract = We present the verification of the normalisation of a binary decision diagram (BDD). The normalisation follows the original algorithm presented by Bryant in 1986 and transforms an ordered BDD in a reduced, ordered and shared BDD. The verification is based on Hoare logics. notify = kleing@cse.unsw.edu.au, norbert.schirmer@web.de [BinarySearchTree] title = Binary Search Trees author = Viktor Kuncak date = 2004-04-05 topic = Computer Science/Data Structures abstract = The correctness is shown of binary search tree operations (lookup, insert and remove) implementing a set. Two versions are given, for both structured and linear (tactic-style) proofs. An implementation of integer-indexed maps is also verified. notify = lp15@cam.ac.uk [Splay_Tree] title = Splay Tree author = Tobias Nipkow notify = nipkow@in.tum.de date = 2014-08-12 topic = Computer Science/Data Structures abstract = Splay trees are self-adjusting binary search trees which were invented by Sleator and Tarjan [JACM 1985]. This entry provides executable and verified functional splay trees as well as the related splay heaps (due to Okasaki).

The amortized complexity of splay trees and heaps is analyzed in the AFP entry Amortized Complexity. extra-history = Change history: [2016-07-12]: Moved splay heaps here from Amortized_Complexity [Root_Balanced_Tree] title = Root-Balanced Tree author = Tobias Nipkow notify = nipkow@in.tum.de date = 2017-08-20 topic = Computer Science/Data Structures abstract =

Andersson introduced general balanced trees, search trees based on the design principle of partial rebuilding: perform update operations naively until the tree becomes too unbalanced, at which point a whole subtree is rebalanced. This article defines and analyzes a functional version of general balanced trees, which we call root-balanced trees. Using a lightweight model of execution time, amortized logarithmic complexity is verified in the theorem prover Isabelle.

This is the Isabelle formalization of the material decribed in the APLAS 2017 article Verified Root-Balanced Trees by the same author, which also presents experimental results that show competitiveness of root-balanced with AVL and red-black trees.

[Skew_Heap] title = Skew Heap author = Tobias Nipkow date = 2014-08-13 topic = Computer Science/Data Structures abstract = Skew heaps are an amazingly simple and lightweight implementation of priority queues. They were invented by Sleator and Tarjan [SIAM 1986] and have logarithmic amortized complexity. This entry provides executable and verified functional skew heaps.

The amortized complexity of skew heaps is analyzed in the AFP entry Amortized Complexity. notify = nipkow@in.tum.de [Pairing_Heap] title = Pairing Heap author = Hauke Brinkop , Tobias Nipkow date = 2016-07-14 topic = Computer Science/Data Structures abstract = This library defines three different versions of pairing heaps: a functional version of the original design based on binary trees [Fredman et al. 1986], the version by Okasaki [1998] and a modified version of the latter that is free of structural invariants.

The amortized complexity of pairing heaps is analyzed in the AFP article Amortized Complexity. extra-0 = Origin: This library was extracted from Amortized Complexity and extended. notify = nipkow@in.tum.de [Priority_Queue_Braun] title = Priority Queues Based on Braun Trees author = Tobias Nipkow date = 2014-09-04 topic = Computer Science/Data Structures abstract = This entry verifies priority queues based on Braun trees. Insertion and deletion take logarithmic time and preserve the balanced nature of Braun trees. Two implementations of deletion are provided. notify = nipkow@in.tum.de extra-history = Change history: [2019-12-16]: Added theory Priority_Queue_Braun2 with second version of del_min [Binomial-Queues] title = Functional Binomial Queues author = René Neumann date = 2010-10-28 topic = Computer Science/Data Structures abstract = Priority queues are an important data structure and efficient implementations of them are crucial. We implement a functional variant of binomial queues in Isabelle/HOL and show its functional correctness. A verification against an abstract reference specification of priority queues has also been attempted, but could not be achieved to the full extent. notify = florian.haftmann@informatik.tu-muenchen.de [Binomial-Heaps] title = Binomial Heaps and Skew Binomial Heaps author = Rene Meis , Finn Nielsen , Peter Lammich date = 2010-10-28 topic = Computer Science/Data Structures abstract = We implement and prove correct binomial heaps and skew binomial heaps. Both are data-structures for priority queues. While binomial heaps have logarithmic findMin, deleteMin, insert, and meld operations, skew binomial heaps have constant time findMin, insert, and meld operations, and only the deleteMin-operation is logarithmic. This is achieved by using skew links to avoid cascading linking on insert-operations, and data-structural bootstrapping to get constant-time findMin and meld operations. Our implementation follows the paper by Brodal and Okasaki. notify = peter.lammich@uni-muenster.de [Finger-Trees] title = Finger Trees author = Benedikt Nordhoff , Stefan Körner , Peter Lammich date = 2010-10-28 topic = Computer Science/Data Structures abstract = We implement and prove correct 2-3 finger trees. Finger trees are a general purpose data structure, that can be used to efficiently implement other data structures, such as priority queues. Intuitively, a finger tree is an annotated sequence, where the annotations are elements of a monoid. Apart from operations to access the ends of the sequence, the main operation is to split the sequence at the point where a monotone predicate over the sum of the left part of the sequence becomes true for the first time. The implementation follows the paper of Hinze and Paterson. The code generator can be used to get efficient, verified code. notify = peter.lammich@uni-muenster.de [Trie] title = Trie author = Andreas Lochbihler , Tobias Nipkow date = 2015-03-30 topic = Computer Science/Data Structures abstract = This article formalizes the ``trie'' data structure invented by Fredkin [CACM 1960]. It also provides a specialization where the entries in the trie are lists. extra-0 = Origin: This article was extracted from existing articles by the authors. notify = nipkow@in.tum.de [FinFun] title = Code Generation for Functions as Data author = Andreas Lochbihler date = 2009-05-06 topic = Computer Science/Data Structures abstract = FinFuns are total functions that are constant except for a finite set of points, i.e. a generalisation of finite maps. They are formalised as a new type in Isabelle/HOL such that the code generator can handle equality tests and quantification on FinFuns. On the code output level, FinFuns are explicitly represented by constant functions and pointwise updates, similarly to associative lists. Inside the logic, they behave like ordinary functions with extensionality. Via the update/constant pattern, a recursion combinator and an induction rule for FinFuns allow for defining and reasoning about operators on FinFun that are also executable. extra-history = Change history: [2010-08-13]: new concept domain of a FinFun as a FinFun (revision 34b3517cbc09)
[2010-11-04]: new conversion function from FinFun to list of elements in the domain (revision 0c167102e6ed)
[2012-03-07]: replace sets as FinFuns by predicates as FinFuns because the set type constructor has been reintroduced (revision b7aa87989f3a) notify = nipkow@in.tum.de [Collections] title = Collections Framework author = Peter Lammich contributors = Andreas Lochbihler , Thomas Tuerk <> date = 2009-11-25 topic = Computer Science/Data Structures abstract = This development provides an efficient, extensible, machine checked collections framework. The library adopts the concepts of interface, implementation and generic algorithm from object-oriented programming and implements them in Isabelle/HOL. The framework features the use of data refinement techniques to refine an abstract specification (using high-level concepts like sets) to a more concrete implementation (using collection datastructures, like red-black-trees). The code-generator of Isabelle/HOL can be used to generate efficient code. extra-history = Change history: [2010-10-08]: New Interfaces: OrderedSet, OrderedMap, List. Fifo now implements list-interface: Function names changed: put/get --> enqueue/dequeue. New Implementations: ArrayList, ArrayHashMap, ArrayHashSet, TrieMap, TrieSet. Invariant-free datastructures: Invariant implicitely hidden in typedef. Record-interfaces: All operations of an interface encapsulated as record. Examples moved to examples subdirectory.
[2010-12-01]: New Interfaces: Priority Queues, Annotated Lists. Implemented by finger trees, (skew) binomial queues.
[2011-10-10]: SetSpec: Added operations: sng, isSng, bexists, size_abort, diff, filter, iterate_rule_insertP MapSpec: Added operations: sng, isSng, iterate_rule_insertP, bexists, size, size_abort, restrict, map_image_filter, map_value_image_filter Some maintenance changes
[2012-04-25]: New iterator foundation by Tuerk. Various maintenance changes.
[2012-08]: Collections V2. New features: Polymorphic iterators. Generic algorithm instantiation where required. Naming scheme changed from xx_opname to xx.opname. A compatibility file CollectionsV1 tries to simplify porting of existing theories, by providing old naming scheme and the old monomorphic iterator locales.
[2013-09]: Added Generic Collection Framework based on Autoref. The GenCF provides: Arbitrary nesting, full integration with Autoref.
[2014-06]: Maintenace changes to GenCF: Optimized inj_image on list_set. op_set_cart (Cartesian product). big-Union operation. atLeastLessThan - operation ({a..<b})
notify = lammich@in.tum.de [Containers] title = Light-weight Containers author = Andreas Lochbihler contributors = René Thiemann date = 2013-04-15 topic = Computer Science/Data Structures abstract = This development provides a framework for container types like sets and maps such that generated code implements these containers with different (efficient) data structures. Thanks to type classes and refinement during code generation, this light-weight approach can seamlessly replace Isabelle's default setup for code generation. Heuristics automatically pick one of the available data structures depending on the type of elements to be stored, but users can also choose on their own. The extensible design permits to add more implementations at any time.

To support arbitrary nesting of sets, we define a linear order on sets based on a linear order of the elements and provide efficient implementations. It even allows to compare complements with non-complements. extra-history = Change history: [2013-07-11]: add pretty printing for sets (revision 7f3f52c5f5fa)
[2013-09-20]: provide generators for canonical type class instantiations (revision 159f4401f4a8 by René Thiemann)
[2014-07-08]: add support for going from partial functions to mappings (revision 7a6fc957e8ed)
[2018-03-05]: add two application examples: depth-first search and 2SAT (revision e5e1a1da2411) notify = mail@andreas-lochbihler.de [FileRefinement] title = File Refinement author = Karen Zee , Viktor Kuncak date = 2004-12-09 topic = Computer Science/Data Structures abstract = These theories illustrates the verification of basic file operations (file creation, file read and file write) in the Isabelle theorem prover. We describe a file at two levels of abstraction: an abstract file represented as a resizable array, and a concrete file represented using data blocks. notify = kkz@mit.edu [Datatype_Order_Generator] title = Generating linear orders for datatypes author = René Thiemann date = 2012-08-07 topic = Computer Science/Data Structures abstract = We provide a framework for registering automatic methods to derive class instances of datatypes, as it is possible using Haskell's ``deriving Ord, Show, ...'' feature.

We further implemented such automatic methods to derive (linear) orders or hash-functions which are required in the Isabelle Collection Framework. Moreover, for the tactic of Huffman and Krauss to show that a datatype is countable, we implemented a wrapper so that this tactic becomes accessible in our framework.

Our formalization was performed as part of the IsaFoR/CeTA project. With our new tactic we could completely remove tedious proofs for linear orders of two datatypes.

This development is aimed at datatypes generated by the "old_datatype" command. notify = rene.thiemann@uibk.ac.at [Deriving] title = Deriving class instances for datatypes author = Christian Sternagel , René Thiemann date = 2015-03-11 topic = Computer Science/Data Structures abstract =

We provide a framework for registering automatic methods to derive class instances of datatypes, as it is possible using Haskell's ``deriving Ord, Show, ...'' feature.

We further implemented such automatic methods to derive comparators, linear orders, parametrizable equality functions, and hash-functions which are required in the Isabelle Collection Framework and the Container Framework. Moreover, for the tactic of Blanchette to show that a datatype is countable, we implemented a wrapper so that this tactic becomes accessible in our framework. All of the generators are based on the infrastructure that is provided by the BNF-based datatype package.

Our formalization was performed as part of the IsaFoR/CeTA project. With our new tactics we could remove several tedious proofs for (conditional) linear orders, and conditional equality operators within IsaFoR and the Container Framework.

notify = rene.thiemann@uibk.ac.at [List-Index] title = List Index date = 2010-02-20 author = Tobias Nipkow topic = Computer Science/Data Structures abstract = This theory provides functions for finding the index of an element in a list, by predicate and by value. notify = nipkow@in.tum.de [List-Infinite] title = Infinite Lists date = 2011-02-23 author = David Trachtenherz <> topic = Computer Science/Data Structures abstract = We introduce a theory of infinite lists in HOL formalized as functions over naturals (folder ListInf, theories ListInf and ListInf_Prefix). It also provides additional results for finite lists (theory ListInf/List2), natural numbers (folder CommonArith, esp. division/modulo, naturals with infinity), sets (folder CommonSet, esp. cutting/truncating sets, traversing sets of naturals). notify = nipkow@in.tum.de [Matrix] title = Executable Matrix Operations on Matrices of Arbitrary Dimensions topic = Computer Science/Data Structures date = 2010-06-17 author = Christian Sternagel , René Thiemann license = LGPL abstract = We provide the operations of matrix addition, multiplication, transposition, and matrix comparisons as executable functions over ordered semirings. Moreover, it is proven that strongly normalizing (monotone) orders can be lifted to strongly normalizing (monotone) orders over matrices. We further show that the standard semirings over the naturals, integers, and rationals, as well as the arctic semirings satisfy the axioms that are required by our matrix theory. Our formalization is part of the CeTA system which contains several termination techniques. The provided theories have been essential to formalize matrix-interpretations and arctic interpretations. extra-history = Change history: [2010-09-17]: Moved theory on arbitrary (ordered) semirings to Abstract Rewriting. notify = rene.thiemann@uibk.ac.at, christian.sternagel@uibk.ac.at [Matrix_Tensor] title = Tensor Product of Matrices topic = Computer Science/Data Structures, Mathematics/Algebra date = 2016-01-18 author = T.V.H. Prathamesh abstract = In this work, the Kronecker tensor product of matrices and the proofs of some of its properties are formalized. Properties which have been formalized include associativity of the tensor product and the mixed-product property. notify = prathamesh@imsc.res.in [Huffman] title = The Textbook Proof of Huffman's Algorithm author = Jasmin Christian Blanchette date = 2008-10-15 topic = Computer Science/Data Structures abstract = Huffman's algorithm is a procedure for constructing a binary tree with minimum weighted path length. This report presents a formal proof of the correctness of Huffman's algorithm written using Isabelle/HOL. Our proof closely follows the sketches found in standard algorithms textbooks, uncovering a few snags in the process. Another distinguishing feature of our formalization is the use of custom induction rules to help Isabelle's automatic tactics, leading to very short proofs for most of the lemmas. notify = jasmin.blanchette@gmail.com [Partial_Function_MR] title = Mutually Recursive Partial Functions author = René Thiemann topic = Computer Science/Functional Programming date = 2014-02-18 license = LGPL abstract = We provide a wrapper around the partial-function command that supports mutual recursion. notify = rene.thiemann@uibk.ac.at [Lifting_Definition_Option] title = Lifting Definition Option author = René Thiemann topic = Computer Science/Functional Programming date = 2014-10-13 license = LGPL abstract = We implemented a command that can be used to easily generate elements of a restricted type {x :: 'a. P x}, provided the definition is of the form f ys = (if check ys then Some(generate ys :: 'a) else None) where ys is a list of variables y1 ... yn and check ys ==> P(generate ys) can be proved.

In principle, such a definition is also directly possible using the lift_definition command. However, then this definition will not be suitable for code-generation. To this end, we automated a more complex construction of Joachim Breitner which is amenable for code-generation, and where the test check ys will only be performed once. In the automation, one auxiliary type is created, and Isabelle's lifting- and transfer-package is invoked several times. notify = rene.thiemann@uibk.ac.at [Coinductive] title = Coinductive topic = Computer Science/Functional Programming author = Andreas Lochbihler contributors = Johannes Hölzl date = 2010-02-12 abstract = This article collects formalisations of general-purpose coinductive data types and sets. Currently, it contains coinductive natural numbers, coinductive lists, i.e. lazy lists or streams, infinite streams, coinductive terminated lists, coinductive resumptions, a library of operations on coinductive lists, and a version of König's lemma as an application for coinductive lists.
The initial theory was contributed by Paulson and Wenzel. Extensions and other coinductive formalisations of general interest are welcome. extra-history = Change history: [2010-06-10]: coinductive lists: setup for quotient package (revision 015574f3bf3c)
[2010-06-28]: new codatatype terminated lazy lists (revision e12de475c558)
[2010-08-04]: terminated lazy lists: setup for quotient package; more lemmas (revision 6ead626f1d01)
[2010-08-17]: Koenig's lemma as an example application for coinductive lists (revision f81ce373fa96)
[2011-02-01]: lazy implementation of coinductive (terminated) lists for the code generator (revision 6034973dce83)
[2011-07-20]: new codatatype resumption (revision 811364c776c7)
[2012-06-27]: new codatatype stream with operations (with contributions by Peter Gammie) (revision dd789a56473c)
[2013-03-13]: construct codatatypes with the BNF package and adjust the definitions and proofs, setup for lifting and transfer packages (revision f593eda5b2c0)
[2013-09-20]: stream theory uses type and operations from HOL/BNF/Examples/Stream (revision 692809b2b262)
[2014-04-03]: ccpo structure on codatatypes used to define ldrop, ldropWhile, lfilter, lconcat as least fixpoint; ccpo topology on coinductive lists contributed by Johannes Hölzl; added examples (revision 23cd8156bd42)
notify = mail@andreas-lochbihler.de [Stream-Fusion] title = Stream Fusion author = Brian Huffman topic = Computer Science/Functional Programming date = 2009-04-29 abstract = Stream Fusion is a system for removing intermediate list structures from Haskell programs; it consists of a Haskell library along with several compiler rewrite rules. (The library is available online.)

These theories contain a formalization of much of the Stream Fusion library in HOLCF. Lazy list and stream types are defined, along with coercions between the two types, as well as an equivalence relation for streams that generate the same list. List and stream versions of map, filter, foldr, enumFromTo, append, zipWith, and concatMap are defined, and the stream versions are shown to respect stream equivalence. notify = brianh@cs.pdx.edu [Tycon] title = Type Constructor Classes and Monad Transformers author = Brian Huffman date = 2012-06-26 topic = Computer Science/Functional Programming abstract = These theories contain a formalization of first class type constructors and axiomatic constructor classes for HOLCF. This work is described in detail in the ICFP 2012 paper Formal Verification of Monad Transformers by the author. The formalization is a revised and updated version of earlier joint work with Matthews and White.

Based on the hierarchy of type classes in Haskell, we define classes for functors, monads, monad-plus, etc. Each one includes all the standard laws as axioms. We also provide a new user command, tycondef, for defining new type constructors in HOLCF. Using tycondef, we instantiate the type class hierarchy with various monads and monad transformers. notify = huffman@in.tum.de [CoreC++] title = CoreC++ author = Daniel Wasserrab date = 2006-05-15 topic = Computer Science/Programming Languages/Language Definitions abstract = We present an operational semantics and type safety proof for multiple inheritance in C++. The semantics models the behavior of method calls, field accesses, and two forms of casts in C++ class hierarchies. For explanations see the OOPSLA 2006 paper by Wasserrab, Nipkow, Snelting and Tip. notify = nipkow@in.tum.de [FeatherweightJava] title = A Theory of Featherweight Java in Isabelle/HOL author = J. Nathan Foster , Dimitrios Vytiniotis date = 2006-03-31 topic = Computer Science/Programming Languages/Language Definitions abstract = We formalize the type system, small-step operational semantics, and type soundness proof for Featherweight Java, a simple object calculus, in Isabelle/HOL. notify = kleing@cse.unsw.edu.au [Jinja] title = Jinja is not Java author = Gerwin Klein , Tobias Nipkow date = 2005-06-01 topic = Computer Science/Programming Languages/Language Definitions abstract = We introduce Jinja, a Java-like programming language with a formal semantics designed to exhibit core features of the Java language architecture. Jinja is a compromise between realism of the language and tractability and clarity of the formal semantics. The following aspects are formalised: a big and a small step operational semantics for Jinja and a proof of their equivalence; a type system and a definite initialisation analysis; a type safety proof of the small step semantics; a virtual machine (JVM), its operational semantics and its type system; a type safety proof for the JVM; a bytecode verifier, i.e. data flow analyser for the JVM; a correctness proof of the bytecode verifier w.r.t. the type system; a compiler and a proof that it preserves semantics and well-typedness. The emphasis of this work is not on particular language features but on providing a unified model of the source language, the virtual machine and the compiler. The whole development has been carried out in the theorem prover Isabelle/HOL. notify = kleing@cse.unsw.edu.au, nipkow@in.tum.de [JinjaThreads] title = Jinja with Threads author = Andreas Lochbihler date = 2007-12-03 topic = Computer Science/Programming Languages/Language Definitions abstract = We extend the Jinja source code semantics by Klein and Nipkow with Java-style arrays and threads. Concurrency is captured in a generic framework semantics for adding concurrency through interleaving to a sequential semantics, which features dynamic thread creation, inter-thread communication via shared memory, lock synchronisation and joins. Also, threads can suspend themselves and be notified by others. We instantiate the framework with the adapted versions of both Jinja source and byte code and show type safety for the multithreaded case. Equally, the compiler from source to byte code is extended, for which we prove weak bisimilarity between the source code small step semantics and the defensive Jinja virtual machine. On top of this, we formalise the JMM and show the DRF guarantee and consistency. For description of the different parts, see Lochbihler's papers at FOOL 2008, ESOP 2010, ITP 2011, and ESOP 2012. extra-history = Change history: [2008-04-23]: added bytecode formalisation with arrays and threads, added thread joins (revision f74a8be156a7)
[2009-04-27]: added verified compiler from source code to bytecode; encapsulate native methods in separate semantics (revision e4f26541e58a)
[2009-11-30]: extended compiler correctness proof to infinite and deadlocking computations (revision e50282397435)
[2010-06-08]: added thread interruption; new abstract memory model with sequential consistency as implementation (revision 0cb9e8dbd78d)
[2010-06-28]: new thread interruption model (revision c0440d0a1177)
[2010-10-15]: preliminary version of the Java memory model for source code (revision 02fee0ef3ca2)
[2010-12-16]: improved version of the Java memory model, also for bytecode executable scheduler for source code semantics (revision 1f41c1842f5a)
[2011-02-02]: simplified code generator setup new random scheduler (revision 3059dafd013f)
[2011-07-21]: new interruption model, generalized JMM proof of DRF guarantee, allow class Object to declare methods and fields, simplified subtyping relation, corrected division and modulo implementation (revision 46e4181ed142)
[2012-02-16]: added example programs (revision bf0b06c8913d)
[2012-11-21]: type safety proof for the Java memory model, allow spurious wake-ups (revision 76063d860ae0)
[2013-05-16]: support for non-deterministic memory allocators (revision cc3344a49ced)
[2017-10-20]: add an atomic compare-and-swap operation for volatile fields (revision a6189b1d6b30)
notify = mail@andreas-lochbihler.de [Locally-Nameless-Sigma] title = Locally Nameless Sigma Calculus author = Ludovic Henrio , Florian Kammüller , Bianca Lutz , Henry Sudhof date = 2010-04-30 topic = Computer Science/Programming Languages/Language Definitions abstract = We present a Theory of Objects based on the original functional sigma-calculus by Abadi and Cardelli but with an additional parameter to methods. We prove confluence of the operational semantics following the outline of Nipkow's proof of confluence for the lambda-calculus reusing his theory Commutation, a generic diamond lemma reduction. We furthermore formalize a simple type system for our sigma-calculus including a proof of type safety. The entire development uses the concept of Locally Nameless representation for binders. We reuse an earlier proof of confluence for a simpler sigma-calculus based on de Bruijn indices and lists to represent objects. notify = nipkow@in.tum.de [AutoFocus-Stream] title = AutoFocus Stream Processing for Single-Clocking and Multi-Clocking Semantics author = David Trachtenherz <> date = 2011-02-23 topic = Computer Science/Programming Languages/Language Definitions abstract = We formalize the AutoFocus Semantics (a time-synchronous subset of the Focus formalism) as stream processing functions on finite and infinite message streams represented as finite/infinite lists. The formalization comprises both the conventional single-clocking semantics (uniform global clock for all components and communications channels) and its extension to multi-clocking semantics (internal execution clocking of a component may be a multiple of the external communication clocking). The semantics is defined by generic stream processing functions making it suitable for simulation/code generation in Isabelle/HOL. Furthermore, a number of AutoFocus semantics properties are formalized using definitions from the IntervalLogic theories. notify = nipkow@in.tum.de [FocusStreamsCaseStudies] title = Stream Processing Components: Isabelle/HOL Formalisation and Case Studies author = Maria Spichkova date = 2013-11-14 topic = Computer Science/Programming Languages/Language Definitions abstract = This set of theories presents an Isabelle/HOL formalisation of stream processing components introduced in Focus, a framework for formal specification and development of interactive systems. This is an extended and updated version of the formalisation, which was elaborated within the methodology "Focus on Isabelle". In addition, we also applied the formalisation on three case studies that cover different application areas: process control (Steam Boiler System), data transmission (FlexRay communication protocol), memory and processing components (Automotive-Gateway System). notify = lp15@cam.ac.uk, maria.spichkova@rmit.edu.au [Isabelle_Meta_Model] title = A Meta-Model for the Isabelle API author = Frédéric Tuong , Burkhart Wolff date = 2015-09-16 topic = Computer Science/Programming Languages/Language Definitions abstract = We represent a theory of (a fragment of) Isabelle/HOL in Isabelle/HOL. The purpose of this exercise is to write packages for domain-specific specifications such as class models, B-machines, ..., and generally speaking, any domain-specific languages whose abstract syntax can be defined by a HOL "datatype". On this basis, the Isabelle code-generator can then be used to generate code for global context transformations as well as tactic code.

Consequently the package is geared towards parsing, printing and code-generation to the Isabelle API. It is at the moment not sufficiently rich for doing meta theory on Isabelle itself. Extensions in this direction are possible though.

Moreover, the chosen fragment is fairly rudimentary. However it should be easily adapted to one's needs if a package is written on top of it. The supported API contains types, terms, transformation of global context like definitions and data-type declarations as well as infrastructure for Isar-setups.

This theory is drawn from the Featherweight OCL project where it is used to construct a package for object-oriented data-type theories generated from UML class diagrams. The Featherweight OCL, for example, allows for both the direct execution of compiled tactic code by the Isabelle API as well as the generation of ".thy"-files for debugging purposes.

Gained experience from this project shows that the compiled code is sufficiently efficient for practical purposes while being based on a formal model on which properties of the package can be proven such as termination of certain transformations, correctness, etc. notify = tuong@users.gforge.inria.fr, wolff@lri.fr [Clean] title = Clean - An Abstract Imperative Programming Language and its Theory author = Frédéric Tuong , Burkhart Wolff topic = Computer Science/Programming Languages, Computer Science/Semantics date = 2019-10-04 notify = wolff@lri.fr, ftuong@lri.fr abstract = Clean is based on a simple, abstract execution model for an imperative target language. “Abstract” is understood in contrast to “Concrete Semantics”; alternatively, the term “shallow-style embedding” could be used. It strives for a type-safe notion of program-variables, an incremental construction of the typed state-space, support of incremental verification, and open-world extensibility of new type definitions being intertwined with the program definitions. Clean is based on a “no-frills” state-exception monad with the usual definitions of bind and unit for the compositional glue of state-based computations. Clean offers conditionals and loops supporting C-like control-flow operators such as break and return. The state-space construction is based on the extensible record package. Direct recursion of procedures is supported. Clean’s design strives for extreme simplicity. It is geared towards symbolic execution and proven correct verification tools. The underlying libraries of this package, however, deliberately restrict themselves to the most elementary infrastructure for these tasks. The package is intended to serve as demonstrator semantic backend for Isabelle/C, or for the test-generation techniques. [PCF] title = Logical Relations for PCF author = Peter Gammie date = 2012-07-01 topic = Computer Science/Programming Languages/Lambda Calculi abstract = We apply Andy Pitts's methods of defining relations over domains to several classical results in the literature. We show that the Y combinator coincides with the domain-theoretic fixpoint operator, that parallel-or and the Plotkin existential are not definable in PCF, that the continuation semantics for PCF coincides with the direct semantics, and that our domain-theoretic semantics for PCF is adequate for reasoning about contextual equivalence in an operational semantics. Our version of PCF is untyped and has both strict and non-strict function abstractions. The development is carried out in HOLCF. notify = peteg42@gmail.com [POPLmark-deBruijn] title = POPLmark Challenge Via de Bruijn Indices author = Stefan Berghofer date = 2007-08-02 topic = Computer Science/Programming Languages/Lambda Calculi abstract = We present a solution to the POPLmark challenge designed by Aydemir et al., which has as a goal the formalization of the meta-theory of System F<:. The formalization is carried out in the theorem prover Isabelle/HOL using an encoding based on de Bruijn indices. We start with a relatively simple formalization covering only the basic features of System F<:, and explain how it can be extended to also cover records and more advanced binding constructs. notify = berghofe@in.tum.de [Lam-ml-Normalization] title = Strong Normalization of Moggis's Computational Metalanguage author = Christian Doczkal date = 2010-08-29 topic = Computer Science/Programming Languages/Lambda Calculi abstract = Handling variable binding is one of the main difficulties in formal proofs. In this context, Moggi's computational metalanguage serves as an interesting case study. It features monadic types and a commuting conversion rule that rearranges the binding structure. Lindley and Stark have given an elegant proof of strong normalization for this calculus. The key construction in their proof is a notion of relational TT-lifting, using stacks of elimination contexts to obtain a Girard-Tait style logical relation. I give a formalization of their proof in Isabelle/HOL-Nominal with a particular emphasis on the treatment of bound variables. notify = doczkal@ps.uni-saarland.de, nipkow@in.tum.de [MiniML] title = Mini ML author = Wolfgang Naraschewski <>, Tobias Nipkow date = 2004-03-19 topic = Computer Science/Programming Languages/Type Systems abstract = This theory defines the type inference rules and the type inference algorithm W for MiniML (simply-typed lambda terms with let) due to Milner. It proves the soundness and completeness of W w.r.t. the rules. notify = kleing@cse.unsw.edu.au [Simpl] title = A Sequential Imperative Programming Language Syntax, Semantics, Hoare Logics and Verification Environment author = Norbert Schirmer <> date = 2008-02-29 topic = Computer Science/Programming Languages/Language Definitions, Computer Science/Programming Languages/Logics license = LGPL abstract = We present the theory of Simpl, a sequential imperative programming language. We introduce its syntax, its semantics (big and small-step operational semantics) and Hoare logics for both partial as well as total correctness. We prove soundness and completeness of the Hoare logic. We integrate and automate the Hoare logic in Isabelle/HOL to obtain a practically usable verification environment for imperative programs. Simpl is independent of a concrete programming language but expressive enough to cover all common language features: mutually recursive procedures, abrupt termination and exceptions, runtime faults, local and global variables, pointers and heap, expressions with side effects, pointers to procedures, partial application and closures, dynamic method invocation and also unbounded nondeterminism. notify = kleing@cse.unsw.edu.au, norbert.schirmer@web.de [Separation_Algebra] title = Separation Algebra author = Gerwin Klein , Rafal Kolanski , Andrew Boyton date = 2012-05-11 topic = Computer Science/Programming Languages/Logics license = BSD abstract = We present a generic type class implementation of separation algebra for Isabelle/HOL as well as lemmas and generic tactics which can be used directly for any instantiation of the type class.

The ex directory contains example instantiations that include structures such as a heap or virtual memory.

The abstract separation algebra is based upon "Abstract Separation Logic" by Calcagno et al. These theories are also the basis of the ITP 2012 rough diamond "Mechanised Separation Algebra" by the authors.

The aim of this work is to support and significantly reduce the effort for future separation logic developments in Isabelle/HOL by factoring out the part of separation logic that can be treated abstractly once and for all. This includes developing typical default rule sets for reasoning as well as automated tactic support for separation logic. notify = kleing@cse.unsw.edu.au, rafal.kolanski@nicta.com.au [Separation_Logic_Imperative_HOL] title = A Separation Logic Framework for Imperative HOL author = Peter Lammich , Rene Meis date = 2012-11-14 topic = Computer Science/Programming Languages/Logics license = BSD abstract = We provide a framework for separation-logic based correctness proofs of Imperative HOL programs. Our framework comes with a set of proof methods to automate canonical tasks such as verification condition generation and frame inference. Moreover, we provide a set of examples that show the applicability of our framework. The examples include algorithms on lists, hash-tables, and union-find trees. We also provide abstract interfaces for lists, maps, and sets, that allow to develop generic imperative algorithms and use data-refinement techniques.
As we target Imperative HOL, our programs can be translated to efficiently executable code in various target languages, including ML, OCaml, Haskell, and Scala. notify = lammich@in.tum.de [Inductive_Confidentiality] title = Inductive Study of Confidentiality author = Giampaolo Bella date = 2012-05-02 topic = Computer Science/Security abstract = This document contains the full theory files accompanying article Inductive Study of Confidentiality --- for Everyone in Formal Aspects of Computing. They aim at an illustrative and didactic presentation of the Inductive Method of protocol analysis, focusing on the treatment of one of the main goals of security protocols: confidentiality against a threat model. The treatment of confidentiality, which in fact forms a key aspect of all protocol analysis tools, has been found cryptic by many learners of the Inductive Method, hence the motivation for this work. The theory files in this document guide the reader step by step towards design and proof of significant confidentiality theorems. These are developed against two threat models, the standard Dolev-Yao and a more audacious one, the General Attacker, which turns out to be particularly useful also for teaching purposes. notify = giamp@dmi.unict.it [Possibilistic_Noninterference] title = Possibilistic Noninterference author = Andrei Popescu , Johannes Hölzl date = 2012-09-10 topic = Computer Science/Security, Computer Science/Programming Languages/Type Systems abstract = We formalize a wide variety of Volpano/Smith-style noninterference notions for a while language with parallel composition. We systematize and classify these notions according to compositionality w.r.t. the language constructs. Compositionality yields sound syntactic criteria (a.k.a. type systems) in a uniform way.

An article about these proofs is published in the proceedings of the conference Certified Programs and Proofs 2012. notify = hoelzl@in.tum.de [SIFUM_Type_Systems] title = A Formalization of Assumptions and Guarantees for Compositional Noninterference author = Sylvia Grewe , Heiko Mantel , Daniel Schoepe date = 2014-04-23 topic = Computer Science/Security, Computer Science/Programming Languages/Type Systems abstract = Research in information-flow security aims at developing methods to identify undesired information leaks within programs from private (high) sources to public (low) sinks. For a concurrent system, it is desirable to have compositional analysis methods that allow for analyzing each thread independently and that nevertheless guarantee that the parallel composition of successfully analyzed threads satisfies a global security guarantee. However, such a compositional analysis should not be overly pessimistic about what an environment might do with shared resources. Otherwise, the analysis will reject many intuitively secure programs.

The paper "Assumptions and Guarantees for Compositional Noninterference" by Mantel et. al. presents one solution for this problem: an approach for compositionally reasoning about non-interference in concurrent programs via rely-guarantee-style reasoning. We present an Isabelle/HOL formalization of the concepts and proofs of this approach. notify = grewe@cs.tu-darmstadt.de [Dependent_SIFUM_Type_Systems] title = A Dependent Security Type System for Concurrent Imperative Programs author = Toby Murray , Robert Sison<>, Edward Pierzchalski<>, Christine Rizkallah notify = toby.murray@unimelb.edu.au date = 2016-06-25 topic = Computer Science/Security, Computer Science/Programming Languages/Type Systems abstract = The paper "Compositional Verification and Refinement of Concurrent Value-Dependent Noninterference" by Murray et. al. (CSF 2016) presents a dependent security type system for compositionally verifying a value-dependent noninterference property, defined in (Murray, PLAS 2015), for concurrent programs. This development formalises that security definition, the type system and its soundness proof, and demonstrates its application on some small examples. It was derived from the SIFUM_Type_Systems AFP entry, by Sylvia Grewe, Heiko Mantel and Daniel Schoepe, and whose structure it inherits. extra-history = Change history: [2016-08-19]: Removed unused "stop" parameter and "stop_no_eval" assumption from the sifum_security locale. (revision dbc482d36372) [2016-09-27]: Added security locale support for the imposition of requirements on the initial memory. (revision cce4ceb74ddb) [Dependent_SIFUM_Refinement] title = Compositional Security-Preserving Refinement for Concurrent Imperative Programs author = Toby Murray , Robert Sison<>, Edward Pierzchalski<>, Christine Rizkallah notify = toby.murray@unimelb.edu.au date = 2016-06-28 topic = Computer Science/Security abstract = The paper "Compositional Verification and Refinement of Concurrent Value-Dependent Noninterference" by Murray et. al. (CSF 2016) presents a compositional theory of refinement for a value-dependent noninterference property, defined in (Murray, PLAS 2015), for concurrent programs. This development formalises that refinement theory, and demonstrates its application on some small examples. extra-history = Change history: [2016-08-19]: Removed unused "stop" parameters from the sifum_refinement locale. (revision dbc482d36372) [2016-09-02]: TobyM extended "simple" refinement theory to be usable for all bisimulations. (revision 547f31c25f60) [Strong_Security] title = A Formalization of Strong Security author = Sylvia Grewe , Alexander Lux , Heiko Mantel , Jens Sauer date = 2014-04-23 topic = Computer Science/Security, Computer Science/Programming Languages/Type Systems abstract = Research in information-flow security aims at developing methods to identify undesired information leaks within programs from private sources to public sinks. Noninterference captures this intuition. Strong security from Sabelfeld and Sands formalizes noninterference for concurrent systems.

We present an Isabelle/HOL formalization of strong security for arbitrary security lattices (Sabelfeld and Sands use a two-element security lattice in the original publication). The formalization includes compositionality proofs for strong security and a soundness proof for a security type system that checks strong security for programs in a simple while language with dynamic thread creation.

Our formalization of the security type system is abstract in the language for expressions and in the semantic side conditions for expressions. It can easily be instantiated with different syntactic approximations for these side conditions. The soundness proof of such an instantiation boils down to showing that these syntactic approximations imply the semantic side conditions. notify = grewe@cs.tu-darmstadt.de [WHATandWHERE_Security] title = A Formalization of Declassification with WHAT-and-WHERE-Security author = Sylvia Grewe , Alexander Lux , Heiko Mantel , Jens Sauer date = 2014-04-23 topic = Computer Science/Security, Computer Science/Programming Languages/Type Systems abstract = Research in information-flow security aims at developing methods to identify undesired information leaks within programs from private sources to public sinks. Noninterference captures this intuition by requiring that no information whatsoever flows from private sources to public sinks. However, in practice this definition is often too strict: Depending on the intuitive desired security policy, the controlled declassification of certain private information (WHAT) at certain points in the program (WHERE) might not result in an undesired information leak.

We present an Isabelle/HOL formalization of such a security property for controlled declassification, namely WHAT&WHERE-security from "Scheduler-Independent Declassification" by Lux, Mantel, and Perner. The formalization includes compositionality proofs for and a soundness proof for a security type system that checks for programs in a simple while language with dynamic thread creation.

Our formalization of the security type system is abstract in the language for expressions and in the semantic side conditions for expressions. It can easily be instantiated with different syntactic approximations for these side conditions. The soundness proof of such an instantiation boils down to showing that these syntactic approximations imply the semantic side conditions.

This Isabelle/HOL formalization uses theories from the entry Strong Security. notify = grewe@cs.tu-darmstadt.de [VolpanoSmith] title = A Correctness Proof for the Volpano/Smith Security Typing System author = Gregor Snelting , Daniel Wasserrab date = 2008-09-02 topic = Computer Science/Programming Languages/Type Systems, Computer Science/Security abstract = The Volpano/Smith/Irvine security type systems requires that variables are annotated as high (secret) or low (public), and provides typing rules which guarantee that secret values cannot leak to public output ports. This property of a program is called confidentiality. For a simple while-language without threads, our proof shows that typeability in the Volpano/Smith system guarantees noninterference. Noninterference means that if two initial states for program execution are low-equivalent, then the final states are low-equivalent as well. This indeed implies that secret values cannot leak to public ports. The proof defines an abstract syntax and operational semantics for programs, formalizes noninterference, and then proceeds by rule induction on the operational semantics. The mathematically most intricate part is the treatment of implicit flows. Note that the Volpano/Smith system is not flow-sensitive and thus quite unprecise, resulting in false alarms. However, due to the correctness property, all potential breaks of confidentiality are discovered. notify = [Abstract-Hoare-Logics] title = Abstract Hoare Logics author = Tobias Nipkow date = 2006-08-08 topic = Computer Science/Programming Languages/Logics abstract = These therories describe Hoare logics for a number of imperative language constructs, from while-loops to mutually recursive procedures. Both partial and total correctness are treated. In particular a proof system for total correctness of recursive procedures in the presence of unbounded nondeterminism is presented. notify = nipkow@in.tum.de [Stone_Algebras] title = Stone Algebras author = Walter Guttmann notify = walter.guttmann@canterbury.ac.nz date = 2016-09-06 topic = Mathematics/Order abstract = A range of algebras between lattices and Boolean algebras generalise the notion of a complement. We develop a hierarchy of these pseudo-complemented algebras that includes Stone algebras. Independently of this theory we study filters based on partial orders. Both theories are combined to prove Chen and Grätzer's construction theorem for Stone algebras. The latter involves extensive reasoning about algebraic structures in addition to reasoning in algebraic structures. [Kleene_Algebra] title = Kleene Algebra author = Alasdair Armstrong <>, Georg Struth , Tjark Weber date = 2013-01-15 topic = Computer Science/Programming Languages/Logics, Computer Science/Automata and Formal Languages, Mathematics/Algebra abstract = These files contain a formalisation of variants of Kleene algebras and their most important models as axiomatic type classes in Isabelle/HOL. Kleene algebras are foundational structures in computing with applications ranging from automata and language theory to computational modeling, program construction and verification.

We start with formalising dioids, which are additively idempotent semirings, and expand them by axiomatisations of the Kleene star for finite iteration and an omega operation for infinite iteration. We show that powersets over a given monoid, (regular) languages, sets of paths in a graph, sets of computation traces, binary relations and formal power series form Kleene algebras, and consider further models based on lattices, max-plus semirings and min-plus semirings. We also demonstrate that dioids are closed under the formation of matrices (proofs for Kleene algebras remain to be completed).

On the one hand we have aimed at a reference formalisation of variants of Kleene algebras that covers a wide range of variants and the core theorems in a structured and modular way and provides readable proofs at text book level. On the other hand, we intend to use this algebraic hierarchy and its models as a generic algebraic middle-layer from which programming applications can quickly be explored, implemented and verified. notify = g.struth@sheffield.ac.uk, tjark.weber@it.uu.se [KAT_and_DRA] title = Kleene Algebra with Tests and Demonic Refinement Algebras author = Alasdair Armstrong <>, Victor B. F. Gomes , Georg Struth date = 2014-01-23 topic = Computer Science/Programming Languages/Logics, Computer Science/Automata and Formal Languages, Mathematics/Algebra abstract = We formalise Kleene algebra with tests (KAT) and demonic refinement algebra (DRA) in Isabelle/HOL. KAT is relevant for program verification and correctness proofs in the partial correctness setting. While DRA targets similar applications in the context of total correctness. Our formalisation contains the two most important models of these algebras: binary relations in the case of KAT and predicate transformers in the case of DRA. In addition, we derive the inference rules for Hoare logic in KAT and its relational model and present a simple formally verified program verification tool prototype based on the algebraic approach. notify = g.struth@dcs.shef.ac.uk [KAD] title = Kleene Algebras with Domain author = Victor B. F. Gomes , Walter Guttmann , Peter Höfner , Georg Struth , Tjark Weber date = 2016-04-12 topic = Computer Science/Programming Languages/Logics, Computer Science/Automata and Formal Languages, Mathematics/Algebra abstract = Kleene algebras with domain are Kleene algebras endowed with an operation that maps each element of the algebra to its domain of definition (or its complement) in abstract fashion. They form a simple algebraic basis for Hoare logics, dynamic logics or predicate transformer semantics. We formalise a modular hierarchy of algebras with domain and antidomain (domain complement) operations in Isabelle/HOL that ranges from domain and antidomain semigroups to modal Kleene algebras and divergence Kleene algebras. We link these algebras with models of binary relations and program traces. We include some examples from modal logics, termination and program analysis. notify = walter.guttman@canterbury.ac.nz, g.struth@sheffield.ac.uk, tjark.weber@it.uu.se [Regular_Algebras] title = Regular Algebras author = Simon Foster , Georg Struth date = 2014-05-21 topic = Computer Science/Automata and Formal Languages, Mathematics/Algebra abstract = Regular algebras axiomatise the equational theory of regular expressions as induced by regular language identity. We use Isabelle/HOL for a detailed systematic study of regular algebras given by Boffa, Conway, Kozen and Salomaa. We investigate the relationships between these classes, formalise a soundness proof for the smallest class (Salomaa's) and obtain completeness of the largest one (Boffa's) relative to a deep result by Krob. In addition we provide a large collection of regular identities in the general setting of Boffa's axiom. Our regular algebra hierarchy is orthogonal to the Kleene algebra hierarchy in the Archive of Formal Proofs; we have not aimed at an integration for pragmatic reasons. notify = simon.foster@york.ac.uk, g.struth@sheffield.ac.uk [BytecodeLogicJmlTypes] title = A Bytecode Logic for JML and Types author = Lennart Beringer <>, Martin Hofmann date = 2008-12-12 topic = Computer Science/Programming Languages/Logics abstract = This document contains the Isabelle/HOL sources underlying the paper A bytecode logic for JML and types by Beringer and Hofmann, updated to Isabelle 2008. We present a program logic for a subset of sequential Java bytecode that is suitable for representing both, features found in high-level specification language JML as well as interpretations of high-level type systems. To this end, we introduce a fine-grained collection of assertions, including strong invariants, local annotations and VDM-reminiscent partial-correctness specifications. Thanks to a goal-oriented structure and interpretation of judgements, verification may proceed without recourse to an additional control flow analysis. The suitability for interpreting intensional type systems is illustrated by the proof-carrying-code style encoding of a type system for a first-order functional language which guarantees a constant upper bound on the number of objects allocated throughout an execution, be the execution terminating or non-terminating. Like the published paper, the formal development is restricted to a comparatively small subset of the JVML, lacking (among other features) exceptions, arrays, virtual methods, and static fields. This shortcoming has been overcome meanwhile, as our paper has formed the basis of the Mobius base logic, a program logic for the full sequential fragment of the JVML. Indeed, the present formalisation formed the basis of a subsequent formalisation of the Mobius base logic in the proof assistant Coq, which includes a proof of soundness with respect to the Bicolano operational semantics by Pichardie. notify = [DataRefinementIBP] title = Semantics and Data Refinement of Invariant Based Programs author = Viorel Preoteasa , Ralph-Johan Back date = 2010-05-28 topic = Computer Science/Programming Languages/Logics abstract = The invariant based programming is a technique of constructing correct programs by first identifying the basic situations (pre- and post-conditions and invariants) that can occur during the execution of the program, and then defining the transitions and proving that they preserve the invariants. Data refinement is a technique of building correct programs working on concrete datatypes as refinements of more abstract programs. In the theories presented here we formalize the predicate transformer semantics for invariant based programs and their data refinement. extra-history = Change history: [2012-01-05]: Moved some general complete lattice properties to the AFP entry Lattice Properties. Changed the definition of the data refinement relation to be more general and updated all corresponding theorems. Added new syntax for demonic and angelic update statements. notify = viorel.preoteasa@aalto.fi [RefinementReactive] title = Formalization of Refinement Calculus for Reactive Systems author = Viorel Preoteasa date = 2014-10-08 topic = Computer Science/Programming Languages/Logics abstract = We present a formalization of refinement calculus for reactive systems. Refinement calculus is based on monotonic predicate transformers (monotonic functions from sets of post-states to sets of pre-states), and it is a powerful formalism for reasoning about imperative programs. We model reactive systems as monotonic property transformers that transform sets of output infinite sequences into sets of input infinite sequences. Within this semantics we can model refinement of reactive systems, (unbounded) angelic and demonic nondeterminism, sequential composition, and other semantic properties. We can model systems that may fail for some inputs, and we can model compatibility of systems. We can specify systems that have liveness properties using linear temporal logic, and we can refine system specifications into systems based on symbolic transitions systems, suitable for implementations. notify = viorel.preoteasa@aalto.fi [SIFPL] title = Secure information flow and program logics author = Lennart Beringer <>, Martin Hofmann date = 2008-11-10 topic = Computer Science/Programming Languages/Logics, Computer Science/Security abstract = We present interpretations of type systems for secure information flow in Hoare logic, complementing previous encodings in relational program logics. We first treat the imperative language IMP, extended by a simple procedure call mechanism. For this language we consider base-line non-interference in the style of Volpano et al. and the flow-sensitive type system by Hunt and Sands. In both cases, we show how typing derivations may be used to automatically generate proofs in the program logic that certify the absence of illicit flows. We then add instructions for object creation and manipulation, and derive appropriate proof rules for base-line non-interference. As a consequence of our work, standard verification technology may be used for verifying that a concrete program satisfies the non-interference property.

The present proof development represents an update of the formalisation underlying our paper [CSF 2007] and is intended to resolve any ambiguities that may be present in the paper. notify = lennart.beringer@ifi.lmu.de [TLA] title = A Definitional Encoding of TLA* in Isabelle/HOL author = Gudmund Grov , Stephan Merz date = 2011-11-19 topic = Computer Science/Programming Languages/Logics abstract = We mechanise the logic TLA* [Merz 1999], an extension of Lamport's Temporal Logic of Actions (TLA) [Lamport 1994] for specifying and reasoning about concurrent and reactive systems. Aiming at a framework for mechanising] the verification of TLA (or TLA*) specifications, this contribution reuses some elements from a previous axiomatic encoding of TLA in Isabelle/HOL by the second author [Merz 1998], which has been part of the Isabelle distribution. In contrast to that previous work, we give here a shallow, definitional embedding, with the following highlights:

  • a theory of infinite sequences, including a formalisation of the concepts of stuttering invariance central to TLA and TLA*;
  • a definition of the semantics of TLA*, which extends TLA by a mutually-recursive definition of formulas and pre-formulas, generalising TLA action formulas;
  • a substantial set of derived proof rules, including the TLA* axioms and Lamport's proof rules for system verification;
  • a set of examples illustrating the usage of Isabelle/TLA* for reasoning about systems.
Note that this work is unrelated to the ongoing development of a proof system for the specification language TLA+, which includes an encoding of TLA+ as a new Isabelle object logic [Chaudhuri et al 2010]. notify = ggrov@inf.ed.ac.uk [Compiling-Exceptions-Correctly] title = Compiling Exceptions Correctly author = Tobias Nipkow date = 2004-07-09 topic = Computer Science/Programming Languages/Compiling abstract = An exception compilation scheme that dynamically creates and removes exception handler entries on the stack. A formalization of an article of the same name by Hutton and Wright. notify = nipkow@in.tum.de [NormByEval] title = Normalization by Evaluation author = Klaus Aehlig , Tobias Nipkow date = 2008-02-18 topic = Computer Science/Programming Languages/Compiling abstract = This article formalizes normalization by evaluation as implemented in Isabelle. Lambda calculus plus term rewriting is compiled into a functional program with pattern matching. It is proved that the result of a successful evaluation is a) correct, i.e. equivalent to the input, and b) in normal form. notify = nipkow@in.tum.de [Program-Conflict-Analysis] title = Formalization of Conflict Analysis of Programs with Procedures, Thread Creation, and Monitors topic = Computer Science/Programming Languages/Static Analysis author = Peter Lammich , Markus Müller-Olm date = 2007-12-14 abstract = In this work we formally verify the soundness and precision of a static program analysis that detects conflicts (e. g. data races) in programs with procedures, thread creation and monitors with the Isabelle theorem prover. As common in static program analysis, our program model abstracts guarded branching by nondeterministic branching, but completely interprets the call-/return behavior of procedures, synchronization by monitors, and thread creation. The analysis is based on the observation that all conflicts already occur in a class of particularly restricted schedules. These restricted schedules are suited to constraint-system-based program analysis. The formalization is based upon a flowgraph-based program model with an operational semantics as reference point. notify = peter.lammich@uni-muenster.de [Shivers-CFA] title = Shivers' Control Flow Analysis topic = Computer Science/Programming Languages/Static Analysis author = Joachim Breitner date = 2010-11-16 abstract = In his dissertation, Olin Shivers introduces a concept of control flow graphs for functional languages, provides an algorithm to statically derive a safe approximation of the control flow graph and proves this algorithm correct. In this research project, Shivers' algorithms and proofs are formalized in the HOLCF extension of HOL. notify = mail@joachim-breitner.de, nipkow@in.tum.de [Slicing] title = Towards Certified Slicing author = Daniel Wasserrab date = 2008-09-16 topic = Computer Science/Programming Languages/Static Analysis abstract = Slicing is a widely-used technique with applications in e.g. compiler technology and software security. Thus verification of algorithms in these areas is often based on the correctness of slicing, which should ideally be proven independent of concrete programming languages and with the help of well-known verifying techniques such as proof assistants. As a first step in this direction, this contribution presents a framework for dynamic and static intraprocedural slicing based on control flow and program dependence graphs. Abstracting from concrete syntax we base the framework on a graph representation of the program fulfilling certain structural and well-formedness properties.

The formalization consists of the basic framework (in subdirectory Basic/), the correctness proof for dynamic slicing (in subdirectory Dynamic/), the correctness proof for static intraprocedural slicing (in subdirectory StaticIntra/) and instantiations of the framework with a simple While language (in subdirectory While/) and the sophisticated object-oriented bytecode language of Jinja (in subdirectory JinjaVM/). For more information on the framework, see the TPHOLS 2008 paper by Wasserrab and Lochbihler and the PLAS 2009 paper by Wasserrab et al. notify = [HRB-Slicing] title = Backing up Slicing: Verifying the Interprocedural Two-Phase Horwitz-Reps-Binkley Slicer author = Daniel Wasserrab date = 2009-11-13 topic = Computer Science/Programming Languages/Static Analysis abstract = After verifying dynamic and static interprocedural slicing, we present a modular framework for static interprocedural slicing. To this end, we formalized the standard two-phase slicer from Horwitz, Reps and Binkley (see their TOPLAS 12(1) 1990 paper) together with summary edges as presented by Reps et al. (see FSE 1994). The framework is again modular in the programming language by using an abstract CFG, defined via structural and well-formedness properties. Using a weak simulation between the original and sliced graph, we were able to prove the correctness of static interprocedural slicing. We also instantiate our framework with a simple While language with procedures. This shows that the chosen abstractions are indeed valid. notify = nipkow@in.tum.de [WorkerWrapper] title = The Worker/Wrapper Transformation author = Peter Gammie date = 2009-10-30 topic = Computer Science/Programming Languages/Transformations abstract = Gill and Hutton formalise the worker/wrapper transformation, building on the work of Launchbury and Peyton-Jones who developed it as a way of changing the type at which a recursive function operates. This development establishes the soundness of the technique and several examples of its use. notify = peteg42@gmail.com, nipkow@in.tum.de [JiveDataStoreModel] title = Jive Data and Store Model author = Nicole Rauch , Norbert Schirmer <> date = 2005-06-20 license = LGPL topic = Computer Science/Programming Languages/Misc abstract = This document presents the formalization of an object-oriented data and store model in Isabelle/HOL. This model is being used in the Java Interactive Verification Environment, Jive. notify = kleing@cse.unsw.edu.au, schirmer@in.tum.de [HotelKeyCards] title = Hotel Key Card System author = Tobias Nipkow date = 2006-09-09 topic = Computer Science/Security abstract = Two models of an electronic hotel key card system are contrasted: a state based and a trace based one. Both are defined, verified, and proved equivalent in the theorem prover Isabelle/HOL. It is shown that if a guest follows a certain safety policy regarding her key cards, she can be sure that nobody but her can enter her room. notify = nipkow@in.tum.de [RSAPSS] title = SHA1, RSA, PSS and more author = Christina Lindenberg <>, Kai Wirt <> date = 2005-05-02 topic = Computer Science/Security/Cryptography abstract = Formal verification is getting more and more important in computer science. However the state of the art formal verification methods in cryptography are very rudimentary. These theories are one step to provide a tool box allowing the use of formal methods in every aspect of cryptography. Moreover we present a proof of concept for the feasibility of verification techniques to a standard signature algorithm. notify = nipkow@in.tum.de [InformationFlowSlicing] title = Information Flow Noninterference via Slicing author = Daniel Wasserrab date = 2010-03-23 topic = Computer Science/Security abstract =

In this contribution, we show how correctness proofs for intra- and interprocedural slicing can be used to prove that slicing is able to guarantee information flow noninterference. Moreover, we also illustrate how to lift the control flow graphs of the respective frameworks such that they fulfil the additional assumptions needed in the noninterference proofs. A detailed description of the intraprocedural proof and its interplay with the slicing framework can be found in the PLAS'09 paper by Wasserrab et al.

This entry contains the part for intra-procedural slicing. See entry InformationFlowSlicing_Inter for the inter-procedural part.

extra-history = Change history: [2016-06-10]: The original entry InformationFlowSlicing contained both the inter- and intra-procedural case was split into two for easier maintenance. notify = [InformationFlowSlicing_Inter] title = Inter-Procedural Information Flow Noninterference via Slicing author = Daniel Wasserrab date = 2010-03-23 topic = Computer Science/Security abstract =

In this contribution, we show how correctness proofs for intra- and interprocedural slicing can be used to prove that slicing is able to guarantee information flow noninterference. Moreover, we also illustrate how to lift the control flow graphs of the respective frameworks such that they fulfil the additional assumptions needed in the noninterference proofs. A detailed description of the intraprocedural proof and its interplay with the slicing framework can be found in the PLAS'09 paper by Wasserrab et al.

This entry contains the part for inter-procedural slicing. See entry InformationFlowSlicing for the intra-procedural part.

extra-history = Change history: [2016-06-10]: The original entry InformationFlowSlicing contained both the inter- and intra-procedural case was split into two for easier maintenance. notify = [ComponentDependencies] title = Formalisation and Analysis of Component Dependencies author = Maria Spichkova date = 2014-04-28 topic = Computer Science/System Description Languages abstract = This set of theories presents a formalisation in Isabelle/HOL of data dependencies between components. The approach allows to analyse system structure oriented towards efficient checking of system: it aims at elaborating for a concrete system, which parts of the system are necessary to check a given property. notify = maria.spichkova@rmit.edu.au [Verified-Prover] title = A Mechanically Verified, Efficient, Sound and Complete Theorem Prover For First Order Logic author = Tom Ridge <> date = 2004-09-28 topic = Logic abstract = Soundness and completeness for a system of first order logic are formally proved, building on James Margetson's formalization of work by Wainer and Wallen. The completeness proofs naturally suggest an algorithm to derive proofs. This algorithm, which can be implemented tail recursively, is formalized in Isabelle/HOL. The algorithm can be executed via the rewriting tactics of Isabelle. Alternatively, the definitions can be exported to OCaml, yielding a directly executable program. notify = lp15@cam.ac.uk [Completeness] title = Completeness theorem author = James Margetson <>, Tom Ridge <> date = 2004-09-20 topic = Logic abstract = The completeness of first-order logic is proved, following the first five pages of Wainer and Wallen's chapter of the book Proof Theory by Aczel et al., CUP, 1992. Their presentation of formulas allows the proofs to use symmetry arguments. Margetson formalized this theorem by early 2000. The Isar conversion is thanks to Tom Ridge. A paper describing the formalization is available [pdf]. notify = lp15@cam.ac.uk [Ordinal] title = Countable Ordinals author = Brian Huffman date = 2005-11-11 topic = Logic abstract = This development defines a well-ordered type of countable ordinals. It includes notions of continuous and normal functions, recursively defined functions over ordinals, least fixed-points, and derivatives. Much of ordinal arithmetic is formalized, including exponentials and logarithms. The development concludes with formalizations of Cantor Normal Form and Veblen hierarchies over normal functions. notify = lcp@cl.cam.ac.uk [Ordinals_and_Cardinals] title = Ordinals and Cardinals author = Andrei Popescu <> date = 2009-09-01 topic = Logic abstract = We develop a basic theory of ordinals and cardinals in Isabelle/HOL, up to the point where some cardinality facts relevant for the ``working mathematician" become available. Unlike in set theory, here we do not have at hand canonical notions of ordinal and cardinal. Therefore, here an ordinal is merely a well-order relation and a cardinal is an ordinal minim w.r.t. order embedding on its field. extra-history = Change history: [2012-09-25]: This entry has been discontinued because it is now part of the Isabelle distribution. notify = uuomul@yahoo.com, nipkow@in.tum.de [FOL-Fitting] title = First-Order Logic According to Fitting author = Stefan Berghofer contributors = Asta Halkjær From date = 2007-08-02 topic = Logic abstract = We present a formalization of parts of Melvin Fitting's book "First-Order Logic and Automated Theorem Proving". The formalization covers the syntax of first-order logic, its semantics, the model existence theorem, a natural deduction proof calculus together with a proof of correctness and completeness, as well as the Löwenheim-Skolem theorem. extra-history = Change history: [2018-07-21]: Proved completeness theorem for open formulas. Proofs are now written in the declarative style. Enumeration of pairs and datatypes is automated using the Countable theory. notify = berghofe@in.tum.de [Epistemic_Logic] title = Epistemic Logic author = Asta Halkjær From topic = Logic date = 2018-10-29 notify = s144442@student.dtu.dk abstract = This work is a formalization of epistemic logic with countably many agents. It includes proofs of soundness and completeness for the axiom system K. The completeness proof is based on the textbook "Reasoning About Knowledge" by Fagin, Halpern, Moses and Vardi (MIT Press 1995). [SequentInvertibility] title = Invertibility in Sequent Calculi author = Peter Chapman <> date = 2009-08-28 topic = Logic license = LGPL abstract = The invertibility of the rules of a sequent calculus is important for guiding proof search and can be used in some formalised proofs of Cut admissibility. We present sufficient conditions for when a rule is invertible with respect to a calculus. We illustrate the conditions with examples. It must be noted we give purely syntactic criteria; no guarantees are given as to the suitability of the rules. notify = pc@cs.st-andrews.ac.uk, nipkow@in.tum.de [LinearQuantifierElim] title = Quantifier Elimination for Linear Arithmetic author = Tobias Nipkow date = 2008-01-11 topic = Logic abstract = This article formalizes quantifier elimination procedures for dense linear orders, linear real arithmetic and Presburger arithmetic. In each case both a DNF-based non-elementary algorithm and one or more (doubly) exponential NNF-based algorithms are formalized, including the well-known algorithms by Ferrante and Rackoff and by Cooper. The NNF-based algorithms for dense linear orders are new but based on Ferrante and Rackoff and on an algorithm by Loos and Weisspfenning which simulates infenitesimals. All algorithms are directly executable. In particular, they yield reflective quantifier elimination procedures for HOL itself. The formalization makes heavy use of locales and is therefore highly modular. notify = nipkow@in.tum.de [Nat-Interval-Logic] title = Interval Temporal Logic on Natural Numbers author = David Trachtenherz <> date = 2011-02-23 topic = Logic abstract = We introduce a theory of temporal logic operators using sets of natural numbers as time domain, formalized in a shallow embedding manner. The theory comprises special natural intervals (theory IL_Interval: open and closed intervals, continuous and modulo intervals, interval traversing results), operators for shifting intervals to left/right on the number axis as well as expanding/contracting intervals by constant factors (theory IL_IntervalOperators.thy), and ultimately definitions and results for unary and binary temporal operators on arbitrary natural sets (theory IL_TemporalOperators). notify = nipkow@in.tum.de [Recursion-Theory-I] title = Recursion Theory I author = Michael Nedzelsky <> date = 2008-04-05 topic = Logic abstract = This document presents the formalization of introductory material from recursion theory --- definitions and basic properties of primitive recursive functions, Cantor pairing function and computably enumerable sets (including a proof of existence of a one-complete computably enumerable set and a proof of the Rice's theorem). notify = MichaelNedzelsky@yandex.ru [Free-Boolean-Algebra] topic = Logic title = Free Boolean Algebra author = Brian Huffman date = 2010-03-29 abstract = This theory defines a type constructor representing the free Boolean algebra over a set of generators. Values of type (α)formula represent propositional formulas with uninterpreted variables from type α, ordered by implication. In addition to all the standard Boolean algebra operations, the library also provides a function for building homomorphisms to any other Boolean algebra type. notify = brianh@cs.pdx.edu [Sort_Encodings] title = Sound and Complete Sort Encodings for First-Order Logic author = Jasmin Christian Blanchette , Andrei Popescu date = 2013-06-27 topic = Logic abstract = This is a formalization of the soundness and completeness properties for various efficient encodings of sorts in unsorted first-order logic used by Isabelle's Sledgehammer tool.

Essentially, the encodings proceed as follows: a many-sorted problem is decorated with (as few as possible) tags or guards that make the problem monotonic; then sorts can be soundly erased.

The development employs a formalization of many-sorted first-order logic in clausal form (clauses, structures and the basic properties of the satisfaction relation), which could be of interest as the starting point for other formalizations of first-order logic metatheory. notify = uuomul@yahoo.com [Lambda_Free_RPOs] title = Formalization of Recursive Path Orders for Lambda-Free Higher-Order Terms author = Jasmin Christian Blanchette , Uwe Waldmann , Daniel Wand date = 2016-09-23 topic = Logic/Rewriting abstract = This Isabelle/HOL formalization defines recursive path orders (RPOs) for higher-order terms without lambda-abstraction and proves many useful properties about them. The main order fully coincides with the standard RPO on first-order terms also in the presence of currying, distinguishing it from previous work. An optimized variant is formalized as well. It appears promising as the basis of a higher-order superposition calculus. notify = jasmin.blanchette@gmail.com [Lambda_Free_KBOs] title = Formalization of Knuth–Bendix Orders for Lambda-Free Higher-Order Terms author = Heiko Becker , Jasmin Christian Blanchette , Uwe Waldmann , Daniel Wand date = 2016-11-12 topic = Logic/Rewriting abstract = This Isabelle/HOL formalization defines Knuth–Bendix orders for higher-order terms without lambda-abstraction and proves many useful properties about them. The main order fully coincides with the standard transfinite KBO with subterm coefficients on first-order terms. It appears promising as the basis of a higher-order superposition calculus. notify = jasmin.blanchette@gmail.com [Lambda_Free_EPO] title = Formalization of the Embedding Path Order for Lambda-Free Higher-Order Terms author = Alexander Bentkamp topic = Logic/Rewriting date = 2018-10-19 notify = a.bentkamp@vu.nl abstract = This Isabelle/HOL formalization defines the Embedding Path Order (EPO) for higher-order terms without lambda-abstraction and proves many useful properties about it. In contrast to the lambda-free recursive path orders, it does not fully coincide with RPO on first-order terms, but it is compatible with arbitrary higher-order contexts. [Nested_Multisets_Ordinals] title = Formalization of Nested Multisets, Hereditary Multisets, and Syntactic Ordinals author = Jasmin Christian Blanchette , Mathias Fleury , Dmitriy Traytel date = 2016-11-12 topic = Logic/Rewriting abstract = This Isabelle/HOL formalization introduces a nested multiset datatype and defines Dershowitz and Manna's nested multiset order. The order is proved well founded and linear. By removing one constructor, we transform the nested multisets into hereditary multisets. These are isomorphic to the syntactic ordinals—the ordinals can be recursively expressed in Cantor normal form. Addition, subtraction, multiplication, and linear orders are provided on this type. notify = jasmin.blanchette@gmail.com [Abstract-Rewriting] title = Abstract Rewriting topic = Logic/Rewriting date = 2010-06-14 author = Christian Sternagel , René Thiemann license = LGPL abstract = We present an Isabelle formalization of abstract rewriting (see, e.g., the book by Baader and Nipkow). First, we define standard relations like joinability, meetability, conversion, etc. Then, we formalize important properties of abstract rewrite systems, e.g., confluence and strong normalization. Our main concern is on strong normalization, since this formalization is the basis of CeTA (which is mainly about strong normalization of term rewrite systems). Hence lemmas involving strong normalization constitute by far the biggest part of this theory. One of those is Newman's lemma. extra-history = Change history: [2010-09-17]: Added theories defining several (ordered) semirings related to strong normalization and giving some standard instances.
[2013-10-16]: Generalized delta-orders from rationals to Archimedean fields. notify = christian.sternagel@uibk.ac.at, rene.thiemann@uibk.ac.at [First_Order_Terms] title = First-Order Terms author = Christian Sternagel , René Thiemann topic = Logic/Rewriting, Computer Science/Algorithms license = LGPL date = 2018-02-06 notify = c.sternagel@gmail.com, rene.thiemann@uibk.ac.at abstract = We formalize basic results on first-order terms, including matching and a first-order unification algorithm, as well as well-foundedness of the subsumption order. This entry is part of the Isabelle Formalization of Rewriting IsaFoR, where first-order terms are omni-present: the unification algorithm is used to certify several confluence and termination techniques, like critical-pair computation and dependency graph approximations; and the subsumption order is a crucial ingredient for completion. [Free-Groups] title = Free Groups author = Joachim Breitner date = 2010-06-24 topic = Mathematics/Algebra abstract = Free Groups are, in a sense, the most generic kind of group. They are defined over a set of generators with no additional relations in between them. They play an important role in the definition of group presentations and in other fields. This theory provides the definition of Free Group as the set of fully canceled words in the generators. The universal property is proven, as well as some isomorphisms results about Free Groups. extra-history = Change history: [2011-12-11]: Added the Ping Pong Lemma. notify = [CofGroups] title = An Example of a Cofinitary Group in Isabelle/HOL author = Bart Kastermans date = 2009-08-04 topic = Mathematics/Algebra abstract = We formalize the usual proof that the group generated by the function k -> k + 1 on the integers gives rise to a cofinitary group. notify = nipkow@in.tum.de [Group-Ring-Module] title = Groups, Rings and Modules author = Hidetsune Kobayashi <>, L. Chen <>, H. Murao <> date = 2004-05-18 topic = Mathematics/Algebra abstract = The theory of groups, rings and modules is developed to a great depth. Group theory results include Zassenhaus's theorem and the Jordan-Hoelder theorem. The ring theory development includes ideals, quotient rings and the Chinese remainder theorem. The module development includes the Nakayama lemma, exact sequences and Tensor products. notify = lp15@cam.ac.uk [Robbins-Conjecture] title = A Complete Proof of the Robbins Conjecture author = Matthew Wampler-Doty <> date = 2010-05-22 topic = Mathematics/Algebra abstract = This document gives a formalization of the proof of the Robbins conjecture, following A. Mann, A Complete Proof of the Robbins Conjecture, 2003. notify = nipkow@in.tum.de [Valuation] title = Fundamental Properties of Valuation Theory and Hensel's Lemma author = Hidetsune Kobayashi <> date = 2007-08-08 topic = Mathematics/Algebra abstract = Convergence with respect to a valuation is discussed as convergence of a Cauchy sequence. Cauchy sequences of polynomials are defined. They are used to formalize Hensel's lemma. notify = lp15@cam.ac.uk [Rank_Nullity_Theorem] title = Rank-Nullity Theorem in Linear Algebra author = Jose Divasón , Jesús Aransay topic = Mathematics/Algebra date = 2013-01-16 abstract = In this contribution, we present some formalizations based on the HOL-Multivariate-Analysis session of Isabelle. Firstly, a generalization of several theorems of such library are presented. Secondly, some definitions and proofs involving Linear Algebra and the four fundamental subspaces of a matrix are shown. Finally, we present a proof of the result known in Linear Algebra as the ``Rank-Nullity Theorem'', which states that, given any linear map f from a finite dimensional vector space V to a vector space W, then the dimension of V is equal to the dimension of the kernel of f (which is a subspace of V) and the dimension of the range of f (which is a subspace of W). The proof presented here is based on the one given by Sheldon Axler in his book Linear Algebra Done Right. As a corollary of the previous theorem, and taking advantage of the relationship between linear maps and matrices, we prove that, for every matrix A (which has associated a linear map between finite dimensional vector spaces), the sum of its null space and its column space (which is equal to the range of the linear map) is equal to the number of columns of A. extra-history = Change history: [2014-07-14]: Added some generalizations that allow us to formalize the Rank-Nullity Theorem over finite dimensional vector spaces, instead of over the more particular euclidean spaces. Updated abstract. notify = jose.divasonm@unirioja.es, jesus-maria.aransay@unirioja.es [Affine_Arithmetic] title = Affine Arithmetic author = Fabian Immler date = 2014-02-07 topic = Mathematics/Analysis abstract = We give a formalization of affine forms as abstract representations of zonotopes. We provide affine operations as well as overapproximations of some non-affine operations like multiplication and division. Expressions involving those operations can automatically be turned into (executable) functions approximating the original expression in affine arithmetic. extra-history = Change history: [2015-01-31]: added algorithm for zonotope/hyperplane intersection
[2017-09-20]: linear approximations for all symbols from the floatarith data type notify = immler@in.tum.de [Laplace_Transform] title = Laplace Transform author = Fabian Immler topic = Mathematics/Analysis date = 2019-08-14 notify = fimmler@cs.cmu.edu abstract = This entry formalizes the Laplace transform and concrete Laplace transforms for arithmetic functions, frequency shift, integration and (higher) differentiation in the time domain. It proves Lerch's lemma and uniqueness of the Laplace transform for continuous functions. In order to formalize the foundational assumptions, this entry contains a formalization of piecewise continuous functions and functions of exponential order. [Cauchy] title = Cauchy's Mean Theorem and the Cauchy-Schwarz Inequality author = Benjamin Porter <> date = 2006-03-14 topic = Mathematics/Analysis abstract = This document presents the mechanised proofs of two popular theorems attributed to Augustin Louis Cauchy - Cauchy's Mean Theorem and the Cauchy-Schwarz Inequality. notify = kleing@cse.unsw.edu.au [Integration] title = Integration theory and random variables author = Stefan Richter date = 2004-11-19 topic = Mathematics/Analysis abstract = Lebesgue-style integration plays a major role in advanced probability. We formalize concepts of elementary measure theory, real-valued random variables as Borel-measurable functions, and a stepwise inductive definition of the integral itself. All proofs are carried out in human readable style using the Isar language. extra-note = Note: This article is of historical interest only. Lebesgue-style integration and probability theory are now available as part of the Isabelle/HOL distribution (directory Probability). notify = richter@informatik.rwth-aachen.de, nipkow@in.tum.de, hoelzl@in.tum.de [Ordinary_Differential_Equations] title = Ordinary Differential Equations author = Fabian Immler , Johannes Hölzl topic = Mathematics/Analysis date = 2012-04-26 abstract =

Session Ordinary-Differential-Equations formalizes ordinary differential equations (ODEs) and initial value problems. This work comprises proofs for local and global existence of unique solutions (Picard-Lindelöf theorem). Moreover, it contains a formalization of the (continuous or even differentiable) dependency of the flow on initial conditions as the flow of ODEs.

Not in the generated document are the following sessions:

  • HOL-ODE-Numerics: Rigorous numerical algorithms for computing enclosures of solutions based on Runge-Kutta methods and affine arithmetic. Reachability analysis with splitting and reduction at hyperplanes.
  • HOL-ODE-Examples: Applications of the numerical algorithms to concrete systems of ODEs.
  • Lorenz_C0, Lorenz_C1: Verified algorithms for checking C1-information according to Tucker's proof, computation of C0-information.

extra-history = Change history: [2014-02-13]: added an implementation of the Euler method based on affine arithmetic
[2016-04-14]: added flow and variational equation
[2016-08-03]: numerical algorithms for reachability analysis (using second-order Runge-Kutta methods, splitting, and reduction) implemented using Lammich's framework for automatic refinement
[2017-09-20]: added Poincare map and propagation of variational equation in reachability analysis, verified algorithms for C1-information and computations for C0-information of the Lorenz attractor. notify = immler@in.tum.de, hoelzl@in.tum.de [Polynomials] title = Executable Multivariate Polynomials author = Christian Sternagel , René Thiemann , Alexander Maletzky , Fabian Immler , Florian Haftmann , Andreas Lochbihler , Alexander Bentkamp date = 2010-08-10 topic = Mathematics/Analysis, Mathematics/Algebra, Computer Science/Algorithms license = LGPL abstract = We define multivariate polynomials over arbitrary (ordered) semirings in combination with (executable) operations like addition, multiplication, and substitution. We also define (weak) monotonicity of polynomials and comparison of polynomials where we provide standard estimations like absolute positiveness or the more recent approach of Neurauter, Zankl, and Middeldorp. Moreover, it is proven that strongly normalizing (monotone) orders can be lifted to strongly normalizing (monotone) orders over polynomials. Our formalization was performed as part of the IsaFoR/CeTA-system which contains several termination techniques. The provided theories have been essential to formalize polynomial interpretations.

This formalization also contains an abstract representation as coefficient functions with finite support and a type of power-products. If this type is ordered by a linear (term) ordering, various additional notions, such as leading power-product, leading coefficient etc., are introduced as well. Furthermore, a lot of generic properties of, and functions on, multivariate polynomials are formalized, including the substitution and evaluation homomorphisms, embeddings of polynomial rings into larger rings (i.e. with one additional indeterminate), homogenization and dehomogenization of polynomials, and the canonical isomorphism between R[X,Y] and R[X][Y]. extra-history = Change history: [2010-09-17]: Moved theories on arbitrary (ordered) semirings to Abstract Rewriting.
[2016-10-28]: Added abstract representation of polynomials and authors Maletzky/Immler.
[2018-01-23]: Added authors Haftmann, Lochbihler after incorporating their formalization of multivariate polynomials based on Polynomial mappings. Moved material from Bentkamp's entry "Deep Learning".
[2019-04-18]: Added material about polynomials whose power-products are represented themselves by polynomial mappings. notify = rene.thiemann@uibk.ac.at, christian.sternagel@uibk.ac.at, alexander.maletzky@risc.jku.at, immler@in.tum.de [Sqrt_Babylonian] title = Computing N-th Roots using the Babylonian Method author = René Thiemann date = 2013-01-03 topic = Mathematics/Analysis license = LGPL abstract = We implement the Babylonian method to compute n-th roots of numbers. We provide precise algorithms for naturals, integers and rationals, and offer an approximation algorithm for square roots over linear ordered fields. Moreover, there are precise algorithms to compute the floor and the ceiling of n-th roots. extra-history = Change history: [2013-10-16]: Added algorithms to compute floor and ceiling of sqrt of integers. [2014-07-11]: Moved NthRoot_Impl from Real-Impl to this entry. notify = rene.thiemann@uibk.ac.at [Sturm_Sequences] title = Sturm's Theorem author = Manuel Eberl date = 2014-01-11 topic = Mathematics/Analysis abstract = Sturm's Theorem states that polynomial sequences with certain properties, so-called Sturm sequences, can be used to count the number of real roots of a real polynomial. This work contains a proof of Sturm's Theorem and code for constructing Sturm sequences efficiently. It also provides the “sturm” proof method, which can decide certain statements about the roots of real polynomials, such as “the polynomial P has exactly n roots in the interval I” or “P(x) > Q(x) for all x ∈ ℝ”. notify = eberlm@in.tum.de [Sturm_Tarski] title = The Sturm-Tarski Theorem author = Wenda Li date = 2014-09-19 topic = Mathematics/Analysis abstract = We have formalized the Sturm-Tarski theorem (also referred as the Tarski theorem), which generalizes Sturm's theorem. Sturm's theorem is usually used as a way to count distinct real roots, while the Sturm-Tarksi theorem forms the basis for Tarski's classic quantifier elimination for real closed field. notify = wl302@cam.ac.uk [Markov_Models] title = Markov Models author = Johannes Hölzl , Tobias Nipkow date = 2012-01-03 topic = Mathematics/Probability Theory, Computer Science/Automata and Formal Languages abstract = This is a formalization of Markov models in Isabelle/HOL. It builds on Isabelle's probability theory. The available models are currently Discrete-Time Markov Chains and a extensions of them with rewards.

As application of these models we formalize probabilistic model checking of pCTL formulas, analysis of IPv4 address allocation in ZeroConf and an analysis of the anonymity of the Crowds protocol. See here for the corresponding paper. notify = hoelzl@in.tum.de [Probabilistic_System_Zoo] title = A Zoo of Probabilistic Systems author = Johannes Hölzl , Andreas Lochbihler , Dmitriy Traytel date = 2015-05-27 topic = Computer Science/Automata and Formal Languages abstract = Numerous models of probabilistic systems are studied in the literature. Coalgebra has been used to classify them into system types and compare their expressiveness. We formalize the resulting hierarchy of probabilistic system types by modeling the semantics of the different systems as codatatypes. This approach yields simple and concise proofs, as bisimilarity coincides with equality for codatatypes.

This work is described in detail in the ITP 2015 publication by the authors. notify = traytel@in.tum.de [Density_Compiler] title = A Verified Compiler for Probability Density Functions author = Manuel Eberl , Johannes Hölzl , Tobias Nipkow date = 2014-10-09 topic = Mathematics/Probability Theory, Computer Science/Programming Languages/Compiling abstract = Bhat et al. [TACAS 2013] developed an inductive compiler that computes density functions for probability spaces described by programs in a probabilistic functional language. In this work, we implement such a compiler for a modified version of this language within the theorem prover Isabelle and give a formal proof of its soundness w.r.t. the semantics of the source and target language. Together with Isabelle's code generation for inductive predicates, this yields a fully verified, executable density compiler. The proof is done in two steps: First, an abstract compiler working with abstract functions modelled directly in the theorem prover's logic is defined and proved sound. Then, this compiler is refined to a concrete version that returns a target-language expression.

An article with the same title and authors is published in the proceedings of ESOP 2015. A detailed presentation of this work can be found in the first author's master's thesis. notify = hoelzl@in.tum.de [CAVA_Automata] title = The CAVA Automata Library author = Peter Lammich date = 2014-05-28 topic = Computer Science/Automata and Formal Languages abstract = We report on the graph and automata library that is used in the fully verified LTL model checker CAVA. As most components of CAVA use some type of graphs or automata, a common automata library simplifies assembly of the components and reduces redundancy.

The CAVA Automata Library provides a hierarchy of graph and automata classes, together with some standard algorithms. Its object oriented design allows for sharing of algorithms, theorems, and implementations between its classes, and also simplifies extensions of the library. Moreover, it is integrated into the Automatic Refinement Framework, supporting automatic refinement of the abstract automata types to efficient data structures.

Note that the CAVA Automata Library is work in progress. Currently, it is very specifically tailored towards the requirements of the CAVA model checker. Nevertheless, the formalization techniques presented here allow an extension of the library to a wider scope. Moreover, they are not limited to graph libraries, but apply to class hierarchies in general.

The CAVA Automata Library is described in the paper: Peter Lammich, The CAVA Automata Library, Isabelle Workshop 2014. notify = lammich@in.tum.de [LTL] title = Linear Temporal Logic author = Salomon Sickert contributors = Benedikt Seidl date = 2016-03-01 topic = Logic, Computer Science/Automata and Formal Languages abstract = This theory provides a formalisation of linear temporal logic (LTL) and unifies previous formalisations within the AFP. This entry establishes syntax and semantics for this logic and decouples it from existing entries, yielding a common environment for theories reasoning about LTL. Furthermore a parser written in SML and an executable simplifier are provided. extra-history = Change history: [2019-03-12]: Support for additional operators, implementation of common equivalence relations, definition of syntactic fragments of LTL and the minimal disjunctive normal form.
notify = sickert@in.tum.de [LTL_to_GBA] title = Converting Linear-Time Temporal Logic to Generalized Büchi Automata author = Alexander Schimpf , Peter Lammich date = 2014-05-28 topic = Computer Science/Automata and Formal Languages abstract = We formalize linear-time temporal logic (LTL) and the algorithm by Gerth et al. to convert LTL formulas to generalized Büchi automata. We also formalize some syntactic rewrite rules that can be applied to optimize the LTL formula before conversion. Moreover, we integrate the Stuttering Equivalence AFP-Entry by Stefan Merz, adapting the lemma that next-free LTL formula cannot distinguish between stuttering equivalent runs to our setting.

We use the Isabelle Refinement and Collection framework, as well as the Autoref tool, to obtain a refined version of our algorithm, from which efficiently executable code can be extracted. notify = lammich@in.tum.de [Gabow_SCC] title = Verified Efficient Implementation of Gabow's Strongly Connected Components Algorithm author = Peter Lammich date = 2014-05-28 topic = Computer Science/Algorithms, Mathematics/Graph Theory abstract = We present an Isabelle/HOL formalization of Gabow's algorithm for finding the strongly connected components of a directed graph. Using data refinement techniques, we extract efficient code that performs comparable to a reference implementation in Java. Our style of formalization allows for re-using large parts of the proofs when defining variants of the algorithm. We demonstrate this by verifying an algorithm for the emptiness check of generalized Büchi automata, re-using most of the existing proofs. notify = lammich@in.tum.de [Promela] title = Promela Formalization author = René Neumann date = 2014-05-28 topic = Computer Science/System Description Languages abstract = We present an executable formalization of the language Promela, the description language for models of the model checker SPIN. This formalization is part of the work for a completely verified model checker (CAVA), but also serves as a useful (and executable!) description of the semantics of the language itself, something that is currently missing. The formalization uses three steps: It takes an abstract syntax tree generated from an SML parser, removes syntactic sugar and enriches it with type information. This further gets translated into a transition system, on which the semantic engine (read: successor function) operates. notify = [CAVA_LTL_Modelchecker] title = A Fully Verified Executable LTL Model Checker author = Javier Esparza , Peter Lammich , René Neumann , Tobias Nipkow , Alexander Schimpf , Jan-Georg Smaus date = 2014-05-28 topic = Computer Science/Automata and Formal Languages abstract = We present an LTL model checker whose code has been completely verified using the Isabelle theorem prover. The checker consists of over 4000 lines of ML code. The code is produced using the Isabelle Refinement Framework, which allows us to split its correctness proof into (1) the proof of an abstract version of the checker, consisting of a few hundred lines of ``formalized pseudocode'', and (2) a verified refinement step in which mathematical sets and other abstract structures are replaced by implementations of efficient structures like red-black trees and functional arrays. This leads to a checker that, while still slower than unverified checkers, can already be used as a trusted reference implementation against which advanced implementations can be tested.

An early version of this model checker is described in the CAV 2013 paper with the same title. notify = lammich@in.tum.de [Fermat3_4] title = Fermat's Last Theorem for Exponents 3 and 4 and the Parametrisation of Pythagorean Triples author = Roelof Oosterhuis <> date = 2007-08-12 topic = Mathematics/Number Theory abstract = This document presents the mechanised proofs of

  • Fermat's Last Theorem for exponents 3 and 4 and
  • the parametrisation of Pythagorean Triples.
notify = nipkow@in.tum.de, roelofoosterhuis@gmail.com [Perfect-Number-Thm] title = Perfect Number Theorem author = Mark Ijbema date = 2009-11-22 topic = Mathematics/Number Theory abstract = These theories present the mechanised proof of the Perfect Number Theorem. notify = nipkow@in.tum.de [SumSquares] title = Sums of Two and Four Squares author = Roelof Oosterhuis <> date = 2007-08-12 topic = Mathematics/Number Theory abstract = This document presents the mechanised proofs of the following results:
  • any prime number of the form 4m+1 can be written as the sum of two squares;
  • any natural number can be written as the sum of four squares
notify = nipkow@in.tum.de, roelofoosterhuis@gmail.com [Lehmer] title = Lehmer's Theorem author = Simon Wimmer , Lars Noschinski date = 2013-07-22 topic = Mathematics/Number Theory abstract = In 1927, Lehmer presented criterions for primality, based on the converse of Fermat's litte theorem. This work formalizes the second criterion from Lehmer's paper, a necessary and sufficient condition for primality.

As a side product we formalize some properties of Euler's phi-function, the notion of the order of an element of a group, and the cyclicity of the multiplicative group of a finite field. notify = noschinl@gmail.com, simon.wimmer@tum.de [Pratt_Certificate] title = Pratt's Primality Certificates author = Simon Wimmer , Lars Noschinski date = 2013-07-22 topic = Mathematics/Number Theory abstract = In 1975, Pratt introduced a proof system for certifying primes. He showed that a number p is prime iff a primality certificate for p exists. By showing a logarithmic upper bound on the length of the certificates in size of the prime number, he concluded that the decision problem for prime numbers is in NP. This work formalizes soundness and completeness of Pratt's proof system as well as an upper bound for the size of the certificate. notify = noschinl@gmail.com, simon.wimmer@tum.de [Monad_Memo_DP] title = Monadification, Memoization and Dynamic Programming author = Simon Wimmer , Shuwei Hu , Tobias Nipkow topic = Computer Science/Programming Languages/Transformations, Computer Science/Algorithms, Computer Science/Functional Programming date = 2018-05-22 notify = wimmers@in.tum.de abstract = We present a lightweight framework for the automatic verified (functional or imperative) memoization of recursive functions. Our tool can turn a pure Isabelle/HOL function definition into a monadified version in a state monad or the Imperative HOL heap monad, and prove a correspondence theorem. We provide a variety of memory implementations for the two types of monads. A number of simple techniques allow us to achieve bottom-up computation and space-efficient memoization. The framework’s utility is demonstrated on a number of representative dynamic programming problems. A detailed description of our work can be found in the accompanying paper [2]. [Probabilistic_Timed_Automata] title = Probabilistic Timed Automata author = Simon Wimmer , Johannes Hölzl topic = Mathematics/Probability Theory, Computer Science/Automata and Formal Languages date = 2018-05-24 notify = wimmers@in.tum.de, hoelzl@in.tum.de abstract = We present a formalization of probabilistic timed automata (PTA) for which we try to follow the formula MDP + TA = PTA as far as possible: our work starts from our existing formalizations of Markov decision processes (MDP) and timed automata (TA) and combines them modularly. We prove the fundamental result for probabilistic timed automata: the region construction that is known from timed automata carries over to the probabilistic setting. In particular, this allows us to prove that minimum and maximum reachability probabilities can be computed via a reduction to MDP model checking, including the case where one wants to disregard unrealizable behavior. Further information can be found in our ITP paper [2]. [Hidden_Markov_Models] title = Hidden Markov Models author = Simon Wimmer topic = Mathematics/Probability Theory, Computer Science/Algorithms date = 2018-05-25 notify = wimmers@in.tum.de abstract = This entry contains a formalization of hidden Markov models [3] based on Johannes Hölzl's formalization of discrete time Markov chains [1]. The basic definitions are provided and the correctness of two main (dynamic programming) algorithms for hidden Markov models is proved: the forward algorithm for computing the likelihood of an observed sequence, and the Viterbi algorithm for decoding the most probable hidden state sequence. The Viterbi algorithm is made executable including memoization. Hidden markov models have various applications in natural language processing. For an introduction see Jurafsky and Martin [2]. [ArrowImpossibilityGS] title = Arrow and Gibbard-Satterthwaite author = Tobias Nipkow date = 2008-09-01 topic = Mathematics/Economics abstract = This article formalizes two proofs of Arrow's impossibility theorem due to Geanakoplos and derives the Gibbard-Satterthwaite theorem as a corollary. One formalization is based on utility functions, the other one on strict partial orders.

An article about these proofs is found here. notify = nipkow@in.tum.de [SenSocialChoice] title = Some classical results in Social Choice Theory author = Peter Gammie date = 2008-11-09 topic = Mathematics/Economics abstract = Drawing on Sen's landmark work "Collective Choice and Social Welfare" (1970), this development proves Arrow's General Possibility Theorem, Sen's Liberal Paradox and May's Theorem in a general setting. The goal was to make precise the classical statements and proofs of these results, and to provide a foundation for more recent results such as the Gibbard-Satterthwaite and Duggan-Schwartz theorems. notify = nipkow@in.tum.de [Vickrey_Clarke_Groves] title = VCG - Combinatorial Vickrey-Clarke-Groves Auctions author = Marco B. Caminati <>, Manfred Kerber , Christoph Lange, Colin Rowat date = 2015-04-30 topic = Mathematics/Economics abstract = A VCG auction (named after their inventors Vickrey, Clarke, and Groves) is a generalization of the single-good, second price Vickrey auction to the case of a combinatorial auction (multiple goods, from which any participant can bid on each possible combination). We formalize in this entry VCG auctions, including tie-breaking and prove that the functions for the allocation and the price determination are well-defined. Furthermore we show that the allocation function allocates goods only to participants, only goods in the auction are allocated, and no good is allocated twice. We also show that the price function is non-negative. These properties also hold for the automatically extracted Scala code. notify = mnfrd.krbr@gmail.com [Topology] title = Topology author = Stefan Friedrich <> date = 2004-04-26 topic = Mathematics/Topology abstract = This entry contains two theories. The first, Topology, develops the basic notions of general topology. The second, which can be viewed as a demonstration of the first, is called LList_Topology. It develops the topology of lazy lists. notify = lcp@cl.cam.ac.uk [Knot_Theory] title = Knot Theory author = T.V.H. Prathamesh date = 2016-01-20 topic = Mathematics/Topology abstract = This work contains a formalization of some topics in knot theory. The concepts that were formalized include definitions of tangles, links, framed links and link/tangle equivalence. The formalization is based on a formulation of links in terms of tangles. We further construct and prove the invariance of the Bracket polynomial. Bracket polynomial is an invariant of framed links closely linked to the Jones polynomial. This is perhaps the first attempt to formalize any aspect of knot theory in an interactive proof assistant. notify = prathamesh@imsc.res.in [Graph_Theory] title = Graph Theory author = Lars Noschinski date = 2013-04-28 topic = Mathematics/Graph Theory abstract = This development provides a formalization of directed graphs, supporting (labelled) multi-edges and infinite graphs. A polymorphic edge type allows edges to be treated as pairs of vertices, if multi-edges are not required. Formalized properties are i.a. walks (and related concepts), connectedness and subgraphs and basic properties of isomorphisms.

This formalization is used to prove characterizations of Euler Trails, Shortest Paths and Kuratowski subgraphs. notify = noschinl@gmail.com [Planarity_Certificates] title = Planarity Certificates author = Lars Noschinski date = 2015-11-11 topic = Mathematics/Graph Theory abstract = This development provides a formalization of planarity based on combinatorial maps and proves that Kuratowski's theorem implies combinatorial planarity. Moreover, it contains verified implementations of programs checking certificates for planarity (i.e., a combinatorial map) or non-planarity (i.e., a Kuratowski subgraph). notify = noschinl@gmail.com [Max-Card-Matching] title = Maximum Cardinality Matching author = Christine Rizkallah date = 2011-07-21 topic = Mathematics/Graph Theory abstract =

A matching in a graph G is a subset M of the edges of G such that no two share an endpoint. A matching has maximum cardinality if its cardinality is at least as large as that of any other matching. An odd-set cover OSC of a graph G is a labeling of the nodes of G with integers such that every edge of G is either incident to a node labeled 1 or connects two nodes labeled with the same number i ≥ 2.

This article proves Edmonds theorem:
Let M be a matching in a graph G and let OSC be an odd-set cover of G. For any i ≥ 0, let n(i) be the number of nodes labeled i. If |M| = n(1) + ∑i ≥ 2(n(i) div 2), then M is a maximum cardinality matching.

notify = nipkow@in.tum.de [Girth_Chromatic] title = A Probabilistic Proof of the Girth-Chromatic Number Theorem author = Lars Noschinski date = 2012-02-06 topic = Mathematics/Graph Theory abstract = This works presents a formalization of the Girth-Chromatic number theorem in graph theory, stating that graphs with arbitrarily large girth and chromatic number exist. The proof uses the theory of Random Graphs to prove the existence with probabilistic arguments. notify = noschinl@gmail.com [Random_Graph_Subgraph_Threshold] title = Properties of Random Graphs -- Subgraph Containment author = Lars Hupel date = 2014-02-13 topic = Mathematics/Graph Theory, Mathematics/Probability Theory abstract = Random graphs are graphs with a fixed number of vertices, where each edge is present with a fixed probability. We are interested in the probability that a random graph contains a certain pattern, for example a cycle or a clique. A very high edge probability gives rise to perhaps too many edges (which degrades performance for many algorithms), whereas a low edge probability might result in a disconnected graph. We prove a theorem about a threshold probability such that a higher edge probability will asymptotically almost surely produce a random graph with the desired subgraph. notify = hupel@in.tum.de [Flyspeck-Tame] title = Flyspeck I: Tame Graphs author = Gertrud Bauer <>, Tobias Nipkow date = 2006-05-22 topic = Mathematics/Graph Theory abstract = These theories present the verified enumeration of tame plane graphs as defined by Thomas C. Hales in his proof of the Kepler Conjecture in his book Dense Sphere Packings. A Blueprint for Formal Proofs. [CUP 2012]. The values of the constants in the definition of tameness are identical to those in the Flyspeck project. The IJCAR 2006 paper by Nipkow, Bauer and Schultz refers to the original version of Hales' proof, the ITP 2011 paper by Nipkow refers to the Blueprint version of the proof. extra-history = Change history: [2010-11-02]: modified theories to reflect the modified definition of tameness in Hales' revised proof.
[2014-07-03]: modified constants in def of tameness and Archive according to the final state of the Flyspeck proof. notify = nipkow@in.tum.de [Well_Quasi_Orders] title = Well-Quasi-Orders author = Christian Sternagel date = 2012-04-13 topic = Mathematics/Combinatorics abstract = Based on Isabelle/HOL's type class for preorders, we introduce a type class for well-quasi-orders (wqo) which is characterized by the absence of "bad" sequences (our proofs are along the lines of the proof of Nash-Williams, from which we also borrow terminology). Our main results are instantiations for the product type, the list type, and a type of finite trees, which (almost) directly follow from our proofs of (1) Dickson's Lemma, (2) Higman's Lemma, and (3) Kruskal's Tree Theorem. More concretely:
  • If the sets A and B are wqo then their Cartesian product is wqo.
  • If the set A is wqo then the set of finite lists over A is wqo.
  • If the set A is wqo then the set of finite trees over A is wqo.
The research was funded by the Austrian Science Fund (FWF): J3202. extra-history = Change history: [2012-06-11]: Added Kruskal's Tree Theorem.
[2012-12-19]: New variant of Kruskal's tree theorem for terms (as opposed to variadic terms, i.e., trees), plus finite version of the tree theorem as corollary.
[2013-05-16]: Simplified construction of minimal bad sequences.
[2014-07-09]: Simplified proofs of Higman's lemma and Kruskal's tree theorem, based on homogeneous sequences.
[2016-01-03]: An alternative proof of Higman's lemma by open induction.
[2017-06-08]: Proved (classical) equivalence to inductive definition of almost-full relations according to the ITP 2012 paper "Stop When You Are Almost-Full" by Vytiniotis, Coquand, and Wahlstedt. notify = c.sternagel@gmail.com [Marriage] title = Hall's Marriage Theorem author = Dongchen Jiang , Tobias Nipkow date = 2010-12-17 topic = Mathematics/Combinatorics abstract = Two proofs of Hall's Marriage Theorem: one due to Halmos and Vaughan, one due to Rado. extra-history = Change history: [2011-09-09]: Added Rado's proof notify = nipkow@in.tum.de [Bondy] title = Bondy's Theorem author = Jeremy Avigad , Stefan Hetzl date = 2012-10-27 topic = Mathematics/Combinatorics abstract = A proof of Bondy's theorem following B. Bollabas, Combinatorics, 1986, Cambridge University Press. notify = avigad@cmu.edu, hetzl@logic.at [Ramsey-Infinite] title = Ramsey's theorem, infinitary version author = Tom Ridge <> date = 2004-09-20 topic = Mathematics/Combinatorics abstract = This formalization of Ramsey's theorem (infinitary version) is taken from Boolos and Jeffrey, Computability and Logic, 3rd edition, Chapter 26. It differs slightly from the text by assuming a slightly stronger hypothesis. In particular, the induction hypothesis is stronger, holding for any infinite subset of the naturals. This avoids the rather peculiar mapping argument between kj and aikj on p.263, which is unnecessary and slightly mars this really beautiful result. notify = lp15@cam.ac.uk [Derangements] title = Derangements Formula author = Lukas Bulwahn date = 2015-06-27 topic = Mathematics/Combinatorics abstract = The Derangements Formula describes the number of fixpoint-free permutations as a closed formula. This theorem is the 88th theorem in a list of the ``Top 100 Mathematical Theorems''. notify = lukas.bulwahn@gmail.com [Euler_Partition] title = Euler's Partition Theorem author = Lukas Bulwahn date = 2015-11-19 topic = Mathematics/Combinatorics abstract = Euler's Partition Theorem states that the number of partitions with only distinct parts is equal to the number of partitions with only odd parts. The combinatorial proof follows John Harrison's HOL Light formalization. This theorem is the 45th theorem of the Top 100 Theorems list. notify = lukas.bulwahn@gmail.com [Discrete_Summation] title = Discrete Summation author = Florian Haftmann contributors = Amine Chaieb <> date = 2014-04-13 topic = Mathematics/Combinatorics abstract = These theories introduce basic concepts and proofs about discrete summation: shifts, formal summation, falling factorials and stirling numbers. As proof of concept, a simple summation conversion is provided. notify = florian.haftmann@informatik.tu-muenchen.de [Open_Induction] title = Open Induction author = Mizuhito Ogawa <>, Christian Sternagel date = 2012-11-02 topic = Mathematics/Combinatorics abstract = A proof of the open induction schema based on J.-C. Raoult, Proving open properties by induction, Information Processing Letters 29, 1988, pp.19-23.

This research was supported by the Austrian Science Fund (FWF): J3202.

notify = c.sternagel@gmail.com [Category] title = Category Theory to Yoneda's Lemma author = Greg O'Keefe date = 2005-04-21 topic = Mathematics/Category Theory license = LGPL abstract = This development proves Yoneda's lemma and aims to be readable by humans. It only defines what is needed for the lemma: categories, functors and natural transformations. Limits, adjunctions and other important concepts are not included. extra-history = Change history: [2010-04-23]: The definition of the constant equinumerous was slightly too weak in the original submission and has been fixed in revision 8c2b5b3c995f. notify = lcp@cl.cam.ac.uk [Category2] title = Category Theory author = Alexander Katovsky date = 2010-06-20 topic = Mathematics/Category Theory abstract = This article presents a development of Category Theory in Isabelle/HOL. A Category is defined using records and locales. Functors and Natural Transformations are also defined. The main result that has been formalized is that the Yoneda functor is a full and faithful embedding. We also formalize the completeness of many sorted monadic equational logic. Extensive use is made of the HOLZF theory in both cases. For an informal description see here [pdf]. notify = alexander.katovsky@cantab.net [FunWithFunctions] title = Fun With Functions author = Tobias Nipkow date = 2008-08-26 topic = Mathematics/Misc abstract = This is a collection of cute puzzles of the form ``Show that if a function satisfies the following constraints, it must be ...'' Please add further examples to this collection! notify = nipkow@in.tum.de [FunWithTilings] title = Fun With Tilings author = Tobias Nipkow , Lawrence C. Paulson date = 2008-11-07 topic = Mathematics/Misc abstract = Tilings are defined inductively. It is shown that one form of mutilated chess board cannot be tiled with dominoes, while another one can be tiled with L-shaped tiles. Please add further fun examples of this kind! notify = nipkow@in.tum.de [Lazy-Lists-II] title = Lazy Lists II author = Stefan Friedrich <> date = 2004-04-26 topic = Computer Science/Data Structures abstract = This theory contains some useful extensions to the LList (lazy list) theory by Larry Paulson, including finite, infinite, and positive llists over an alphabet, as well as the new constants take and drop and the prefix order of llists. Finally, the notions of safety and liveness in the sense of Alpern and Schneider (1985) are defined. notify = lcp@cl.cam.ac.uk [Ribbon_Proofs] title = Ribbon Proofs author = John Wickerson <> date = 2013-01-19 topic = Computer Science/Programming Languages/Logics abstract = This document concerns the theory of ribbon proofs: a diagrammatic proof system, based on separation logic, for verifying program correctness. We include the syntax, proof rules, and soundness results for two alternative formalisations of ribbon proofs.

Compared to traditional proof outlines, ribbon proofs emphasise the structure of a proof, so are intelligible and pedagogical. Because they contain less redundancy than proof outlines, and allow each proof step to be checked locally, they may be more scalable. Where proof outlines are cumbersome to modify, ribbon proofs can be visually manoeuvred to yield proofs of variant programs. notify = [Koenigsberg_Friendship] title = The Königsberg Bridge Problem and the Friendship Theorem author = Wenda Li date = 2013-07-19 topic = Mathematics/Graph Theory abstract = This development provides a formalization of undirected graphs and simple graphs, which are based on Benedikt Nordhoff and Peter Lammich's simple formalization of labelled directed graphs in the archive. Then, with our formalization of graphs, we show both necessary and sufficient conditions for Eulerian trails and circuits as well as the fact that the Königsberg Bridge Problem does not have a solution. In addition, we show the Friendship Theorem in simple graphs. notify = [Tree_Decomposition] title = Tree Decomposition author = Christoph Dittmann notify = date = 2016-05-31 topic = Mathematics/Graph Theory abstract = We formalize tree decompositions and tree width in Isabelle/HOL, proving that trees have treewidth 1. We also show that every edge of a tree decomposition is a separation of the underlying graph. As an application of this theorem we prove that complete graphs of size n have treewidth n-1. [Menger] title = Menger's Theorem author = Christoph Dittmann topic = Mathematics/Graph Theory date = 2017-02-26 notify = isabelle@christoph-d.de abstract = We present a formalization of Menger's Theorem for directed and undirected graphs in Isabelle/HOL. This well-known result shows that if two non-adjacent distinct vertices u, v in a directed graph have no separator smaller than n, then there exist n internally vertex-disjoint paths from u to v. The version for undirected graphs follows immediately because undirected graphs are a special case of directed graphs. [IEEE_Floating_Point] title = A Formal Model of IEEE Floating Point Arithmetic author = Lei Yu contributors = Fabian Hellauer , Fabian Immler date = 2013-07-27 topic = Computer Science/Data Structures abstract = This development provides a formal model of IEEE-754 floating-point arithmetic. This formalization, including formal specification of the standard and proofs of important properties of floating-point arithmetic, forms the foundation for verifying programs with floating-point computation. There is also a code generation setup for floats so that we can execute programs using this formalization in functional programming languages. notify = lp15@cam.ac.uk, immler@in.tum.de extra-history = Change history: [2017-09-25]: Added conversions from and to software floating point numbers (by Fabian Hellauer and Fabian Immler).
[2018-02-05]: 'Modernized' representation following the formalization in HOL4: former "float_format" and predicate "is_valid" is now encoded in a type "('e, 'f) float" where 'e and 'f encode the size of exponent and fraction. [Native_Word] title = Native Word author = Andreas Lochbihler contributors = Peter Lammich date = 2013-09-17 topic = Computer Science/Data Structures abstract = This entry makes machine words and machine arithmetic available for code generation from Isabelle/HOL. It provides a common abstraction that hides the differences between the different target languages. The code generator maps these operations to the APIs of the target languages. Apart from that, we extend the available bit operations on types int and integer, and map them to the operations in the target languages. extra-history = Change history: [2013-11-06]: added conversion function between native words and characters (revision fd23d9a7fe3a)
[2014-03-31]: added words of default size in the target language (by Peter Lammich) (revision 25caf5065833)
[2014-10-06]: proper test setup with compilation and execution of tests in all target languages (revision 5d7a1c9ae047)
[2017-09-02]: added 64-bit words (revision c89f86244e3c)
[2018-07-15]: added cast operators for default-size words (revision fc1f1fb8dd30)
notify = mail@andreas-lochbihler.de [XML] title = XML author = Christian Sternagel , René Thiemann date = 2014-10-03 topic = Computer Science/Functional Programming, Computer Science/Data Structures abstract = This entry provides an XML library for Isabelle/HOL. This includes parsing and pretty printing of XML trees as well as combinators for transforming XML trees into arbitrary user-defined data. The main contribution of this entry is an interface (fit for code generation) that allows for communication between verified programs formalized in Isabelle/HOL and the outside world via XML. This library was developed as part of the IsaFoR/CeTA project to which we refer for examples of its usage. notify = c.sternagel@gmail.com, rene.thiemann@uibk.ac.at [HereditarilyFinite] title = The Hereditarily Finite Sets author = Lawrence C. Paulson date = 2013-11-17 topic = Logic abstract = The theory of hereditarily finite sets is formalised, following the development of Swierczkowski. An HF set is a finite collection of other HF sets; they enjoy an induction principle and satisfy all the axioms of ZF set theory apart from the axiom of infinity, which is negated. All constructions that are possible in ZF set theory (Cartesian products, disjoint sums, natural numbers, functions) without using infinite sets are possible here. The definition of addition for the HF sets follows Kirby. This development forms the foundation for the Isabelle proof of Gödel's incompleteness theorems, which has been formalised separately. extra-history = Change history: [2015-02-23]: Added the theory "Finitary" defining the class of types that can be embedded in hf, including int, char, option, list, etc. notify = lp15@cam.ac.uk [Incompleteness] title = Gödel's Incompleteness Theorems author = Lawrence C. Paulson date = 2013-11-17 topic = Logic abstract = Gödel's two incompleteness theorems are formalised, following a careful presentation by Swierczkowski, in the theory of hereditarily finite sets. This represents the first ever machine-assisted proof of the second incompleteness theorem. Compared with traditional formalisations using Peano arithmetic (see e.g. Boolos), coding is simpler, with no need to formalise the notion of multiplication (let alone that of a prime number) in the formalised calculus upon which the theorem is based. However, other technical problems had to be solved in order to complete the argument. notify = lp15@cam.ac.uk [Finite_Automata_HF] title = Finite Automata in Hereditarily Finite Set Theory author = Lawrence C. Paulson date = 2015-02-05 topic = Computer Science/Automata and Formal Languages abstract = Finite Automata, both deterministic and non-deterministic, for regular languages. The Myhill-Nerode Theorem. Closure under intersection, concatenation, etc. Regular expressions define regular languages. Closure under reversal; the powerset construction mapping NFAs to DFAs. Left and right languages; minimal DFAs. Brzozowski's minimization algorithm. Uniqueness up to isomorphism of minimal DFAs. notify = lp15@cam.ac.uk [Decreasing-Diagrams] title = Decreasing Diagrams author = Harald Zankl license = LGPL date = 2013-11-01 topic = Logic/Rewriting abstract = This theory contains a formalization of decreasing diagrams showing that any locally decreasing abstract rewrite system is confluent. We consider the valley (van Oostrom, TCS 1994) and the conversion version (van Oostrom, RTA 2008) and closely follow the original proofs. As an application we prove Newman's lemma. notify = Harald.Zankl@uibk.ac.at [Decreasing-Diagrams-II] title = Decreasing Diagrams II author = Bertram Felgenhauer license = LGPL date = 2015-08-20 topic = Logic/Rewriting abstract = This theory formalizes the commutation version of decreasing diagrams for Church-Rosser modulo. The proof follows Felgenhauer and van Oostrom (RTA 2013). The theory also provides important specializations, in particular van Oostrom’s conversion version (TCS 2008) of decreasing diagrams. notify = bertram.felgenhauer@uibk.ac.at [GoedelGod] title = Gödel's God in Isabelle/HOL author = Christoph Benzmüller , Bruno Woltzenlogel Paleo date = 2013-11-12 topic = Logic/Philosophy abstract = Dana Scott's version of Gödel's proof of God's existence is formalized in quantified modal logic KB (QML KB). QML KB is modeled as a fragment of classical higher-order logic (HOL); thus, the formalization is essentially a formalization in HOL. notify = lp15@cam.ac.uk, c.benzmueller@fu-berlin.de [Types_Tableaus_and_Goedels_God] title = Types, Tableaus and Gödel’s God in Isabelle/HOL author = David Fuenmayor , Christoph Benzmüller topic = Logic/Philosophy date = 2017-05-01 notify = davfuenmayor@gmail.com, c.benzmueller@gmail.com abstract = A computer-formalisation of the essential parts of Fitting's textbook "Types, Tableaus and Gödel's God" in Isabelle/HOL is presented. In particular, Fitting's (and Anderson's) variant of the ontological argument is verified and confirmed. This variant avoids the modal collapse, which has been criticised as an undesirable side-effect of Kurt Gödel's (and Dana Scott's) versions of the ontological argument. Fitting's work is employing an intensional higher-order modal logic, which we shallowly embed here in classical higher-order logic. We then utilize the embedded logic for the formalisation of Fitting's argument. (See also the earlier AFP entry ``Gödel's God in Isabelle/HOL''.) [GewirthPGCProof] title = Formalisation and Evaluation of Alan Gewirth's Proof for the Principle of Generic Consistency in Isabelle/HOL author = David Fuenmayor , Christoph Benzmüller topic = Logic/Philosophy date = 2018-10-30 notify = davfuenmayor@gmail.com, c.benzmueller@gmail.com abstract = An ambitious ethical theory ---Alan Gewirth's "Principle of Generic Consistency"--- is encoded and analysed in Isabelle/HOL. Gewirth's theory has stirred much attention in philosophy and ethics and has been proposed as a potential means to bound the impact of artificial general intelligence. extra-history = Change history: [2019-04-09]: added proof for a stronger variant of the PGC and examplary inferences (revision 88182cb0a2f6)
[Lowe_Ontological_Argument] title = Computer-assisted Reconstruction and Assessment of E. J. Lowe's Modal Ontological Argument author = David Fuenmayor , Christoph Benzmüller topic = Logic/Philosophy date = 2017-09-21 notify = davfuenmayor@gmail.com, c.benzmueller@gmail.com abstract = Computers may help us to understand --not just verify-- philosophical arguments. By utilizing modern proof assistants in an iterative interpretive process, we can reconstruct and assess an argument by fully formal means. Through the mechanization of a variant of St. Anselm's ontological argument by E. J. Lowe, which is a paradigmatic example of a natural-language argument with strong ties to metaphysics and religion, we offer an ideal showcase for our computer-assisted interpretive method. [AnselmGod] title = Anselm's God in Isabelle/HOL author = Ben Blumson topic = Logic/Philosophy date = 2017-09-06 notify = benblumson@gmail.com abstract = Paul Oppenheimer and Edward Zalta's formalisation of Anselm's ontological argument for the existence of God is automated by embedding a free logic for definite descriptions within Isabelle/HOL. [Tail_Recursive_Functions] title = A General Method for the Proof of Theorems on Tail-recursive Functions author = Pasquale Noce date = 2013-12-01 topic = Computer Science/Functional Programming abstract =

Tail-recursive function definitions are sometimes more straightforward than alternatives, but proving theorems on them may be roundabout because of the peculiar form of the resulting recursion induction rules.

This paper describes a proof method that provides a general solution to this problem by means of suitable invariants over inductive sets, and illustrates the application of such method by examining two case studies.

notify = pasquale.noce.lavoro@gmail.com [CryptoBasedCompositionalProperties] title = Compositional Properties of Crypto-Based Components author = Maria Spichkova date = 2014-01-11 topic = Computer Science/Security abstract = This paper presents an Isabelle/HOL set of theories which allows the specification of crypto-based components and the verification of their composition properties wrt. cryptographic aspects. We introduce a formalisation of the security property of data secrecy, the corresponding definitions and proofs. Please note that here we import the Isabelle/HOL theory ListExtras.thy, presented in the AFP entry FocusStreamsCaseStudies-AFP. notify = maria.spichkova@rmit.edu.au [Featherweight_OCL] title = Featherweight OCL: A Proposal for a Machine-Checked Formal Semantics for OCL 2.5 author = Achim D. Brucker , Frédéric Tuong , Burkhart Wolff date = 2014-01-16 topic = Computer Science/System Description Languages abstract = The Unified Modeling Language (UML) is one of the few modeling languages that is widely used in industry. While UML is mostly known as diagrammatic modeling language (e.g., visualizing class models), it is complemented by a textual language, called Object Constraint Language (OCL). The current version of OCL is based on a four-valued logic that turns UML into a formal language. Any type comprises the elements "invalid" and "null" which are propagated as strict and non-strict, respectively. Unfortunately, the former semi-formal semantics of this specification language, captured in the "Annex A" of the OCL standard, leads to different interpretations of corner cases. We formalize the core of OCL: denotational definitions, a logical calculus and operational rules that allow for the execution of OCL expressions by a mixture of term rewriting and code compilation. Our formalization reveals several inconsistencies and contradictions in the current version of the OCL standard. Overall, this document is intended to provide the basis for a machine-checked text "Annex A" of the OCL standard targeting at tool implementors. extra-history = Change history: [2015-10-13]: afp-devel@ea3b38fc54d6 and hol-testgen@12148
   Update of Featherweight OCL including a change in the abstract.
[2014-01-16]: afp-devel@9091ce05cb20 and hol-testgen@10241
   New Entry: Featherweight OCL notify = brucker@spamfence.net, tuong@users.gforge.inria.fr, wolff@lri.fr [Relation_Algebra] title = Relation Algebra author = Alasdair Armstrong <>, Simon Foster , Georg Struth , Tjark Weber date = 2014-01-25 topic = Mathematics/Algebra abstract = Tarski's algebra of binary relations is formalised along the lines of the standard textbooks of Maddux and Schmidt and Ströhlein. This includes relation-algebraic concepts such as subidentities, vectors and a domain operation as well as various notions associated to functions. Relation algebras are also expanded by a reflexive transitive closure operation, and they are linked with Kleene algebras and models of binary relations and Boolean matrices. notify = g.struth@sheffield.ac.uk, tjark.weber@it.uu.se [PSemigroupsConvolution] title = Partial Semigroups and Convolution Algebras author = Brijesh Dongol , Victor B. F. Gomes , Ian J. Hayes , Georg Struth topic = Mathematics/Algebra date = 2017-06-13 notify = g.struth@sheffield.ac.uk, victor.gomes@cl.cam.ac.uk abstract = Partial Semigroups are relevant to the foundations of quantum mechanics and combinatorics as well as to interval and separation logics. Convolution algebras can be understood either as algebras of generalised binary modalities over ternary Kripke frames, in particular over partial semigroups, or as algebras of quantale-valued functions which are equipped with a convolution-style operation of multiplication that is parametrised by a ternary relation. Convolution algebras provide algebraic semantics for various substructural logics, including categorial, relevance and linear logics, for separation logic and for interval logics; they cover quantitative and qualitative applications. These mathematical components for partial semigroups and convolution algebras provide uniform foundations from which models of computation based on relations, program traces or pomsets, and verification components for separation or interval temporal logics can be built with little effort. [Secondary_Sylow] title = Secondary Sylow Theorems author = Jakob von Raumer date = 2014-01-28 topic = Mathematics/Algebra abstract = These theories extend the existing proof of the first Sylow theorem (written by Florian Kammueller and L. C. Paulson) by what are often called the second, third and fourth Sylow theorems. These theorems state propositions about the number of Sylow p-subgroups of a group and the fact that they are conjugate to each other. The proofs make use of an implementation of group actions and their properties. notify = psxjv4@nottingham.ac.uk [Jordan_Hoelder] title = The Jordan-Hölder Theorem author = Jakob von Raumer date = 2014-09-09 topic = Mathematics/Algebra abstract = This submission contains theories that lead to a formalization of the proof of the Jordan-Hölder theorem about composition series of finite groups. The theories formalize the notions of isomorphism classes of groups, simple groups, normal series, composition series, maximal normal subgroups. Furthermore, they provide proofs of the second isomorphism theorem for groups, the characterization theorem for maximal normal subgroups as well as many useful lemmas about normal subgroups and factor groups. The proof is inspired by course notes of Stuart Rankin. notify = psxjv4@nottingham.ac.uk [Cayley_Hamilton] title = The Cayley-Hamilton Theorem author = Stephan Adelsberger , Stefan Hetzl , Florian Pollak date = 2014-09-15 topic = Mathematics/Algebra abstract = This document contains a proof of the Cayley-Hamilton theorem based on the development of matrices in HOL/Multivariate Analysis. notify = stvienna@gmail.com [Probabilistic_Noninterference] title = Probabilistic Noninterference author = Andrei Popescu , Johannes Hölzl date = 2014-03-11 topic = Computer Science/Security abstract = We formalize a probabilistic noninterference for a multi-threaded language with uniform scheduling, where probabilistic behaviour comes from both the scheduler and the individual threads. We define notions probabilistic noninterference in two variants: resumption-based and trace-based. For the resumption-based notions, we prove compositionality w.r.t. the language constructs and establish sound type-system-like syntactic criteria. This is a formalization of the mathematical development presented at CPP 2013 and CALCO 2013. It is the probabilistic variant of the Possibilistic Noninterference AFP entry. notify = hoelzl@in.tum.de [HyperCTL] title = A shallow embedding of HyperCTL* author = Markus N. Rabe , Peter Lammich , Andrei Popescu date = 2014-04-16 topic = Computer Science/Security, Logic abstract = We formalize HyperCTL*, a temporal logic for expressing security properties. We first define a shallow embedding of HyperCTL*, within which we prove inductive and coinductive rules for the operators. Then we show that a HyperCTL* formula captures Goguen-Meseguer noninterference, a landmark information flow property. We also define a deep embedding and connect it to the shallow embedding by a denotational semantics, for which we prove sanity w.r.t. dependence on the free variables. Finally, we show that under some finiteness assumptions about the model, noninterference is given by a (finitary) syntactic formula. notify = uuomul@yahoo.com [Bounded_Deducibility_Security] title = Bounded-Deducibility Security author = Andrei Popescu , Peter Lammich date = 2014-04-22 topic = Computer Science/Security abstract = This is a formalization of bounded-deducibility security (BD security), a flexible notion of information-flow security applicable to arbitrary input-output automata. It generalizes Sutherland's classic notion of nondeducibility by factoring in declassification bounds and trigger, whereas nondeducibility states that, in a system, information cannot flow between specified sources and sinks, BD security indicates upper bounds for the flow and triggers under which these upper bounds are no longer guaranteed. notify = uuomul@yahoo.com, lammich@in.tum.de [Network_Security_Policy_Verification] title = Network Security Policy Verification author = Cornelius Diekmann date = 2014-07-04 topic = Computer Science/Security abstract = We present a unified theory for verifying network security policies. A security policy is represented as directed graph. To check high-level security goals, security invariants over the policy are expressed. We cover monotonic security invariants, i.e. prohibiting more does not harm security. We provide the following contributions for the security invariant theory.
  • Secure auto-completion of scenario-specific knowledge, which eases usability.
  • Security violations can be repaired by tightening the policy iff the security invariants hold for the deny-all policy.
  • An algorithm to compute a security policy.
  • A formalization of stateful connection semantics in network security mechanisms.
  • An algorithm to compute a secure stateful implementation of a policy.
  • An executable implementation of all the theory.
  • Examples, ranging from an aircraft cabin data network to the analysis of a large real-world firewall.
  • More examples: A fully automated translation of high-level security goals to both firewall and SDN configurations (see Examples/Distributed_WebApp.thy).
For a detailed description, see extra-history = Change history: [2015-04-14]: Added Distributed WebApp example and improved graphviz visualization (revision 4dde08ca2ab8)
notify = diekmann@net.in.tum.de [Abstract_Completeness] title = Abstract Completeness author = Jasmin Christian Blanchette , Andrei Popescu , Dmitriy Traytel date = 2014-04-16 topic = Logic abstract = A formalization of an abstract property of possibly infinite derivation trees (modeled by a codatatype), representing the core of a proof (in Beth/Hintikka style) of the first-order logic completeness theorem, independent of the concrete syntax or inference rules. This work is described in detail in the IJCAR 2014 publication by the authors. The abstract proof can be instantiated for a wide range of Gentzen and tableau systems as well as various flavors of FOL---e.g., with or without predicates, equality, or sorts. Here, we give only a toy example instantiation with classical propositional logic. A more serious instance---many-sorted FOL with equality---is described elsewhere [Blanchette and Popescu, FroCoS 2013]. notify = traytel@in.tum.de [Pop_Refinement] title = Pop-Refinement author = Alessandro Coglio date = 2014-07-03 topic = Computer Science/Programming Languages/Misc abstract = Pop-refinement is an approach to stepwise refinement, carried out inside an interactive theorem prover by constructing a monotonically decreasing sequence of predicates over deeply embedded target programs. The sequence starts with a predicate that characterizes the possible implementations, and ends with a predicate that characterizes a unique program in explicit syntactic form. Pop-refinement enables more requirements (e.g. program-level and non-functional) to be captured in the initial specification and preserved through refinement. Security requirements expressed as hyperproperties (i.e. predicates over sets of traces) are always preserved by pop-refinement, unlike the popular notion of refinement as trace set inclusion. Two simple examples in Isabelle/HOL are presented, featuring program-level requirements, non-functional requirements, and hyperproperties. notify = coglio@kestrel.edu [VectorSpace] title = Vector Spaces author = Holden Lee date = 2014-08-29 topic = Mathematics/Algebra abstract = This formalisation of basic linear algebra is based completely on locales, building off HOL-Algebra. It includes basic definitions: linear combinations, span, linear independence; linear transformations; interpretation of function spaces as vector spaces; the direct sum of vector spaces, sum of subspaces; the replacement theorem; existence of bases in finite-dimensional; vector spaces, definition of dimension; the rank-nullity theorem. Some concepts are actually defined and proved for modules as they also apply there. Infinite-dimensional vector spaces are supported, but dimension is only supported for finite-dimensional vector spaces. The proofs are standard; the proofs of the replacement theorem and rank-nullity theorem roughly follow the presentation in Linear Algebra by Friedberg, Insel, and Spence. The rank-nullity theorem generalises the existing development in the Archive of Formal Proof (originally using type classes, now using a mix of type classes and locales). notify = holdenl@princeton.edu [Special_Function_Bounds] title = Real-Valued Special Functions: Upper and Lower Bounds author = Lawrence C. Paulson date = 2014-08-29 topic = Mathematics/Analysis abstract = This development proves upper and lower bounds for several familiar real-valued functions. For sin, cos, exp and sqrt, it defines and verifies infinite families of upper and lower bounds, mostly based on Taylor series expansions. For arctan, ln and exp, it verifies a finite collection of upper and lower bounds, originally obtained from the functions' continued fraction expansions using the computer algebra system Maple. A common theme in these proofs is to take the difference between a function and its approximation, which should be zero at one point, and then consider the sign of the derivative. The immediate purpose of this development is to verify axioms used by MetiTarski, an automatic theorem prover for real-valued special functions. Crucial to MetiTarski's operation is the provision of upper and lower bounds for each function of interest. notify = lp15@cam.ac.uk [Landau_Symbols] title = Landau Symbols author = Manuel Eberl date = 2015-07-14 topic = Mathematics/Analysis abstract = This entry provides Landau symbols to describe and reason about the asymptotic growth of functions for sufficiently large inputs. A number of simplification procedures are provided for additional convenience: cancelling of dominated terms in sums under a Landau symbol, cancelling of common factors in products, and a decision procedure for Landau expressions containing products of powers of functions like x, ln(x), ln(ln(x)) etc. notify = eberlm@in.tum.de [Error_Function] title = The Error Function author = Manuel Eberl topic = Mathematics/Analysis date = 2018-02-06 notify = eberlm@in.tum.de abstract =

This entry provides the definitions and basic properties of the complex and real error function erf and the complementary error function erfc. Additionally, it gives their full asymptotic expansions.

[Akra_Bazzi] title = The Akra-Bazzi theorem and the Master theorem author = Manuel Eberl date = 2015-07-14 topic = Mathematics/Analysis abstract = This article contains a formalisation of the Akra-Bazzi method based on a proof by Leighton. It is a generalisation of the well-known Master Theorem for analysing the complexity of Divide & Conquer algorithms. We also include a generalised version of the Master theorem based on the Akra-Bazzi theorem, which is easier to apply than the Akra-Bazzi theorem itself.

Some proof methods that facilitate applying the Master theorem are also included. For a more detailed explanation of the formalisation and the proof methods, see the accompanying paper (publication forthcoming). notify = eberlm@in.tum.de [Dirichlet_Series] title = Dirichlet Series author = Manuel Eberl topic = Mathematics/Number Theory date = 2017-10-12 notify = eberlm@in.tum.de abstract = This entry is a formalisation of much of Chapters 2, 3, and 11 of Apostol's “Introduction to Analytic Number Theory”. This includes:

  • Definitions and basic properties for several number-theoretic functions (Euler's φ, Möbius μ, Liouville's λ, the divisor function σ, von Mangoldt's Λ)
  • Executable code for most of these functions, the most efficient implementations using the factoring algorithm by Thiemann et al.
  • Dirichlet products and formal Dirichlet series
  • Analytic results connecting convergent formal Dirichlet series to complex functions
  • Euler product expansions
  • Asymptotic estimates of number-theoretic functions including the density of squarefree integers and the average number of divisors of a natural number
These results are useful as a basis for developing more number-theoretic results, such as the Prime Number Theorem. [Zeta_Function] title = The Hurwitz and Riemann ζ Functions author = Manuel Eberl topic = Mathematics/Number Theory, Mathematics/Analysis date = 2017-10-12 notify = eberlm@in.tum.de abstract = -

This entry builds upon the results about formal and analytic - Dirichlet series to define the Hurwitz ζ function and, based - on that, the Riemann ζ function. This is done by first - defining them for ℜ(z) > 1 and then - successively extending the domain to the left using the - Euler–MacLaurin formula.

Some basic - results about these functions are also shown, such as their - analyticity on ℂ∖{1}, that they - have a simple pole with residue 1 at 1, their relation to the - Γ function, and the special values at negative integers and - positive even integers – including the famous ζ(-1) - = -1/12 and ζ(2) = π²/6.

- Lastly, the entry also contains Euler's analytic proof of the - infinitude of primes, based on the fact that - ζ(s) has a pole at s = - 1.

+

This entry builds upon the results about formal and analytic Dirichlet + series to define the Hurwitz ζ function ζ(a,s) and, + based on that, the Riemann ζ function ζ(s). + This is done by first defining them for ℜ(z) > 1 + and then successively extending the domain to the left using the + Euler–MacLaurin formula.

+

Apart from the most basic facts such as analyticity, the following + results are provided:

+
    +
  • the Stieltjes constants and the Laurent expansion of + ζ(s) at s = 1
    • +
  • the non-vanishing of ζ(s) + for ℜ(z) ≥ 1
    • +
  • the relationship between ζ(a,s) and Γ
    • +
  • the special values at negative integers and positive even integers
    • +
  • Hurwitz's formula and the reflection formula for ζ(s)
    • +
  • the + Hadjicostas–Chapman formula
    • +
+

The entry also contains Euler's analytic proof of the infinitude of primes, + based on the fact that ζ(s) has a pole at s = 1.

[Linear_Recurrences] title = Linear Recurrences author = Manuel Eberl topic = Mathematics/Analysis date = 2017-10-12 notify = eberlm@in.tum.de abstract =

Linear recurrences with constant coefficients are an interesting class of recurrence equations that can be solved explicitly. The most famous example are certainly the Fibonacci numbers with the equation f(n) = f(n-1) + f(n - 2) and the quite non-obvious closed form (φn - (-φ)-n) / √5 where φ is the golden ratio.

In this work, I build on existing tools in Isabelle – such as formal power series and polynomial factorisation algorithms – to develop a theory of these recurrences and derive a fully executable solver for them that can be exported to programming languages like Haskell.

[Cartan_FP] title = The Cartan Fixed Point Theorems author = Lawrence C. Paulson date = 2016-03-08 topic = Mathematics/Analysis abstract = The Cartan fixed point theorems concern the group of holomorphic automorphisms on a connected open set of Cn. Ciolli et al. have formalised the one-dimensional case of these theorems in HOL Light. This entry contains their proofs, ported to Isabelle/HOL. Thus it addresses the authors' remark that "it would be important to write a formal proof in a language that can be read by both humans and machines". notify = lp15@cam.ac.uk [Gauss_Jordan] title = Gauss-Jordan Algorithm and Its Applications author = Jose Divasón , Jesús Aransay topic = Computer Science/Algorithms date = 2014-09-03 abstract = The Gauss-Jordan algorithm states that any matrix over a field can be transformed by means of elementary row operations to a matrix in reduced row echelon form. The formalization is based on the Rank Nullity Theorem entry of the AFP and on the HOL-Multivariate-Analysis session of Isabelle, where matrices are represented as functions over finite types. We have set up the code generator to make this representation executable. In order to improve the performance, a refinement to immutable arrays has been carried out. We have formalized some of the applications of the Gauss-Jordan algorithm. Thanks to this development, the following facts can be computed over matrices whose elements belong to a field: Ranks, Determinants, Inverses, Bases and dimensions and Solutions of systems of linear equations. Code can be exported to SML and Haskell. notify = jose.divasonm@unirioja.es, jesus-maria.aransay@unirioja.es [Echelon_Form] title = Echelon Form author = Jose Divasón , Jesús Aransay topic = Computer Science/Algorithms, Mathematics/Algebra date = 2015-02-12 abstract = We formalize an algorithm to compute the Echelon Form of a matrix. We have proved its existence over Bézout domains and made it executable over Euclidean domains, such as the integer ring and the univariate polynomials over a field. This allows us to compute determinants, inverses and characteristic polynomials of matrices. The work is based on the HOL-Multivariate Analysis library, and on both the Gauss-Jordan and Cayley-Hamilton AFP entries. As a by-product, some algebraic structures have been implemented (principal ideal domains, Bézout domains...). The algorithm has been refined to immutable arrays and code can be generated to functional languages as well. notify = jose.divasonm@unirioja.es, jesus-maria.aransay@unirioja.es [QR_Decomposition] title = QR Decomposition author = Jose Divasón , Jesús Aransay topic = Computer Science/Algorithms, Mathematics/Algebra date = 2015-02-12 abstract = QR decomposition is an algorithm to decompose a real matrix A into the product of two other matrices Q and R, where Q is orthogonal and R is invertible and upper triangular. The algorithm is useful for the least squares problem; i.e., the computation of the best approximation of an unsolvable system of linear equations. As a side-product, the Gram-Schmidt process has also been formalized. A refinement using immutable arrays is presented as well. The development relies, among others, on the AFP entry "Implementing field extensions of the form Q[sqrt(b)]" by René Thiemann, which allows execution of the algorithm using symbolic computations. Verified code can be generated and executed using floats as well. extra-history = Change history: [2015-06-18]: The second part of the Fundamental Theorem of Linear Algebra has been generalized to more general inner product spaces. notify = jose.divasonm@unirioja.es, jesus-maria.aransay@unirioja.es [Hermite] title = Hermite Normal Form author = Jose Divasón , Jesús Aransay topic = Computer Science/Algorithms, Mathematics/Algebra date = 2015-07-07 abstract = Hermite Normal Form is a canonical matrix analogue of Reduced Echelon Form, but involving matrices over more general rings. In this work we formalise an algorithm to compute the Hermite Normal Form of a matrix by means of elementary row operations, taking advantage of the Echelon Form AFP entry. We have proven the correctness of such an algorithm and refined it to immutable arrays. Furthermore, we have also formalised the uniqueness of the Hermite Normal Form of a matrix. Code can be exported and some examples of execution involving integer matrices and polynomial matrices are presented as well. notify = jose.divasonm@unirioja.es, jesus-maria.aransay@unirioja.es [Imperative_Insertion_Sort] title = Imperative Insertion Sort author = Christian Sternagel date = 2014-09-25 topic = Computer Science/Algorithms abstract = The insertion sort algorithm of Cormen et al. (Introduction to Algorithms) is expressed in Imperative HOL and proved to be correct and terminating. For this purpose we also provide a theory about imperative loop constructs with accompanying induction/invariant rules for proving partial and total correctness. Furthermore, the formalized algorithm is fit for code generation. notify = lp15@cam.ac.uk [Stream_Fusion_Code] title = Stream Fusion in HOL with Code Generation author = Andreas Lochbihler , Alexandra Maximova date = 2014-10-10 topic = Computer Science/Functional Programming abstract = Stream Fusion is a system for removing intermediate list data structures from functional programs, in particular Haskell. This entry adapts stream fusion to Isabelle/HOL and its code generator. We define stream types for finite and possibly infinite lists and stream versions for most of the fusible list functions in the theories List and Coinductive_List, and prove them correct with respect to the conversion functions between lists and streams. The Stream Fusion transformation itself is implemented as a simproc in the preprocessor of the code generator. [Brian Huffman's AFP entry formalises stream fusion in HOLCF for the domain of lazy lists to prove the GHC compiler rewrite rules correct. In contrast, this work enables Isabelle's code generator to perform stream fusion itself. To that end, it covers both finite and coinductive lists from the HOL library and the Coinductive entry. The fusible list functions require specification and proof principles different from Huffman's.] notify = mail@andreas-lochbihler.de [Case_Labeling] title = Generating Cases from Labeled Subgoals author = Lars Noschinski date = 2015-07-21 topic = Tools, Computer Science/Programming Languages/Misc abstract = Isabelle/Isar provides named cases to structure proofs. This article contains an implementation of a proof method casify, which can be used to easily extend proof tools with support for named cases. Such a proof tool must produce labeled subgoals, which are then interpreted by casify.

As examples, this work contains verification condition generators producing named cases for three languages: The Hoare language from HOL/Library, a monadic language for computations with failure (inspired by the AutoCorres tool), and a language of conditional expressions. These VCGs are demonstrated by a number of example programs. notify = noschinl@gmail.com [DPT-SAT-Solver] title = A Fast SAT Solver for Isabelle in Standard ML topic = Tools author = Armin Heller <> date = 2009-12-09 abstract = This contribution contains a fast SAT solver for Isabelle written in Standard ML. By loading the theory DPT_SAT_Solver, the SAT solver installs itself (under the name ``dptsat'') and certain Isabelle tools like Refute will start using it automatically. This is a port of the DPT (Decision Procedure Toolkit) SAT Solver written in OCaml. notify = jasmin.blanchette@gmail.com [Rep_Fin_Groups] title = Representations of Finite Groups topic = Mathematics/Algebra author = Jeremy Sylvestre date = 2015-08-12 abstract = We provide a formal framework for the theory of representations of finite groups, as modules over the group ring. Along the way, we develop the general theory of groups (relying on the group_add class for the basics), modules, and vector spaces, to the extent required for theory of group representations. We then provide formal proofs of several important introductory theorems in the subject, including Maschke's theorem, Schur's lemma, and Frobenius reciprocity. We also prove that every irreducible representation is isomorphic to a submodule of the group ring, leading to the fact that for a finite group there are only finitely many isomorphism classes of irreducible representations. In all of this, no restriction is made on the characteristic of the ring or field of scalars until the definition of a group representation, and then the only restriction made is that the characteristic must not divide the order of the group. notify = jsylvest@ualberta.ca [Noninterference_Inductive_Unwinding] title = The Inductive Unwinding Theorem for CSP Noninterference Security topic = Computer Science/Security author = Pasquale Noce date = 2015-08-18 abstract =

The necessary and sufficient condition for CSP noninterference security stated by the Ipurge Unwinding Theorem is expressed in terms of a pair of event lists varying over the set of process traces. This does not render it suitable for the subsequent application of rule induction in the case of a process defined inductively, since rule induction may rather be applied to a single variable ranging over an inductively defined set.

Starting from the Ipurge Unwinding Theorem, this paper derives a necessary and sufficient condition for CSP noninterference security that involves a single event list varying over the set of process traces, and is thus suitable for rule induction; hence its name, Inductive Unwinding Theorem. Similarly to the Ipurge Unwinding Theorem, the new theorem only requires to consider individual accepted and refused events for each process trace, and applies to the general case of a possibly intransitive noninterference policy. Specific variants of this theorem are additionally proven for deterministic processes and trace set processes.

notify = pasquale.noce.lavoro@gmail.com [Password_Authentication_Protocol] title = Verification of a Diffie-Hellman Password-based Authentication Protocol by Extending the Inductive Method author = Pasquale Noce topic = Computer Science/Security date = 2017-01-03 notify = pasquale.noce.lavoro@gmail.com abstract = This paper constructs a formal model of a Diffie-Hellman password-based authentication protocol between a user and a smart card, and proves its security. The protocol provides for the dispatch of the user's password to the smart card on a secure messaging channel established by means of Password Authenticated Connection Establishment (PACE), where the mapping method being used is Chip Authentication Mapping. By applying and suitably extending Paulson's Inductive Method, this paper proves that the protocol establishes trustworthy secure messaging channels, preserves the secrecy of users' passwords, and provides an effective mutual authentication service. What is more, these security properties turn out to hold independently of the secrecy of the PACE authentication key. [Jordan_Normal_Form] title = Matrices, Jordan Normal Forms, and Spectral Radius Theory topic = Mathematics/Algebra author = René Thiemann , Akihisa Yamada contributors = Alexander Bentkamp date = 2015-08-21 abstract =

Matrix interpretations are useful as measure functions in termination proving. In order to use these interpretations also for complexity analysis, the growth rate of matrix powers has to examined. Here, we formalized a central result of spectral radius theory, namely that the growth rate is polynomially bounded if and only if the spectral radius of a matrix is at most one.

To formally prove this result we first studied the growth rates of matrices in Jordan normal form, and prove the result that every complex matrix has a Jordan normal form using a constructive prove via Schur decomposition.

The whole development is based on a new abstract type for matrices, which is also executable by a suitable setup of the code generator. It completely subsumes our former AFP-entry on executable matrices, and its main advantage is its close connection to the HMA-representation which allowed us to easily adapt existing proofs on determinants.

All the results have been applied to improve CeTA, our certifier to validate termination and complexity proof certificates.

extra-history = Change history: [2016-01-07]: Added Schur-decomposition, Gram-Schmidt orthogonalization, uniqueness of Jordan normal forms
[2018-04-17]: Integrated lemmas from deep-learning AFP-entry of Alexander Bentkamp notify = rene.thiemann@uibk.ac.at, ayamada@trs.cm.is.nagoya-u.ac.jp [LTL_to_DRA] title = Converting Linear Temporal Logic to Deterministic (Generalized) Rabin Automata topic = Computer Science/Automata and Formal Languages author = Salomon Sickert date = 2015-09-04 abstract = Recently, Javier Esparza and Jan Kretinsky proposed a new method directly translating linear temporal logic (LTL) formulas to deterministic (generalized) Rabin automata. Compared to the existing approaches of constructing a non-deterministic Buechi-automaton in the first step and then applying a determinization procedure (e.g. some variant of Safra's construction) in a second step, this new approach preservers a relation between the formula and the states of the resulting automaton. While the old approach produced a monolithic structure, the new method is compositional. Furthermore, in some cases the resulting automata are much smaller than the automata generated by existing approaches. In order to ensure the correctness of the construction, this entry contains a complete formalisation and verification of the translation. Furthermore from this basis executable code is generated. extra-history = Change history: [2015-09-23]: Enable code export for the eager unfolding optimisation and reduce running time of the generated tool. Moreover, add support for the mlton SML compiler.
[2016-03-24]: Make use of the LTL entry and include the simplifier. notify = sickert@in.tum.de [Timed_Automata] title = Timed Automata author = Simon Wimmer date = 2016-03-08 topic = Computer Science/Automata and Formal Languages abstract = Timed automata are a widely used formalism for modeling real-time systems, which is employed in a class of successful model checkers such as UPPAAL [LPY97], HyTech [HHWt97] or Kronos [Yov97]. This work formalizes the theory for the subclass of diagonal-free timed automata, which is sufficient to model many interesting problems. We first define the basic concepts and semantics of diagonal-free timed automata. Based on this, we prove two types of decidability results for the language emptiness problem. The first is the classic result of Alur and Dill [AD90, AD94], which uses a finite partitioning of the state space into so-called `regions`. Our second result focuses on an approach based on `Difference Bound Matrices (DBMs)`, which is practically used by model checkers. We prove the correctness of the basic forward analysis operations on DBMs. One of these operations is the Floyd-Warshall algorithm for the all-pairs shortest paths problem. To obtain a finite search space, a widening operation has to be used for this kind of analysis. We use Patricia Bouyer's [Bou04] approach to prove that this widening operation is correct in the sense that DBM-based forward analysis in combination with the widening operation also decides language emptiness. The interesting property of this proof is that the first decidability result is reused to obtain the second one. notify = wimmers@in.tum.de [Parity_Game] title = Positional Determinacy of Parity Games author = Christoph Dittmann date = 2015-11-02 topic = Computer Science/Games abstract = We present a formalization of parity games (a two-player game on directed graphs) and a proof of their positional determinacy in Isabelle/HOL. This proof works for both finite and infinite games. notify = [Ergodic_Theory] title = Ergodic Theory author = Sebastien Gouezel date = 2015-12-01 topic = Mathematics/Probability Theory abstract = Ergodic theory is the branch of mathematics that studies the behaviour of measure preserving transformations, in finite or infinite measure. It interacts both with probability theory (mainly through measure theory) and with geometry as a lot of interesting examples are from geometric origin. We implement the first definitions and theorems of ergodic theory, including notably Poicaré recurrence theorem for finite measure preserving systems (together with the notion of conservativity in general), induced maps, Kac's theorem, Birkhoff theorem (arguably the most important theorem in ergodic theory), and variations around it such as conservativity of the corresponding skew product, or Atkinson lemma. notify = sebastien.gouezel@univ-rennes1.fr, hoelzl@in.tum.de [Latin_Square] title = Latin Square author = Alexander Bentkamp date = 2015-12-02 topic = Mathematics/Combinatorics abstract = A Latin Square is a n x n table filled with integers from 1 to n where each number appears exactly once in each row and each column. A Latin Rectangle is a partially filled n x n table with r filled rows and n-r empty rows, such that each number appears at most once in each row and each column. The main result of this theory is that any Latin Rectangle can be completed to a Latin Square. notify = bentkamp@gmail.com [Deep_Learning] title = Expressiveness of Deep Learning author = Alexander Bentkamp date = 2016-11-10 topic = Computer Science/Algorithms abstract = Deep learning has had a profound impact on computer science in recent years, with applications to search engines, image recognition and language processing, bioinformatics, and more. Recently, Cohen et al. provided theoretical evidence for the superiority of deep learning over shallow learning. This formalization of their work simplifies and generalizes the original proof, while working around the limitations of the Isabelle type system. To support the formalization, I developed reusable libraries of formalized mathematics, including results about the matrix rank, the Lebesgue measure, and multivariate polynomials, as well as a library for tensor analysis. notify = bentkamp@gmail.com [Applicative_Lifting] title = Applicative Lifting author = Andreas Lochbihler , Joshua Schneider <> date = 2015-12-22 topic = Computer Science/Functional Programming abstract = Applicative functors augment computations with effects by lifting function application to types which model the effects. As the structure of the computation cannot depend on the effects, applicative expressions can be analysed statically. This allows us to lift universally quantified equations to the effectful types, as observed by Hinze. Thus, equational reasoning over effectful computations can be reduced to pure types.

This entry provides a package for registering applicative functors and two proof methods for lifting of equations over applicative functors. The first method normalises applicative expressions according to the laws of applicative functors. This way, equations whose two sides contain the same list of variables can be lifted to every applicative functor.

To lift larger classes of equations, the second method exploits a number of additional properties (e.g., commutativity of effects) provided the properties have been declared for the concrete applicative functor at hand upon registration.

We declare several types from the Isabelle library as applicative functors and illustrate the use of the methods with two examples: the lifting of the arithmetic type class hierarchy to streams and the verification of a relabelling function on binary trees. We also formalise and verify the normalisation algorithm used by the first proof method.

extra-history = Change history: [2016-03-03]: added formalisation of lifting with combinators
[2016-06-10]: implemented automatic derivation of lifted combinator reductions; support arbitrary lifted relations using relators; improved compatibility with locale interpretation (revision ec336f354f37)
notify = mail@andreas-lochbihler.de [Stern_Brocot] title = The Stern-Brocot Tree author = Peter Gammie , Andreas Lochbihler date = 2015-12-22 topic = Mathematics/Number Theory abstract = The Stern-Brocot tree contains all rational numbers exactly once and in their lowest terms. We formalise the Stern-Brocot tree as a coinductive tree using recursive and iterative specifications, which we have proven equivalent, and show that it indeed contains all the numbers as stated. Following Hinze, we prove that the Stern-Brocot tree can be linearised looplessly into Stern's diatonic sequence (also known as Dijkstra's fusc function) and that it is a permutation of the Bird tree.

The reasoning stays at an abstract level by appealing to the uniqueness of solutions of guarded recursive equations and lifting algebraic laws point-wise to trees and streams using applicative functors.

notify = mail@andreas-lochbihler.de [Algebraic_Numbers] title = Algebraic Numbers in Isabelle/HOL topic = Mathematics/Algebra author = René Thiemann , Akihisa Yamada , Sebastiaan Joosten date = 2015-12-22 abstract = Based on existing libraries for matrices, factorization of rational polynomials, and Sturm's theorem, we formalized algebraic numbers in Isabelle/HOL. Our development serves as an implementation for real and complex numbers, and it admits to compute roots and completely factorize real and complex polynomials, provided that all coefficients are rational numbers. Moreover, we provide two implementations to display algebraic numbers, an injective and expensive one, or a faster but approximative version.

To this end, we mechanized several results on resultants, which also required us to prove that polynomials over a unique factorization domain form again a unique factorization domain.

extra-history = Change history: [2016-01-29]: Split off Polynomial Interpolation and Polynomial Factorization
[2017-04-16]: Use certified Berlekamp-Zassenhaus factorization, use subresultant algorithm for computing resultants, improved bisection algorithm notify = rene.thiemann@uibk.ac.at, ayamada@trs.cm.is.nagoya-u.ac.jp, sebastiaan.joosten@uibk.ac.at [Polynomial_Interpolation] title = Polynomial Interpolation topic = Mathematics/Algebra author = René Thiemann , Akihisa Yamada date = 2016-01-29 abstract = We formalized three algorithms for polynomial interpolation over arbitrary fields: Lagrange's explicit expression, the recursive algorithm of Neville and Aitken, and the Newton interpolation in combination with an efficient implementation of divided differences. Variants of these algorithms for integer polynomials are also available, where sometimes the interpolation can fail; e.g., there is no linear integer polynomial p such that p(0) = 0 and p(2) = 1. Moreover, for the Newton interpolation for integer polynomials, we proved that all intermediate results that are computed during the algorithm must be integers. This admits an early failure detection in the implementation. Finally, we proved the uniqueness of polynomial interpolation.

The development also contains improved code equations to speed up the division of integers in target languages. notify = rene.thiemann@uibk.ac.at, ayamada@trs.cm.is.nagoya-u.ac.jp [Polynomial_Factorization] title = Polynomial Factorization topic = Mathematics/Algebra author = René Thiemann , Akihisa Yamada date = 2016-01-29 abstract = Based on existing libraries for polynomial interpolation and matrices, we formalized several factorization algorithms for polynomials, including Kronecker's algorithm for integer polynomials, Yun's square-free factorization algorithm for field polynomials, and Berlekamp's algorithm for polynomials over finite fields. By combining the last one with Hensel's lifting, we derive an efficient factorization algorithm for the integer polynomials, which is then lifted for rational polynomials by mechanizing Gauss' lemma. Finally, we assembled a combined factorization algorithm for rational polynomials, which combines all the mentioned algorithms and additionally uses the explicit formula for roots of quadratic polynomials and a rational root test.

As side products, we developed division algorithms for polynomials over integral domains, as well as primality-testing and prime-factorization algorithms for integers. notify = rene.thiemann@uibk.ac.at, ayamada@trs.cm.is.nagoya-u.ac.jp [Perron_Frobenius] title = Perron-Frobenius Theorem for Spectral Radius Analysis author = Jose Divasón , Ondřej Kunčar , René Thiemann , Akihisa Yamada notify = rene.thiemann@uibk.ac.at date = 2016-05-20 topic = Mathematics/Algebra abstract =

The spectral radius of a matrix A is the maximum norm of all eigenvalues of A. In previous work we already formalized that for a complex matrix A, the values in An grow polynomially in n if and only if the spectral radius is at most one. One problem with the above characterization is the determination of all complex eigenvalues. In case A contains only non-negative real values, a simplification is possible with the help of the Perron–Frobenius theorem, which tells us that it suffices to consider only the real eigenvalues of A, i.e., applying Sturm's method can decide the polynomial growth of An.

We formalize the Perron–Frobenius theorem based on a proof via Brouwer's fixpoint theorem, which is available in the HOL multivariate analysis (HMA) library. Since the results on the spectral radius is based on matrices in the Jordan normal form (JNF) library, we further develop a connection which allows us to easily transfer theorems between HMA and JNF. With this connection we derive the combined result: if A is a non-negative real matrix, and no real eigenvalue of A is strictly larger than one, then An is polynomially bounded in n.

extra-history = Change history: [2017-10-18]: added Perron-Frobenius theorem for irreducible matrices with generalization (revision bda1f1ce8a1c)
[2018-05-17]: prove conjecture of CPP'18 paper: Jordan blocks of spectral radius have maximum size (revision ffdb3794e5d5) [Stochastic_Matrices] title = Stochastic Matrices and the Perron-Frobenius Theorem author = René Thiemann topic = Mathematics/Algebra, Computer Science/Automata and Formal Languages date = 2017-11-22 notify = rene.thiemann@uibk.ac.at abstract = Stochastic matrices are a convenient way to model discrete-time and finite state Markov chains. The Perron–Frobenius theorem tells us something about the existence and uniqueness of non-negative eigenvectors of a stochastic matrix. In this entry, we formalize stochastic matrices, link the formalization to the existing AFP-entry on Markov chains, and apply the Perron–Frobenius theorem to prove that stationary distributions always exist, and they are unique if the stochastic matrix is irreducible. [Formal_SSA] title = Verified Construction of Static Single Assignment Form author = Sebastian Ullrich , Denis Lohner date = 2016-02-05 topic = Computer Science/Algorithms, Computer Science/Programming Languages/Transformations abstract =

We define a functional variant of the static single assignment (SSA) form construction algorithm described by Braun et al., which combines simplicity and efficiency. The definition is based on a general, abstract control flow graph representation using Isabelle locales.

We prove that the algorithm's output is semantically equivalent to the input according to a small-step semantics, and that it is in minimal SSA form for the common special case of reducible inputs. We then show the satisfiability of the locale assumptions by giving instantiations for a simple While language.

Furthermore, we use a generic instantiation based on typedefs in order to extract OCaml code and replace the unverified SSA construction algorithm of the CompCertSSA project with it.

A more detailed description of the verified SSA construction can be found in the paper Verified Construction of Static Single Assignment Form, CC 2016.

notify = denis.lohner@kit.edu [Minimal_SSA] title = Minimal Static Single Assignment Form author = Max Wagner , Denis Lohner topic = Computer Science/Programming Languages/Transformations date = 2017-01-17 notify = denis.lohner@kit.edu abstract =

This formalization is an extension to "Verified Construction of Static Single Assignment Form". In their work, the authors have shown that Braun et al.'s static single assignment (SSA) construction algorithm produces minimal SSA form for input programs with a reducible control flow graph (CFG). However Braun et al. also proposed an extension to their algorithm that they claim produces minimal SSA form even for irreducible CFGs.
In this formalization we support that claim by giving a mechanized proof.

As the extension of Braun et al.'s algorithm aims for removing so-called redundant strongly connected components of phi functions, we show that this suffices to guarantee minimality according to Cytron et al..

[PropResPI] title = Propositional Resolution and Prime Implicates Generation author = Nicolas Peltier notify = Nicolas.Peltier@imag.fr date = 2016-03-11 topic = Logic abstract = We provide formal proofs in Isabelle-HOL (using mostly structured Isar proofs) of the soundness and completeness of the Resolution rule in propositional logic. The completeness proofs take into account the usual redundancy elimination rules (tautology elimination and subsumption), and several refinements of the Resolution rule are considered: ordered resolution (with selection functions), positive and negative resolution, semantic resolution and unit resolution (the latter refinement is complete only for clause sets that are Horn- renamable). We also define a concrete procedure for computing saturated sets and establish its soundness and completeness. The clause sets are not assumed to be finite, so that the results can be applied to formulas obtained by grounding sets of first-order clauses (however, a total ordering among atoms is assumed to be given). Next, we show that the unrestricted Resolution rule is deductive- complete, in the sense that it is able to generate all (prime) implicates of any set of propositional clauses (i.e., all entailment- minimal, non-valid, clausal consequences of the considered set). The generation of prime implicates is an important problem, with many applications in artificial intelligence and verification (for abductive reasoning, knowledge compilation, diagnosis, debugging etc.). We also show that implicates can be computed in an incremental way, by fixing an ordering among all the atoms in the considered sets and resolving upon these atoms one by one in the considered order (with no backtracking). This feature is critical for the efficient computation of prime implicates. Building on these results, we provide a procedure for computing such implicates and establish its soundness and completeness. [SuperCalc] title = A Variant of the Superposition Calculus author = Nicolas Peltier notify = Nicolas.Peltier@imag.fr date = 2016-09-06 topic = Logic abstract = We provide a formalization of a variant of the superposition calculus, together with formal proofs of soundness and refutational completeness (w.r.t. the usual redundancy criteria based on clause ordering). This version of the calculus uses all the standard restrictions of the superposition rules, together with the following refinement, inspired by the basic superposition calculus: each clause is associated with a set of terms which are assumed to be in normal form -- thus any application of the replacement rule on these terms is blocked. The set is initially empty and terms may be added or removed at each inference step. The set of terms that are assumed to be in normal form includes any term introduced by previous unifiers as well as any term occurring in the parent clauses at a position that is smaller (according to some given ordering on positions) than a previously replaced term. The standard superposition calculus corresponds to the case where the set of irreducible terms is always empty. [Nominal2] title = Nominal 2 author = Christian Urban , Stefan Berghofer , Cezary Kaliszyk date = 2013-02-21 topic = Tools abstract =

Dealing with binders, renaming of bound variables, capture-avoiding substitution, etc., is very often a major problem in formal proofs, especially in proofs by structural and rule induction. Nominal Isabelle is designed to make such proofs easy to formalise: it provides an infrastructure for declaring nominal datatypes (that is alpha-equivalence classes) and for defining functions over them by structural recursion. It also provides induction principles that have Barendregt’s variable convention already built in.

This entry can be used as a more advanced replacement for HOL/Nominal in the Isabelle distribution.

notify = christian.urban@kcl.ac.uk [First_Welfare_Theorem] title = Microeconomics and the First Welfare Theorem author = Julian Parsert , Cezary Kaliszyk topic = Mathematics/Economics license = LGPL date = 2017-09-01 notify = julian.parsert@uibk.ac.at, cezary.kaliszyk@uibk.ac.at abstract = Economic activity has always been a fundamental part of society. Due to modern day politics, economic theory has gained even more influence on our lives. Thus we want models and theories to be as precise as possible. This can be achieved using certification with the help of formal proof technology. Hence we will use Isabelle/HOL to construct two economic models, that of the the pure exchange economy and a version of the Arrow-Debreu Model. We will prove that the First Theorem of Welfare Economics holds within both. The theorem is the mathematical formulation of Adam Smith's famous invisible hand and states that a group of self-interested and rational actors will eventually achieve an efficient allocation of goods and services. extra-history = Change history: [2018-06-17]: Added some lemmas and a theory file, also introduced Microeconomics folder.
[Noninterference_Sequential_Composition] title = Conservation of CSP Noninterference Security under Sequential Composition author = Pasquale Noce date = 2016-04-26 topic = Computer Science/Security, Computer Science/Concurrency/Process Calculi abstract =

In his outstanding work on Communicating Sequential Processes, Hoare has defined two fundamental binary operations allowing to compose the input processes into another, typically more complex, process: sequential composition and concurrent composition. Particularly, the output of the former operation is a process that initially behaves like the first operand, and then like the second operand once the execution of the first one has terminated successfully, as long as it does.

This paper formalizes Hoare's definition of sequential composition and proves, in the general case of a possibly intransitive policy, that CSP noninterference security is conserved under this operation, provided that successful termination cannot be affected by confidential events and cannot occur as an alternative to other events in the traces of the first operand. Both of these assumptions are shown, by means of counterexamples, to be necessary for the theorem to hold.

notify = pasquale.noce.lavoro@gmail.com [Noninterference_Concurrent_Composition] title = Conservation of CSP Noninterference Security under Concurrent Composition author = Pasquale Noce notify = pasquale.noce.lavoro@gmail.com date = 2016-06-13 topic = Computer Science/Security, Computer Science/Concurrency/Process Calculi abstract =

In his outstanding work on Communicating Sequential Processes, Hoare has defined two fundamental binary operations allowing to compose the input processes into another, typically more complex, process: sequential composition and concurrent composition. Particularly, the output of the latter operation is a process in which any event not shared by both operands can occur whenever the operand that admits the event can engage in it, whereas any event shared by both operands can occur just in case both can engage in it.

This paper formalizes Hoare's definition of concurrent composition and proves, in the general case of a possibly intransitive policy, that CSP noninterference security is conserved under this operation. This result, along with the previous analogous one concerning sequential composition, enables the construction of more and more complex processes enforcing noninterference security by composing, sequentially or concurrently, simpler secure processes, whose security can in turn be proven using either the definition of security, or unwinding theorems.

[ROBDD] title = Algorithms for Reduced Ordered Binary Decision Diagrams author = Julius Michaelis , Maximilian Haslbeck , Peter Lammich , Lars Hupel date = 2016-04-27 topic = Computer Science/Algorithms, Computer Science/Data Structures abstract = We present a verified and executable implementation of ROBDDs in Isabelle/HOL. Our implementation relates pointer-based computation in the Heap monad to operations on an abstract definition of boolean functions. Internally, we implemented the if-then-else combinator in a recursive fashion, following the Shannon decomposition of the argument functions. The implementation mixes and adapts known techniques and is built with efficiency in mind. notify = bdd@liftm.de, haslbecm@in.tum.de [No_FTL_observers] title = No Faster-Than-Light Observers author = Mike Stannett , István Németi date = 2016-04-28 topic = Mathematics/Physics abstract = We provide a formal proof within First Order Relativity Theory that no observer can travel faster than the speed of light. Originally reported in Stannett & Németi (2014) "Using Isabelle/HOL to verify first-order relativity theory", Journal of Automated Reasoning 52(4), pp. 361-378. notify = m.stannett@sheffield.ac.uk [Groebner_Bases] title = Gröbner Bases Theory author = Fabian Immler , Alexander Maletzky date = 2016-05-02 topic = Mathematics/Algebra, Computer Science/Algorithms abstract = This formalization is concerned with the theory of Gröbner bases in (commutative) multivariate polynomial rings over fields, originally developed by Buchberger in his 1965 PhD thesis. Apart from the statement and proof of the main theorem of the theory, the formalization also implements Buchberger's algorithm for actually computing Gröbner bases as a tail-recursive function, thus allowing to effectively decide ideal membership in finitely generated polynomial ideals. Furthermore, all functions can be executed on a concrete representation of multivariate polynomials as association lists. extra-history = Change history: [2019-04-18]: Specialized Gröbner bases to less abstract representation of polynomials, where power-products are represented as polynomial mappings.
notify = alexander.maletzky@risc.jku.at [Nullstellensatz] title = Hilbert's Nullstellensatz author = Alexander Maletzky topic = Mathematics/Algebra, Mathematics/Geometry date = 2019-06-16 notify = alexander.maletzky@risc-software.at abstract = This entry formalizes Hilbert's Nullstellensatz, an important theorem in algebraic geometry that can be viewed as the generalization of the Fundamental Theorem of Algebra to multivariate polynomials: If a set of (multivariate) polynomials over an algebraically closed field has no common zero, then the ideal it generates is the entire polynomial ring. The formalization proves several equivalent versions of this celebrated theorem: the weak Nullstellensatz, the strong Nullstellensatz (connecting algebraic varieties and radical ideals), and the field-theoretic Nullstellensatz. The formalization follows Chapter 4.1. of Ideals, Varieties, and Algorithms by Cox, Little and O'Shea. [Bell_Numbers_Spivey] title = Spivey's Generalized Recurrence for Bell Numbers author = Lukas Bulwahn date = 2016-05-04 topic = Mathematics/Combinatorics abstract = This entry defines the Bell numbers as the cardinality of set partitions for a carrier set of given size, and derives Spivey's generalized recurrence relation for Bell numbers following his elegant and intuitive combinatorial proof.

As the set construction for the combinatorial proof requires construction of three intermediate structures, the main difficulty of the formalization is handling the overall combinatorial argument in a structured way. The introduced proof structure allows us to compose the combinatorial argument from its subparts, and supports to keep track how the detailed proof steps are related to the overall argument. To obtain this structure, this entry uses set monad notation for the set construction's definition, introduces suitable predicates and rules, and follows a repeating structure in its Isar proof. notify = lukas.bulwahn@gmail.com [Randomised_Social_Choice] title = Randomised Social Choice Theory author = Manuel Eberl date = 2016-05-05 topic = Mathematics/Economics abstract = This work contains a formalisation of basic Randomised Social Choice, including Stochastic Dominance and Social Decision Schemes (SDSs) along with some of their most important properties (Anonymity, Neutrality, ex-post- and SD-Efficiency, SD-Strategy-Proofness) and two particular SDSs – Random Dictatorship and Random Serial Dictatorship (with proofs of the properties that they satisfy). Many important properties of these concepts are also proven – such as the two equivalent characterisations of Stochastic Dominance and the fact that SD-efficiency of a lottery only depends on the support. The entry also provides convenient commands to define Preference Profiles, prove their well-formedness, and automatically derive restrictions that sufficiently nice SDSs need to satisfy on the defined profiles. Currently, the formalisation focuses on weak preferences and Stochastic Dominance, but it should be easy to extend it to other domains – such as strict preferences – or other lottery extensions – such as Bilinear Dominance or Pairwise Comparison. notify = eberlm@in.tum.de [SDS_Impossibility] title = The Incompatibility of SD-Efficiency and SD-Strategy-Proofness author = Manuel Eberl date = 2016-05-04 topic = Mathematics/Economics abstract = This formalisation contains the proof that there is no anonymous and neutral Social Decision Scheme for at least four voters and alternatives that fulfils both SD-Efficiency and SD-Strategy- Proofness. The proof is a fully structured and quasi-human-redable one. It was derived from the (unstructured) SMT proof of the case for exactly four voters and alternatives by Brandl et al. Their proof relies on an unverified translation of the original problem to SMT, and the proof that lifts the argument for exactly four voters and alternatives to the general case is also not machine-checked. In this Isabelle proof, on the other hand, all of these steps are fully proven and machine-checked. This is particularly important seeing as a previously published informal proof of a weaker statement contained a mistake in precisely this lifting step. notify = eberlm@in.tum.de [Median_Of_Medians_Selection] title = The Median-of-Medians Selection Algorithm author = Manuel Eberl topic = Computer Science/Algorithms date = 2017-12-21 notify = eberlm@in.tum.de abstract =

This entry provides an executable functional implementation of the Median-of-Medians algorithm for selecting the k-th smallest element of an unsorted list deterministically in linear time. The size bounds for the recursive call that lead to the linear upper bound on the run-time of the algorithm are also proven.

[Mason_Stothers] title = The Mason–Stothers Theorem author = Manuel Eberl topic = Mathematics/Algebra date = 2017-12-21 notify = eberlm@in.tum.de abstract =

This article provides a formalisation of Snyder’s simple and elegant proof of the Mason–Stothers theorem, which is the polynomial analogue of the famous abc Conjecture for integers. Remarkably, Snyder found this very elegant proof when he was still a high-school student.

In short, the statement of the theorem is that three non-zero coprime polynomials A, B, C over a field which sum to 0 and do not all have vanishing derivatives fulfil max{deg(A), deg(B), deg(C)} < deg(rad(ABC)) where the rad(P) denotes the radical of P, i. e. the product of all unique irreducible factors of P.

This theorem also implies a kind of polynomial analogue of Fermat’s Last Theorem for polynomials: except for trivial cases, An + Bn + Cn = 0 implies n ≤ 2 for coprime polynomials A, B, C over a field.

[FLP] title = A Constructive Proof for FLP author = Benjamin Bisping , Paul-David Brodmann , Tim Jungnickel , Christina Rickmann , Henning Seidler , Anke Stüber , Arno Wilhelm-Weidner , Kirstin Peters , Uwe Nestmann date = 2016-05-18 topic = Computer Science/Concurrency abstract = The impossibility of distributed consensus with one faulty process is a result with important consequences for real world distributed systems e.g., commits in replicated databases. Since proofs are not immune to faults and even plausible proofs with a profound formalism can conclude wrong results, we validate the fundamental result named FLP after Fischer, Lynch and Paterson. We present a formalization of distributed systems and the aforementioned consensus problem. Our proof is based on Hagen Völzer's paper "A constructive proof for FLP". In addition to the enhanced confidence in the validity of Völzer's proof, we contribute the missing gaps to show the correctness in Isabelle/HOL. We clarify the proof details and even prove fairness of the infinite execution that contradicts consensus. Our Isabelle formalization can also be reused for further proofs of properties of distributed systems. notify = henning.seidler@mailbox.tu-berlin.de [IMAP-CRDT] title = The IMAP CmRDT author = Tim Jungnickel , Lennart Oldenburg <>, Matthias Loibl <> topic = Computer Science/Algorithms, Computer Science/Data Structures date = 2017-11-09 notify = tim.jungnickel@tu-berlin.de abstract = We provide our Isabelle/HOL formalization of a Conflict-free Replicated Datatype for Internet Message Access Protocol commands. We show that Strong Eventual Consistency (SEC) is guaranteed by proving the commutativity of concurrent operations. We base our formalization on the recently proposed "framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes" (AFP.CRDT) from Gomes et al. Hence, we provide an additional example of how the recently proposed framework can be used to design and prove CRDTs. [Incredible_Proof_Machine] title = The meta theory of the Incredible Proof Machine author = Joachim Breitner , Denis Lohner date = 2016-05-20 topic = Logic abstract = The Incredible Proof Machine is an interactive visual theorem prover which represents proofs as port graphs. We model this proof representation in Isabelle, and prove that it is just as powerful as natural deduction. notify = mail@joachim-breitner.de [Word_Lib] title = Finite Machine Word Library author = Joel Beeren<>, Matthew Fernandez<>, Xin Gao<>, Gerwin Klein , Rafal Kolanski<>, Japheth Lim<>, Corey Lewis<>, Daniel Matichuk<>, Thomas Sewell<> notify = kleing@unsw.edu.au date = 2016-06-09 topic = Computer Science/Data Structures abstract = This entry contains an extension to the Isabelle library for fixed-width machine words. In particular, the entry adds quickcheck setup for words, printing as hexadecimals, additional operations, reasoning about alignment, signed words, enumerations of words, normalisation of word numerals, and an extensive library of properties about generic fixed-width words, as well as an instantiation of many of these to the commonly used 32 and 64-bit bases. [Catalan_Numbers] title = Catalan Numbers author = Manuel Eberl notify = eberlm@in.tum.de date = 2016-06-21 topic = Mathematics/Combinatorics abstract =

In this work, we define the Catalan numbers Cn and prove several equivalent definitions (including some closed-form formulae). We also show one of their applications (counting the number of binary trees of size n), prove the asymptotic growth approximation Cn ∼ 4n / (√π · n1.5), and provide reasonably efficient executable code to compute them.

The derivation of the closed-form formulae uses algebraic manipulations of the ordinary generating function of the Catalan numbers, and the asymptotic approximation is then done using generalised binomial coefficients and the Gamma function. Thanks to these highly non-elementary mathematical tools, the proofs are very short and simple.

[Fisher_Yates] title = Fisher–Yates shuffle author = Manuel Eberl notify = eberlm@in.tum.de date = 2016-09-30 topic = Computer Science/Algorithms abstract =

This work defines and proves the correctness of the Fisher–Yates algorithm for shuffling – i.e. producing a random permutation – of a list. The algorithm proceeds by traversing the list and in each step swapping the current element with a random element from the remaining list.

[Bertrands_Postulate] title = Bertrand's postulate author = Julian Biendarra<>, Manuel Eberl contributors = Lawrence C. Paulson topic = Mathematics/Number Theory date = 2017-01-17 notify = eberlm@in.tum.de abstract =

Bertrand's postulate is an early result on the distribution of prime numbers: For every positive integer n, there exists a prime number that lies strictly between n and 2n. The proof is ported from John Harrison's formalisation in HOL Light. It proceeds by first showing that the property is true for all n greater than or equal to 600 and then showing that it also holds for all n below 600 by case distinction.

[Rewriting_Z] title = The Z Property author = Bertram Felgenhauer<>, Julian Nagele<>, Vincent van Oostrom<>, Christian Sternagel notify = bertram.felgenhauer@uibk.ac.at, julian.nagele@uibk.ac.at, c.sternagel@gmail.com date = 2016-06-30 topic = Logic/Rewriting abstract = We formalize the Z property introduced by Dehornoy and van Oostrom. First we show that for any abstract rewrite system, Z implies confluence. Then we give two examples of proofs using Z: confluence of lambda-calculus with respect to beta-reduction and confluence of combinatory logic. [Resolution_FOL] title = The Resolution Calculus for First-Order Logic author = Anders Schlichtkrull notify = andschl@dtu.dk date = 2016-06-30 topic = Logic abstract = This theory is a formalization of the resolution calculus for first-order logic. It is proven sound and complete. The soundness proof uses the substitution lemma, which shows a correspondence between substitutions and updates to an environment. The completeness proof uses semantic trees, i.e. trees whose paths are partial Herbrand interpretations. It employs Herbrand's theorem in a formulation which states that an unsatisfiable set of clauses has a finite closed semantic tree. It also uses the lifting lemma which lifts resolution derivation steps from the ground world up to the first-order world. The theory is presented in a paper in the Journal of Automated Reasoning [Sch18] which extends a paper presented at the International Conference on Interactive Theorem Proving [Sch16]. An earlier version was presented in an MSc thesis [Sch15]. The formalization mostly follows textbooks by Ben-Ari [BA12], Chang and Lee [CL73], and Leitsch [Lei97]. The theory is part of the IsaFoL project [IsaFoL].

[Sch18] Anders Schlichtkrull. "Formalization of the Resolution Calculus for First-Order Logic". Journal of Automated Reasoning, 2018.
[Sch16] Anders Schlichtkrull. "Formalization of the Resolution Calculus for First-Order Logic". In: ITP 2016. Vol. 9807. LNCS. Springer, 2016.
[Sch15] Anders Schlichtkrull. "Formalization of Resolution Calculus in Isabelle". https://people.compute.dtu.dk/andschl/Thesis.pdf. MSc thesis. Technical University of Denmark, 2015.
[BA12] Mordechai Ben-Ari. Mathematical Logic for Computer Science. 3rd. Springer, 2012.
[CL73] Chin-Liang Chang and Richard Char-Tung Lee. Symbolic Logic and Mechanical Theorem Proving. 1st. Academic Press, Inc., 1973.
[Lei97] Alexander Leitsch. The Resolution Calculus. Texts in theoretical computer science. Springer, 1997.
[IsaFoL] IsaFoL authors. IsaFoL: Isabelle Formalization of Logic. https://bitbucket.org/jasmin_blanchette/isafol. extra-history = Change history: [2018-01-24]: added several new versions of the soundness and completeness theorems as described in the paper [Sch18].
[2018-03-20]: added a concrete instance of the unification and completeness theorems using the First-Order Terms AFP-entry from IsaFoR as described in the papers [Sch16] and [Sch18]. [Surprise_Paradox] title = Surprise Paradox author = Joachim Breitner notify = mail@joachim-breitner.de date = 2016-07-17 topic = Logic abstract = In 1964, Fitch showed that the paradox of the surprise hanging can be resolved by showing that the judge’s verdict is inconsistent. His formalization builds on Gödel’s coding of provability. In this theory, we reproduce his proof in Isabelle, building on Paulson’s formalisation of Gödel’s incompleteness theorems. [Ptolemys_Theorem] title = Ptolemy's Theorem author = Lukas Bulwahn notify = lukas.bulwahn@gmail.com date = 2016-08-07 topic = Mathematics/Geometry abstract = This entry provides an analytic proof to Ptolemy's Theorem using polar form transformation and trigonometric identities. In this formalization, we use ideas from John Harrison's HOL Light formalization and the proof sketch on the Wikipedia entry of Ptolemy's Theorem. This theorem is the 95th theorem of the Top 100 Theorems list. [Falling_Factorial_Sum] title = The Falling Factorial of a Sum author = Lukas Bulwahn topic = Mathematics/Combinatorics date = 2017-12-22 notify = lukas.bulwahn@gmail.com abstract = This entry shows that the falling factorial of a sum can be computed with an expression using binomial coefficients and the falling factorial of its summands. The entry provides three different proofs: a combinatorial proof, an induction proof and an algebraic proof using the Vandermonde identity. The three formalizations try to follow their informal presentations from a Mathematics Stack Exchange page as close as possible. The induction and algebraic formalization end up to be very close to their informal presentation, whereas the combinatorial proof first requires the introduction of list interleavings, and significant more detail than its informal presentation. [InfPathElimination] title = Infeasible Paths Elimination by Symbolic Execution Techniques: Proof of Correctness and Preservation of Paths author = Romain Aissat<>, Frederic Voisin<>, Burkhart Wolff notify = wolff@lri.fr date = 2016-08-18 topic = Computer Science/Programming Languages/Static Analysis abstract = TRACER is a tool for verifying safety properties of sequential C programs. TRACER attempts at building a finite symbolic execution graph which over-approximates the set of all concrete reachable states and the set of feasible paths. We present an abstract framework for TRACER and similar CEGAR-like systems. The framework provides 1) a graph- transformation based method for reducing the feasible paths in control-flow graphs, 2) a model for symbolic execution, subsumption, predicate abstraction and invariant generation. In this framework we formally prove two key properties: correct construction of the symbolic states and preservation of feasible paths. The framework focuses on core operations, leaving to concrete prototypes to “fit in” heuristics for combining them. The accompanying paper (published in ITP 2016) can be found at https://www.lri.fr/∼wolff/papers/conf/2016-itp-InfPathsNSE.pdf. [Stirling_Formula] title = Stirling's formula author = Manuel Eberl notify = eberlm@in.tum.de date = 2016-09-01 topic = Mathematics/Analysis abstract = This work contains a proof of Stirling's formula both for the factorial n! ∼ √2πn (n/e)n on natural numbers and the real Gamma function Γ(x) ∼ √2π/x (x/e)x. The proof is based on work by Graham Jameson. [Lp] title = Lp spaces author = Sebastien Gouezel notify = sebastien.gouezel@univ-rennes1.fr date = 2016-10-05 topic = Mathematics/Analysis abstract = Lp is the space of functions whose p-th power is integrable. It is one of the most fundamental Banach spaces that is used in analysis and probability. We develop a framework for function spaces, and then implement the Lp spaces in this framework using the existing integration theory in Isabelle/HOL. Our development contains most fundamental properties of Lp spaces, notably the Hölder and Minkowski inequalities, completeness of Lp, duality, stability under almost sure convergence, multiplication of functions in Lp and Lq, stability under conditional expectation. [Berlekamp_Zassenhaus] title = The Factorization Algorithm of Berlekamp and Zassenhaus author = Jose Divasón , Sebastiaan Joosten , René Thiemann , Akihisa Yamada notify = rene.thiemann@uibk.ac.at date = 2016-10-14 topic = Mathematics/Algebra abstract =

We formalize the Berlekamp-Zassenhaus algorithm for factoring square-free integer polynomials in Isabelle/HOL. We further adapt an existing formalization of Yun’s square-free factorization algorithm to integer polynomials, and thus provide an efficient and certified factorization algorithm for arbitrary univariate polynomials.

The algorithm first performs a factorization in the prime field GF(p) and then performs computations in the integer ring modulo p^k, where both p and k are determined at runtime. Since a natural modeling of these structures via dependent types is not possible in Isabelle/HOL, we formalize the whole algorithm using Isabelle’s recent addition of local type definitions.

Through experiments we verify that our algorithm factors polynomials of degree 100 within seconds.

[Allen_Calculus] title = Allen's Interval Calculus author = Fadoua Ghourabi <> notify = fadouaghourabi@gmail.com date = 2016-09-29 topic = Logic, Mathematics/Order abstract = Allen’s interval calculus is a qualitative temporal representation of time events. Allen introduced 13 binary relations that describe all the possible arrangements between two events, i.e. intervals with non-zero finite length. The compositions are pertinent to reasoning about knowledge of time. In particular, a consistency problem of relation constraints is commonly solved with a guideline from these compositions. We formalize the relations together with an axiomatic system. We proof the validity of the 169 compositions of these relations. We also define nests as the sets of intervals that share a meeting point. We prove that nests give the ordering properties of points without introducing a new datatype for points. [1] J.F. Allen. Maintaining Knowledge about Temporal Intervals. In Commun. ACM, volume 26, pages 832–843, 1983. [2] J. F. Allen and P. J. Hayes. A Common-sense Theory of Time. In Proceedings of the 9th International Joint Conference on Artificial Intelligence (IJCAI’85), pages 528–531, 1985. [Source_Coding_Theorem] title = Source Coding Theorem author = Quentin Hibon , Lawrence C. Paulson notify = qh225@cl.cam.ac.uk date = 2016-10-19 topic = Mathematics/Probability Theory abstract = This document contains a proof of the necessary condition on the code rate of a source code, namely that this code rate is bounded by the entropy of the source. This represents one half of Shannon's source coding theorem, which is itself an equivalence. [Buffons_Needle] title = Buffon's Needle Problem author = Manuel Eberl topic = Mathematics/Probability Theory, Mathematics/Geometry date = 2017-06-06 notify = eberlm@in.tum.de abstract = In the 18th century, Georges-Louis Leclerc, Comte de Buffon posed and later solved the following problem, which is often called the first problem ever solved in geometric probability: Given a floor divided into vertical strips of the same width, what is the probability that a needle thrown onto the floor randomly will cross two strips? This entry formally defines the problem in the case where the needle's position is chosen uniformly at random in a single strip around the origin (which is equivalent to larger arrangements due to symmetry). It then provides proofs of the simple solution in the case where the needle's length is no greater than the width of the strips and the more complicated solution in the opposite case. [SPARCv8] title = A formal model for the SPARCv8 ISA and a proof of non-interference for the LEON3 processor author = Zhe Hou , David Sanan , Alwen Tiu , Yang Liu notify = zhe.hou@ntu.edu.sg, sanan@ntu.edu.sg date = 2016-10-19 topic = Computer Science/Security, Computer Science/Hardware abstract = We formalise the SPARCv8 instruction set architecture (ISA) which is used in processors such as LEON3. Our formalisation can be specialised to any SPARCv8 CPU, here we use LEON3 as a running example. Our model covers the operational semantics for all the instructions in the integer unit of the SPARCv8 architecture and it supports Isabelle code export, which effectively turns the Isabelle model into a SPARCv8 CPU simulator. We prove the language-based non-interference property for the LEON3 processor. Our model is based on deterministic monad, which is a modified version of the non-deterministic monad from NICTA/l4v. [Separata] title = Separata: Isabelle tactics for Separation Algebra author = Zhe Hou , David Sanan , Alwen Tiu , Rajeev Gore , Ranald Clouston notify = zhe.hou@ntu.edu.sg date = 2016-11-16 topic = Computer Science/Programming Languages/Logics, Tools abstract = We bring the labelled sequent calculus $LS_{PASL}$ for propositional abstract separation logic to Isabelle. The tactics given here are directly applied on an extension of the Separation Algebra in the AFP. In addition to the cancellative separation algebra, we further consider some useful properties in the heap model of separation logic, such as indivisible unit, disjointness, and cross-split. The tactics are essentially a proof search procedure for the calculus $LS_{PASL}$. We wrap the tactics in an Isabelle method called separata, and give a few examples of separation logic formulae which are provable by separata. [LOFT] title = LOFT — Verified Migration of Linux Firewalls to SDN author = Julius Michaelis , Cornelius Diekmann notify = isabelleopenflow@liftm.de date = 2016-10-21 topic = Computer Science/Networks abstract = We present LOFT — Linux firewall OpenFlow Translator, a system that transforms the main routing table and FORWARD chain of iptables of a Linux-based firewall into a set of static OpenFlow rules. Our implementation is verified against a model of a simplified Linux-based router and we can directly show how much of the original functionality is preserved. [Stable_Matching] title = Stable Matching author = Peter Gammie notify = peteg42@gmail.com date = 2016-10-24 topic = Mathematics/Economics abstract = We mechanize proofs of several results from the matching with contracts literature, which generalize those of the classical two-sided matching scenarios that go by the name of stable marriage. Our focus is on game theoretic issues. Along the way we develop executable algorithms for computing optimal stable matches. [Modal_Logics_for_NTS] title = Modal Logics for Nominal Transition Systems author = Tjark Weber , Lars-Henrik Eriksson , Joachim Parrow , Johannes Borgström , Ramunas Gutkovas notify = tjark.weber@it.uu.se date = 2016-10-25 topic = Computer Science/Concurrency/Process Calculi, Logic abstract = We formalize a uniform semantic substrate for a wide variety of process calculi where states and action labels can be from arbitrary nominal sets. A Hennessy-Milner logic for these systems is defined, and proved adequate for bisimulation equivalence. A main novelty is the construction of an infinitary nominal data type to model formulas with (finitely supported) infinite conjunctions and actions that may contain binding names. The logic is generalized to treat different bisimulation variants such as early, late and open in a systematic way. extra-history = Change history: [2017-01-29]: Formalization of weak bisimilarity added (revision c87cc2057d9c) [Abs_Int_ITP2012] title = Abstract Interpretation of Annotated Commands author = Tobias Nipkow notify = nipkow@in.tum.de date = 2016-11-23 topic = Computer Science/Programming Languages/Static Analysis abstract = This is the Isabelle formalization of the material decribed in the eponymous ITP 2012 paper. It develops a generic abstract interpreter for a while-language, including widening and narrowing. The collecting semantics and the abstract interpreter operate on annotated commands: the program is represented as a syntax tree with the semantic information directly embedded, without auxiliary labels. The aim of the formalization is simplicity, not efficiency or precision. This is motivated by the inclusion of the material in a theorem prover based course on semantics. A similar (but more polished) development is covered in the book Concrete Semantics. [Complx] title = COMPLX: A Verification Framework for Concurrent Imperative Programs author = Sidney Amani<>, June Andronick<>, Maksym Bortin<>, Corey Lewis<>, Christine Rizkallah<>, Joseph Tuong<> notify = sidney.amani@data61.csiro.au, corey.lewis@data61.csiro.au date = 2016-11-29 topic = Computer Science/Programming Languages/Logics, Computer Science/Programming Languages/Language Definitions abstract = We propose a concurrency reasoning framework for imperative programs, based on the Owicki-Gries (OG) foundational shared-variable concurrency method. Our framework combines the approaches of Hoare-Parallel, a formalisation of OG in Isabelle/HOL for a simple while-language, and Simpl, a generic imperative language embedded in Isabelle/HOL, allowing formal reasoning on C programs. We define the Complx language, extending the syntax and semantics of Simpl with support for parallel composition and synchronisation. We additionally define an OG logic, which we prove sound w.r.t. the semantics, and a verification condition generator, both supporting involved low-level imperative constructs such as function calls and abrupt termination. We illustrate our framework on an example that features exceptions, guards and function calls. We aim to then target concurrent operating systems, such as the interruptible eChronos embedded operating system for which we already have a model-level OG proof using Hoare-Parallel. extra-history = Change history: [2017-01-13]: Improve VCG for nested parallels and sequential sections (revision 30739dbc3dcb) [Paraconsistency] title = Paraconsistency author = Anders Schlichtkrull , Jørgen Villadsen topic = Logic date = 2016-12-07 notify = andschl@dtu.dk, jovi@dtu.dk abstract = Paraconsistency is about handling inconsistency in a coherent way. In classical and intuitionistic logic everything follows from an inconsistent theory. A paraconsistent logic avoids the explosion. Quite a few applications in computer science and engineering are discussed in the Intelligent Systems Reference Library Volume 110: Towards Paraconsistent Engineering (Springer 2016). We formalize a paraconsistent many-valued logic that we motivated and described in a special issue on logical approaches to paraconsistency (Journal of Applied Non-Classical Logics 2005). We limit ourselves to the propositional fragment of the higher-order logic. The logic is based on so-called key equalities and has a countably infinite number of truth values. We prove theorems in the logic using the definition of validity. We verify truth tables and also counterexamples for non-theorems. We prove meta-theorems about the logic and finally we investigate a case study. [Proof_Strategy_Language] title = Proof Strategy Language author = Yutaka Nagashima<> topic = Tools date = 2016-12-20 notify = Yutaka.Nagashima@data61.csiro.au abstract = Isabelle includes various automatic tools for finding proofs under certain conditions. However, for each conjecture, knowing which automation to use, and how to tweak its parameters, is currently labour intensive. We have developed a language, PSL, designed to capture high level proof strategies. PSL offloads the construction of human-readable fast-to-replay proof scripts to automatic search, making use of search-time information about each conjecture. Our preliminary evaluations show that PSL reduces the labour cost of interactive theorem proving. This submission contains the implementation of PSL and an example theory file, Example.thy, showing how to write poof strategies in PSL. [Concurrent_Ref_Alg] title = Concurrent Refinement Algebra and Rely Quotients author = Julian Fell , Ian J. Hayes , Andrius Velykis topic = Computer Science/Concurrency date = 2016-12-30 notify = Ian.Hayes@itee.uq.edu.au abstract = The concurrent refinement algebra developed here is designed to provide a foundation for rely/guarantee reasoning about concurrent programs. The algebra builds on a complete lattice of commands by providing sequential composition, parallel composition and a novel weak conjunction operator. The weak conjunction operator coincides with the lattice supremum providing its arguments are non-aborting, but aborts if either of its arguments do. Weak conjunction provides an abstract version of a guarantee condition as a guarantee process. We distinguish between models that distribute sequential composition over non-deterministic choice from the left (referred to as being conjunctive in the refinement calculus literature) and those that don't. Least and greatest fixed points of monotone functions are provided to allow recursion and iteration operators to be added to the language. Additional iteration laws are available for conjunctive models. The rely quotient of processes c and i is the process that, if executed in parallel with i implements c. It represents an abstract version of a rely condition generalised to a process. [FOL_Harrison] title = First-Order Logic According to Harrison author = Alexander Birch Jensen , Anders Schlichtkrull , Jørgen Villadsen topic = Logic date = 2017-01-01 notify = aleje@dtu.dk, andschl@dtu.dk, jovi@dtu.dk abstract =

We present a certified declarative first-order prover with equality based on John Harrison's Handbook of Practical Logic and Automated Reasoning, Cambridge University Press, 2009. ML code reflection is used such that the entire prover can be executed within Isabelle as a very simple interactive proof assistant. As examples we consider Pelletier's problems 1-46.

Reference: Programming and Verifying a Declarative First-Order Prover in Isabelle/HOL. Alexander Birch Jensen, John Bruntse Larsen, Anders Schlichtkrull & Jørgen Villadsen. AI Communications 31:281-299 2018. https://content.iospress.com/articles/ai-communications/aic764

See also: Students' Proof Assistant (SPA). https://github.com/logic-tools/spa

extra-history = Change history: [2018-07-21]: Proof of Pelletier's problem 34 (Andrews's Challenge) thanks to Asta Halkjær From. [Bernoulli] title = Bernoulli Numbers author = Lukas Bulwahn, Manuel Eberl topic = Mathematics/Analysis, Mathematics/Number Theory date = 2017-01-24 notify = eberlm@in.tum.de abstract =

Bernoulli numbers were first discovered in the closed-form expansion of the sum 1m + 2m + … + nm for a fixed m and appear in many other places. This entry provides three different definitions for them: a recursive one, an explicit one, and one through their exponential generating function.

In addition, we prove some basic facts, e.g. their relation to sums of powers of integers and that all odd Bernoulli numbers except the first are zero, and some advanced facts like their relationship to the Riemann zeta function on positive even integers.

We also prove the correctness of the Akiyama–Tanigawa algorithm for computing Bernoulli numbers with reasonable efficiency, and we define the periodic Bernoulli polynomials (which appear e.g. in the Euler–MacLaurin summation formula and the expansion of the log-Gamma function) and prove their basic properties.

[Stone_Relation_Algebras] title = Stone Relation Algebras author = Walter Guttmann topic = Mathematics/Algebra date = 2017-02-07 notify = walter.guttmann@canterbury.ac.nz abstract = We develop Stone relation algebras, which generalise relation algebras by replacing the underlying Boolean algebra structure with a Stone algebra. We show that finite matrices over extended real numbers form an instance. As a consequence, relation-algebraic concepts and methods can be used for reasoning about weighted graphs. We also develop a fixpoint calculus and apply it to compare different definitions of reflexive-transitive closures in semirings. [Stone_Kleene_Relation_Algebras] title = Stone-Kleene Relation Algebras author = Walter Guttmann topic = Mathematics/Algebra date = 2017-07-06 notify = walter.guttmann@canterbury.ac.nz abstract = We develop Stone-Kleene relation algebras, which expand Stone relation algebras with a Kleene star operation to describe reachability in weighted graphs. Many properties of the Kleene star arise as a special case of a more general theory of iteration based on Conway semirings extended by simulation axioms. This includes several theorems representing complex program transformations. We formally prove the correctness of Conway's automata-based construction of the Kleene star of a matrix. We prove numerous results useful for reasoning about weighted graphs. [Abstract_Soundness] title = Abstract Soundness author = Jasmin Christian Blanchette , Andrei Popescu , Dmitriy Traytel topic = Logic date = 2017-02-10 notify = jasmin.blanchette@gmail.com abstract = A formalized coinductive account of the abstract development of Brotherston, Gorogiannis, and Petersen [APLAS 2012], in a slightly more general form since we work with arbitrary infinite proofs, which may be acyclic. This work is described in detail in an article by the authors, published in 2017 in the Journal of Automated Reasoning. The abstract proof can be instantiated for various formalisms, including first-order logic with inductive predicates. [Differential_Dynamic_Logic] title = Differential Dynamic Logic author = Brandon Bohrer topic = Logic, Computer Science/Programming Languages/Logics date = 2017-02-13 notify = bbohrer@cs.cmu.edu abstract = We formalize differential dynamic logic, a logic for proving properties of hybrid systems. The proof calculus in this formalization is based on the uniform substitution principle. We show it is sound with respect to our denotational semantics, which provides increased confidence in the correctness of the KeYmaera X theorem prover based on this calculus. As an application, we include a proof term checker embedded in Isabelle/HOL with several example proofs. Published in: Brandon Bohrer, Vincent Rahli, Ivana Vukotic, Marcus Völp, André Platzer: Formally verified differential dynamic logic. CPP 2017. [Elliptic_Curves_Group_Law] title = The Group Law for Elliptic Curves author = Stefan Berghofer topic = Computer Science/Security/Cryptography date = 2017-02-28 notify = berghofe@in.tum.de abstract = We prove the group law for elliptic curves in Weierstrass form over fields of characteristic greater than 2. In addition to affine coordinates, we also formalize projective coordinates, which allow for more efficient computations. By specializing the abstract formalization to prime fields, we can apply the curve operations to parameters used in standard security protocols. [Example-Submission] title = Example Submission author = Gerwin Klein topic = Mathematics/Analysis, Mathematics/Number Theory date = 2004-02-25 notify = kleing@cse.unsw.edu.au abstract = This is an example submission to the Archive of Formal Proofs. It shows submission requirements and explains the structure of a simple typical submission. extra-no-index = no-index: true [CRDT] title = A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes author = Victor B. F. Gomes , Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford topic = Computer Science/Algorithms/Distributed, Computer Science/Data Structures date = 2017-07-07 notify = vb358@cam.ac.uk, dominic.p.mulligan@googlemail.com abstract = In this work, we focus on the correctness of Conflict-free Replicated Data Types (CRDTs), a class of algorithm that provides strong eventual consistency guarantees for replicated data. We develop a modular and reusable framework for verifying the correctness of CRDT algorithms. We avoid correctness issues that have dogged previous mechanised proofs in this area by including a network model in our formalisation, and proving that our theorems hold in all possible network behaviours. Our axiomatic network model is a standard abstraction that accurately reflects the behaviour of real-world computer networks. Moreover, we identify an abstract convergence theorem, a property of order relations, which provides a formal definition of strong eventual consistency. We then obtain the first machine-checked correctness theorems for three concrete CRDTs: the Replicated Growable Array, the Observed-Remove Set, and an Increment-Decrement Counter. [HOLCF-Prelude] title = HOLCF-Prelude author = Joachim Breitner, Brian Huffman<>, Neil Mitchell<>, Christian Sternagel topic = Computer Science/Functional Programming date = 2017-07-15 notify = c.sternagel@gmail.com, joachim@cis.upenn.edu, hupel@in.tum.de abstract = The Isabelle/HOLCF-Prelude is a formalization of a large part of Haskell's standard prelude in Isabelle/HOLCF. We use it to prove the correctness of the Eratosthenes' Sieve, in its self-referential implementation commonly used to showcase Haskell's laziness; prove correctness of GHC's "fold/build" rule and related rewrite rules; and certify a number of hints suggested by HLint. [Decl_Sem_Fun_PL] title = Declarative Semantics for Functional Languages author = Jeremy Siek topic = Computer Science/Programming Languages date = 2017-07-21 notify = jsiek@indiana.edu abstract = We present a semantics for an applied call-by-value lambda-calculus that is compositional, extensional, and elementary. We present four different views of the semantics: 1) as a relational (big-step) semantics that is not operational but instead declarative, 2) as a denotational semantics that does not use domain theory, 3) as a non-deterministic interpreter, and 4) as a variant of the intersection type systems of the Torino group. We prove that the semantics is correct by showing that it is sound and complete with respect to operational semantics on programs and that is sound with respect to contextual equivalence. We have not yet investigated whether it is fully abstract. We demonstrate that this approach to semantics is useful with three case studies. First, we use the semantics to prove correctness of a compiler optimization that inlines function application. Second, we adapt the semantics to the polymorphic lambda-calculus extended with general recursion and prove semantic type soundness. Third, we adapt the semantics to the call-by-value lambda-calculus with mutable references.
The paper that accompanies these Isabelle theories is available on arXiv. [DynamicArchitectures] title = Dynamic Architectures author = Diego Marmsoler topic = Computer Science/System Description Languages date = 2017-07-28 notify = diego.marmsoler@tum.de abstract = The architecture of a system describes the system's overall organization into components and connections between those components. With the emergence of mobile computing, dynamic architectures have become increasingly important. In such architectures, components may appear or disappear, and connections may change over time. In the following we mechanize a theory of dynamic architectures and verify the soundness of a corresponding calculus. Therefore, we first formalize the notion of configuration traces as a model for dynamic architectures. Then, the behavior of single components is formalized in terms of behavior traces and an operator is introduced and studied to extract the behavior of a single component out of a given configuration trace. Then, behavior trace assertions are introduced as a temporal specification technique to specify behavior of components. Reasoning about component behavior in a dynamic context is formalized in terms of a calculus for dynamic architectures. Finally, the soundness of the calculus is verified by introducing an alternative interpretation for behavior trace assertions over configuration traces and proving the rules of the calculus. Since projection may lead to finite as well as infinite behavior traces, they are formalized in terms of coinductive lists. Thus, our theory is based on Lochbihler's formalization of coinductive lists. The theory may be applied to verify properties for dynamic architectures. extra-history = Change history: [2018-06-07]: adding logical operators to specify configuration traces (revision 09178f08f050)
[Stewart_Apollonius] title = Stewart's Theorem and Apollonius' Theorem author = Lukas Bulwahn topic = Mathematics/Geometry date = 2017-07-31 notify = lukas.bulwahn@gmail.com abstract = This entry formalizes the two geometric theorems, Stewart's and Apollonius' theorem. Stewart's Theorem relates the length of a triangle's cevian to the lengths of the triangle's two sides. Apollonius' Theorem is a specialisation of Stewart's theorem, restricting the cevian to be the median. The proof applies the law of cosines, some basic geometric facts about triangles and then simply transforms the terms algebraically to yield the conjectured relation. The formalization in Isabelle can closely follow the informal proofs described in the Wikipedia articles of those two theorems. [LambdaMu] title = The LambdaMu-calculus author = Cristina Matache , Victor B. F. Gomes , Dominic P. Mulligan topic = Computer Science/Programming Languages/Lambda Calculi, Logic date = 2017-08-16 notify = victorborgesfg@gmail.com, dominic.p.mulligan@googlemail.com abstract = The propositions-as-types correspondence is ordinarily presented as linking the metatheory of typed λ-calculi and the proof theory of intuitionistic logic. Griffin observed that this correspondence could be extended to classical logic through the use of control operators. This observation set off a flurry of further research, leading to the development of Parigots λμ-calculus. In this work, we formalise λμ- calculus in Isabelle/HOL and prove several metatheoretical properties such as type preservation and progress. [Orbit_Stabiliser] title = Orbit-Stabiliser Theorem with Application to Rotational Symmetries author = Jonas Rädle topic = Mathematics/Algebra date = 2017-08-20 notify = jonas.raedle@tum.de abstract = The Orbit-Stabiliser theorem is a basic result in the algebra of groups that factors the order of a group into the sizes of its orbits and stabilisers. We formalize the notion of a group action and the related concepts of orbits and stabilisers. This allows us to prove the orbit-stabiliser theorem. In the second part of this work, we formalize the tetrahedral group and use the orbit-stabiliser theorem to prove that there are twelve (orientation-preserving) rotations of the tetrahedron. [PLM] title = Representation and Partial Automation of the Principia Logico-Metaphysica in Isabelle/HOL author = Daniel Kirchner topic = Logic/Philosophy date = 2017-09-17 notify = daniel@ekpyron.org abstract =

We present an embedding of the second-order fragment of the Theory of Abstract Objects as described in Edward Zalta's upcoming work Principia Logico-Metaphysica (PLM) in the automated reasoning framework Isabelle/HOL. The Theory of Abstract Objects is a metaphysical theory that reifies property patterns, as they for example occur in the abstract reasoning of mathematics, as abstract objects and provides an axiomatic framework that allows to reason about these objects. It thereby serves as a fundamental metaphysical theory that can be used to axiomatize and describe a wide range of philosophical objects, such as Platonic forms or Leibniz' concepts, and has the ambition to function as a foundational theory of mathematics. The target theory of our embedding as described in chapters 7-9 of PLM employs a modal relational type theory as logical foundation for which a representation in functional type theory is known to be challenging.

Nevertheless we arrive at a functioning representation of the theory in the functional logic of Isabelle/HOL based on a semantical representation of an Aczel-model of the theory. Based on this representation we construct an implementation of the deductive system of PLM which allows to automatically and interactively find and verify theorems of PLM.

Our work thereby supports the concept of shallow semantical embeddings of logical systems in HOL as a universal tool for logical reasoning as promoted by Christoph Benzmüller.

The most notable result of the presented work is the discovery of a previously unknown paradox in the formulation of the Theory of Abstract Objects. The embedding of the theory in Isabelle/HOL played a vital part in this discovery. Furthermore it was possible to immediately offer several options to modify the theory to guarantee its consistency. Thereby our work could provide a significant contribution to the development of a proper grounding for object theory.

[KD_Tree] title = Multidimensional Binary Search Trees author = Martin Rau<> topic = Computer Science/Data Structures date = 2019-05-30 notify = martin.rau@tum.de, mrtnrau@googlemail.com abstract = This entry provides a formalization of multidimensional binary trees, also known as k-d trees. It includes a balanced build algorithm as well as the nearest neighbor algorithm and the range search algorithm. It is based on the papers Multidimensional binary search trees used for associative searching and An Algorithm for Finding Best Matches in Logarithmic Expected Time. [Diophantine_Eqns_Lin_Hom] title = Homogeneous Linear Diophantine Equations author = Florian Messner , Julian Parsert , Jonas Schöpf , Christian Sternagel topic = Computer Science/Algorithms, Mathematics/Number Theory, Tools license = LGPL date = 2017-10-14 notify = c.sternagel@gmail.com, julian.parsert@gmail.com abstract = We formalize the theory of homogeneous linear diophantine equations, focusing on two main results: (1) an abstract characterization of minimal complete sets of solutions, and (2) an algorithm computing them. Both, the characterization and the algorithm are based on previous work by Huet. Our starting point is a simple but inefficient variant of Huet's lexicographic algorithm incorporating improved bounds due to Clausen and Fortenbacher. We proceed by proving its soundness and completeness. Finally, we employ code equations to obtain a reasonably efficient implementation. Thus, we provide a formally verified solver for homogeneous linear diophantine equations. [Winding_Number_Eval] title = Evaluate Winding Numbers through Cauchy Indices author = Wenda Li topic = Mathematics/Analysis date = 2017-10-17 notify = wl302@cam.ac.uk, liwenda1990@hotmail.com abstract = In complex analysis, the winding number measures the number of times a path (counterclockwise) winds around a point, while the Cauchy index can approximate how the path winds. This entry provides a formalisation of the Cauchy index, which is then shown to be related to the winding number. In addition, this entry also offers a tactic that enables users to evaluate the winding number by calculating Cauchy indices. [Count_Complex_Roots] title = Count the Number of Complex Roots author = Wenda Li topic = Mathematics/Analysis date = 2017-10-17 notify = wl302@cam.ac.uk, liwenda1990@hotmail.com abstract = Based on evaluating Cauchy indices through remainder sequences, this entry provides an effective procedure to count the number of complex roots (with multiplicity) of a polynomial within a rectangle box or a half-plane. Potential applications of this entry include certified complex root isolation (of a polynomial) and testing the Routh-Hurwitz stability criterion (i.e., to check whether all the roots of some characteristic polynomial have negative real parts). [Buchi_Complementation] title = Büchi Complementation author = Julian Brunner topic = Computer Science/Automata and Formal Languages date = 2017-10-19 notify = brunnerj@in.tum.de abstract = This entry provides a verified implementation of rank-based Büchi Complementation. The verification is done in three steps:
  1. Definition of odd rankings and proof that an automaton rejects a word iff there exists an odd ranking for it.
  2. Definition of the complement automaton and proof that it accepts exactly those words for which there is an odd ranking.
  3. Verified implementation of the complement automaton using the Isabelle Collections Framework.
[Transition_Systems_and_Automata] title = Transition Systems and Automata author = Julian Brunner topic = Computer Science/Automata and Formal Languages date = 2017-10-19 notify = brunnerj@in.tum.de abstract = This entry provides a very abstract theory of transition systems that can be instantiated to express various types of automata. A transition system is typically instantiated by providing a set of initial states, a predicate for enabled transitions, and a transition execution function. From this, it defines the concepts of finite and infinite paths as well as the set of reachable states, among other things. Many useful theorems, from basic path manipulation rules to coinduction and run construction rules, are proven in this abstract transition system context. The library comes with instantiations for DFAs, NFAs, and Büchi automata. [Kuratowski_Closure_Complement] title = The Kuratowski Closure-Complement Theorem author = Peter Gammie , Gianpaolo Gioiosa<> topic = Mathematics/Topology date = 2017-10-26 notify = peteg42@gmail.com abstract = We discuss a topological curiosity discovered by Kuratowski (1922): the fact that the number of distinct operators on a topological space generated by compositions of closure and complement never exceeds 14, and is exactly 14 in the case of R. In addition, we prove a theorem due to Chagrov (1982) that classifies topological spaces according to the number of such operators they support. [Hybrid_Multi_Lane_Spatial_Logic] title = Hybrid Multi-Lane Spatial Logic author = Sven Linker topic = Logic date = 2017-11-06 notify = s.linker@liverpool.ac.uk abstract = We present a semantic embedding of a spatio-temporal multi-modal logic, specifically defined to reason about motorway traffic, into Isabelle/HOL. The semantic model is an abstraction of a motorway, emphasising local spatial properties, and parameterised by the types of sensors deployed in the vehicles. We use the logic to define controller constraints to ensure safety, i.e., the absence of collisions on the motorway. After proving safety with a restrictive definition of sensors, we relax these assumptions and show how to amend the controller constraints to still guarantee safety. [Dirichlet_L] title = Dirichlet L-Functions and Dirichlet's Theorem author = Manuel Eberl topic = Mathematics/Number Theory, Mathematics/Algebra date = 2017-12-21 notify = eberlm@in.tum.de abstract =

This article provides a formalisation of Dirichlet characters and Dirichlet L-functions including proofs of their basic properties – most notably their analyticity, their areas of convergence, and their non-vanishing for ℜ(s) ≥ 1. All of this is built in a very high-level style using Dirichlet series. The proof of the non-vanishing follows a very short and elegant proof by Newman, which we attempt to reproduce faithfully in a similar level of abstraction in Isabelle.

This also leads to a relatively short proof of Dirichlet’s Theorem, which states that, if h and n are coprime, there are infinitely many primes p with p ≡ h (mod n).

[Symmetric_Polynomials] title = Symmetric Polynomials author = Manuel Eberl topic = Mathematics/Algebra date = 2018-09-25 notify = eberlm@in.tum.de abstract =

A symmetric polynomial is a polynomial in variables X1,…,Xn that does not discriminate between its variables, i. e. it is invariant under any permutation of them. These polynomials are important in the study of the relationship between the coefficients of a univariate polynomial and its roots in its algebraic closure.

This article provides a definition of symmetric polynomials and the elementary symmetric polynomials e1,…,en and proofs of their basic properties, including three notable ones:

  • Vieta's formula, which gives an explicit expression for the k-th coefficient of a univariate monic polynomial in terms of its roots x1,…,xn, namely ck = (-1)n-k en-k(x1,…,xn).
  • Second, the Fundamental Theorem of Symmetric Polynomials, which states that any symmetric polynomial is itself a uniquely determined polynomial combination of the elementary symmetric polynomials.
  • Third, as a corollary of the previous two, that given a polynomial over some ring R, any symmetric polynomial combination of its roots is also in R even when the roots are not.

Both the symmetry property itself and the witness for the Fundamental Theorem are executable.

[Taylor_Models] title = Taylor Models author = Christoph Traut<>, Fabian Immler topic = Computer Science/Algorithms, Computer Science/Data Structures, Mathematics/Analysis, Mathematics/Algebra date = 2018-01-08 notify = immler@in.tum.de abstract = We present a formally verified implementation of multivariate Taylor models. Taylor models are a form of rigorous polynomial approximation, consisting of an approximation polynomial based on Taylor expansions, combined with a rigorous bound on the approximation error. Taylor models were introduced as a tool to mitigate the dependency problem of interval arithmetic. Our implementation automatically computes Taylor models for the class of elementary functions, expressed by composition of arithmetic operations and basic functions like exp, sin, or square root. [Green] title = An Isabelle/HOL formalisation of Green's Theorem author = Mohammad Abdulaziz , Lawrence C. Paulson topic = Mathematics/Analysis date = 2018-01-11 notify = mohammad.abdulaziz8@gmail.com, lp15@cam.ac.uk abstract = We formalise a statement of Green’s theorem—the first formalisation to our knowledge—in Isabelle/HOL. The theorem statement that we formalise is enough for most applications, especially in physics and engineering. Our formalisation is made possible by a novel proof that avoids the ubiquitous line integral cancellation argument. This eliminates the need to formalise orientations and region boundaries explicitly with respect to the outwards-pointing normal vector. Instead we appeal to a homological argument about equivalences between paths. [Gromov_Hyperbolicity] title = Gromov Hyperbolicity author = Sebastien Gouezel<> topic = Mathematics/Geometry date = 2018-01-16 notify = sebastien.gouezel@univ-rennes1.fr abstract = A geodesic metric space is Gromov hyperbolic if all its geodesic triangles are thin, i.e., every side is contained in a fixed thickening of the two other sides. While this definition looks innocuous, it has proved extremely important and versatile in modern geometry since its introduction by Gromov. We formalize the basic classical properties of Gromov hyperbolic spaces, notably the Morse lemma asserting that quasigeodesics are close to geodesics, the invariance of hyperbolicity under quasi-isometries, we define and study the Gromov boundary and its associated distance, and prove that a quasi-isometry between Gromov hyperbolic spaces extends to a homeomorphism of the boundaries. We also prove a less classical theorem, by Bonk and Schramm, asserting that a Gromov hyperbolic space embeds isometrically in a geodesic Gromov-hyperbolic space. As the original proof uses a transfinite sequence of Cauchy completions, this is an interesting formalization exercise. Along the way, we introduce basic material on isometries, quasi-isometries, Lipschitz maps, geodesic spaces, the Hausdorff distance, the Cauchy completion of a metric space, and the exponential on extended real numbers. [Ordered_Resolution_Prover] title = Formalization of Bachmair and Ganzinger's Ordered Resolution Prover author = Anders Schlichtkrull , Jasmin Christian Blanchette , Dmitriy Traytel , Uwe Waldmann topic = Logic date = 2018-01-18 notify = andschl@dtu.dk, j.c.blanchette@vu.nl abstract = This Isabelle/HOL formalization covers Sections 2 to 4 of Bachmair and Ganzinger's "Resolution Theorem Proving" chapter in the Handbook of Automated Reasoning. This includes soundness and completeness of unordered and ordered variants of ground resolution with and without literal selection, the standard redundancy criterion, a general framework for refutational theorem proving, and soundness and completeness of an abstract first-order prover. [BNF_Operations] title = Operations on Bounded Natural Functors author = Jasmin Christian Blanchette , Andrei Popescu , Dmitriy Traytel topic = Tools date = 2017-12-19 notify = jasmin.blanchette@gmail.com,uuomul@yahoo.com,traytel@inf.ethz.ch abstract = This entry formalizes the closure property of bounded natural functors (BNFs) under seven operations. These operations and the corresponding proofs constitute the core of Isabelle's (co)datatype package. To be close to the implemented tactics, the proofs are deliberately formulated as detailed apply scripts. The (co)datatypes together with (co)induction principles and (co)recursors are byproducts of the fixpoint operations LFP and GFP. Composition of BNFs is subdivided into four simpler operations: Compose, Kill, Lift, and Permute. The N2M operation provides mutual (co)induction principles and (co)recursors for nested (co)datatypes. [LLL_Basis_Reduction] title = A verified LLL algorithm author = Ralph Bottesch <>, Jose Divasón , Maximilian Haslbeck <>, Sebastiaan Joosten , René Thiemann , Akihisa Yamada<> topic = Computer Science/Algorithms, Mathematics/Algebra date = 2018-02-02 notify = ralph.bottesch@uibk.ac.at, jose.divason@unirioja.es, maximilian.haslbeck@uibk.ac.at, s.j.c.joosten@utwente.nl, rene.thiemann@uibk.ac.at, ayamada@trs.cm.is.nagoya-u.ac.jp abstract = The Lenstra-Lenstra-Lovász basis reduction algorithm, also known as LLL algorithm, is an algorithm to find a basis with short, nearly orthogonal vectors of an integer lattice. Thereby, it can also be seen as an approximation to solve the shortest vector problem (SVP), which is an NP-hard problem, where the approximation quality solely depends on the dimension of the lattice, but not the lattice itself. The algorithm also possesses many applications in diverse fields of computer science, from cryptanalysis to number theory, but it is specially well-known since it was used to implement the first polynomial-time algorithm to factor polynomials. In this work we present the first mechanized soundness proof of the LLL algorithm to compute short vectors in lattices. The formalization follows a textbook by von zur Gathen and Gerhard. extra-history = Change history: [2018-04-16]: Integrated formal complexity bounds (Haslbeck, Thiemann) [2018-05-25]: Integrated much faster LLL implementation based on integer arithmetic (Bottesch, Haslbeck, Thiemann) [LLL_Factorization] title = A verified factorization algorithm for integer polynomials with polynomial complexity author = Jose Divasón , Sebastiaan Joosten , René Thiemann , Akihisa Yamada topic = Mathematics/Algebra date = 2018-02-06 notify = jose.divason@unirioja.es, s.j.c.joosten@utwente.nl, rene.thiemann@uibk.ac.at, ayamada@trs.cm.is.nagoya-u.ac.jp abstract = Short vectors in lattices and factors of integer polynomials are related. Each factor of an integer polynomial belongs to a certain lattice. When factoring polynomials, the condition that we are looking for an irreducible polynomial means that we must look for a small element in a lattice, which can be done by a basis reduction algorithm. In this development we formalize this connection and thereby one main application of the LLL basis reduction algorithm: an algorithm to factor square-free integer polynomials which runs in polynomial time. The work is based on our previous Berlekamp–Zassenhaus development, where the exponential reconstruction phase has been replaced by the polynomial-time basis reduction algorithm. Thanks to this formalization we found a serious flaw in a textbook. [Treaps] title = Treaps author = Maximilian Haslbeck , Manuel Eberl , Tobias Nipkow topic = Computer Science/Data Structures date = 2018-02-06 notify = eberlm@in.tum.de abstract =

A Treap is a binary tree whose nodes contain pairs consisting of some payload and an associated priority. It must have the search-tree property w.r.t. the payloads and the heap property w.r.t. the priorities. Treaps are an interesting data structure that is related to binary search trees (BSTs) in the following way: if one forgets all the priorities of a treap, the resulting BST is exactly the same as if one had inserted the elements into an empty BST in order of ascending priority. This means that a treap behaves like a BST where we can pretend the elements were inserted in a different order from the one in which they were actually inserted.

In particular, by choosing these priorities at random upon insertion of an element, we can pretend that we inserted the elements in random order, so that the shape of the resulting tree is that of a random BST no matter in what order we insert the elements. This is the main result of this formalisation.

[Hoare_Time] title = Hoare Logics for Time Bounds author = Maximilian P. L. Haslbeck , Tobias Nipkow topic = Computer Science/Programming Languages/Logics date = 2018-02-26 notify = haslbema@in.tum.de abstract = We study three different Hoare logics for reasoning about time bounds of imperative programs and formalize them in Isabelle/HOL: a classical Hoare like logic due to Nielson, a logic with potentials due to Carbonneaux et al. and a separation logic following work by Atkey, Chaguérand and Pottier. These logics are formally shown to be sound and complete. Verification condition generators are developed and are shown sound and complete too. We also consider variants of the systems where we abstract from multiplicative constants in the running time bounds, thus supporting a big-O style of reasoning. Finally we compare the expressive power of the three systems. [Architectural_Design_Patterns] title = A Theory of Architectural Design Patterns author = Diego Marmsoler topic = Computer Science/System Description Languages date = 2018-03-01 notify = diego.marmsoler@tum.de abstract = The following document formalizes and verifies several architectural design patterns. Each pattern specification is formalized in terms of a locale where the locale assumptions correspond to the assumptions which a pattern poses on an architecture. Thus, pattern specifications may build on top of each other by interpreting the corresponding locale. A pattern is verified using the framework provided by the AFP entry Dynamic Architectures. Currently, the document consists of formalizations of 4 different patterns: the singleton, the publisher subscriber, the blackboard pattern, and the blockchain pattern. Thereby, the publisher component of the publisher subscriber pattern is modeled as an instance of the singleton pattern and the blackboard pattern is modeled as an instance of the publisher subscriber pattern. In general, this entry provides the first steps towards an overall theory of architectural design patterns. extra-history = Change history: [2018-05-25]: changing the major assumption for blockchain architectures from alternative minings to relative mining frequencies (revision 5043c5c71685)
[2019-04-08]: adapting the terminology: honest instead of trusted, dishonest instead of untrusted (revision 7af3431a22ae) [Weight_Balanced_Trees] title = Weight-Balanced Trees author = Tobias Nipkow , Stefan Dirix<> topic = Computer Science/Data Structures date = 2018-03-13 notify = nipkow@in.tum.de abstract = This theory provides a verified implementation of weight-balanced trees following the work of Hirai and Yamamoto who proved that all parameters in a certain range are valid, i.e. guarantee that insertion and deletion preserve weight-balance. Instead of a general theorem we provide parameterized proofs of preservation of the invariant that work for many (all?) valid parameters. [Fishburn_Impossibility] title = The Incompatibility of Fishburn-Strategyproofness and Pareto-Efficiency author = Felix Brandt , Manuel Eberl , Christian Saile , Christian Stricker topic = Mathematics/Economics date = 2018-03-22 notify = eberlm@in.tum.de abstract =

This formalisation contains the proof that there is no anonymous Social Choice Function for at least three agents and alternatives that fulfils both Pareto-Efficiency and Fishburn-Strategyproofness. It was derived from a proof of Brandt et al., which relies on an unverified translation of a fixed finite instance of the original problem to SAT. This Isabelle proof contains a machine-checked version of both the statement for exactly three agents and alternatives and the lifting to the general case.

[BNF_CC] title = Bounded Natural Functors with Covariance and Contravariance author = Andreas Lochbihler , Joshua Schneider topic = Computer Science/Functional Programming, Tools date = 2018-04-24 notify = mail@andreas-lochbihler.de, joshua.schneider@inf.ethz.ch abstract = Bounded natural functors (BNFs) provide a modular framework for the construction of (co)datatypes in higher-order logic. Their functorial operations, the mapper and relator, are restricted to a subset of the parameters, namely those where recursion can take place. For certain applications, such as free theorems, data refinement, quotients, and generalised rewriting, it is desirable that these operations do not ignore the other parameters. In this article, we formalise the generalisation BNFCC that extends the mapper and relator to covariant and contravariant parameters. We show that
  1. BNFCCs are closed under functor composition and least and greatest fixpoints,
  2. subtypes inherit the BNFCC structure under conditions that generalise those for the BNF case, and
  3. BNFCCs preserve quotients under mild conditions.
These proofs are carried out for abstract BNFCCs similar to the AFP entry BNF Operations. In addition, we apply the BNFCC theory to several concrete functors. [Modular_Assembly_Kit_Security] title = An Isabelle/HOL Formalization of the Modular Assembly Kit for Security Properties author = Oliver Bračevac , Richard Gay , Sylvia Grewe , Heiko Mantel , Henning Sudbrock , Markus Tasch topic = Computer Science/Security date = 2018-05-07 notify = tasch@mais.informatik.tu-darmstadt.de abstract = The "Modular Assembly Kit for Security Properties" (MAKS) is a framework for both the definition and verification of possibilistic information-flow security properties at the specification-level. MAKS supports the uniform representation of a wide range of possibilistic information-flow properties and provides support for the verification of such properties via unwinding results and compositionality results. We provide a formalization of this framework in Isabelle/HOL. [AxiomaticCategoryTheory] title = Axiom Systems for Category Theory in Free Logic author = Christoph Benzmüller , Dana Scott topic = Mathematics/Category Theory date = 2018-05-23 notify = c.benzmueller@gmail.com abstract = This document provides a concise overview on the core results of our previous work on the exploration of axioms systems for category theory. Extending the previous studies (http://arxiv.org/abs/1609.01493) we include one further axiomatic theory in our experiments. This additional theory has been suggested by Mac Lane in 1948. We show that the axioms proposed by Mac Lane are equivalent to the ones we studied before, which includes an axioms set suggested by Scott in the 1970s and another axioms set proposed by Freyd and Scedrov in 1990, which we slightly modified to remedy a minor technical issue. [OpSets] title = OpSets: Sequential Specifications for Replicated Datatypes author = Martin Kleppmann , Victor B. F. Gomes , Dominic P. Mulligan , Alastair R. Beresford topic = Computer Science/Algorithms/Distributed, Computer Science/Data Structures date = 2018-05-10 notify = vb358@cam.ac.uk abstract = We introduce OpSets, an executable framework for specifying and reasoning about the semantics of replicated datatypes that provide eventual consistency in a distributed system, and for mechanically verifying algorithms that implement these datatypes. Our approach is simple but expressive, allowing us to succinctly specify a variety of abstract datatypes, including maps, sets, lists, text, graphs, trees, and registers. Our datatypes are also composable, enabling the construction of complex data structures. To demonstrate the utility of OpSets for analysing replication algorithms, we highlight an important correctness property for collaborative text editing that has traditionally been overlooked; algorithms that do not satisfy this property can exhibit awkward interleaving of text. We use OpSets to specify this correctness property and prove that although one existing replication algorithm satisfies this property, several other published algorithms do not. [Irrationality_J_Hancl] title = Irrational Rapidly Convergent Series author = Angeliki Koutsoukou-Argyraki , Wenda Li topic = Mathematics/Number Theory, Mathematics/Analysis date = 2018-05-23 notify = ak2110@cam.ac.uk, wl302@cam.ac.uk abstract = We formalize with Isabelle/HOL a proof of a theorem by J. Hancl asserting the irrationality of the sum of a series consisting of rational numbers, built up by sequences that fulfill certain properties. Even though the criterion is a number theoretic result, the proof makes use only of analytical arguments. We also formalize a corollary of the theorem for a specific series fulfilling the assumptions of the theorem. [Optimal_BST] title = Optimal Binary Search Trees author = Tobias Nipkow , Dániel Somogyi <> topic = Computer Science/Algorithms, Computer Science/Data Structures date = 2018-05-27 notify = nipkow@in.tum.de abstract = This article formalizes recursive algorithms for the construction of optimal binary search trees given fixed access frequencies. We follow Knuth (1971), Yao (1980) and Mehlhorn (1984). The algorithms are memoized with the help of the AFP article Monadification, Memoization and Dynamic Programming, thus yielding dynamic programming algorithms. [Projective_Geometry] title = Projective Geometry author = Anthony Bordg topic = Mathematics/Geometry date = 2018-06-14 notify = apdb3@cam.ac.uk abstract = We formalize the basics of projective geometry. In particular, we give a proof of the so-called Hessenberg's theorem in projective plane geometry. We also provide a proof of the so-called Desargues's theorem based on an axiomatization of (higher) projective space geometry using the notion of rank of a matroid. This last approach allows to handle incidence relations in an homogeneous way dealing only with points and without the need of talking explicitly about lines, planes or any higher entity. [Localization_Ring] title = The Localization of a Commutative Ring author = Anthony Bordg topic = Mathematics/Algebra date = 2018-06-14 notify = apdb3@cam.ac.uk abstract = We formalize the localization of a commutative ring R with respect to a multiplicative subset (i.e. a submonoid of R seen as a multiplicative monoid). This localization is itself a commutative ring and we build the natural homomorphism of rings from R to its localization. [Minsky_Machines] title = Minsky Machines author = Bertram Felgenhauer<> topic = Logic date = 2018-08-14 notify = int-e@gmx.de abstract =

We formalize undecidablity results for Minsky machines. To this end, we also formalize recursive inseparability.

We start by proving that Minsky machines can compute arbitrary primitive recursive and recursive functions. We then show that there is a deterministic Minsky machine with one argument and two final states such that the set of inputs that are accepted in one state is recursively inseparable from the set of inputs that are accepted in the other state.

As a corollary, the set of Minsky configurations that reach the first state but not the second recursively inseparable from the set of Minsky configurations that reach the second state but not the first. In particular both these sets are undecidable.

We do not prove that recursive functions can simulate Minsky machines.

[Neumann_Morgenstern_Utility] title = Von-Neumann-Morgenstern Utility Theorem author = Julian Parsert, Cezary Kaliszyk topic = Mathematics/Economics license = LGPL date = 2018-07-04 notify = julian.parsert@uibk.ac.at, cezary.kaliszyk@uibk.ac.at abstract = Utility functions form an essential part of game theory and economics. In order to guarantee the existence of utility functions most of the time sufficient properties are assumed in an axiomatic manner. One famous and very common set of such assumptions is that of expected utility theory. Here, the rationality, continuity, and independence of preferences is assumed. The von-Neumann-Morgenstern Utility theorem shows that these assumptions are necessary and sufficient for an expected utility function to exists. This theorem was proven by Neumann and Morgenstern in ``Theory of Games and Economic Behavior'' which is regarded as one of the most influential works in game theory. The formalization includes formal definitions of the underlying concepts including continuity and independence of preferences. [Simplex] title = An Incremental Simplex Algorithm with Unsatisfiable Core Generation author = Filip Marić , Mirko Spasić , René Thiemann topic = Computer Science/Algorithms date = 2018-08-24 notify = rene.thiemann@uibk.ac.at abstract = We present an Isabelle/HOL formalization and total correctness proof for the incremental version of the Simplex algorithm which is used in most state-of-the-art SMT solvers. It supports extraction of satisfying assignments, extraction of minimal unsatisfiable cores, incremental assertion of constraints and backtracking. The formalization relies on stepwise program refinement, starting from a simple specification, going through a number of refinement steps, and ending up in a fully executable functional implementation. Symmetries present in the algorithm are handled with special care. [Budan_Fourier] title = The Budan-Fourier Theorem and Counting Real Roots with Multiplicity author = Wenda Li topic = Mathematics/Analysis date = 2018-09-02 notify = wl302@cam.ac.uk, liwenda1990@hotmail.com abstract = This entry is mainly about counting and approximating real roots (of a polynomial) with multiplicity. We have first formalised the Budan-Fourier theorem: given a polynomial with real coefficients, we can calculate sign variations on Fourier sequences to over-approximate the number of real roots (counting multiplicity) within an interval. When all roots are known to be real, the over-approximation becomes tight: we can utilise this theorem to count real roots exactly. It is also worth noting that Descartes' rule of sign is a direct consequence of the Budan-Fourier theorem, and has been included in this entry. In addition, we have extended previous formalised Sturm's theorem to count real roots with multiplicity, while the original Sturm's theorem only counts distinct real roots. Compared to the Budan-Fourier theorem, our extended Sturm's theorem always counts roots exactly but may suffer from greater computational cost. [Quaternions] title = Quaternions author = Lawrence C. Paulson topic = Mathematics/Algebra, Mathematics/Geometry date = 2018-09-05 notify = lp15@cam.ac.uk abstract = This theory is inspired by the HOL Light development of quaternions, but follows its own route. Quaternions are developed coinductively, as in the existing formalisation of the complex numbers. Quaternions are quickly shown to belong to the type classes of real normed division algebras and real inner product spaces. And therefore they inherit a great body of facts involving algebraic laws, limits, continuity, etc., which must be proved explicitly in the HOL Light version. The development concludes with the geometric interpretation of the product of imaginary quaternions. [Octonions] title = Octonions author = Angeliki Koutsoukou-Argyraki topic = Mathematics/Algebra, Mathematics/Geometry date = 2018-09-14 notify = ak2110@cam.ac.uk abstract = We develop the basic theory of Octonions, including various identities and properties of the octonions and of the octonionic product, a description of 7D isometries and representations of orthogonal transformations. To this end we first develop the theory of the vector cross product in 7 dimensions. The development of the theory of Octonions is inspired by that of the theory of Quaternions by Lawrence Paulson. However, we do not work within the type class real_algebra_1 because the octonionic product is not associative. [Aggregation_Algebras] title = Aggregation Algebras author = Walter Guttmann topic = Mathematics/Algebra date = 2018-09-15 notify = walter.guttmann@canterbury.ac.nz abstract = We develop algebras for aggregation and minimisation for weight matrices and for edge weights in graphs. We verify the correctness of Prim's and Kruskal's minimum spanning tree algorithms based on these algebras. We also show numerous instances of these algebras based on linearly ordered commutative semigroups. [Prime_Number_Theorem] title = The Prime Number Theorem author = Manuel Eberl , Lawrence C. Paulson topic = Mathematics/Number Theory date = 2018-09-19 notify = eberlm@in.tum.de abstract =

This article provides a short proof of the Prime Number Theorem in several equivalent forms, most notably π(x) ~ x/ln x where π(x) is the number of primes no larger than x. It also defines other basic number-theoretic functions related to primes like Chebyshev's functions ϑ and ψ and the “n-th prime number” function pn. We also show various bounds and relationship between these functions are shown. Lastly, we derive Mertens' First and Second Theorem, i. e. ∑p≤x ln p/p = ln x + O(1) and ∑p≤x 1/p = ln ln x + M + O(1/ln x). We also give explicit bounds for the remainder terms.

The proof of the Prime Number Theorem builds on a library of Dirichlet series and analytic combinatorics. We essentially follow the presentation by Newman. The core part of the proof is a Tauberian theorem for Dirichlet series, which is proven using complex analysis and then used to strengthen Mertens' First Theorem to ∑p≤x ln p/p = ln x + c + o(1).

A variant of this proof has been formalised before by Harrison in HOL Light, and formalisations of Selberg's elementary proof exist both by Avigad et al. in Isabelle and by Carneiro in Metamath. The advantage of the analytic proof is that, while it requires more powerful mathematical tools, it is considerably shorter and clearer. This article attempts to provide a short and clear formalisation of all components of that proof using the full range of mathematical machinery available in Isabelle, staying as close as possible to Newman's simple paper proof.

[Signature_Groebner] title = Signature-Based Gröbner Basis Algorithms author = Alexander Maletzky topic = Mathematics/Algebra, Computer Science/Algorithms date = 2018-09-20 notify = alexander.maletzky@risc.jku.at abstract =

This article formalizes signature-based algorithms for computing Gröbner bases. Such algorithms are, in general, superior to other algorithms in terms of efficiency, and have not been formalized in any proof assistant so far. The present development is both generic, in the sense that most known variants of signature-based algorithms are covered by it, and effectively executable on concrete input thanks to Isabelle's code generator. Sample computations of benchmark problems show that the verified implementation of signature-based algorithms indeed outperforms the existing implementation of Buchberger's algorithm in Isabelle/HOL.

Besides total correctness of the algorithms, the article also proves that under certain conditions they a-priori detect and avoid all useless zero-reductions, and always return 'minimal' (in some sense) Gröbner bases if an input parameter is chosen in the right way.

The formalization follows the recent survey article by Eder and Faugère.

[Factored_Transition_System_Bounding] title = Upper Bounding Diameters of State Spaces of Factored Transition Systems author = Friedrich Kurz <>, Mohammad Abdulaziz topic = Computer Science/Automata and Formal Languages, Mathematics/Graph Theory date = 2018-10-12 notify = friedrich.kurz@tum.de, mohammad.abdulaziz@in.tum.de abstract = A completeness threshold is required to guarantee the completeness of planning as satisfiability, and bounded model checking of safety properties. One valid completeness threshold is the diameter of the underlying transition system. The diameter is the maximum element in the set of lengths of all shortest paths between pairs of states. The diameter is not calculated exactly in our setting, where the transition system is succinctly described using a (propositionally) factored representation. Rather, an upper bound on the diameter is calculated compositionally, by bounding the diameters of small abstract subsystems, and then composing those. We port a HOL4 formalisation of a compositional algorithm for computing a relatively tight upper bound on the system diameter. This compositional algorithm exploits acyclicity in the state space to achieve compositionality, and it was introduced by Abdulaziz et. al. The formalisation that we port is described as a part of another paper by Abdulaziz et. al. As a part of this porting we developed a libray about transition systems, which shall be of use in future related mechanisation efforts. [Smooth_Manifolds] title = Smooth Manifolds author = Fabian Immler , Bohua Zhan topic = Mathematics/Analysis, Mathematics/Topology date = 2018-10-22 notify = immler@in.tum.de, bzhan@ios.ac.cn abstract = We formalize the definition and basic properties of smooth manifolds in Isabelle/HOL. Concepts covered include partition of unity, tangent and cotangent spaces, and the fundamental theorem of path integrals. We also examine some concrete manifolds such as spheres and projective spaces. The formalization makes extensive use of the analysis and linear algebra libraries in Isabelle/HOL, in particular its “types-to-sets” mechanism. [Matroids] title = Matroids author = Jonas Keinholz<> topic = Mathematics/Combinatorics date = 2018-11-16 notify = eberlm@in.tum.de abstract =

This article defines the combinatorial structures known as Independence Systems and Matroids and provides basic concepts and theorems related to them. These structures play an important role in combinatorial optimisation, e. g. greedy algorithms such as Kruskal's algorithm. The development is based on Oxley's `What is a Matroid?'.

[Graph_Saturation] title = Graph Saturation author = Sebastiaan J. C. Joosten<> topic = Logic/Rewriting, Mathematics/Graph Theory date = 2018-11-23 notify = sjcjoosten@gmail.com abstract = This is an Isabelle/HOL formalisation of graph saturation, closely following a paper by the author on graph saturation. Nine out of ten lemmas of the original paper are proven in this formalisation. The formalisation additionally includes two theorems that show the main premise of the paper: that consistency and entailment are decided through graph saturation. This formalisation does not give executable code, and it did not implement any of the optimisations suggested in the paper. [Functional_Ordered_Resolution_Prover] title = A Verified Functional Implementation of Bachmair and Ganzinger's Ordered Resolution Prover author = Anders Schlichtkrull , Jasmin Christian Blanchette , Dmitriy Traytel topic = Logic date = 2018-11-23 notify = andschl@dtu.dk,j.c.blanchette@vu.nl,traytel@inf.ethz.ch abstract = This Isabelle/HOL formalization refines the abstract ordered resolution prover presented in Section 4.3 of Bachmair and Ganzinger's "Resolution Theorem Proving" chapter in the Handbook of Automated Reasoning. The result is a functional implementation of a first-order prover. [Auto2_HOL] title = Auto2 Prover author = Bohua Zhan topic = Tools date = 2018-11-20 notify = bzhan@ios.ac.cn abstract = Auto2 is a saturation-based heuristic prover for higher-order logic, implemented as a tactic in Isabelle. This entry contains the instantiation of auto2 for Isabelle/HOL, along with two basic examples: solutions to some of the Pelletier’s problems, and elementary number theory of primes. [Order_Lattice_Props] title = Properties of Orderings and Lattices author = Georg Struth topic = Mathematics/Order date = 2018-12-11 notify = g.struth@sheffield.ac.uk abstract = These components add further fundamental order and lattice-theoretic concepts and properties to Isabelle's libraries. They follow by and large the introductory sections of the Compendium of Continuous Lattices, covering directed and filtered sets, down-closed and up-closed sets, ideals and filters, Galois connections, closure and co-closure operators. Some emphasis is on duality and morphisms between structures, as in the Compendium. To this end, three ad-hoc approaches to duality are compared. [Quantales] title = Quantales author = Georg Struth topic = Mathematics/Algebra date = 2018-12-11 notify = g.struth@sheffield.ac.uk abstract = These mathematical components formalise basic properties of quantales, together with some important models, constructions, and concepts, including quantic nuclei and conuclei. [Transformer_Semantics] title = Transformer Semantics author = Georg Struth topic = Mathematics/Algebra, Computer Science/Semantics date = 2018-12-11 notify = g.struth@sheffield.ac.uk abstract = These mathematical components formalise predicate transformer semantics for programs, yet currently only for partial correctness and in the absence of faults. A first part for isotone (or monotone), Sup-preserving and Inf-preserving transformers follows Back and von Wright's approach, with additional emphasis on the quantalic structure of algebras of transformers. The second part develops Sup-preserving and Inf-preserving predicate transformers from the powerset monad, via its Kleisli category and Eilenberg-Moore algebras, with emphasis on adjunctions and dualities, as well as isomorphisms between relations, state transformers and predicate transformers. [Concurrent_Revisions] title = Formalization of Concurrent Revisions author = Roy Overbeek topic = Computer Science/Concurrency date = 2018-12-25 notify = Roy.Overbeek@cwi.nl abstract = Concurrent revisions is a concurrency control model developed by Microsoft Research. It has many interesting properties that distinguish it from other well-known models such as transactional memory. One of these properties is determinacy: programs written within the model always produce the same outcome, independent of scheduling activity. The concurrent revisions model has an operational semantics, with an informal proof of determinacy. This document contains an Isabelle/HOL formalization of this semantics and the proof of determinacy. [Core_DOM] title = A Formal Model of the Document Object Model author = Achim D. Brucker , Michael Herzberg topic = Computer Science/Data Structures date = 2018-12-26 notify = adbrucker@0x5f.org abstract = In this AFP entry, we formalize the core of the Document Object Model (DOM). At its core, the DOM defines a tree-like data structure for representing documents in general and HTML documents in particular. It is the heart of any modern web browser. Formalizing the key concepts of the DOM is a prerequisite for the formal reasoning over client-side JavaScript programs and for the analysis of security concepts in modern web browsers. We present a formalization of the core DOM, with focus on the node-tree and the operations defined on node-trees, in Isabelle/HOL. We use the formalization to verify the functional correctness of the most important functions defined in the DOM standard. Moreover, our formalization is 1) extensible, i.e., can be extended without the need of re-proving already proven properties and 2) executable, i.e., we can generate executable code from our specification. [Store_Buffer_Reduction] title = A Reduction Theorem for Store Buffers author = Ernie Cohen , Norbert Schirmer topic = Computer Science/Concurrency date = 2019-01-07 notify = norbert.schirmer@web.de abstract = When verifying a concurrent program, it is usual to assume that memory is sequentially consistent. However, most modern multiprocessors depend on store buffering for efficiency, and provide native sequential consistency only at a substantial performance penalty. To regain sequential consistency, a programmer has to follow an appropriate programming discipline. However, naïve disciplines, such as protecting all shared accesses with locks, are not flexible enough for building high-performance multiprocessor software. We present a new discipline for concurrent programming under TSO (total store order, with store buffer forwarding). It does not depend on concurrency primitives, such as locks. Instead, threads use ghost operations to acquire and release ownership of memory addresses. A thread can write to an address only if no other thread owns it, and can read from an address only if it owns it or it is shared and the thread has flushed its store buffer since it last wrote to an address it did not own. This discipline covers both coarse-grained concurrency (where data is protected by locks) as well as fine-grained concurrency (where atomic operations race to memory). We formalize this discipline in Isabelle/HOL, and prove that if every execution of a program in a system without store buffers follows the discipline, then every execution of the program with store buffers is sequentially consistent. Thus, we can show sequential consistency under TSO by ordinary assertional reasoning about the program, without having to consider store buffers at all. [IMP2] title = IMP2 – Simple Program Verification in Isabelle/HOL author = Peter Lammich , Simon Wimmer topic = Computer Science/Programming Languages/Logics, Computer Science/Algorithms date = 2019-01-15 notify = lammich@in.tum.de abstract = IMP2 is a simple imperative language together with Isabelle tooling to create a program verification environment in Isabelle/HOL. The tools include a C-like syntax, a verification condition generator, and Isabelle commands for the specification of programs. The framework is modular, i.e., it allows easy reuse of already proved programs within larger programs. This entry comes with a quickstart guide and a large collection of examples, spanning basic algorithms with simple proofs to more advanced algorithms and proof techniques like data refinement. Some highlights from the examples are:
  • Bisection Square Root,
  • Extended Euclid,
  • Exponentiation by Squaring,
  • Binary Search,
  • Insertion Sort,
  • Quicksort,
  • Depth First Search.
The abstract syntax and semantics are very simple and well-documented. They are suitable to be used in a course, as extension to the IMP language which comes with the Isabelle distribution. While this entry is limited to a simple imperative language, the ideas could be extended to more sophisticated languages. [Farkas] title = Farkas' Lemma and Motzkin's Transposition Theorem author = Ralph Bottesch , Max W. Haslbeck , René Thiemann topic = Mathematics/Algebra date = 2019-01-17 notify = rene.thiemann@uibk.ac.at abstract = We formalize a proof of Motzkin's transposition theorem and Farkas' lemma in Isabelle/HOL. Our proof is based on the formalization of the simplex algorithm which, given a set of linear constraints, either returns a satisfying assignment to the problem or detects unsatisfiability. By reusing facts about the simplex algorithm we show that a set of linear constraints is unsatisfiable if and only if there is a linear combination of the constraints which evaluates to a trivially unsatisfiable inequality. [Auto2_Imperative_HOL] title = Verifying Imperative Programs using Auto2 author = Bohua Zhan topic = Computer Science/Algorithms, Computer Science/Data Structures date = 2018-12-21 notify = bzhan@ios.ac.cn abstract = This entry contains the application of auto2 to verifying functional and imperative programs. Algorithms and data structures that are verified include linked lists, binary search trees, red-black trees, interval trees, priority queue, quicksort, union-find, Dijkstra's algorithm, and a sweep-line algorithm for detecting rectangle intersection. The imperative verification is based on Imperative HOL and its separation logic framework. A major goal of this work is to set up automation in order to reduce the length of proof that the user needs to provide, both for verifying functional programs and for working with separation logic. [UTP] title = Isabelle/UTP: Mechanised Theory Engineering for Unifying Theories of Programming author = Simon Foster , Frank Zeyda<>, Yakoub Nemouchi , Pedro Ribeiro<>, Burkhart Wolff topic = Computer Science/Programming Languages/Logics date = 2019-02-01 notify = simon.foster@york.ac.uk abstract = Isabelle/UTP is a mechanised theory engineering toolkit based on Hoare and He’s Unifying Theories of Programming (UTP). UTP enables the creation of denotational, algebraic, and operational semantics for different programming languages using an alphabetised relational calculus. We provide a semantic embedding of the alphabetised relational calculus in Isabelle/HOL, including new type definitions, relational constructors, automated proof tactics, and accompanying algebraic laws. Isabelle/UTP can be used to both capture laws of programming for different languages, and put these fundamental theorems to work in the creation of associated verification tools, using calculi like Hoare logics. This document describes the relational core of the UTP in Isabelle/HOL. [HOL-CSP] title = HOL-CSP Version 2.0 author = Safouan Taha , Lina Ye , Burkhart Wolff topic = Computer Science/Concurrency/Process Calculi, Computer Science/Semantics date = 2019-04-26 notify = wolff@lri.fr abstract = This is a complete formalization of the work of Hoare and Roscoe on the denotational semantics of the Failure/Divergence Model of CSP. It follows essentially the presentation of CSP in Roscoe’s Book ”Theory and Practice of Concurrency” [8] and the semantic details in a joint Paper of Roscoe and Brooks ”An improved failures model for communicating processes". The present work is based on a prior formalization attempt, called HOL-CSP 1.0, done in 1997 by H. Tej and B. Wolff with the Isabelle proof technology available at that time. This work revealed minor, but omnipresent foundational errors in key concepts like the process invariant. The present version HOL-CSP profits from substantially improved libraries (notably HOLCF), improved automated proof techniques, and structured proof techniques in Isar and is substantially shorter but more complete. [Probabilistic_Prime_Tests] title = Probabilistic Primality Testing author = Daniel Stüwe<>, Manuel Eberl topic = Mathematics/Number Theory date = 2019-02-11 notify = eberlm@in.tum.de abstract =

The most efficient known primality tests are probabilistic in the sense that they use randomness and may, with some probability, mistakenly classify a composite number as prime – but never a prime number as composite. Examples of this are the Miller–Rabin test, the Solovay–Strassen test, and (in most cases) Fermat's test.

This entry defines these three tests and proves their correctness. It also develops some of the number-theoretic foundations, such as Carmichael numbers and the Jacobi symbol with an efficient executable algorithm to compute it.

[Kruskal] title = Kruskal's Algorithm for Minimum Spanning Forest author = Maximilian P.L. Haslbeck , Peter Lammich , Julian Biendarra<> topic = Computer Science/Algorithms date = 2019-02-14 notify = haslbema@in.tum.de, lammich@in.tum.de abstract = This Isabelle/HOL formalization defines a greedy algorithm for finding a minimum weight basis on a weighted matroid and proves its correctness. This algorithm is an abstract version of Kruskal's algorithm. We interpret the abstract algorithm for the cycle matroid (i.e. forests in a graph) and refine it to imperative executable code using an efficient union-find data structure. Our formalization can be instantiated for different graph representations. We provide instantiations for undirected graphs and symmetric directed graphs. [List_Inversions] title = The Inversions of a List author = Manuel Eberl topic = Computer Science/Algorithms date = 2019-02-01 notify = eberlm@in.tum.de abstract =

This entry defines the set of inversions of a list, i.e. the pairs of indices that violate sortedness. It also proves the correctness of the well-known O(n log n) divide-and-conquer algorithm to compute the number of inversions.

[Prime_Distribution_Elementary] title = Elementary Facts About the Distribution of Primes author = Manuel Eberl topic = Mathematics/Number Theory date = 2019-02-21 notify = eberlm@in.tum.de abstract =

This entry is a formalisation of Chapter 4 (and parts of Chapter 3) of Apostol's Introduction to Analytic Number Theory. The main topics that are addressed are properties of the distribution of prime numbers that can be shown in an elementary way (i. e. without the Prime Number Theorem), the various equivalent forms of the PNT (which imply each other in elementary ways), and consequences that follow from the PNT in elementary ways. The latter include, most notably, asymptotic bounds for the number of distinct prime factors of n, the divisor function d(n), Euler's totient function φ(n), and lcm(1,…,n).

[Safe_OCL] title = Safe OCL author = Denis Nikiforov <> topic = Computer Science/Programming Languages/Language Definitions license = LGPL date = 2019-03-09 notify = denis.nikif@gmail.com abstract =

The theory is a formalization of the OCL type system, its abstract syntax and expression typing rules. The theory does not define a concrete syntax and a semantics. In contrast to Featherweight OCL, it is based on a deep embedding approach. The type system is defined from scratch, it is not based on the Isabelle HOL type system.

The Safe OCL distincts nullable and non-nullable types. Also the theory gives a formal definition of safe navigation operations. The Safe OCL typing rules are much stricter than rules given in the OCL specification. It allows one to catch more errors on a type checking phase.

The type theory presented is four-layered: classes, basic types, generic types, errorable types. We introduce the following new types: non-nullable types (T[1]), nullable types (T[?]), OclSuper. OclSuper is a supertype of all other types (basic types, collections, tuples). This type allows us to define a total supremum function, so types form an upper semilattice. It allows us to define rich expression typing rules in an elegant manner.

The Preliminaries Chapter of the theory defines a number of helper lemmas for transitive closures and tuples. It defines also a generic object model independent from OCL. It allows one to use the theory as a reference for formalization of analogous languages.

[QHLProver] title = Quantum Hoare Logic author = Junyi Liu<>, Bohua Zhan , Shuling Wang<>, Shenggang Ying<>, Tao Liu<>, Yangjia Li<>, Mingsheng Ying<>, Naijun Zhan<> topic = Computer Science/Programming Languages/Logics, Computer Science/Semantics date = 2019-03-24 notify = bzhan@ios.ac.cn abstract = We formalize quantum Hoare logic as given in [1]. In particular, we specify the syntax and denotational semantics of a simple model of quantum programs. Then, we write down the rules of quantum Hoare logic for partial correctness, and show the soundness and completeness of the resulting proof system. As an application, we verify the correctness of Grover’s algorithm. [Transcendence_Series_Hancl_Rucki] title = The Transcendence of Certain Infinite Series author = Angeliki Koutsoukou-Argyraki , Wenda Li topic = Mathematics/Analysis, Mathematics/Number Theory date = 2019-03-27 notify = wl302@cam.ac.uk, ak2110@cam.ac.uk abstract = We formalize the proofs of two transcendence criteria by J. Hančl and P. Rucki that assert the transcendence of the sums of certain infinite series built up by sequences that fulfil certain properties. Both proofs make use of Roth's celebrated theorem on diophantine approximations to algebraic numbers from 1955 which we implement as an assumption without having formalised its proof. [Binding_Syntax_Theory] title = A General Theory of Syntax with Bindings author = Lorenzo Gheri , Andrei Popescu topic = Computer Science/Programming Languages/Lambda Calculi, Computer Science/Functional Programming, Logic date = 2019-04-06 notify = a.popescu@mdx.ac.uk, lor.gheri@gmail.com abstract = We formalize a theory of syntax with bindings that has been developed and refined over the last decade to support several large formalization efforts. Terms are defined for an arbitrary number of constructors of varying numbers of inputs, quotiented to alpha-equivalence and sorted according to a binding signature. The theory includes many properties of the standard operators on terms: substitution, swapping and freshness. It also includes bindings-aware induction and recursion principles and support for semantic interpretation. This work has been presented in the ITP 2017 paper “A Formalized General Theory of Syntax with Bindings”. [LTL_Master_Theorem] title = A Compositional and Unified Translation of LTL into ω-Automata author = Benedikt Seidl , Salomon Sickert topic = Computer Science/Automata and Formal Languages date = 2019-04-16 notify = benedikt.seidl@tum.de, s.sickert@tum.de abstract = We present a formalisation of the unified translation approach of linear temporal logic (LTL) into ω-automata from [1]. This approach decomposes LTL formulas into ``simple'' languages and allows a clear separation of concerns: first, we formalise the purely logical result yielding this decomposition; second, we instantiate this generic theory to obtain a construction for deterministic (state-based) Rabin automata (DRA). We extract from this particular instantiation an executable tool translating LTL to DRAs. To the best of our knowledge this is the first verified translation from LTL to DRAs that is proven to be double exponential in the worst case which asymptotically matches the known lower bound.

[1] Javier Esparza, Jan Kretínský, Salomon Sickert. One Theorem to Rule Them All: A Unified Translation of LTL into ω-Automata. LICS 2018 [LambdaAuth] title = Formalization of Generic Authenticated Data Structures author = Matthias Brun<>, Dmitriy Traytel topic = Computer Science/Security, Computer Science/Programming Languages/Lambda Calculi date = 2019-05-14 notify = traytel@inf.ethz.ch abstract = Authenticated data structures are a technique for outsourcing data storage and maintenance to an untrusted server. The server is required to produce an efficiently checkable and cryptographically secure proof that it carried out precisely the requested computation. Miller et al. introduced λ• (pronounced lambda auth)—a functional programming language with a built-in primitive authentication construct, which supports a wide range of user-specified authenticated data structures while guaranteeing certain correctness and security properties for all well-typed programs. We formalize λ• and prove its correctness and security properties. With Isabelle's help, we uncover and repair several mistakes in the informal proofs and lemma statements. Our findings are summarized in a paper draft. [IMP2_Binary_Heap] title = Binary Heaps for IMP2 author = Simon Griebel<> topic = Computer Science/Data Structures, Computer Science/Algorithms date = 2019-06-13 notify = s.griebel@tum.de abstract = In this submission array-based binary minimum heaps are formalized. The correctness of the following heap operations is proved: insert, get-min, delete-min and make-heap. These are then used to verify an in-place heapsort. The formalization is based on IMP2, an imperative program verification framework implemented in Isabelle/HOL. The verified heap functions are iterative versions of the partly recursive functions found in "Algorithms and Data Structures – The Basic Toolbox" by K. Mehlhorn and P. Sanders and "Introduction to Algorithms" by T. H. Cormen, C. E. Leiserson, R. L. Rivest and C. Stein. [Groebner_Macaulay] title = Gröbner Bases, Macaulay Matrices and Dubé's Degree Bounds author = Alexander Maletzky topic = Mathematics/Algebra date = 2019-06-15 notify = alexander.maletzky@risc.jku.at abstract = This entry formalizes the connection between Gröbner bases and Macaulay matrices (sometimes also referred to as `generalized Sylvester matrices'). In particular, it contains a method for computing Gröbner bases, which proceeds by first constructing some Macaulay matrix of the initial set of polynomials, then row-reducing this matrix, and finally converting the result back into a set of polynomials. The output is shown to be a Gröbner basis if the Macaulay matrix constructed in the first step is sufficiently large. In order to obtain concrete upper bounds on the size of the matrix (and hence turn the method into an effectively executable algorithm), Dubé's degree bounds on Gröbner bases are utilized; consequently, they are also part of the formalization. [Linear_Inequalities] title = Linear Inequalities author = Ralph Bottesch , Alban Reynaud <>, René Thiemann topic = Mathematics/Algebra date = 2019-06-21 notify = rene.thiemann@uibk.ac.at abstract = We formalize results about linear inqualities, mainly from Schrijver's book. The main results are the proof of the fundamental theorem on linear inequalities, Farkas' lemma, Carathéodory's theorem, the Farkas-Minkowsky-Weyl theorem, the decomposition theorem of polyhedra, and Meyer's result that the integer hull of a polyhedron is a polyhedron itself. Several theorems include bounds on the appearing numbers, and in particular we provide an a-priori bound on mixed-integer solutions of linear inequalities. [Linear_Programming] title = Linear Programming author = Julian Parsert , Cezary Kaliszyk topic = Mathematics/Algebra date = 2019-08-06 notify = julian.parsert@gmail.com, cezary.kaliszyk@uibk.ac.at abstract = We use the previous formalization of the general simplex algorithm to formulate an algorithm for solving linear programs. We encode the linear programs using only linear constraints. Solving these constraints also solves the original linear program. This algorithm is proven to be sound by applying the weak duality theorem which is also part of this formalization. [Differential_Game_Logic] title = Differential Game Logic author = André Platzer topic = Computer Science/Programming Languages/Logics date = 2019-06-03 notify = aplatzer@cs.cmu.edu abstract = This formalization provides differential game logic (dGL), a logic for proving properties of hybrid game. In addition to the syntax and semantics, it formalizes a uniform substitution calculus for dGL. Church's uniform substitutions substitute a term or formula for a function or predicate symbol everywhere. The uniform substitutions for dGL also substitute hybrid games for a game symbol everywhere. We prove soundness of one-pass uniform substitutions and the axioms of differential game logic with respect to their denotational semantics. One-pass uniform substitutions are faster by postponing soundness-critical admissibility checks with a linear pass homomorphic application and regain soundness by a variable condition at the replacements. The formalization is based on prior non-mechanized soundness proofs for dGL. [Complete_Non_Orders] title = Complete Non-Orders and Fixed Points author = Akihisa Yamada , Jérémy Dubut topic = Mathematics/Order date = 2019-06-27 notify = akihisayamada@nii.ac.jp, dubut@nii.ac.jp abstract = We develop an Isabelle/HOL library of order-theoretic concepts, such as various completeness conditions and fixed-point theorems. We keep our formalization as general as possible: we reprove several well-known results about complete orders, often without any properties of ordering, thus complete non-orders. In particular, we generalize the Knaster–Tarski theorem so that we ensure the existence of a quasi-fixed point of monotone maps over complete non-orders, and show that the set of quasi-fixed points is complete under a mild condition—attractivity—which is implied by either antisymmetry or transitivity. This result generalizes and strengthens a result by Stauti and Maaden. Finally, we recover Kleene’s fixed-point theorem for omega-complete non-orders, again using attractivity to prove that Kleene’s fixed points are least quasi-fixed points. [Priority_Search_Trees] title = Priority Search Trees author = Peter Lammich , Tobias Nipkow topic = Computer Science/Data Structures date = 2019-06-25 notify = lammich@in.tum.de abstract = We present a new, purely functional, simple and efficient data structure combining a search tree and a priority queue, which we call a priority search tree. The salient feature of priority search trees is that they offer a decrease-key operation, something that is missing from other simple, purely functional priority queue implementations. Priority search trees can be implemented on top of any search tree. This entry does the implementation for red-black trees. This entry formalizes the first part of our ITP-2019 proof pearl Purely Functional, Simple and Efficient Priority Search Trees and Applications to Prim and Dijkstra. [Prim_Dijkstra_Simple] title = Purely Functional, Simple, and Efficient Implementation of Prim and Dijkstra author = Peter Lammich , Tobias Nipkow topic = Computer Science/Algorithms date = 2019-06-25 notify = lammich@in.tum.de abstract = We verify purely functional, simple and efficient implementations of Prim's and Dijkstra's algorithms. This constitutes the first verification of an executable and even efficient version of Prim's algorithm. This entry formalizes the second part of our ITP-2019 proof pearl Purely Functional, Simple and Efficient Priority Search Trees and Applications to Prim and Dijkstra. [MFOTL_Monitor] title = Formalization of a Monitoring Algorithm for Metric First-Order Temporal Logic author = Joshua Schneider , Dmitriy Traytel topic = Computer Science/Algorithms, Logic, Computer Science/Automata and Formal Languages date = 2019-07-04 notify = joshua.schneider@inf.ethz.ch, traytel@inf.ethz.ch abstract = A monitor is a runtime verification tool that solves the following problem: Given a stream of time-stamped events and a policy formulated in a specification language, decide whether the policy is satisfied at every point in the stream. We verify the correctness of an executable monitor for specifications given as formulas in metric first-order temporal logic (MFOTL), an expressive extension of linear temporal logic with real-time constraints and first-order quantification. The verified monitor implements a simplified variant of the algorithm used in the efficient MonPoly monitoring tool. The formalization is presented in a forthcoming RV 2019 paper, which also compares the output of the verified monitor to that of other monitoring tools on randomly generated inputs. This case study revealed several errors in the optimized but unverified tools. [FOL_Seq_Calc1] title = A Sequent Calculus for First-Order Logic author = Asta Halkjær From contributors = Alexander Birch Jensen , Anders Schlichtkrull , Jørgen Villadsen topic = Logic date = 2019-07-18 notify = s144442@student.dtu.dk abstract = This work formalizes soundness and completeness of a one-sided sequent calculus for first-order logic. The completeness is shown via a translation from a complete semantic tableau calculus, the proof of which is based on the First-Order Logic According to Fitting theory. The calculi and proof techniques are taken from Ben-Ari's Mathematical Logic for Computer Science. [Szpilrajn] title = Szpilrajn Extension Theorem author = Peter Zeller topic = Mathematics/Order date = 2019-07-27 notify = p_zeller@cs.uni-kl.de abstract = We formalize the Szpilrajn extension theorem, also known as order-extension principal: Every strict partial order can be extended to a strict linear order. [TESL_Language] title = A Formal Development of a Polychronous Polytimed Coordination Language author = Hai Nguyen Van , Frédéric Boulanger , Burkhart Wolff topic = Computer Science/System Description Languages, Computer Science/Semantics, Computer Science/Concurrency date = 2019-07-30 notify = frederic.boulanger@centralesupelec.fr, burkhart.wolff@lri.fr abstract = The design of complex systems involves different formalisms for modeling their different parts or aspects. The global model of a system may therefore consist of a coordination of concurrent sub-models that use different paradigms. We develop here a theory for a language used to specify the timed coordination of such heterogeneous subsystems by addressing the following issues:

  • the behavior of the sub-systems is observed only at a series of discrete instants,
  • events may occur in different sub-systems at unrelated times, leading to polychronous systems, which do not necessarily have a common base clock,
  • coordination between subsystems involves causality, so the occurrence of an event may enforce the occurrence of other events, possibly after a certain duration has elapsed or an event has occurred a given number of times,
  • the domain of time (discrete, rational, continuous...) may be different in the subsystems, leading to polytimed systems,
  • the time frames of different sub-systems may be related (for instance, time in a GPS satellite and in a GPS receiver on Earth are related although they are not the same).
Firstly, a denotational semantics of the language is defined. Then, in order to be able to incrementally check the behavior of systems, an operational semantics is given, with proofs of progress, soundness and completeness with regard to the denotational semantics. These proofs are made according to a setup that can scale up when new operators are added to the language. In order for specifications to be composed in a clean way, the language should be invariant by stuttering (i.e., adding observation instants at which nothing happens). The proof of this invariance is also given. [Stellar_Quorums] title = Stellar Quorum Systems author = Giuliano Losa topic = Computer Science/Algorithms/Distributed date = 2019-08-01 notify = giuliano@galois.com abstract = We formalize the static properties of personal Byzantine quorum systems (PBQSs) and Stellar quorum systems, as described in the paper ``Stellar Consensus by Reduction'' (to appear at DISC 2019). [IMO2019] title = Selected Problems from the International Mathematical Olympiad 2019 author = Manuel Eberl topic = Mathematics/Misc date = 2019-08-05 notify = eberlm@in.tum.de abstract =

This entry contains formalisations of the answers to three of the six problem of the International Mathematical Olympiad 2019, namely Q1, Q4, and Q5.

The reason why these problems were chosen is that they are particularly amenable to formalisation: they can be solved with minimal use of libraries. The remaining three concern geometry and graph theory, which, in the author's opinion, are more difficult to formalise resp. require a more complex library.

[Adaptive_State_Counting] title = Formalisation of an Adaptive State Counting Algorithm author = Robert Sachtleben topic = Computer Science/Automata and Formal Languages, Computer Science/Algorithms date = 2019-08-16 notify = rob_sac@uni-bremen.de abstract = This entry provides a formalisation of a refinement of an adaptive state counting algorithm, used to test for reduction between finite state machines. The algorithm has been originally presented by Hierons in the paper Testing from a Non-Deterministic Finite State Machine Using Adaptive State Counting. Definitions for finite state machines and adaptive test cases are given and many useful theorems are derived from these. The algorithm is formalised using mutually recursive functions, for which it is proven that the generated test suite is sufficient to test for reduction against finite state machines of a certain fault domain. Additionally, the algorithm is specified in a simple WHILE-language and its correctness is shown using Hoare-logic. [Jacobson_Basic_Algebra] title = A Case Study in Basic Algebra author = Clemens Ballarin topic = Mathematics/Algebra date = 2019-08-30 notify = ballarin@in.tum.de abstract = The focus of this case study is re-use in abstract algebra. It contains locale-based formalisations of selected parts of set, group and ring theory from Jacobson's Basic Algebra leading to the respective fundamental homomorphism theorems. The study is not intended as a library base for abstract algebra. It rather explores an approach towards abstract algebra in Isabelle. [Hybrid_Systems_VCs] title = Verification Components for Hybrid Systems author = Jonathan Julian Huerta y Munive <> topic = Mathematics/Algebra, Mathematics/Analysis date = 2019-09-10 notify = jjhuertaymunive1@sheffield.ac.uk, jonjulian23@gmail.com abstract = These components formalise a semantic framework for the deductive verification of hybrid systems. They support reasoning about continuous evolutions of hybrid programs in the style of differential dynamics logic. Vector fields or flows model these evolutions, and their verification is done with invariants for the former or orbits for the latter. Laws of modal Kleene algebra or categorical predicate transformers implement the verification condition generation. Examples show the approach at work. [Generic_Join] title = Formalization of Multiway-Join Algorithms author = Thibault Dardinier<> topic = Computer Science/Algorithms date = 2019-09-16 notify = tdardini@student.ethz.ch, traytel@inf.ethz.ch abstract = Worst-case optimal multiway-join algorithms are recent seminal achievement of the database community. These algorithms compute the natural join of multiple relational databases and improve in the worst case over traditional query plan optimizations of nested binary joins. In 2014, Ngo, Ré, and Rudra gave a unified presentation of different multi-way join algorithms. We formalized and proved correct their "Generic Join" algorithm and extended it to support negative joins. [Aristotles_Assertoric_Syllogistic] title = Aristotle's Assertoric Syllogistic author = Angeliki Koutsoukou-Argyraki topic = Logic/Philosophy date = 2019-10-08 notify = ak2110@cam.ac.uk abstract = We formalise with Isabelle/HOL some basic elements of Aristotle's assertoric syllogistic following the article from the Stanford Encyclopedia of Philosophy by Robin Smith. To this end, we use a set theoretic formulation (covering both individual and general predication). In particular, we formalise the deductions in the Figures and after that we present Aristotle's metatheoretical observation that all deductions in the Figures can in fact be reduced to either Barbara or Celarent. As the formal proofs prove to be straightforward, the interest of this entry lies in illustrating the functionality of Isabelle and high efficiency of Sledgehammer for simple exercises in philosophy. [VerifyThis2019] title = VerifyThis 2019 -- Polished Isabelle Solutions author = Peter Lammich<>, Simon Wimmer topic = Computer Science/Algorithms date = 2019-10-16 notify = lammich@in.tum.de, wimmers@in.tum.de abstract = VerifyThis 2019 (http://www.pm.inf.ethz.ch/research/verifythis.html) was a program verification competition associated with ETAPS 2019. It was the 8th event in the VerifyThis competition series. In this entry, we present polished and completed versions of our solutions that we created during the competition. [ZFC_in_HOL] title = Zermelo Fraenkel Set Theory in Higher-Order Logic author = Lawrence C. Paulson topic = Mathematics/Set Theory date = 2019-10-24 notify = lp15@cam.ac.uk abstract =

This entry is a new formalisation of ZFC set theory in Isabelle/HOL. It is logically equivalent to Obua's HOLZF; the point is to have the closest possible integration with the rest of Isabelle/HOL, minimising the amount of new notations and exploiting type classes.

There is a type V of sets and a function elts :: V => V set mapping a set to its elements. Classes simply have type V set, and a predicate identifies the small classes: those that correspond to actual sets. Type classes connected with orders and lattices are used to minimise the amount of new notation for concepts such as the subset relation, union and intersection. Basic concepts — Cartesian products, disjoint sums, natural numbers, functions, etc. — are formalised.

More advanced set-theoretic concepts, such as transfinite induction, ordinals, cardinals and the transitive closure of a set, are also provided. The definition of addition and multiplication for general sets (not just ordinals) follows Kirby.

The theory provides two type classes with the aim of facilitating developments that combine V with other Isabelle/HOL types: embeddable, the class of types that can be injected into V (including V itself as well as V*V, etc.), and small, the class of types that correspond to some ZF set.

[Interval_Arithmetic_Word32] title = Interval Arithmetic on 32-bit Words author = Brandon Bohrer topic = Computer Science/Data Structures date = 2019-11-27 notify = bjbohrer@gmail.com, bbohrer@cs.cmu.edu abstract = Interval_Arithmetic implements conservative interval arithmetic computations, then uses this interval arithmetic to implement a simple programming language where all terms have 32-bit signed word values, with explicit infinities for terms outside the representable bounds. Our target use case is interpreters for languages that must have a well-understood low-level behavior. We include a formalization of bounded-length strings which are used for the identifiers of our language. Bounded-length identifiers are useful in some applications, for example the Differential_Dynamic_Logic article, where a Euclidean space indexed by identifiers demands that identifiers are finitely many. [Generalized_Counting_Sort] title = An Efficient Generalization of Counting Sort for Large, possibly Infinite Key Ranges author = Pasquale Noce topic = Computer Science/Algorithms, Computer Science/Functional Programming date = 2019-12-04 notify = pasquale.noce.lavoro@gmail.com abstract = Counting sort is a well-known algorithm that sorts objects of any kind mapped to integer keys, or else to keys in one-to-one correspondence with some subset of the integers (e.g. alphabet letters). However, it is suitable for direct use, viz. not just as a subroutine of another sorting algorithm (e.g. radix sort), only if the key range is not significantly larger than the number of the objects to be sorted. This paper describes a tail-recursive generalization of counting sort making use of a bounded number of counters, suitable for direct use in case of a large, or even infinite key range of any kind, subject to the only constraint of being a subset of an arbitrary linear order. After performing a pen-and-paper analysis of how such algorithm has to be designed to maximize its efficiency, this paper formalizes the resulting generalized counting sort (GCsort) algorithm and then formally proves its correctness properties, namely that (a) the counters' number is maximized never exceeding the fixed upper bound, (b) objects are conserved, (c) objects get sorted, and (d) the algorithm is stable. [Poincare_Bendixson] title = The Poincaré-Bendixson Theorem author = Fabian Immler , Yong Kiam Tan topic = Mathematics/Analysis date = 2019-12-18 notify = fimmler@cs.cmu.edu, yongkiat@cs.cmu.edu abstract = The Poincaré-Bendixson theorem is a classical result in the study of (continuous) dynamical systems. Colloquially, it restricts the possible behaviors of planar dynamical systems: such systems cannot be chaotic. In practice, it is a useful tool for proving the existence of (limiting) periodic behavior in planar systems. The theorem is an interesting and challenging benchmark for formalized mathematics because proofs in the literature rely on geometric sketches and only hint at symmetric cases. It also requires a substantial background of mathematical theories, e.g., the Jordan curve theorem, real analysis, ordinary differential equations, and limiting (long-term) behavior of dynamical systems. [Isabelle_C] title = Isabelle/C author = Frédéric Tuong , Burkhart Wolff topic = Computer Science/Programming Languages/Language Definitions, Computer Science/Semantics, Tools date = 2019-10-22 notify = tuong@users.gforge.inria.fr, wolff@lri.fr abstract = We present a framework for C code in C11 syntax deeply integrated into the Isabelle/PIDE development environment. Our framework provides an abstract interface for verification back-ends to be plugged-in independently. Thus, various techniques such as deductive program verification or white-box testing can be applied to the same source, which is part of an integrated PIDE document model. Semantic back-ends are free to choose the supported C fragment and its semantics. In particular, they can differ on the chosen memory model or the specification mechanism for framing conditions. Our framework supports semantic annotations of C sources in the form of comments. Annotations serve to locally control back-end settings, and can express the term focus to which an annotation refers. Both the logical and the syntactic context are available when semantic annotations are evaluated. As a consequence, a formula in an annotation can refer both to HOL or C variables. Our approach demonstrates the degree of maturity and expressive power the Isabelle/PIDE sub-system has achieved in recent years. Our integration technique employs Lex and Yacc style grammars to ensure efficient deterministic parsing. This is the core-module of Isabelle/C; the AFP package for Clean and Clean_wrapper as well as AutoCorres and AutoCorres_wrapper (available via git) are applications of this front-end. diff --git a/thys/Zeta_Function/Hadjicostas_Chapman.thy b/thys/Zeta_Function/Hadjicostas_Chapman.thy new file mode 100644 --- /dev/null +++ b/thys/Zeta_Function/Hadjicostas_Chapman.thy @@ -0,0 +1,668 @@ +section \The Hadjicostas--Chapman formula\ +theory Hadjicostas_Chapman + imports Zeta_Laurent_Expansion +begin + +text \ + In this section, we will derive a formula for the \\\ function that was conjectured by + Hadjicostas~\cite{hadjicostas2004} and proven shortly afterwards by Chapman~\cite{chapman2004}. + The formula is: + \begin{align*} + &\int_0^1 \int_0^1 \frac{(-\ln (xy))^z (1-x)}{1-xy}\ \text{d}x\,\text{d}y\\ + &\quad = \int_0^1 \frac{(-\ln u)^z(-\ln u + u - 1)}{1-u}\ \text{d}u\\ + &\quad = \Gamma(z + 2) \left(\zeta(z + 2) - \frac{1}{z+1}\right) + \end{align*} + for any \z\ with $\mathfrak{R}(z) > -2$. In particular, setting $z = 1$, we can derive + the following formula for the Euler--Mascheroni constant \\\: + \[-\int_0^1 \int_0^1 \frac{1-x}{(1-xy) \ln (xy)}\ \text{d}x\,\text{d}y = \gamma\] + This formula was first proven by Sondow~\cite{sondow2002}. +\ + +subsection \The real case\ + +text \ + We first define the integral for real \z > -2\. This is then a non-negative integral, + so that we can ignore the issue of integrability and use the Lebesgue integral on the + extended non-negative reals + + We first show the equivalence of the single-integral and the double-integral form. +\ + +definition Hadjicostas_nn_integral :: "real \ ennreal" where + "Hadjicostas_nn_integral z = + set_nn_integral lborel {0<..<1} + (\u. ennreal ((-ln u) powr z / (1 - u) * (-ln u + u - 1)))" + +definition Hadjicostas_integral :: "complex \ complex" where + "Hadjicostas_integral z = + (LBINT u=0..1. of_real (-ln u) powr z / of_real (1 - u) * of_real (-ln u + u - 1))" + +lemma Hadjicostas_nn_integral_altdef: + "Hadjicostas_nn_integral z = + (\\<^sup>+(x,y)\{0<..<1}\{0<..<1}. ((-ln (x*y)) powr z * (1-x) / (1-x*y)) \lborel)" +proof - + define f where "f \ (\u. ((-ln u) powr z / (1 - u) * (-ln u + u - 1)))" + let ?I = "Gamma (z + 2) * (Re (zeta (z + 2)) - 1 / (z + 1))" + let ?f = "\u. ((-ln u) powr z / (1 - u) * (-ln u + u - 1))" + define D :: "(real \ real) set" where "D = {0<..<1} \ {0<..<1}" + define D1 where "D1 = (SIGMA x:{0<..<1}. {0<..<(x::real)})" + define D2 where "D2 = (SIGMA u:{0<..<1}. {u<..<(1::real)})" + have [measurable]: "D1 \ sets (lborel \\<^sub>M lborel)" + proof - + have "D1 = {x\space (lborel \\<^sub>M lborel). snd x > 0 \ fst x > snd x \ fst x < 1}" + by (auto simp: D1_def space_pair_measure) + also have "\ \ sets (lborel \\<^sub>M lborel)" + by measurable + finally show ?thesis . + qed + have [measurable]: "D2 \ sets (lborel \\<^sub>M lborel)" + proof - + have "D2 = {x\space (lborel \\<^sub>M lborel). fst x > 0 \ fst x < snd x \ snd x < 1}" + by (auto simp: D2_def space_pair_measure) + also have "\ \ sets (lborel \\<^sub>M lborel)" + by measurable + finally show ?thesis . + qed + + have "(\\<^sup>+(x,y)\D. ((-ln (x*y)) powr z * (1-x) / (1-x*y)) \lborel) = + (\\<^sup>+x\{0<..<1}. (\\<^sup>+y\{0<..<1}. ((-ln (x*y)) powr z / (1-x*y) * (1-x)) \lborel) \lborel)" + unfolding lborel_prod [symmetric] case_prod_unfold D_def + by (subst lborel.nn_integral_fst[symmetric]) + (auto intro!: nn_integral_cong simp: indicator_def) + also have "\ = (\\<^sup>+x\{0<..<1}. (\\<^sup>+u\{0<..lborel) \lborel)" + proof (rule set_nn_integral_cong) + fix x :: real assume x: "x \ space lborel \ {0<..<1}" + show "(\\<^sup>+y\{0<..<1}. ((-ln (x*y)) powr z / (1-x*y) * (1-x)) \lborel) = + (\\<^sup>+u\{0<..lborel)" using x + by (subst lborel_distr_mult'[of "1/x"]) + (auto simp: nn_integral_density nn_integral_distr indicator_def field_simps + simp flip: ennreal_mult' intro!: nn_integral_cong) + qed auto + also have "\ = (\\<^sup>+(x,u)\D1. ((- ln u) powr z / (1 - u) * (1 - x) / x) \lborel)" + unfolding lborel_prod [symmetric] case_prod_unfold D_def + by (subst lborel.nn_integral_fst[symmetric], measurable) + (auto intro!: nn_integral_cong simp: indicator_def D1_def) + also have "\ = (\\<^sup>+(x,u). indicator D2 (u,x) * ((- ln u) powr z / (1 - u) * (1 - x) / x) \lborel)" + by (intro nn_integral_cong) (auto simp: D1_def D2_def indicator_def split: if_splits) + also have "\ = (\\<^sup>+u\{0<..<1}. (\\<^sup>+x\{u<..<1}. ((- ln u) powr z / (1 - u) * (1 - x) / x) \lborel) \lborel)" + unfolding case_prod_unfold lborel_prod [symmetric] + by (subst lborel_pair.nn_integral_snd [symmetric], measurable) + (auto intro!: nn_integral_cong simp: D2_def indicator_def) + also have "\ = (\\<^sup>+u\{0<..<1}. ((-ln u) powr z / (1 - u) * (-ln u + u - 1)) \lborel)" + proof (intro set_nn_integral_cong refl) + fix u :: real assume u: "u \ space lborel \ {0<..<1}" + let ?F = "\x. (- ln u) powr z / (1 - u) * (ln x - x)" + have "(\\<^sup>+x\{u<..<1}. ennreal ((- ln u) powr z / (1 - u) * (1 - x) / x) \lborel) = + (\\<^sup>+x\{u..1}. ennreal ((- ln u) powr z / (1 - u) * (1 - x) / x) \lborel)" + by (rule nn_integral_cong_AE, rule AE_I[of _ _ "{u,1}"]) + (auto simp: emeasure_lborel_countable indicator_def) + also have "\ = ennreal (?F 1 - ?F u)" + using u by (intro nn_integral_FTC_Icc) (auto intro!: derivative_eq_intros simp: divide_simps) + also have "?F 1 - ?F u = (-ln u) powr z / (1 - u) * (-ln u + u - 1)" + using u by (simp add: divide_simps) (simp add: algebra_simps)? + finally show "(\\<^sup>+x\{u<..<1}. ((- ln u) powr z / (1 - u) * (1 - x) / x) \lborel) = ennreal \" . + qed + also have "\ = Hadjicostas_nn_integral z" + by (simp add: Hadjicostas_nn_integral_def) + finally show ?thesis by (simp add: D_def) +qed + +text \ + We now solve the single integral for real \z > -1\. +\ +lemma Hadjicostas_Chapman_aux: + fixes z :: real + assumes z: "z > -1" + defines "f \ (\u. ((-ln u) powr z / (1 - u) * (-ln u + u - 1)))" + shows "(f has_integral (Gamma (z + 2) * (Re (zeta (z + 2)) - 1 / (z + 1)))) {0<..<1}" +proof - + let ?I = "Gamma (z + 2) * (Re (zeta (z + 2)) - 1 / (z + 1))" + have nonneg: "1 \ x + exp (- x)" if "x \ 0" for x :: real + proof - + have "x + (1 + (-x)) \ x + exp (-x)" + by (intro add_left_mono exp_ge_add_one_self) + thus ?thesis by simp + qed + + have eq: "((\t::real. exp (-t)) ` {0<..}) = {0<..<1}" + proof safe + fix x :: real assume x: "x \ {0<..<1}" + hence "x = exp (-(-ln x))" and "-ln x \ {0<..}" + by auto + thus "x \ (\t. exp (-t)) ` {0<..}" by blast + qed auto + + have I: "((\x. x powr (z+1) / (exp x - 1) - x powr z / exp x) has_integral ?I) {0<..}" + proof - + from z have "z + 1 \ \\<^sub>\\<^sub>0" + by (auto simp: nonpos_Reals_def) + hence z': "z + 1 \ \\<^sub>\\<^sub>0" + using nonpos_Ints_subset_nonpos_Reals by blast + have "((\x. x powr (z + 2 - 1) / (exp x - 1) - x powr (z + 1 - 1) / exp x) + has_integral (Gamma (z + 2) * Re (zeta (z + 2)) - Gamma (z + 1))) {0<..}" using z + by (intro has_integral_diff Gamma_integral_real' Gamma_times_zeta_has_integral_real) auto + also have "Gamma (z + 2) * Re (zeta (z + 2)) - Gamma (z + 1) = + Gamma (z + 2) * (Re (zeta (z + 2)) - 1 / (z + 1))" + using Gamma_plus1[of "z+1"] z z' by (auto simp: field_simps) + finally show ?thesis + by (simp add: add_ac) + qed + also have "?this \ ((\x. \-exp (-x)\ * f (exp (-x))) has_integral ?I) {0<..}" + unfolding f_def + apply (intro has_integral_cong) + apply (auto simp: field_simps powr_add powr_def exp_add) + apply (simp flip: exp_add) + done + finally have *: "((\x. \-exp (-x)\ * f (exp (-x))) has_integral ?I) {0<..}" . + + have "((\x. \-exp (-x)\ *\<^sub>R f (exp (-x))) absolutely_integrable_on {0<..}) \ + integral {0<..} (\x. \-exp (-x)\ *\<^sub>R f (exp (-x))) = ?I" + proof (intro conjI nonnegative_absolutely_integrable_1) + fix x :: real assume x: "x \ {0<..}" + thus "\-exp (-x)\ *\<^sub>R f (exp (-x)) \ 0" + unfolding f_def using nonneg + by (intro scaleR_nonneg_nonneg mult_nonneg_nonneg divide_nonneg_nonneg) auto + qed (use * in \simp_all add: has_integral_iff\) + + also have "?this \ f absolutely_integrable_on (\x. exp (- x)) ` {0<..} \ + integral ((\x. exp (- x)) ` {0<..}) f = ?I" + by (intro has_absolute_integral_change_of_variables_1') + (auto intro!: derivative_eq_intros inj_onI) + also have "(\x::real. exp (- x)) ` {0<..} = {0<..<1}" + by (fact eq) + finally show "(f has_integral ?I) {0<..<1}" + by (auto simp: has_integral_iff dest: set_lebesgue_integral_eq_integral) +qed + +lemma real_zeta_ge_one_over_minus_one: + fixes z :: real + assumes z: "z > 1" + shows "Re (zeta (complex_of_real z)) \ 1 / (z - 1)" +proof - + have ineq: "1 \ x - ln x" if "x \ {0<..<1}" for x :: real + using ln_le_minus_one[of x] that by simp + have *: "((\u. (- ln u) powr (z - 2) * (u - ln u - 1) / (1 - u)) has_integral + Gamma z * (Re (zeta (complex_of_real z)) - 1 / (z - 1))) {0<..<1}" + using Hadjicostas_Chapman_aux[of "z - 2"] z by simp + from ineq have "Gamma z * (Re (zeta (complex_of_real z)) - 1 / (z - 1)) \ 0" + by (intro has_integral_nonneg[OF *] z mult_nonneg_nonneg divide_nonneg_nonneg) auto + moreover have "Gamma z > 0" + using assms by (intro Gamma_real_pos) auto + ultimately show "Re (zeta (complex_of_real z)) \ 1 / (z - 1)" + by (subst (asm) zero_le_mult_iff) auto +qed + +text \ + We now have the formula for real \z > -1\. +\ +lemma Hadjicostas_Chapman_formula_real: + fixes z :: real + assumes z: "z > -1" + shows "Hadjicostas_nn_integral z = + ennreal (Gamma (z + 2) * (Re (zeta (z + 2)) - 1 / (z + 1)))" +proof - + have nonneg: "1 \ x - ln x" if "x > 0" "x < 1" for x :: real + proof - + have "ln x + (1 + ln x) \ ln x + exp (ln x)" + by (intro add_left_mono exp_ge_add_one_self) + thus ?thesis using that by (simp add: exp_minus) + qed + show ?thesis + unfolding Hadjicostas_nn_integral_def using nonneg Hadjicostas_Chapman_aux[OF z] + by (intro nn_integral_has_integral_lebesgue' mult_nonneg_nonneg divide_nonneg_nonneg) auto +qed + + +subsection \Analyticity of the integral\ + +text \ + To extend the formula to its full domain of validity (any complex \z\ with + $\mathfrak{R}(z)>-2$), we will use analytic continuation. To do this, we first + have to show that the integral is an analytic function of \z\ on that domain. + This is unfortunately somewhat involved, since the integral is an improper one + and we first need to show uniform convergence so that we can pull the derivative + inside the integral sign. + + We will use the single-integral form so that we only have to deal with one integral + and not two. +\ + +context + fixes f :: "complex \ real \ complex" + defines "f \ (\z u. of_real (-ln u) powr z / of_real (1 - u) * of_real (-ln u + u - 1))" +begin + +context + fixes x y :: real and g1 g2 :: "real \ real" + assumes "x > -2" + defines "g1 \ (\x. (- ln x) powr y * (x - ln x - 1) / (1 - x))" + defines "g2 \ (\u. (-ln u) powr x * (u - ln u - 1) / (1 - u))" +begin + +lemma integrable_bound1: + "interval_lebesgue_integrable lborel 0 (ereal (exp (- 1))) g1" + unfolding zero_ereal_def +proof (rule interval_lebesgue_integrable_bigo_left) + show "g1 \ O[at_right 0](\u. u powr (-1/2))" + unfolding g1_def by real_asymp + show "continuous_on {0<..exp(-1)} g1" + unfolding g1_def by (auto intro!: continuous_intros) + have "set_integrable lborel (einterval 0 (exp (-1))) (\u. u powr (-1/2))" + proof (rule interval_integral_FTC_nonneg) + fix u :: real assume u: "0 < ereal u" "ereal u < ereal (exp (-1))" + show "((\u. 2 * u powr (1/2)) has_field_derivative (u powr (-1/2))) (at u)" + using u by (auto intro!: derivative_eq_intros simp: power2_eq_square) + show "isCont (\u. u powr (-1/2)) u" + using u by (auto intro!: continuous_intros) + next + show "(((\u. 2 * u powr (1/2)) \ real_of_ereal) \ 2 * exp (-1) powr (1/2)) + (at_left (ereal (exp (- 1))))" + unfolding ereal_tendsto_simps by real_asymp + show "(((\u. 2 * u powr (1/2)) \ real_of_ereal) \ 0) (at_right 0)" + unfolding zero_ereal_def unfolding ereal_tendsto_simps by real_asymp + qed auto + thus "interval_lebesgue_integrable lborel (ereal 0) (ereal (exp (- 1))) + (\u. u powr (-1/2))" + by (simp add: interval_lebesgue_integrable_def zero_ereal_def) +qed (auto simp add: g1_def set_borel_measurable_def) + +lemma integrable_bound2: + "interval_lebesgue_integrable lborel (exp (-1)) 1 g2" + unfolding one_ereal_def +proof (rule interval_lebesgue_integrable_bigo_right) + show "g2 \ O[at_left 1](\u. (1 - u) powr (x + 1))" + unfolding g2_def by real_asymp + have "ln x \ 0" if "x \ {exp (-1)..<1}" for x :: real + proof - + have "0 < exp (-1 :: real)" by simp + also have "\ \ x" using that by auto + finally have "x > 0" . + from that \x > 0\ have "ln x < ln 1" + by (subst ln_less_cancel_iff) auto + thus "ln x \ 0" by simp + qed + thus "continuous_on {exp (- 1)..<1} g2" + unfolding g2_def by (auto intro!: continuous_intros) + let ?F = "(\u. -1 / (x + 2) * (1 - u) powr (x + 2))" + have "set_integrable lborel (einterval (exp (-1)) 1) (\u. (1 - u) powr (x + 1))" + proof (rule interval_integral_FTC_nonneg[where F = ?F]) + fix u :: real assume u: "ereal (exp (-1)) < ereal u" "ereal u < 1" + show "(?F has_field_derivative (1 - u) powr (x + 1)) (at u)" + using u \x > -2\ by (auto intro!: derivative_eq_intros simp: one_ereal_def add_ac) + show "isCont (\u. (1 - u) powr (x + 1)) u" + using u by (auto intro!: continuous_intros) + next + show "(((\u. - 1 / (x + 2) * (1 - u) powr (x + 2)) \ real_of_ereal) \ + - 1 / (x + 2) * (1 - exp (-1)) powr (x + 2)) (at_right (ereal (exp (- 1))))" + unfolding ereal_tendsto_simps by real_asymp + show "(((\u. - 1 / (x + 2) * (1 - u) powr (x + 2)) \ real_of_ereal) \ 0) (at_left 1)" + unfolding one_ereal_def unfolding ereal_tendsto_simps + using \x > -2\ by real_asymp + qed auto + thus "interval_lebesgue_integrable lborel (ereal (exp (- 1))) + (ereal 1) (\u. (1 - u) powr (x + 1))" + by (simp add: interval_lebesgue_integrable_def one_ereal_def) +qed (auto simp add: g2_def set_borel_measurable_def) + +lemma bound2: + "norm (f z u) \ g2 u" if z: "Re z \ {x..y}" and u: "u \ {exp (-1)<..<1}" for z u +proof - + have "0 < exp (-1::real)" by simp + also have "\ \ u" using u by (simp add: einterval_def) + finally have "u > 0" . + + from u \u > 0\ have ln_u: "ln u > ln (exp (-1))" + by (subst ln_less_cancel_iff) (auto simp: einterval_def) + from z u \u > 0\ have "norm (f z u) = (- ln u) powr Re z * \u - ln u - 1\ / (1 - u)" + unfolding f_def norm_mult norm_divide norm_of_real + by (simp add: norm_powr_real_powr einterval_def) + also have "\u - ln u - 1\ = u - ln u - 1" + using u \u > 0\ ln_add_one_self_le_self2[of "u - 1"] by (simp add: einterval_def) + also have "(- ln u) powr Re z * (u - ln u - 1) / (1 - u) \ + (- ln u) powr x * (u - ln u - 1) / (1 - u)" + using z u \u > 0\ ln_u ln_add_one_self_le_self2[of "u - 1"] + by (intro mult_right_mono divide_right_mono powr_mono') (auto simp: einterval_def) + finally show "norm (f z u) \ g2 u" by (simp add: g2_def) +qed + +lemma integrable2_aux: "interval_lebesgue_integrable lborel (exp (-1)) 1 (f z)" + if z: "Re z \ {x..y}" for z +proof - + have "set_integrable lborel {exp (-1)<..<1} (f z)" + proof (rule set_integrable_bound[OF _ _ AE_I2[OF impI]]) + fix u :: real assume "u \ {exp (-1)<..<1}" + hence "norm (f z u) \ g2 u" using z by (intro bound2) auto + also have "\ \ norm (g2 u)" by simp + finally show "norm (f z u) \ norm (g2 u)" . + qed (use integrable_bound2 in \simp_all add: interval_lebesgue_integrable_def + one_ereal_def set_borel_measurable_def f_def\) + thus ?thesis by (simp add: interval_lebesgue_integrable_def one_ereal_def) +qed + +lemma uniform_limit2: + "uniform_limit {z. Re z \ {x..y}} + (\a z. LBINT u=exp (-1)..a. f z u) + (\z. LBINT u=exp (-1)..1. f z u) (at_left 1)" + by (intro uniform_limit_interval_integral_right[of _ _ g2] AE_I2 impI) + (use bound2 integrable_bound2 in \simp_all add: einterval_def f_def set_borel_measurable_def\) + +lemma uniform_limit2': + "uniform_limit {z. Re z \ {x..y}} + (\n z. LBINT u=exp (-1)..ereal (1-(1/2)^Suc n). f z u) + (\z. LBINT u=exp (-1)..1. f z u) sequentially" +proof (rule filterlim_compose[OF uniform_limit2]) + have "filterlim (\n. 1 - (1/2)^Suc n :: real) (at_left 1) sequentially" + by real_asymp + hence "filtermap ereal (filtermap (\n. (1 - (1 / 2) ^ Suc n)) sequentially) \ + filtermap ereal (at_left 1)" + unfolding filterlim_def by (rule filtermap_mono) + thus "filterlim (\n. ereal (1 - (1/2)^Suc n)) (at_left 1) sequentially" + unfolding one_ereal_def at_left_ereal by (simp add: filterlim_def filtermap_filtermap) +qed + +lemma bound1: "norm (f z u) \ g1 u" if z: "Re z \ {x..y}" and u: "u \ {0<.. exp (-1)" by (simp add: einterval_def) + also have "exp (-1) < exp (0::real)" + by (subst exp_less_cancel_iff) auto + also have "exp (0::real) = 1" by simp + finally have "u < 1" . + from u have "ln u < ln (exp (-1))" + by (subst ln_less_cancel_iff) (auto simp: einterval_def) + hence ln_u: "ln u < -1" by simp + from z u \u < 1\ have "norm (f z u) = (- ln u) powr Re z * \u - ln u - 1\ / (1 - u)" + unfolding f_def norm_mult norm_divide norm_of_real + by (simp add: norm_powr_real_powr einterval_def) + also have "\u - ln u - 1\ = u - ln u - 1" + using u ln_add_one_self_le_self2[of "u - 1"] by (simp add: einterval_def) + also have "(- ln u) powr Re z * (u - ln u - 1) / (1 - u) \ + (- ln u) powr y * (u - ln u - 1) / (1 - u)" + using z u ln_u \u < 1\ + by (intro mult_right_mono divide_right_mono powr_mono) (auto simp: einterval_def) + finally show "norm (f z u) \ g1 u" by (simp add: g1_def) +qed + +lemma integrable1_aux: "interval_lebesgue_integrable lborel 0 (exp (-1)) (f z)" + if z: "Re z \ {x..y}" for z +proof - + have "set_integrable lborel {0<.. {0<.. g1 u" using z by (intro bound1) auto + also have "\ \ norm (g1 u)" by simp + finally show "norm (f z u) \ norm (g1 u)" . + qed (use integrable_bound1 in \simp_all add: interval_lebesgue_integrable_def + zero_ereal_def set_borel_measurable_def f_def\) + thus ?thesis by (simp add: interval_lebesgue_integrable_def zero_ereal_def) +qed + +lemma uniform_limit1: + "uniform_limit {z. Re z \ {x..y}} + (\a z. LBINT u=a..exp (-1). f z u) + (\z. LBINT u=0..exp (-1). f z u) (at_right 0)" + by (intro uniform_limit_interval_integral_left[of _ _ g1] AE_I2 impI) + (use bound1 integrable_bound1 in \simp_all add: einterval_def f_def set_borel_measurable_def\) + +lemma uniform_limit1': + "uniform_limit {z. Re z \ {x..y}} + (\n z. LBINT u=ereal ((1/2)^Suc n)..exp (-1). f z u) + (\z. LBINT u=0..exp (-1). f z u) sequentially" +proof (rule filterlim_compose[OF uniform_limit1]) + have "filterlim (\n. (1/2)^Suc n :: real) (at_right 0) sequentially" + by real_asymp + hence "filtermap ereal (filtermap (\n. ((1 / 2) ^ Suc n)) sequentially) \ + filtermap ereal (at_right 0)" + unfolding filterlim_def by (rule filtermap_mono) + thus "filterlim (\n. ereal ((1/2)^Suc n)) (at_right 0) sequentially" + unfolding zero_ereal_def at_right_ereal by (simp add: filterlim_def filtermap_filtermap) +qed + +end + +text \ + With all of the above bounds, we have shown that the integral exists for any + \z\ with $\mathfrak{R}(z) > -2$. +\ +theorem Hadjicostas_integral_integrable: "interval_lebesgue_integrable lborel 0 1 (f z)" + if z: "Re z > -2" +proof - + from dense[OF z] obtain x where x: "x > -2" "Re z > x" by blast + have "interval_lebesgue_integrable lborel 0 (exp(-1)) (f z)" + by (rule integrable1_aux[of x _ "Re z + 1"]) (use x in auto) + moreover have "interval_lebesgue_integrable lborel (exp(-1)) 1 (f z)" + by (rule integrable2_aux[of x _ "Re z + 1"]) (use x in auto) + ultimately show "interval_lebesgue_integrable lborel 0 1 (f z)" + by (rule interval_lebesgue_integrable_combine) (auto simp: f_def set_borel_measurable_def) +qed + +lemma integral_holo_aux: + assumes ab: "a > 0" "a \ b" "b < 1" + shows "(\z. LBINT u=ereal a..ereal b. f z u) holomorphic_on A" +proof - + define f' :: "complex \ real \ complex" + where "f' \ (\z u. ln (-ln u) * f z u)" + note [derivative_intros] = has_field_derivative_complex_powr_right' + + have "(\z. integral (cbox a b) (f z)) holomorphic_on UNIV" + proof (rule leibniz_rule_holomorphic[of _ _ _ _ f'], goal_cases) + case (1 z t) + show ?case unfolding f_def + apply (insert 1 ab) + apply (rule derivative_eq_intros refl | simp)+ + apply (auto simp: f'_def field_simps f_def Ln_of_real) + done + next + from ab show "continuous_on (UNIV \ cbox a b) (\(z, t). f' z t)" + by (auto simp: case_prod_unfold f'_def f_def Ln_of_real intro!: continuous_intros) + next + fix z :: complex + show "f z integrable_on cbox a b" + unfolding f_def f'_def using ab + by (intro integrable_continuous continuous_intros) auto + qed (auto simp: convex_halfspace_Re_gt) + also have "(\z. integral (cbox a b) (f z)) = (\z. \u\cbox a b. f z u \lborel)" + proof (intro ext set_borel_integral_eq_integral(2) [symmetric]) + fix z :: complex + show "complex_set_integrable lborel (cbox a b) (f z)" + unfolding f_def using ab + by (intro continuous_on_imp_set_integrable_cbox continuous_intros) (auto simp: Ln_of_real) + qed + also have "\ = (\z. LBINT u=a..b. f z u)" + using ab by (simp add: interval_integral_Icc) + finally show ?thesis by (rule holomorphic_on_subset) auto +qed + +lemma integral_holo: + assumes ab: "min a b > 0" "max a b < 1" + shows "(\z. LBINT u=ereal a..ereal b. f z u) holomorphic_on A" +proof (cases "a \ b") + case True + thus ?thesis using assms integral_holo_aux[of a b] by auto +next + case False + have "(\z. -(LBINT u=ereal b..ereal a. f z u)) holomorphic_on A" + using False assms by (intro holomorphic_intros integral_holo_aux) auto + thus ?thesis by (subst interval_integral_endpoints_reverse) +qed + +lemma holo1: "(\z. LBINT u=0..exp (-1). f z u) holomorphic_on {z. Re z > -2}" +proof (rule holomorphic_uniform_sequence + [where f = "(\n z. LBINT u=ereal ((1/2)^Suc n)..exp (-1). f z u)"], goal_cases) + case (3 z) + define \ where "\ = (Re z + 2) / 2" + from 3 have "\ > 0" by (auto simp: \_def) + have subset: "cball z \ \ {s. Re s \ {Re z - \..Re z + \}}" + proof safe + fix s assume s: "s \ cball z \" + have "\Re (s - z)\ \ norm (s - z)" by (rule abs_Re_le_cmod) + also have "\ \ \" using s by (simp add: dist_norm norm_minus_commute) + finally show "Re s \ {Re z - \..Re z + \}" by auto + qed + + show ?case + proof (rule exI[of _ \], intro conjI) + have "cball z \ \ {s. Re s \ {Re z - \..Re z + \}}" by fact + also have "\ \ {s. Re s > -2}" + using 3 by (auto simp: \_def field_simps) + finally show "cball z \ \ {s. Re s > -2}" . + next + from 3 have "Re z - \ > -2" by (simp add: \_def field_simps) + thus "uniform_limit (cball z \) (\n z. LBINT u=ereal ((1 / 2) ^ Suc n)..ereal (exp (- 1)). f z u) + (\z. LBINT u=0..ereal (exp(-1)). f z u) sequentially" + using uniform_limit_on_subset[OF uniform_limit1' subset] by simp + qed fact+ +next + fix n :: nat + have "(1 / 2) ^ Suc n < (1 / 2 :: real) ^ 0" + by (subst power_strict_decreasing_iff) auto + thus "(\z. LBINT u=ereal ((1 / 2) ^ Suc n)..ereal (exp (- 1)). f z u) holomorphic_on {z. Re z > -2}" + by (intro integral_holo) auto +qed (auto simp: open_halfspace_Re_gt) + +lemma holo2: "(\z. LBINT u=exp (-1)..1. f z u) holomorphic_on {z. Re z > -2}" +proof (rule holomorphic_uniform_sequence + [where f = "(\n z. LBINT u=exp (-1)..ereal (1-(1/2)^Suc n). f z u)"], goal_cases) + case (3 z) + define \ where "\ = (Re z + 2) / 2" + from 3 have "\ > 0" by (auto simp: \_def) + have subset: "cball z \ \ {s. Re s \ {Re z - \..Re z + \}}" + proof safe + fix s assume s: "s \ cball z \" + have "\Re (s - z)\ \ norm (s - z)" by (rule abs_Re_le_cmod) + also have "\ \ \" using s by (simp add: dist_norm norm_minus_commute) + finally show "Re s \ {Re z - \..Re z + \}" by auto + qed + + show ?case + proof (rule exI[of _ \], intro conjI) + have "cball z \ \ {s. Re s \ {Re z - \..Re z + \}}" by fact + also have "\ \ {s. Re s > -2}" + using 3 by (auto simp: \_def field_simps) + finally show "cball z \ \ {s. Re s > -2}" . + next + from 3 have "Re z - \ > -2" by (simp add: \_def field_simps) + thus "uniform_limit (cball z \) (\n z. LBINT u=ereal (exp (- 1))..ereal (1-(1/2)^Suc n). f z u) + (\z. LBINT u=ereal (exp(-1))..1. f z u) sequentially" + using uniform_limit_on_subset[OF uniform_limit2' subset] by simp + qed fact+ +next + fix n :: nat + have "(1 / 2) ^ Suc n < (1 / 2 :: real) ^ 0" + by (subst power_strict_decreasing_iff) auto + thus "(\z. LBINT u=ereal (exp (-1))..ereal (1-(1/2)^Suc n). f z u) holomorphic_on {z. Re z > -2}" + by (intro integral_holo) auto +qed (auto simp: open_halfspace_Re_gt) + +text \ + Finally, we have shown that Hadjicostas's integral is an analytic function + of \z\ in the domain $\mathfrak{R}(z) > -2$. +\ +lemma holomorphic_Hadjicostas_integral: + "Hadjicostas_integral holomorphic_on {z. Re z > -2}" +proof - + have "(\z. (LBINT u=0..exp(-1). f z u) + (LBINT u=exp(-1)..1. f z u)) + holomorphic_on {z. Re z > -2}" + by (intro holomorphic_intros holo1 holo2) + also have "?this \ (\z. LBINT u=0..1. f z u) holomorphic_on {z. Re z > -2}" + using Hadjicostas_integral_integrable + by (intro holomorphic_cong interval_integral_sum) + (simp_all add: zero_ereal_def one_ereal_def min_def max_def) + also have "(\z. LBINT u=0..1. f z u) = Hadjicostas_integral" + by (simp add: Hadjicostas_integral_def[abs_def] f_def) + finally show ?thesis . +qed + +lemma analytic_Hadjicostas_integral: + "Hadjicostas_integral analytic_on {z. Re z > -2}" + by (simp add: analytic_on_open open_halfspace_Re_gt holomorphic_Hadjicostas_integral) + +end + + +subsection \Analytic continuation and main result\ + +text \ + Since we have already shown the formula for any real \z > -1\ and e.\,g.\ 0 is a limit + point of that set, it extends to the full domain by analytic continuation. + + As a caveat, note that $\zeta(s)$ is \<^emph>\not\ analytic at \z = 1\, so that we use + an analytic continuation of $\zeta(z) - \frac{1}{z-1}$ to state the formula. This + continuation is @{term "pre_zeta 1"}. +\ +lemma Hadjicostas_Chapman_formula_aux: + assumes z: "Re z > -2" + shows "Hadjicostas_integral z = Gamma (z + 2) * pre_zeta 1 (z + 2)" + (is "_ z = ?f z") +proof (rule analytic_continuation'[of Hadjicostas_integral]) + show "Hadjicostas_integral holomorphic_on {z. Re z > -2}" + by (rule holomorphic_Hadjicostas_integral) + show "connected {z. Re z > -2}" + by (intro convex_connected convex_halfspace_Re_gt) + show "open {z. Re z > -2}" + by (auto simp: open_halfspace_Re_gt) + show "{z. Re z > -1 \ Im z = 0} \ {z. Re z > -2}" and "0 \ {z. Re z > -2}" + by auto + have "\n. 1 / (of_nat (Suc n)) \ {z. Re z > -1 \ Im z = 0} - {0}" + by (auto simp: field_simps simp flip: of_nat_Suc) + moreover have "(\n. 1 / of_nat (Suc n) :: complex) \ 0" + by (rule tendsto_divide_0[OF tendsto_const] filterlim_compose[OF tendsto_of_nat] filterlim_Suc)+ + ultimately show "0 islimpt {z. Re z > -1 \ Im z = 0}" + unfolding islimpt_sequential + by (intro exI[of _ "\n. 1 / of_nat (Suc n) :: complex"]) simp + show "?f holomorphic_on {z. - 2 < Re z}" + proof (intro holomorphic_intros) + fix z assume z: "z \ {z. Re z > -2}" + hence "z + 2 \ \\<^sub>\\<^sub>0" by (auto elim!: nonpos_Reals_cases simp: complex_eq_iff) + thus "z + 2 \ \\<^sub>\\<^sub>0" using nonpos_Ints_subset_nonpos_Reals by blast + qed auto +next + fix s assume s: "s \ {z. - 1 < Re z \ Im z = 0}" + hence "s + 2 \ 1" by (simp add: algebra_simps complex_eq_iff) + have ineq: "x - ln x \ 1" if "x \ {0<..<1}" for x :: real + using ln_le_minus_one[of x] that by (simp add: algebra_simps) + define x where "x = Re s" + from s have x: "x > -1" and [simp]: "s = of_real x" + by (auto simp: x_def complex_eq_iff) + have "Hadjicostas_integral s = (LBINT u=0..1. of_real ((-ln u) powr x / (1-u) * (-ln u + u - 1)))" + unfolding Hadjicostas_integral_def + by (intro interval_lebesgue_integral_cong) (auto simp: einterval_def powr_Reals_eq) + also have "\ = of_real (LBINT u=0..1. (-ln u) powr x / (1-u) * (-ln u + u - 1))" + by (subst interval_lebesgue_integral_of_real) auto + also have "(LBINT u=0..1. (- ln u) powr x / (1 - u) * (- ln u + u - 1)) = + (\u. (- ln u) powr x / (1-u) * (- ln u + u - 1) * indicator {0<..<1} u \lborel)" + by (simp add: interval_integral_Ioo zero_ereal_def one_ereal_def set_lebesgue_integral_def mult_ac) + also have "\ = enn2real (Hadjicostas_nn_integral x)" + unfolding Hadjicostas_nn_integral_def using ineq + by (subst integral_eq_nn_integral) + (auto intro!: AE_I2 divide_nonneg_nonneg mult_nonneg_nonneg arg_cong[where f = enn2real] + nn_integral_cong simp: indicator_def) + also have "\ = enn2real (ennreal (Gamma (x + 2) * (Re (zeta (x + 2)) - 1 / (x + 1))))" + using x by (subst Hadjicostas_Chapman_formula_real) auto + also have "\ = Gamma (x + 2) * (Re (zeta (x + 2)) - 1 / (x + 1))" + using x real_zeta_ge_one_over_minus_one[of "x + 2"] + by (intro enn2real_ennreal mult_nonneg_nonneg Gamma_real_nonneg) (auto simp: add_ac) + also have "complex_of_real \ = Gamma (s + 2) * (zeta (s + 2) - 1 / (s + 1))" + using x Gamma_complex_of_real[of "x + 2"] by (simp add: zeta_real') + also have "(zeta (s + 2) - 1 / (s + 1)) = pre_zeta 1 (s + 2)" + using \s + 2 \ 1\ by (subst zeta_minus_pole_eq [symmetric]) (auto simp flip: of_nat_Suc) + finally show "Hadjicostas_integral s = Gamma (s + 2) * pre_zeta 1 (s + 2)" . +qed (use assms in auto) + +text \ + The following form and the corollary are perhaps a bit nicer to read. +\ +theorem Hadjicostas_Chapman_formula: + assumes z: "Re z > -2" "z \ -1" + shows "Hadjicostas_integral z = Gamma (z + 2) * (zeta (z + 2) - 1 / (z + 1))" +proof - + from z have "z + 1 \ 0" + by (auto simp: complex_eq_iff) + thus ?thesis using Hadjicostas_Chapman_formula_aux[of z] assms + by (subst (asm) zeta_minus_pole_eq [symmetric]) (auto simp: add_ac) +qed + +corollary euler_mascheroni_integral_form: + "Hadjicostas_integral (-1) = euler_mascheroni" + using Hadjicostas_Chapman_formula_aux[of "-1"] by simp + +end diff --git a/thys/Zeta_Function/ROOT b/thys/Zeta_Function/ROOT --- a/thys/Zeta_Function/ROOT +++ b/thys/Zeta_Function/ROOT @@ -1,21 +1,23 @@ chapter AFP session Zeta_Function (AFP) = Dirichlet_Series + options [timeout = 600] sessions Euler_MacLaurin Bernoulli "HOL-Library" "HOL-Real_Asymp" Dirichlet_Series Winding_Number_Eval theories [document=false] "Euler_MacLaurin.Euler_MacLaurin" "Bernoulli.Bernoulli_Zeta" "HOL-Library.Landau_Symbols" "Dirichlet_Series.Dirichlet_Series_Analysis" theories Zeta_Function + Zeta_Laurent_Expansion + Hadjicostas_Chapman document_files "root.tex" "root.bib" diff --git a/thys/Zeta_Function/Zeta_Function.thy b/thys/Zeta_Function/Zeta_Function.thy --- a/thys/Zeta_Function/Zeta_Function.thy +++ b/thys/Zeta_Function/Zeta_Function.thy @@ -1,3632 +1,3703 @@ (* File: Zeta_Function.thy Author: Manuel Eberl, TU München *) section \The Hurwitz and Riemann $\zeta$ functions\ theory Zeta_Function imports "Euler_MacLaurin.Euler_MacLaurin" "Bernoulli.Bernoulli_Zeta" "Dirichlet_Series.Dirichlet_Series_Analysis" "Winding_Number_Eval.Winding_Number_Eval" "HOL-Real_Asymp.Real_Asymp" + Zeta_Library begin subsection \Preliminary facts\ (* TODO Move once Landau symbols are in the distribution *) lemma holomorphic_on_extend: assumes "f holomorphic_on S - {\}" "\ \ interior S" "f \ O[at \](\_. 1)" shows "(\g. g holomorphic_on S \ (\z\S - {\}. g z = f z))" by (subst holomorphic_on_extend_bounded) (insert assms, auto elim!: landau_o.bigE) lemma removable_singularities: assumes "finite X" "X \ interior S" "f holomorphic_on (S - X)" assumes "\z. z \ X \ f \ O[at z](\_. 1)" shows "\g. g holomorphic_on S \ (\z\S-X. g z = f z)" using assms proof (induction arbitrary: f rule: finite_induct) case empty thus ?case by auto next case (insert z0 X f) from insert.prems and insert.hyps have z0: "z0 \ interior (S - X)" by (auto simp: interior_diff finite_imp_closed) hence "\g. g holomorphic_on (S - X) \ (\z\S - X - {z0}. g z = f z)" using insert.prems insert.hyps by (intro holomorphic_on_extend) auto then obtain g where g: "g holomorphic_on (S - X)" "\z\S - X - {z0}. g z = f z" by blast have "\h. h holomorphic_on S \ (\z\S - X. h z = g z)" proof (rule insert.IH) fix z0' assume z0': "z0' \ X" hence "eventually (\z. z \ interior S - (X - {z0'}) - {z0}) (nhds z0')" using insert.prems insert.hyps by (intro eventually_nhds_in_open open_Diff finite_imp_closed) auto hence ev: "eventually (\z. z \ S - X - {z0}) (at z0')" unfolding eventually_at_filter by eventually_elim (insert z0' insert.hyps interior_subset[of S], auto) have "g \ \[at z0'](f)" by (intro bigthetaI_cong eventually_mono[OF ev]) (insert g, auto) also have "f \ O[at z0'](\_. 1)" using z0' by (intro insert.prems) auto finally show "g \ \" . qed (insert insert.prems g, auto) then obtain h where "h holomorphic_on S" "\z\S - X. h z = g z" by blast with g have "h holomorphic_on S" "\z\S - insert z0 X. h z = f z" by auto thus ?case by blast qed lemma continuous_imp_bigo_1: assumes "continuous (at x within A) f" shows "f \ O[at x within A](\_. 1)" proof (rule bigoI_tendsto) from assms show "((\x. f x / 1) \ f x) (at x within A)" by (auto simp: continuous_within) qed auto lemma taylor_bigo_linear: assumes "f field_differentiable at x0 within A" shows "(\x. f x - f x0) \ O[at x0 within A](\x. x - x0)" proof - from assms obtain f' where "(f has_field_derivative f') (at x0 within A)" by (auto simp: field_differentiable_def) hence "((\x. (f x - f x0) / (x - x0)) \ f') (at x0 within A)" by (auto simp: has_field_derivative_iff) thus ?thesis by (intro bigoI_tendsto[where c = f']) (auto simp: eventually_at_filter) qed (* END TODO *) (* TODO Move? *) lemma powr_add_minus_powr_asymptotics: fixes a z :: complex shows "((\z. ((1 + z) powr a - 1) / z) \ a) (at 0)" proof (rule Lim_transform_eventually) have "eventually (\z::complex. z \ ball 0 1 - {0}) (at 0)" using eventually_at_ball'[of 1 "0::complex" UNIV] by (simp add: dist_norm) thus "eventually (\z. (\n. (a gchoose (Suc n)) * z ^ n) = ((1 + z) powr a - 1) / z) (at 0)" proof eventually_elim case (elim z) hence "(\n. (a gchoose n) * z ^ n) sums (1 + z) powr a" by (intro gen_binomial_complex) auto hence "(\n. (a gchoose (Suc n)) * z ^ (Suc n)) sums ((1 + z) powr a - 1)" by (subst sums_Suc_iff) simp_all also have "(\n. (a gchoose (Suc n)) * z ^ (Suc n)) = (\n. z * ((a gchoose (Suc n)) * z ^ n))" by (simp add: algebra_simps) finally have "(\n. (a gchoose (Suc n)) * z ^ n) sums (((1 + z) powr a - 1) / z)" by (rule sums_mult_D) (use elim in auto) thus ?case by (simp add: sums_iff) qed next have "conv_radius (\n. a gchoose (n + 1)) = conv_radius (\n. a gchoose n)" using conv_radius_shift[of "\n. a gchoose n" 1] by simp hence "continuous_on (cball 0 (1/2)) (\z. \n. (a gchoose (Suc n)) * (z - 0) ^ n)" using conv_radius_gchoose[of a] by (intro powser_continuous_suminf) (simp_all) hence "isCont (\z. \n. (a gchoose (Suc n)) * z ^ n) 0" by (auto intro: continuous_on_interior) thus "(\z. \n. (a gchoose Suc n) * z ^ n) \0\ a" by (auto simp: isCont_def) qed lemma complex_powr_add_minus_powr_asymptotics: fixes s :: complex assumes a: "a > 0" and s: "Re s < 1" shows "filterlim (\x. of_real (x + a) powr s - of_real x powr s) (nhds 0) at_top" proof (rule Lim_transform_eventually) show "eventually (\x. ((1 + of_real (a / x)) powr s - 1) / of_real (a / x) * of_real x powr (s - 1) * a = of_real (x + a) powr s - of_real x powr s) at_top" (is "eventually (\x. ?f x / ?g x * ?h x * _ = _) _") using eventually_gt_at_top[of a] proof eventually_elim case (elim x) have "?f x / ?g x * ?h x * a = ?f x * (a * ?h x / ?g x)" by simp also have "a * ?h x / ?g x = of_real x powr s" using elim a by (simp add: powr_diff) also have "?f x * \ = of_real (x + a) powr s - of_real x powr s" using a elim by (simp add: algebra_simps powr_times_real [symmetric]) finally show ?case . qed have "filterlim (\x. complex_of_real (a / x)) (nhds (complex_of_real 0)) at_top" by (intro tendsto_of_real real_tendsto_divide_at_top[OF tendsto_const] filterlim_ident) hence "filterlim (\x. complex_of_real (a / x)) (at 0) at_top" using a by (intro filterlim_atI) auto hence "((\x. ?f x / ?g x * ?h x * a) \ s * 0 * a) at_top" using s by (intro tendsto_mult filterlim_compose[OF powr_add_minus_powr_asymptotics] tendsto_const tendsto_neg_powr_complex_of_real filterlim_ident) auto thus "((\x. ?f x / ?g x * ?h x * a) \ 0) at_top" by simp qed (* END TODO *) lemma summable_zeta: assumes "Re s > 1" shows "summable (\n. of_nat (Suc n) powr -s)" proof - have "summable (\n. exp (complex_of_real (ln (real (Suc n))) * - s))" (is "summable ?f") by (subst summable_Suc_iff, rule summable_complex_powr_iff) (use assms in auto) also have "?f = (\n. of_nat (Suc n) powr -s)" by (simp add: powr_def algebra_simps del: of_nat_Suc) finally show ?thesis . qed lemma summable_zeta_real: assumes "x > 1" shows "summable (\n. real (Suc n) powr -x)" proof - have "summable (\n. of_nat (Suc n) powr -complex_of_real x)" using assms by (intro summable_zeta) simp_all also have "(\n. of_nat (Suc n) powr -complex_of_real x) = (\n. of_real (real (Suc n) powr -x))" by (subst powr_Reals_eq) simp_all finally show ?thesis by (subst (asm) summable_complex_of_real) qed lemma summable_hurwitz_zeta: assumes "Re s > 1" "a > 0" shows "summable (\n. (of_nat n + of_real a) powr -s)" proof - have "summable (\n. (of_nat (Suc n) + of_real a) powr -s)" proof (rule summable_comparison_test' [OF summable_zeta_real [OF assms(1)]] ) fix n :: nat have "norm ((of_nat (Suc n) + of_real a) powr -s) = (real (Suc n) + a) powr - Re s" (is "?N = _") using assms by (simp add: norm_powr_real_powr) also have "\ \ real (Suc n) powr -Re s" using assms by (intro powr_mono2') auto finally show "?N \ \" . qed thus ?thesis by (subst (asm) summable_Suc_iff) qed lemma summable_hurwitz_zeta_real: assumes "x > 1" "a > 0" shows "summable (\n. (real n + a) powr -x)" proof - have "summable (\n. (of_nat n + of_real a) powr -complex_of_real x)" using assms by (intro summable_hurwitz_zeta) simp_all also have "(\n. (of_nat n + of_real a) powr -complex_of_real x) = (\n. of_real ((real n + a) powr -x))" using assms by (subst powr_Reals_eq) simp_all finally show ?thesis by (subst (asm) summable_complex_of_real) qed subsection \Definitions\ text \ We use the Euler--MacLaurin summation formula to express $\zeta(s,a) - \frac{a^{1-s}}{s-1}$ as a polynomial plus some remainder term, which is an integral over a function of order $O(-1-2n-\mathfrak{R}(s))$. It is then clear that this integral converges uniformly to an analytic function in $s$ for all $s$ with $\mathfrak{R}(s) > -2n$. \ definition pre_zeta_aux :: "nat \ real \ complex \ complex" where "pre_zeta_aux N a s = a powr - s / 2 + (\i=1..N. (bernoulli (2 * i) / fact (2 * i)) *\<^sub>R (pochhammer s (2*i - 1) * of_real a powr (- s - of_nat (2*i - 1)))) + EM_remainder (Suc (2*N)) (\x. -(pochhammer s (Suc (2*N)) * of_real (x + a) powr (- 1 - 2*N - s))) 0" text \ By iterating the above construction long enough, we can extend this to the entire complex plane. \ definition pre_zeta :: "real \ complex \ complex" where "pre_zeta a s = pre_zeta_aux (nat (1 - \Re s / 2\)) a s" text \ We can then obtain the Hurwitz $\zeta$ function by adding back the pole at 1. Note that it is not necessary to trust that this somewhat complicated definition is, in fact, the correct one, since we will later show that this Hurwitz zeta function fulfils \[\zeta(s,a) = \sum_{n=0}^\infty \frac{1}{(n + a)^s}\] and is analytic on $\mathbb{C}\setminus \{1\}$, which uniquely defines the function due to analytic continuation. It is therefore obvious that any alternative definition that is analytic on $\mathbb{C}\setminus \{1\}$ and satisfies the above equation must be equal to our Hurwitz $\zeta$ function. \ definition hurwitz_zeta :: "real \ complex \ complex" where "hurwitz_zeta a s = (if s = 1 then 0 else pre_zeta a s + of_real a powr (1 - s) / (s - 1))" text \ The Riemann $\zeta$ function is simply the Hurwitz $\zeta$ function with $a = 1$. \ definition zeta :: "complex \ complex" where "zeta = hurwitz_zeta 1" text \ We define the $\zeta$ functions as 0 at their poles. To avoid confusion, these facts are not added as simplification rules by default. \ lemma hurwitz_zeta_1: "hurwitz_zeta c 1 = 0" by (simp add: hurwitz_zeta_def) lemma zeta_1: "zeta 1 = 0" by (simp add: zeta_def hurwitz_zeta_1) +lemma zeta_minus_pole_eq: "s \ 1 \ zeta s - 1 / (s - 1) = pre_zeta 1 s" + by (simp add: zeta_def hurwitz_zeta_def) + context begin private lemma holomorphic_pre_zeta_aux': assumes "a > 0" "bounded U" "open U" "U \ {s. Re s > \}" and \: "\ > - 2 * real n" shows "pre_zeta_aux n a holomorphic_on U" unfolding pre_zeta_aux_def proof (intro holomorphic_intros) define C :: real where "C = max 0 (Sup ((\s. norm (pochhammer s (Suc (2 * n)))) ` closure U))" have "compact (closure U)" using assms by (auto simp: compact_eq_bounded_closed) hence "compact ((\s. norm (pochhammer s (Suc (2 * n)))) ` closure U)" by (rule compact_continuous_image [rotated]) (auto intro!: continuous_intros) hence "bounded ((\s. norm (pochhammer s (Suc (2 * n)))) ` closure U)" by (simp add: compact_eq_bounded_closed) hence C: "cmod (pochhammer s (Suc (2 * n))) \ C" if "s \ U" for s using that closure_subset[of U] unfolding C_def by (intro max.coboundedI2 cSup_upper bounded_imp_bdd_above) (auto simp: image_iff) have C' [simp]: "C \ 0" by (simp add: C_def) let ?g = "\(x::real). C * (x + a) powr (- 1 - 2 * of_nat n - \)" let ?G = "\(x::real). C / (- 2 * of_nat n - \) * (x + a) powr (- 2 * of_nat n - \)" define poch' where "poch' = deriv (\z::complex. pochhammer z (Suc (2 * n)))" have [derivative_intros]: "((\z. pochhammer z (Suc (2 * n))) has_field_derivative poch' z) (at z within A)" for z :: complex and A unfolding poch'_def by (rule holomorphic_derivI [OF holomorphic_pochhammer [of _ UNIV]]) auto have A: "continuous_on A poch'" for A unfolding poch'_def by (rule continuous_on_subset[OF _ subset_UNIV], intro holomorphic_on_imp_continuous_on holomorphic_deriv) (auto intro: holomorphic_pochhammer) note [continuous_intros] = continuous_on_compose2[OF this _ subset_UNIV] define f' where "f' = (\z t. - (poch' z * complex_of_real (t + a) powr (- 1 - 2 * of_nat n - z) - Ln (complex_of_real (t + a)) * complex_of_real (t + a) powr (- 1 - 2 * of_nat n - z) * pochhammer z (Suc (2 * n))))" show "(\z. EM_remainder (Suc (2 * n)) (\x. - (pochhammer z (Suc (2 * n)) * complex_of_real (x + a) powr (- 1 - 2 * of_nat n - z))) 0) holomorphic_on U" unfolding pre_zeta_aux_def proof (rule holomorphic_EM_remainder[of _ ?G ?g _ _ f'], goal_cases) case (1 x) show ?case by (insert 1 \ \a > 0\, rule derivative_eq_intros refl | simp)+ (auto simp: field_simps powr_diff powr_add powr_minus) next case (2 z t x) note [derivative_intros] = has_field_derivative_powr_right [THEN DERIV_chain2] show ?case by (insert 2 \ \a > 0\, (rule derivative_eq_intros refl | (simp add: add_eq_0_iff; fail))+) (simp add: f'_def) next case 3 hence *: "complex_of_real x + complex_of_real a \ \\<^sub>\\<^sub>0" if "x \ 0" for x using nonpos_Reals_of_real_iff[of "x+a", unfolded of_real_add] that \a > 0\ by auto show ?case using \a > 0\ and * unfolding f'_def by (auto simp: case_prod_unfold add_eq_0_iff intro!: continuous_intros) next case (4 b c z e) have "- 2 * real n < \" by (fact \) also from 4 assms have "\ < Re z" by auto finally show ?case using assms 4 by (intro integrable_continuous_real continuous_intros) (auto simp: add_eq_0_iff) next case (5 t x s) thus ?case using \a > 0\ by (intro integrable_EM_remainder') (auto intro!: continuous_intros simp: add_eq_0_iff) next case 6 from \ have "(\y. C / (-2 * real n - \) * (a + y) powr (-2 * real n - \)) \ 0" by (intro tendsto_mult_right_zero tendsto_neg_powr filterlim_real_sequentially filterlim_tendsto_add_at_top [OF tendsto_const]) auto thus ?case unfolding convergent_def by (auto simp: add_ac) next case 7 show ?case proof (intro eventually_mono [OF eventually_ge_at_top[of 1]] ballI) fix x :: real and s :: complex assume x: "x \ 1" and s: "s \ U" have "norm (- (pochhammer s (Suc (2 * n)) * of_real (x + a) powr (- 1 - 2 * of_nat n - s))) = norm (pochhammer s (Suc (2 * n))) * (x + a) powr (-1 - 2 * of_nat n - Re s)" (is "?N = _") using 7 \a > 0\ x by (simp add: norm_mult norm_powr_real_powr) also have "\ \ ?g x" using 7 assms x s \a > 0\ by (intro mult_mono C powr_mono) auto finally show "?N \ ?g x" . qed qed (insert assms, auto) qed (insert assms, auto) lemma analytic_pre_zeta_aux: assumes "a > 0" shows "pre_zeta_aux n a analytic_on {s. Re s > - 2 * real n}" unfolding analytic_on_def proof fix s assume s: "s \ {s. Re s > - 2 * real n}" define \ where "\ = (Re s - 2 * real n) / 2" with s have \: "\ > - 2 * real n" by (simp add: \_def field_simps) from s have s': "s \ {s. Re s > \}" by (auto simp: \_def field_simps) have "open {s. Re s > \}" by (rule open_halfspace_Re_gt) with s' obtain \ where "\ > 0" "ball s \ \ {s. Re s > \}" unfolding open_contains_ball by blast with \ have "pre_zeta_aux n a holomorphic_on ball s \" by (intro holomorphic_pre_zeta_aux' [OF assms, of _ \]) auto with \\ > 0\ show "\e>0. pre_zeta_aux n a holomorphic_on ball s e" by blast qed end context fixes s :: complex and N :: nat and \ :: "complex \ complex" and a :: real assumes s: "Re s > 1" and a: "a > 0" defines "\ \ (\s. \n. (of_nat n + of_real a) powr -s)" begin interpretation \: euler_maclaurin_nat' "\x. of_real (x + a) powr (1 - s) / (1 - s)" "\x. of_real (x + a) powr -s" "\n x. (-1) ^ n * pochhammer s n * of_real (x + a) powr -(s + n)" 0 N "\ s" "{}" proof (standard, goal_cases) case 2 show ?case by (simp add: powr_minus field_simps) next case (3 k) have "complex_of_real x + complex_of_real a = 0 \ x = -a" for x by (simp only: of_real_add [symmetric] of_real_eq_0_iff add_eq_0_iff2) with a s show ?case by (intro continuous_intros) (auto simp: add_nonneg_nonneg) next case (4 k x) with a have "0 < x + a" by simp hence *: "complex_of_real x + complex_of_real a \ \\<^sub>\\<^sub>0" using nonpos_Reals_of_real_iff[of "x+a", unfolded of_real_add] by auto have **: "pochhammer z (Suc n) = - pochhammer z n * (-z - of_nat n :: complex)" for z n by (simp add: pochhammer_rec' field_simps) show "((\x. (- 1) ^ k * pochhammer s k * of_real (x + a) powr - (s + of_nat k)) has_vector_derivative (- 1) ^ Suc k * pochhammer s (Suc k) * of_real (x + a) powr - (s + of_nat (Suc k))) (at x)" by (insert 4 *, (rule has_vector_derivative_real_field derivative_eq_intros refl | simp)+) (auto simp: divide_simps powr_add powr_diff powr_minus **) next case 5 with s a show ?case by (auto intro!: continuous_intros simp: minus_equation_iff add_eq_0_iff) next case (6 x) with a have "0 < x + a" by simp hence *: "complex_of_real x + complex_of_real a \ \\<^sub>\\<^sub>0" using nonpos_Reals_of_real_iff[of "x+a", unfolded of_real_add] by auto show ?case unfolding of_real_add by (insert 6 s *, (rule has_vector_derivative_real_field derivative_eq_intros refl | force simp add: minus_equation_iff)+) next case 7 from s a have "(\k. (of_nat k + of_real a) powr -s) sums \ s" unfolding \_def by (intro summable_sums summable_hurwitz_zeta) auto hence 1: "(\b. (\k=0..b. (of_nat k + of_real a) powr -s)) \ \ s" by (simp add: sums_def') { fix z assume "Re z < 0" hence "((\b. (a + real b) powr Re z) \ 0) at_top" by (intro tendsto_neg_powr filterlim_tendsto_add_at_top filterlim_real_sequentially) auto also have "(\b. (a + real b) powr Re z) = (\b. norm ((of_nat b + a) powr z))" using a by (subst norm_powr_real_powr) (auto simp: add_ac) finally have "((\b. (of_nat b + a) powr z) \ 0) at_top" by (subst (asm) tendsto_norm_zero_iff) simp } note * = this have "(\b. (of_nat b + a) powr (1 - s) / (1 - s)) \ 0 / (1 - s)" using s by (intro tendsto_divide tendsto_const *) auto hence 2: "(\b. (of_nat b + a) powr (1 - s) / (1 - s)) \ 0" by simp have "(\b. (\i<2 * N + 1. (bernoulli' (Suc i) / fact (Suc i)) *\<^sub>R ((- 1) ^ i * pochhammer s i * (of_nat b + a) powr -(s + of_nat i)))) \ (\i<2 * N + 1. (bernoulli' (Suc i) / fact (Suc i)) *\<^sub>R ((- 1) ^ i * pochhammer s i * 0))" using s by (intro tendsto_intros *) auto hence 3: "(\b. (\i<2 * N + 1. (bernoulli' (Suc i) / fact (Suc i)) *\<^sub>R ((- 1) ^ i * pochhammer s i * (of_nat b + a) powr -(s + of_nat i)))) \ 0" by simp from tendsto_diff[OF tendsto_diff[OF 1 2] 3] show ?case by simp qed simp_all text \ The pre-$\zeta$ functions agree with the infinite sum that is used to define the $\zeta$ function for $\mathfrak{R}(s)>1$. \ lemma pre_zeta_aux_conv_zeta: "pre_zeta_aux N a s = \ s + a powr (1 - s) / (1 - s)" proof - let ?R = "(\i=1..N. ((bernoulli (2*i) / fact (2*i)) *\<^sub>R pochhammer s (2*i - 1) * of_real a powr (-s - (2*i-1))))" let ?S = "EM_remainder (Suc (2 * N)) (\x. - (pochhammer s (Suc (2*N)) * of_real (x + a) powr (- 1 - 2 * of_nat N - s))) 0" from \.euler_maclaurin_strong_nat'[OF le_refl, simplified] have "of_real a powr -s = a powr (1 - s) / (1 - s) + \ s + a powr -s / 2 + (-?R) - ?S" unfolding sum_negf [symmetric] by (simp add: scaleR_conv_of_real pre_zeta_aux_def mult_ac) thus ?thesis unfolding pre_zeta_aux_def (* TODO: Field_as_Ring causes some problems with field_simps vs. div_mult_self *) by (simp add: field_simps del: div_mult_self3 div_mult_self4 div_mult_self2 div_mult_self1) qed end text \ Since all of the partial pre-$\zeta$ functions are analytic and agree in the halfspace with $\mathfrak R(s)>0$, they must agree in their entire domain. \ lemma pre_zeta_aux_eq: assumes "m \ n" "a > 0" "Re s > -2 * real m" shows "pre_zeta_aux m a s = pre_zeta_aux n a s" proof - have "pre_zeta_aux n a s - pre_zeta_aux m a s = 0" proof (rule analytic_continuation[of "\s. pre_zeta_aux n a s - pre_zeta_aux m a s"]) show "(\s. pre_zeta_aux n a s - pre_zeta_aux m a s) holomorphic_on {s. Re s > -2 * real m}" using assms by (intro holomorphic_intros analytic_imp_holomorphic analytic_on_subset[OF analytic_pre_zeta_aux]) auto next fix s assume "s \ {s. Re s > 1}" with \a > 0\ show "pre_zeta_aux n a s - pre_zeta_aux m a s = 0" by (simp add: pre_zeta_aux_conv_zeta) next have "2 \ {s. Re s > 1}" by simp also have "\ = interior \" by (intro interior_open [symmetric] open_halfspace_Re_gt) finally show "2 islimpt {s. Re s > 1}" by (rule interior_limit_point) next show "connected {s. Re s > -2 * real m}" using convex_halfspace_gt[of "-2 * real m" "1::complex"] by (intro convex_connected) auto qed (insert assms, auto simp: open_halfspace_Re_gt) thus ?thesis by simp qed lemma pre_zeta_aux_eq': assumes "a > 0" "Re s > -2 * real m" "Re s > -2 * real n" shows "pre_zeta_aux m a s = pre_zeta_aux n a s" proof (cases m n rule: linorder_cases) case less with assms show ?thesis by (intro pre_zeta_aux_eq) auto next case greater with assms show ?thesis by (subst eq_commute, intro pre_zeta_aux_eq) auto qed auto lemma pre_zeta_aux_eq_pre_zeta: assumes "Re s > -2 * real n" and "a > 0" shows "pre_zeta_aux n a s = pre_zeta a s" unfolding pre_zeta_def proof (intro pre_zeta_aux_eq') from assms show "- 2 * real (nat (1 - \Re s / 2\)) < Re s" by linarith qed (insert assms, simp_all) text \ This means that the idea of iterating that construction infinitely does yield a well-defined entire function. \ lemma analytic_pre_zeta: assumes "a > 0" shows "pre_zeta a analytic_on A" unfolding analytic_on_def proof fix s assume "s \ A" let ?B = "{s'. Re s' > of_int \Re s\ - 1}" have s: "s \ ?B" by simp linarith? moreover have "open ?B" by (rule open_halfspace_Re_gt) ultimately obtain \ where \: "\ > 0" "ball s \ \ ?B" unfolding open_contains_ball by blast define C where "C = ball s \" note analytic = analytic_on_subset[OF analytic_pre_zeta_aux] have "pre_zeta_aux (nat \- Re s\ + 2) a holomorphic_on C" proof (intro analytic_imp_holomorphic analytic subsetI assms, goal_cases) case (1 w) with \ have "w \ ?B" by (auto simp: C_def) thus ?case by (auto simp: ceiling_minus) qed also have "?this \ pre_zeta a holomorphic_on C" proof (intro holomorphic_cong refl pre_zeta_aux_eq_pre_zeta assms) fix w assume "w \ C" with \ have w: "w \ ?B" by (auto simp: C_def) thus " - 2 * real (nat \- Re s\ + 2) < Re w" by (simp add: ceiling_minus) qed finally show "\e>0. pre_zeta a holomorphic_on ball s e" using \\ > 0\ unfolding C_def by blast qed lemma holomorphic_pre_zeta [holomorphic_intros]: "f holomorphic_on A \ a > 0 \ (\z. pre_zeta a (f z)) holomorphic_on A" using holomorphic_on_compose [OF _ analytic_imp_holomorphic [OF analytic_pre_zeta], of f] by (simp add: o_def) corollary continuous_on_pre_zeta: "a > 0 \ continuous_on A (pre_zeta a)" by (intro holomorphic_on_imp_continuous_on holomorphic_intros) auto corollary continuous_on_pre_zeta' [continuous_intros]: "continuous_on A f \ a > 0 \ continuous_on A (\x. pre_zeta a (f x))" using continuous_on_compose2 [OF continuous_on_pre_zeta, of a A f "f ` A"] by (auto simp: image_iff) corollary continuous_pre_zeta [continuous_intros]: "a > 0 \ continuous (at s within A) (pre_zeta a)" by (rule continuous_within_subset[of _ UNIV]) (insert continuous_on_pre_zeta[of a UNIV], auto simp: continuous_on_eq_continuous_at open_Compl) corollary continuous_pre_zeta' [continuous_intros]: "a > 0 \ continuous (at s within A) f \ continuous (at s within A) (\s. pre_zeta a (f s))" using continuous_within_compose3[OF continuous_pre_zeta, of a s A f] by auto text \ It is now obvious that $\zeta$ is holomorphic everywhere except 1, where it has a simple pole with residue 1, which we can simply read off. \ theorem holomorphic_hurwitz_zeta: assumes "a > 0" "1 \ A" shows "hurwitz_zeta a holomorphic_on A" proof - have "(\s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) holomorphic_on A" using assms by (auto intro!: holomorphic_intros) also from assms have "?this \ ?thesis" by (intro holomorphic_cong) (auto simp: hurwitz_zeta_def) finally show ?thesis . qed corollary holomorphic_hurwitz_zeta' [holomorphic_intros]: assumes "f holomorphic_on A" and "a > 0" and "\z. z \ A \ f z \ 1" shows "(\x. hurwitz_zeta a (f x)) holomorphic_on A" proof - have "hurwitz_zeta a \ f holomorphic_on A" using assms by (intro holomorphic_on_compose_gen[of _ _ _ "f ` A"] holomorphic_hurwitz_zeta assms) auto thus ?thesis by (simp add: o_def) qed theorem holomorphic_zeta: "1 \ A\ zeta holomorphic_on A" unfolding zeta_def by (auto intro: holomorphic_intros) corollary holomorphic_zeta' [holomorphic_intros]: assumes "f holomorphic_on A" and "\z. z \ A \ f z \ 1" shows "(\x. zeta (f x)) holomorphic_on A" using assms unfolding zeta_def by (auto intro: holomorphic_intros) corollary analytic_hurwitz_zeta: assumes "a > 0" "1 \ A" shows "hurwitz_zeta a analytic_on A" proof - from assms(1) have "hurwitz_zeta a holomorphic_on -{1}" by (rule holomorphic_hurwitz_zeta) auto also have "?this \ hurwitz_zeta a analytic_on -{1}" by (intro analytic_on_open [symmetric]) auto finally show ?thesis by (rule analytic_on_subset) (insert assms, auto) qed corollary analytic_zeta: "1 \ A \ zeta analytic_on A" unfolding zeta_def by (rule analytic_hurwitz_zeta) auto corollary continuous_on_hurwitz_zeta: "a > 0 \ 1 \ A \ continuous_on A (hurwitz_zeta a)" by (intro holomorphic_on_imp_continuous_on holomorphic_intros) auto corollary continuous_on_hurwitz_zeta' [continuous_intros]: "continuous_on A f \ a > 0 \ (\x. x \ A \ f x \ 1) \ continuous_on A (\x. hurwitz_zeta a (f x))" using continuous_on_compose2 [OF continuous_on_hurwitz_zeta, of a "f ` A" A f] by (auto simp: image_iff) corollary continuous_on_zeta: "1 \ A \ continuous_on A zeta" by (intro holomorphic_on_imp_continuous_on holomorphic_intros) auto corollary continuous_on_zeta' [continuous_intros]: "continuous_on A f \ (\x. x \ A \ f x \ 1) \ continuous_on A (\x. zeta (f x))" using continuous_on_compose2 [OF continuous_on_zeta, of "f ` A" A f] by (auto simp: image_iff) corollary continuous_hurwitz_zeta [continuous_intros]: "a > 0 \ s \ 1 \ continuous (at s within A) (hurwitz_zeta a)" by (rule continuous_within_subset[of _ UNIV]) (insert continuous_on_hurwitz_zeta[of a "-{1}"], auto simp: continuous_on_eq_continuous_at open_Compl) corollary continuous_hurwitz_zeta' [continuous_intros]: "a > 0 \ f s \ 1 \ continuous (at s within A) f \ continuous (at s within A) (\s. hurwitz_zeta a (f s))" using continuous_within_compose3[OF continuous_hurwitz_zeta, of a f s A] by auto corollary continuous_zeta [continuous_intros]: "s \ 1 \ continuous (at s within A) zeta" unfolding zeta_def by (intro continuous_intros) auto corollary continuous_zeta' [continuous_intros]: "f s \ 1 \ continuous (at s within A) f \ continuous (at s within A) (\s. zeta (f s))" unfolding zeta_def by (intro continuous_intros) auto corollary field_differentiable_at_zeta: assumes "s \ 1" shows "zeta field_differentiable at s" proof - have "zeta holomorphic_on (- {1})" using holomorphic_zeta by force moreover have "open (-{1} :: complex set)" by (intro open_Compl) auto ultimately show ?thesis using assms by (auto simp add: holomorphic_on_open open_halfspace_Re_gt open_Diff field_differentiable_def) qed theorem is_pole_hurwitz_zeta: assumes "a > 0" shows "is_pole (hurwitz_zeta a) 1" proof - from assms have "continuous_on UNIV (pre_zeta a)" by (intro holomorphic_on_imp_continuous_on analytic_imp_holomorphic analytic_pre_zeta) hence "isCont (pre_zeta a) 1" by (auto simp: continuous_on_eq_continuous_at) hence *: "pre_zeta a \1\ pre_zeta a 1" by (simp add: isCont_def) from assms have "isCont (\s. complex_of_real a powr (1 - s)) 1" by (intro isCont_powr_complex) auto with assms have **: "(\s. complex_of_real a powr (1 - s)) \1\ 1" by (simp add: isCont_def) have "(\s::complex. s - 1) \1\ 1 - 1" by (intro tendsto_intros) hence "filterlim (\s::complex. s - 1) (at 0) (at 1)" by (auto simp: filterlim_at eventually_at_filter) hence ***: "filterlim (\s :: complex. a powr (1 - s) / (s - 1)) at_infinity (at 1)" by (intro filterlim_divide_at_infinity [OF **]) auto have "is_pole (\s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1" unfolding is_pole_def hurwitz_zeta_def by (rule tendsto_add_filterlim_at_infinity * ***)+ also have "?this \ ?thesis" unfolding is_pole_def by (intro filterlim_cong refl) (auto simp: eventually_at_filter hurwitz_zeta_def) finally show ?thesis . qed corollary is_pole_zeta: "is_pole zeta 1" unfolding zeta_def by (rule is_pole_hurwitz_zeta) auto theorem zorder_hurwitz_zeta: assumes "a > 0" shows "zorder (hurwitz_zeta a) 1 = -1" proof (rule zorder_eqI[of UNIV]) fix w :: complex assume "w \ UNIV" "w \ 1" thus "hurwitz_zeta a w = (pre_zeta a w * (w - 1) + a powr (1 - w)) * (w - 1) powr (of_int (-1))" apply (subst (1) powr_of_int) by (auto simp add: hurwitz_zeta_def field_simps) qed (insert assms, auto intro!: holomorphic_intros) corollary zorder_zeta: "zorder zeta 1 = - 1" unfolding zeta_def by (rule zorder_hurwitz_zeta) auto theorem residue_hurwitz_zeta: assumes "a > 0" shows "residue (hurwitz_zeta a) 1 = 1" proof - note holo = analytic_imp_holomorphic[OF analytic_pre_zeta] have "residue (hurwitz_zeta a) 1 = residue (\z. pre_zeta a z + a powr (1 - z) / (z - 1)) 1" by (intro residue_cong) (auto simp: eventually_at_filter hurwitz_zeta_def) also have "\ = residue (\z. a powr (1 - z) / (z - 1)) 1" using assms by (subst residue_add [of UNIV]) (auto intro!: holomorphic_intros holo intro: residue_holo[of UNIV, OF _ _ holo]) also have "\ = complex_of_real a powr (1 - 1)" using assms by (intro residue_simple [of UNIV]) (auto intro!: holomorphic_intros) also from assms have "\ = 1" by simp finally show ?thesis . qed corollary residue_zeta: "residue zeta 1 = 1" unfolding zeta_def by (rule residue_hurwitz_zeta) auto lemma zeta_bigo_at_1: "zeta \ O[at 1 within A](\x. 1 / (x - 1))" proof - have "zeta \ \[at 1 within A](\s. pre_zeta 1 s + 1 / (s - 1))" by (intro bigthetaI_cong) (auto simp: eventually_at_filter zeta_def hurwitz_zeta_def) also have "(\s. pre_zeta 1 s + 1 / (s - 1)) \ O[at 1 within A](\s. 1 / (s - 1))" proof (rule sum_in_bigo) have "continuous_on UNIV (pre_zeta 1)" by (intro holomorphic_on_imp_continuous_on holomorphic_intros) auto hence "isCont (pre_zeta 1) 1" by (auto simp: continuous_on_eq_continuous_at) hence "continuous (at 1 within A) (pre_zeta 1)" by (rule continuous_within_subset) auto hence "pre_zeta 1 \ O[at 1 within A](\_. 1)" by (intro continuous_imp_bigo_1) auto also have ev: "eventually (\s. s \ ball 1 1 \ s \ 1 \ s \ A) (at 1 within A)" by (intro eventually_at_ball') auto have "(\_. 1) \ O[at 1 within A](\s. 1 / (s - 1))" by (intro landau_o.bigI[of 1] eventually_mono[OF ev]) (auto simp: eventually_at_filter norm_divide dist_norm norm_minus_commute field_simps) finally show "pre_zeta 1 \ O[at 1 within A](\s. 1 / (s - 1))" . qed simp_all finally show ?thesis . qed theorem assumes "a > 0" "Re s > 1" shows hurwitz_zeta_conv_suminf: "hurwitz_zeta a s = (\n. (of_nat n + of_real a) powr -s)" and sums_hurwitz_zeta: "(\n. (of_nat n + of_real a) powr -s) sums hurwitz_zeta a s" proof - from assms have [simp]: "s \ 1" by auto from assms have "hurwitz_zeta a s = pre_zeta_aux 0 a s + of_real a powr (1 - s) / (s - 1)" by (simp add: hurwitz_zeta_def pre_zeta_def) also from assms have "pre_zeta_aux 0 a s = (\n. (of_nat n + of_real a) powr -s) + of_real a powr (1 - s) / (1 - s)" by (intro pre_zeta_aux_conv_zeta) also have "\ + a powr (1 - s) / (s - 1) = (\n. (of_nat n + of_real a) powr -s) + a powr (1 - s) * (1 / (1 - s) + 1 / (s - 1))" by (simp add: algebra_simps) also have "1 / (1 - s) + 1 / (s - 1) = 0" by (simp add: divide_simps) finally show "hurwitz_zeta a s = (\n. (of_nat n + of_real a) powr -s)" by simp moreover have "(\n. (of_nat n + of_real a) powr -s) sums (\n. (of_nat n + of_real a) powr -s)" by (intro summable_sums summable_hurwitz_zeta assms) ultimately show "(\n. (of_nat n + of_real a) powr -s) sums hurwitz_zeta a s" by simp qed corollary assumes "Re s > 1" shows zeta_conv_suminf: "zeta s = (\n. of_nat (Suc n) powr -s)" and sums_zeta: "(\n. of_nat (Suc n) powr -s) sums zeta s" using hurwitz_zeta_conv_suminf[of 1 s] sums_hurwitz_zeta[of 1 s] assms by (simp_all add: zeta_def add_ac) corollary assumes "n > 1" shows zeta_nat_conv_suminf: "zeta (of_nat n) = (\k. 1 / of_nat (Suc k) ^ n)" and sums_zeta_nat: "(\k. 1 / of_nat (Suc k) ^ n) sums zeta (of_nat n)" proof - have "(\k. of_nat (Suc k) powr -of_nat n) sums zeta (of_nat n)" using assms by (intro sums_zeta) auto also have "(\k. of_nat (Suc k) powr -of_nat n) = (\k. 1 / of_nat (Suc k) ^ n :: complex)" by (simp add: powr_minus divide_simps del: of_nat_Suc) finally show "(\k. 1 / of_nat (Suc k) ^ n) sums zeta (of_nat n)" . thus "zeta (of_nat n) = (\k. 1 / of_nat (Suc k) ^ n)" by (simp add: sums_iff) qed lemma pre_zeta_aux_cnj [simp]: assumes "a > 0" shows "pre_zeta_aux n a (cnj z) = cnj (pre_zeta_aux n a z)" proof - have "cnj (pre_zeta_aux n a z) = of_real a powr -cnj z / 2 + (\x=1..n. (bernoulli (2 * x) / fact (2 * x)) *\<^sub>R a powr (-cnj z - (2*x-1)) * pochhammer (cnj z) (2*x-1)) + EM_remainder (2*n+1) (\x. -(pochhammer (cnj z) (Suc (2 * n)) * cnj (of_real (x + a) powr (-1 - 2 * of_nat n - z)))) 0" (is "_ = _ + ?A + ?B") unfolding pre_zeta_aux_def complex_cnj_add using assms by (subst EM_remainder_cnj [symmetric]) (auto intro!: continuous_intros simp: cnj_powr add_eq_0_iff mult_ac) also have "?B = EM_remainder (2*n+1) (\x. -(pochhammer (cnj z) (Suc (2 * n)) * of_real (x + a) powr (-1 - 2 * of_nat n - cnj z))) 0" using assms by (intro EM_remainder_cong) (auto simp: cnj_powr) also have "of_real a powr -cnj z / 2 + ?A + \ = pre_zeta_aux n a (cnj z)" by (simp add: pre_zeta_aux_def mult_ac) finally show ?thesis .. qed lemma pre_zeta_cnj [simp]: "a > 0 \ pre_zeta a (cnj z) = cnj (pre_zeta a z)" by (simp add: pre_zeta_def) -theorem hurwitz_zeta_cnj [simp]: "a > 0 \ hurwitz_zeta a (cnj z) = cnj (hurwitz_zeta a z)" +lemma hurwitz_zeta_cnj [simp]: "a > 0 \ hurwitz_zeta a (cnj z) = cnj (hurwitz_zeta a z)" proof - assume "a > 0" moreover have "cnj z = 1 \ z = 1" by (simp add: complex_eq_iff) ultimately show ?thesis by (auto simp: hurwitz_zeta_def cnj_powr) qed -theorem zeta_cnj [simp]: "zeta (cnj z) = cnj (zeta z)" +lemma zeta_cnj [simp]: "zeta (cnj z) = cnj (zeta z)" by (simp add: zeta_def) corollary hurwitz_zeta_real: "a > 0 \ hurwitz_zeta a (of_real x) \ \" using hurwitz_zeta_cnj [of a "of_real x"] by (simp add: Reals_cnj_iff del: zeta_cnj) corollary zeta_real: "zeta (of_real x) \ \" unfolding zeta_def by (rule hurwitz_zeta_real) auto +corollary zeta_real': "z \ \ \ zeta z \ \" + by (elim Reals_cases) (auto simp: zeta_real) + subsection \Connection to Dirichlet series\ lemma eval_fds_zeta: "Re s > 1 \ eval_fds fds_zeta s = zeta s" using sums_zeta [of s] by (intro eval_fds_eqI) (auto simp: powr_minus divide_simps) theorem euler_product_zeta: assumes "Re s > 1" shows "(\n. \p\n. if prime p then inverse (1 - 1 / of_nat p powr s) else 1) \ zeta s" using euler_product_fds_zeta[of s] assms unfolding nat_power_complex_def by (simp add: eval_fds_zeta) corollary euler_product_zeta': assumes "Re s > 1" shows "(\n. \p | prime p \ p \ n. inverse (1 - 1 / of_nat p powr s)) \ zeta s" proof - note euler_product_zeta [OF assms] also have "(\n. \p\n. if prime p then inverse (1 - 1 / of_nat p powr s) else 1) = (\n. \p | prime p \ p \ n. inverse (1 - 1 / of_nat p powr s))" by (intro ext prod.mono_neutral_cong_right refl) auto finally show ?thesis . qed theorem zeta_Re_gt_1_nonzero: "Re s > 1 \ zeta s \ 0" using eval_fds_zeta_nonzero[of s] by (simp add: eval_fds_zeta) theorem tendsto_zeta_Re_going_to_at_top: "(zeta \ 1) (Re going_to at_top)" proof (rule Lim_transform_eventually) have "eventually (\x::real. x > 1) at_top" by (rule eventually_gt_at_top) hence "eventually (\s. Re s > 1) (Re going_to at_top)" by blast thus "eventually (\z. eval_fds fds_zeta z = zeta z) (Re going_to at_top)" by eventually_elim (simp add: eval_fds_zeta) next have "conv_abscissa (fds_zeta :: complex fds) \ 1" proof (rule conv_abscissa_leI) fix c' assume "ereal c' > 1" thus "\s. s \ 1 = c' \ fds_converges fds_zeta (s::complex)" by (auto intro!: exI[of _ "of_real c'"]) qed hence "(eval_fds fds_zeta \ fds_nth fds_zeta 1) (Re going_to at_top)" by (intro tendsto_eval_fds_Re_going_to_at_top') auto thus "(eval_fds fds_zeta \ 1) (Re going_to at_top)" by simp qed lemma conv_abscissa_zeta [simp]: "conv_abscissa (fds_zeta :: complex fds) = 1" and abs_conv_abscissa_zeta [simp]: "abs_conv_abscissa (fds_zeta :: complex fds) = 1" proof - let ?z = "fds_zeta :: complex fds" have A: "conv_abscissa ?z \ 1" proof (intro conv_abscissa_geI) fix c' assume "ereal c' < 1" hence "\summable (\n. real n powr -c')" by (subst summable_real_powr_iff) auto hence "\summable (\n. of_real (real n powr -c') :: complex)" by (subst summable_of_real_iff) also have "summable (\n. of_real (real n powr -c') :: complex) \ fds_converges fds_zeta (of_real c' :: complex)" unfolding fds_converges_def by (intro summable_cong eventually_mono [OF eventually_gt_at_top[of 0]]) (simp add: fds_nth_zeta powr_Reals_eq powr_minus divide_simps) finally show "\s::complex. s \ 1 = c' \ \fds_converges fds_zeta s" by (intro exI[of _ "of_real c'"]) auto qed have B: "abs_conv_abscissa ?z \ 1" proof (intro abs_conv_abscissa_leI) fix c' assume "1 < ereal c'" thus "\s::complex. s \ 1 = c' \ fds_abs_converges fds_zeta s" by (intro exI[of _ "of_real c'"]) auto qed have "conv_abscissa ?z \ abs_conv_abscissa ?z" by (rule conv_le_abs_conv_abscissa) also note B finally show "conv_abscissa ?z = 1" using A by (intro antisym) note A also have "conv_abscissa ?z \ abs_conv_abscissa ?z" by (rule conv_le_abs_conv_abscissa) finally show "abs_conv_abscissa ?z = 1" using B by (intro antisym) qed theorem deriv_zeta_sums: assumes s: "Re s > 1" shows "(\n. -of_real (ln (real (Suc n))) / of_nat (Suc n) powr s) sums deriv zeta s" proof - from s have "fds_converges (fds_deriv fds_zeta) s" by (intro fds_converges_deriv) simp_all with s have "(\n. -of_real (ln (real (Suc n))) / of_nat (Suc n) powr s) sums deriv (eval_fds fds_zeta) s" unfolding fds_converges_altdef by (simp add: fds_nth_deriv scaleR_conv_of_real eval_fds_deriv eval_fds_zeta) also from s have "eventually (\s. s \ {s. Re s > 1}) (nhds s)" by (intro eventually_nhds_in_open) (auto simp: open_halfspace_Re_gt) hence "eventually (\s. eval_fds fds_zeta s = zeta s) (nhds s)" by eventually_elim (auto simp: eval_fds_zeta) hence "deriv (eval_fds fds_zeta) s = deriv zeta s" by (intro deriv_cong_ev refl) finally show ?thesis . qed theorem inverse_zeta_sums: assumes s: "Re s > 1" shows "(\n. moebius_mu (Suc n) / of_nat (Suc n) powr s) sums inverse (zeta s)" proof - have "fds_converges (fds moebius_mu) s" using assms by (auto intro!: fds_abs_converges_moebius_mu) hence "(\n. moebius_mu (Suc n) / of_nat (Suc n) powr s) sums eval_fds (fds moebius_mu) s" by (simp add: fds_converges_altdef) also have "fds moebius_mu = inverse (fds_zeta :: complex fds)" by (rule fds_moebius_inverse_zeta) also from s have "eval_fds \ s = inverse (zeta s)" by (subst eval_fds_inverse) (auto simp: fds_moebius_inverse_zeta [symmetric] eval_fds_zeta intro!: fds_abs_converges_moebius_mu) finally show ?thesis . qed text \ The following gives an extension of the $\zeta$ functions to the critical strip. \ lemma hurwitz_zeta_critical_strip: fixes s :: complex and a :: real defines "S \ (\n. \i (\n. of_nat n powr (1 - s) / (1 - s))" assumes "Re s > 0" "s \ 1" and "a > 0" shows "(\n. S n - I' n) \ hurwitz_zeta a s" proof - from assms have [simp]: "s \ 1" by auto let ?f = "\x. of_real (x + a) powr -s" let ?fs = "\n x. (-1) ^ n * pochhammer s n * of_real (x + a) powr (-s - of_nat n)" have minus_commute: "-a - b = -b - a" for a b :: complex by (simp add: algebra_simps) define I where "I = (\n. (of_nat n + a) powr (1 - s) / (1 - s))" define R where "R = (\n. EM_remainder' 1 (?fs 1) (real 0) (real n))" define R_lim where "R_lim = EM_remainder 1 (?fs 1) 0" define C where "C = - (a powr -s / 2)" define D where "D = (\n. (1/2) * (of_real (a + real n) powr - s))" define D' where "D' = (\n. of_real (a + real n) powr - s)" define C' where "C' = a powr (1 - s) / (1 - s)" define C'' where "C'' = of_real a powr - s" { fix n :: nat assume n: "n > 0" have "((\x. of_real (x + a) powr -s) has_integral (of_real (real n + a) powr (1-s) / (1 - s) - of_real (0 + a) powr (1 - s) / (1 - s))) {0..real n}" using n assms by (intro fundamental_theorem_of_calculus) (auto intro!: continuous_intros has_vector_derivative_real_field derivative_eq_intros simp: complex_nonpos_Reals_iff) hence I: "((\x. of_real (x + a) powr -s) has_integral (I n - C')) {0..n}" by (auto simp: divide_simps C'_def I_def) have "(\i\{0<..n}. ?f (real i)) - integral {real 0..real n} ?f = (\k<1. (bernoulli' (Suc k) / fact (Suc k)) *\<^sub>R (?fs k (real n) - ?fs k (real 0))) + R n" using n assms unfolding R_def by (intro euler_maclaurin_strong_raw_nat[where Y = "{0}"]) (auto intro!: continuous_intros derivative_eq_intros has_vector_derivative_real_field simp: pochhammer_rec' algebra_simps complex_nonpos_Reals_iff add_eq_0_iff) also have "(\k<1. (bernoulli' (Suc k) / fact (Suc k)) *\<^sub>R (?fs k (real n) - ?fs k (real 0))) = ((n + a) powr - s - a powr - s) / 2" by (simp add: lessThan_nat_numeral scaleR_conv_of_real numeral_2_eq_2 [symmetric]) also have "\ = C + D n" by (simp add: C_def D_def field_simps) also have "integral {real 0..real n} (\x. complex_of_real (x + a) powr - s) = I n - C'" using I by (simp add: has_integral_iff) also have "(\i\{0<..n}. of_real (real i + a) powr - s) = (\i=0..n. of_real (real i + a) powr - s) - of_real a powr -s" using assms by (subst sum.head) auto also have "(\i=0..n. of_real (real i + a) powr - s) = S n + of_real (real n + a) powr -s" unfolding S_def by (subst sum.last_plus) (auto simp: atLeast0LessThan) finally have "C - C' + C'' - D' n + D n + R n + (I n - I' n) = S n - I' n" by (simp add: algebra_simps S_def D'_def C''_def) } hence ev: "eventually (\n. C - C' + C'' - D' n + D n + R n + (I n - I' n) = S n - I' n) at_top" by (intro eventually_mono[OF eventually_gt_at_top[of 0]]) auto have [simp]: "-1 - s = -s - 1" by simp { let ?C = "norm (pochhammer s 1)" have "R \ R_lim" unfolding R_def R_lim_def of_nat_0 proof (subst of_int_0 [symmetric], rule tendsto_EM_remainder) show "eventually (\x. norm (?fs 1 x) \ ?C * (x + a) powr (-Re s - 1)) at_top" using eventually_ge_at_top[of 0] by eventually_elim (insert assms, auto simp: norm_mult norm_powr_real_powr) next fix x assume x: "x \ real_of_int 0" have [simp]: "-numeral n - (x :: real) = -x - numeral n" for x n by (simp add: algebra_simps) show "((\x. ?C / (-Re s) * (x + a) powr (-Re s)) has_real_derivative ?C * (x + a) powr (- Re s - 1)) (at x within {real_of_int 0..})" using assms x by (auto intro!: derivative_eq_intros) next have "(\y. ?C / (- Re s) * (a + real y) powr (- Re s)) \ 0" by (intro tendsto_mult_right_zero tendsto_neg_powr filterlim_real_sequentially filterlim_tendsto_add_at_top[OF tendsto_const]) (use assms in auto) thus "convergent (\y. ?C / (- Re s) * (real y + a) powr (- Re s))" by (auto simp: add_ac convergent_def) qed (intro integrable_EM_remainder' continuous_intros, insert assms, auto simp: add_eq_0_iff) } moreover have "(\n. I n - I' n) \ 0" proof - have "(\n. (complex_of_real (real n + a) powr (1 - s) - of_real (real n) powr (1 - s)) / (1 - s)) \ 0 / (1 - s)" using assms(3-5) by (intro filterlim_compose[OF _ filterlim_real_sequentially] tendsto_divide complex_powr_add_minus_powr_asymptotics) auto thus "(\n. I n - I' n) \ 0" by (simp add: I_def I'_def divide_simps) qed ultimately have "(\n. C - C' + C'' - D' n + D n + R n + (I n - I' n)) \ C - C' + C'' - 0 + 0 + R_lim + 0" unfolding D_def D'_def using assms by (intro tendsto_add tendsto_diff tendsto_const tendsto_mult_right_zero tendsto_neg_powr_complex_of_real filterlim_tendsto_add_at_top filterlim_real_sequentially) auto also have "C - C' + C'' - 0 + 0 + R_lim + 0 = (a powr - s / 2) + a powr (1 - s) / (s - 1) + R_lim" by (simp add: C_def C'_def C''_def field_simps) also have "\ = hurwitz_zeta a s" using assms by (simp add: hurwitz_zeta_def pre_zeta_def pre_zeta_aux_def R_lim_def scaleR_conv_of_real) finally have "(\n. C - C' + C'' - D' n + D n + R n + (I n - I' n)) \ hurwitz_zeta a s" . with ev show ?thesis by (blast intro: Lim_transform_eventually) qed lemma zeta_critical_strip: fixes s :: complex and a :: real defines "S \ (\n. \i=1..n. (of_nat i) powr - s)" defines "I \ (\n. of_nat n powr (1 - s) / (1 - s))" assumes s: "Re s > 0" "s \ 1" shows "(\n. S n - I n) \ zeta s" proof - from hurwitz_zeta_critical_strip[OF s zero_less_one] have "(\n. (\i hurwitz_zeta 1 s" by (simp add: add_ac) also have "(\n. (\in. (\i=1..n. of_nat i powr -s))" by (intro ext sum.reindex_bij_witness[of _ "\x. x - 1" Suc]) auto finally show ?thesis by (simp add: zeta_def S_def I_def) qed subsection \The non-vanishing of $\zeta$ for $\mathfrak{R}(s) \geq 1$\ text \ This proof is based on a sketch by Newman~\cite{newman1998analytic}, which was previously formalised in HOL Light by Harrison~\cite{harrison2009pnt}, albeit in a much more concrete and low-level style. Our aim here is to reproduce Newman's proof idea cleanly and on the same high level of abstraction. \ theorem zeta_Re_ge_1_nonzero: fixes s assumes "Re s \ 1" "s \ 1" shows "zeta s \ 0" proof (cases "Re s > 1") case False define a where "a = -Im s" from False assms have s [simp]: "s = 1 - \ * a" and a: "a \ 0" by (auto simp: complex_eq_iff a_def) show ?thesis proof assume "zeta s = 0" hence zero: "zeta (1 - \ * a) = 0" by simp with zeta_cnj[of "1 - \ * a"] have zero': "zeta (1 + \ * a) = 0" by simp \ \We define the function $Q(s) = \zeta(s)^2\zeta(s+ia)\zeta(s-ia)$ and its Dirichlet series. The objective will be to show that this function is entire and its Dirichlet series converges everywhere. Of course, $Q(s)$ has singularities at $1$ and $1\pm ia$, so we need to show they can be removed.\ define Q Q_fds where "Q = (\s. zeta s ^ 2 * zeta (s + \ * a) * zeta (s - \ * a))" and "Q_fds = fds_zeta ^ 2 * fds_shift (\ * a) fds_zeta * fds_shift (-\ * a) fds_zeta" let ?sings = "{1, 1 + \ * a, 1 - \ * a}" \ \We show that @{term Q} is locally bounded everywhere. This is the case because the poles of $\zeta(s)$ cancel with the zeros of $\zeta(s\pm ia)$ and vice versa. This boundedness is then enough to show that @{term Q} has only removable singularities.\ have Q_bigo_1: "Q \ O[at s](\_. 1)" for s proof - have Q_eq: "Q = (\s. (zeta s * zeta (s + \ * a)) * (zeta s * zeta (s - \ * a)))" by (simp add: Q_def power2_eq_square mult_ac) \ \The singularity of $\zeta(s)$ at 1 gets cancelled by the zero of $\zeta(s-ia)$:\ have bigo1: "(\s. zeta s * zeta (s - \ * a)) \ O[at 1](\_. 1)" if "zeta (1 - \ * a) = 0" "a \ 0" for a :: real proof - have "(\s. zeta (s - \ * a) - zeta (1 - \ * a)) \ O[at 1](\s. s - 1)" using that by (intro taylor_bigo_linear holomorphic_on_imp_differentiable_at[of _ "-{1 + \ * a}"] holomorphic_intros) (auto simp: complex_eq_iff) hence "(\s. zeta s * zeta (s - \ * a)) \ O[at 1](\s. 1 / (s - 1) * (s - 1))" using that by (intro landau_o.big.mult zeta_bigo_at_1) simp_all also have "(\s. 1 / (s - 1) * (s - 1)) \ \[at 1](\_. 1)" by (intro bigthetaI_cong) (auto simp: eventually_at_filter) finally show ?thesis . qed \ \The analogous result for $\zeta(s) \zeta(s+ia)$:\ have bigo1': "(\s. zeta s * zeta (s + \ * a)) \ O[at 1](\_. 1)" if "zeta (1 - \ * a) = 0" "a \ 0" for a :: real using bigo1[of "-a"] that zeta_cnj[of "1 - \ * a"] by simp \ \The singularity of $\zeta(s-ia)$ gets cancelled by the zero of $\zeta(s)$:\ have bigo2: "(\s. zeta s * zeta (s - \ * a)) \ O[at (1 + \ * a)](\_. 1)" if "zeta (1 - \ * a) = 0" "a \ 0" for a :: real proof - have "(\s. zeta s * zeta (s - \ * a)) \ O[filtermap (\s. s + \ * a) (at 1)](\_. 1)" using bigo1'[of a] that by (simp add: mult.commute landau_o.big.in_filtermap_iff) also have "filtermap (\s. s + \ * a) (at 1) = at (1 + \ * a)" using filtermap_at_shift[of "-\ * a" 1] by simp finally show ?thesis . qed \ \Again, the analogous result for $\zeta(s) \zeta(s+ia)$:\ have bigo2': "(\s. zeta s * zeta (s + \ * a)) \ O[at (1 - \ * a)](\_. 1)" if "zeta (1 - \ * a) = 0" "a \ 0" for a :: real using bigo2[of "-a"] that zeta_cnj[of "1 - \ * a"] by simp \ \Now the final case distinction to show $Q(s)\in O(1)$ for all $s\in\mathbb{C}$:\ consider "s = 1" | "s = 1 + \ * a" | "s = 1 - \ * a" | "s \ ?sings" by blast thus ?thesis proof cases case 1 thus ?thesis unfolding Q_eq using zero zero' a by (auto intro: bigo1 bigo1' landau_o.big.mult_in_1) next case 2 from a have "isCont (\s. zeta s * zeta (s + \ * a)) (1 + \ * a)" by (auto intro!: continuous_intros) with 2 show ?thesis unfolding Q_eq using zero zero' a by (auto intro: bigo2 landau_o.big.mult_in_1 continuous_imp_bigo_1) next case 3 from a have "isCont (\s. zeta s * zeta (s - \ * a)) (1 - \ * a)" by (auto intro!: continuous_intros) with 3 show ?thesis unfolding Q_eq using zero zero' a by (auto intro: bigo2' landau_o.big.mult_in_1 continuous_imp_bigo_1) qed (auto intro!: continuous_imp_bigo_1 continuous_intros simp: Q_def complex_eq_iff) qed \ \Thus, we can remove the singularities from @{term Q} and extend it to an entire function.\ have "\Q'. Q' holomorphic_on UNIV \ (\z\UNIV - ?sings. Q' z = Q z)" by (intro removable_singularities Q_bigo_1) (auto simp: Q_def complex_eq_iff intro!: holomorphic_intros) then obtain Q' where Q': "Q' holomorphic_on UNIV" "\z. z \ ?sings \ Q' z = Q z" by blast \ \@{term Q'} constitutes an analytic continuation of the Dirichlet series of @{term Q}.\ have eval_Q_fds: "eval_fds Q_fds s = Q' s" if "Re s > 1" for s proof - have "eval_fds Q_fds s = Q s" using that by (simp add: Q_fds_def Q_def eval_fds_mult eval_fds_power fds_abs_converges_mult fds_abs_converges_power eval_fds_zeta) also from that have "\ = Q' s" by (subst Q') auto finally show ?thesis . qed \ \Since $\zeta(s)$ and $\zeta(s\pm ia)$ are completely multiplicative Dirichlet series, the logarithm of their product can be rewritten into the following nice form:\ have ln_Q_fds_eq: "fds_ln 0 Q_fds = fds (\k. of_real (2 * mangoldt k / ln k * (1 + cos (a * ln k))))" proof - note simps = fds_ln_mult[where l' = 0 and l'' = 0] fds_ln_power[where l' = 0] fds_ln_prod[where l' = "\_. 0"] have "fds_ln 0 Q_fds = 2 * fds_ln 0 fds_zeta + fds_shift (\ * a) (fds_ln 0 fds_zeta) + fds_shift (-\ * a) (fds_ln 0 fds_zeta)" by (auto simp: Q_fds_def simps) also have "completely_multiplicative_function (fds_nth (fds_zeta :: complex fds))" by standard auto hence "fds_ln (0 :: complex) fds_zeta = fds (\n. mangoldt n /\<^sub>R ln (real n))" by (subst fds_ln_completely_multiplicative) (auto simp: fds_eq_iff) also have "2 * \ + fds_shift (\ * a) \ + fds_shift (-\ * a) \ = fds (\k. of_real (2 * mangoldt k / ln k * (1 + cos (a * ln k))))" (is "?a = ?b") proof (intro fds_eqI, goal_cases) case (1 n) then consider "n = 1" | "n > 1" by force hence "fds_nth ?a n = mangoldt n / ln (real n) * (2 + (n powr (\ * a) + n powr (-\ * a)))" by cases (auto simp: field_simps scaleR_conv_of_real numeral_fds) also have "n powr (\ * a) + n powr (-\ * a) = 2 * cos (of_real (a * ln n))" using 1 by (subst cos_exp_eq) (simp_all add: powr_def algebra_simps) also have "mangoldt n / ln (real n) * (2 + \) = of_real (2 * mangoldt n / ln n * (1 + cos (a * ln n)))" by (subst cos_of_real) simp_all finally show ?case by (simp add: fds_nth_fds') qed finally show ?thesis . qed \ \It is then obvious that this logarithm series has non-negative real coefficients.\ also have "nonneg_dirichlet_series \" proof (standard, goal_cases) case (1 n) from cos_ge_minus_one[of "a * ln n"] have "1 + cos (a * ln (real n)) \ 0" by linarith thus ?case using 1 by (cases "n = 0") (auto simp: complex_nonneg_Reals_iff fds_nth_fds' mangoldt_nonneg intro!: divide_nonneg_nonneg mult_nonneg_nonneg) qed \ \Therefore, the original series also has non-negative real coefficients.\ finally have nonneg: "nonneg_dirichlet_series Q_fds" by (rule nonneg_dirichlet_series_lnD) (auto simp: Q_fds_def) \ \By the Pringsheim--Landau theorem, a Dirichlet series with non-negative coefficnets that can be analytically continued to the entire complex plane must converge everywhere, i.\,e.\ its abscissa of (absolute) convergence is $-\infty$:\ have abscissa_Q_fds: "abs_conv_abscissa Q_fds \ 1" unfolding Q_fds_def by (auto intro!: abs_conv_abscissa_mult_leI abs_conv_abscissa_power_leI) with nonneg and eval_Q_fds and \Q' holomorphic_on UNIV\ have abscissa: "abs_conv_abscissa Q_fds = -\" by (intro entire_continuation_imp_abs_conv_abscissa_MInfty[where c = 1 and g = Q']) (auto simp: one_ereal_def) \ \This now leads to a contradiction in a very obvious way. If @{term Q_fds} is absolutely convergent, then the subseries corresponding to powers of 2 (\i.e. we delete all summands $a_n / n ^ s$ where $n$ is not a power of 2 from the sum) is also absolutely convergent. We denote this series with $R$.\ define R_fds where "R_fds = fds_primepow_subseries 2 Q_fds" have "conv_abscissa R_fds \ abs_conv_abscissa R_fds" by (rule conv_le_abs_conv_abscissa) also have "abs_conv_abscissa R_fds \ abs_conv_abscissa Q_fds" unfolding R_fds_def by (rule abs_conv_abscissa_restrict) also have "\ = -\" by (simp add: abscissa) finally have abscissa': "conv_abscissa R_fds = -\" by simp \ \Since $\zeta(s)$ and $\zeta(s \pm ia)$ have an Euler product expansion for $\mathfrak{R}(s) > 1$, we have \[R(s) = (1 - 2^{-s})^-2 (1 - 2^{-s+ia})^{-1} (1 - 2^{-s-ia})^{-1}\] there, and since $R$ converges everywhere and the right-hand side is holomorphic for $\mathfrak{R}(s) > 0$, the equation is also valid for all $s$ with $\mathfrak{R}(s) > 0$ by analytic continuation.\ have eval_R: "eval_fds R_fds s = 1 / ((1 - 2 powr -s) ^ 2 * (1 - 2 powr (-s + \ * a)) * (1 - 2 powr (-s - \ * a)))" (is "_ = ?f s") if "Re s > 0" for s proof - show ?thesis proof (rule analytic_continuation_open[where f = "eval_fds R_fds"]) show "?f holomorphic_on {s. Re s > 0}" by (intro holomorphic_intros) (auto simp: powr_def exp_eq_1 Ln_Reals_eq) next fix z assume z: "z \ {s. Re s > 1}" have [simp]: "completely_multiplicative_function (fds_nth fds_zeta)" by standard auto thus "eval_fds R_fds z = ?f z" using z by (simp add: R_fds_def Q_fds_def eval_fds_mult eval_fds_power fds_abs_converges_mult fds_abs_converges_power fds_primepow_subseries_euler_product_cm divide_simps powr_minus powr_diff powr_add fds_abs_summable_zeta) qed (insert that abscissa', auto intro!: exI[of _ 2] convex_connected open_halfspace_Re_gt convex_halfspace_Re_gt holomorphic_intros) qed \ \We now clearly have a contradiction: $R(s)$, being entire, is continuous everywhere, while the function on the right-hand side clearly has a pole at $0$.\ show False proof (rule not_tendsto_and_filterlim_at_infinity) have "((\b. (1-2 powr - b)\<^sup>2 * (1 - 2 powr (-b+\*a)) * (1 - 2 powr (-b-\*a))) \ 0) (at 0 within {s. Re s > 0})" (is "filterlim ?f' _ _") by (intro tendsto_eq_intros) (auto) moreover have "eventually (\s. s \ {s. Re s > 0}) (at 0 within {s. Re s > 0})" by (auto simp: eventually_at_filter) hence "eventually (\s. ?f' s \ 0) (at 0 within {s. Re s > 0})" by eventually_elim (auto simp: powr_def exp_eq_1 Ln_Reals_eq) ultimately have "filterlim ?f' (at 0) (at 0 within {s. Re s > 0})" by (simp add: filterlim_at) hence "filterlim ?f at_infinity (at 0 within {s. Re s > 0})" (is ?lim) by (intro filterlim_divide_at_infinity[OF tendsto_const] tendsto_mult_filterlim_at_infinity) auto also have ev: "eventually (\s. Re s > 0) (at 0 within {s. Re s > 0})" by (auto simp: eventually_at intro!: exI[of _ 1]) have "?lim \ filterlim (eval_fds R_fds) at_infinity (at 0 within {s. Re s > 0})" by (intro filterlim_cong refl eventually_mono[OF ev]) (auto simp: eval_R) finally show \ . next have "continuous (at 0 within {s. Re s > 0}) (eval_fds R_fds)" by (intro continuous_intros) (auto simp: abscissa') thus "((eval_fds R_fds \ eval_fds R_fds 0)) (at 0 within {s. Re s > 0})" by (auto simp: continuous_within) next have "0 \ {s. Re s \ 0}" by simp also have "{s. Re s \ 0} = closure {s. Re s > 0}" using closure_halfspace_gt[of "1::complex" 0] by (simp add: inner_commute) finally have "0 \ \" . thus "at 0 within {s. Re s > 0} \ bot" by (subst at_within_eq_bot_iff) auto qed qed qed (fact zeta_Re_gt_1_nonzero) subsection \Special values of the $\zeta$ functions\ theorem hurwitz_zeta_neg_of_nat: assumes "a > 0" shows "hurwitz_zeta a (-of_nat n) = -bernpoly (Suc n) a / of_nat (Suc n)" proof - have "-of_nat n \ (1::complex)" by (simp add: complex_eq_iff) hence "hurwitz_zeta a (-of_nat n) = pre_zeta a (-of_nat n) + a powr real (Suc n) / (-of_nat (Suc n))" unfolding zeta_def hurwitz_zeta_def using assms by (simp add: powr_of_real [symmetric]) also have "a powr real (Suc n) / (-of_nat (Suc n)) = - (a powr real (Suc n) / of_nat (Suc n))" by (simp add: divide_simps del: of_nat_Suc) also have "a powr real (Suc n) = a ^ Suc n" using assms by (intro powr_realpow) also have "pre_zeta a (-of_nat n) = pre_zeta_aux (Suc n) a (- of_nat n)" using assms by (intro pre_zeta_aux_eq_pre_zeta [symmetric]) auto also have "\ = of_real a powr of_nat n / 2 + (\i = 1..Suc n. (bernoulli (2 * i) / fact (2 * i)) *\<^sub>R (pochhammer (- of_nat n) (2 * i - 1) * of_real a powr (of_nat n - of_nat (2 * i - 1)))) + EM_remainder (Suc (2 * Suc n)) (\x. - (pochhammer (- of_nat n) (2*n+3) * of_real (x + a) powr (- of_nat n - 3))) 0" (is "_ = ?B + sum (\n. ?f (2 * n)) _ + _") unfolding pre_zeta_aux_def by (simp add: add_ac eval_nat_numeral) also have "?B = of_real (a ^ n) / 2" using assms by (subst powr_Reals_eq) (auto simp: powr_realpow) also have "pochhammer (-of_nat n :: complex) (2*n+3) = 0" by (subst pochhammer_eq_0_iff) auto finally have "hurwitz_zeta a (-of_nat n) = - (a ^ Suc n / of_nat (Suc n)) + (a ^ n / 2 + sum (\n. ?f (2 * n)) {1..Suc n})" by simp also have "sum (\n. ?f (2 * n)) {1..Suc n} = sum ?f ((*) 2 ` {1..Suc n})" by (intro sum.reindex_bij_witness[of _ "\i. i div 2" "\i. 2*i"]) auto also have "\ = (\i=2..2*n+2. ?f i)" proof (intro sum.mono_neutral_left ballI, goal_cases) case (3 i) hence "odd i" "i \ 1" by (auto elim!: evenE) thus ?case by (simp add: bernoulli_odd_eq_0) qed auto also have "\ = (\i=2..Suc n. ?f i)" proof (intro sum.mono_neutral_right ballI, goal_cases) case (3 i) hence "pochhammer (-of_nat n :: complex) (i - 1) = 0" by (subst pochhammer_eq_0_iff) auto thus ?case by simp qed auto also have "\ = (\i=Suc 1..Suc n. -of_real (real (Suc n choose i) * bernoulli i * a ^ (Suc n - i)) / of_nat (Suc n))" (is "sum ?lhs _ = sum ?f _") proof (intro sum.cong, goal_cases) case (2 i) hence "of_nat n - of_nat (i - 1) = (of_nat (Suc n - i) :: complex)" by (auto simp: of_nat_diff) also have "of_real a powr \ = of_real (a ^ (Suc n - i))" using 2 assms by (subst powr_nat) auto finally have A: "of_real a powr (of_nat n - of_nat (i - 1)) = \" . have "pochhammer (-of_nat n) (i - 1) = complex_of_real (pochhammer (-real n) (i - 1))" by (simp add: pochhammer_of_real [symmetric]) also have "pochhammer (-real n) (i - 1) = pochhammer (-of_nat (Suc n)) i / (-1 - real n)" using 2 by (subst (2) pochhammer_rec_if) auto also have "-1 - real n = -real (Suc n)" by simp finally have B: "pochhammer (-of_nat n) (i - 1) = -complex_of_real (pochhammer (-real (Suc n)) i / real (Suc n))" by (simp del: of_nat_Suc) have "?lhs i = -complex_of_real (bernoulli i * pochhammer (-real (Suc n)) i / fact i * a ^ (Suc n - i)) / of_nat (Suc n)" by (simp only: A B) (simp add: scaleR_conv_of_real) also have "bernoulli i * pochhammer (-real (Suc n)) i / fact i = (real (Suc n) gchoose i) * bernoulli i" using 2 by (subst gbinomial_pochhammer) (auto simp: minus_one_power_iff bernoulli_odd_eq_0) also have "real (Suc n) gchoose i = Suc n choose i" by (subst binomial_gbinomial) auto finally show ?case by simp qed auto also have "a ^ n / 2 + sum ?f {Suc 1..Suc n} = sum ?f {1..Suc n}" by (subst (2) sum.atLeast_Suc_atMost) (simp_all add: scaleR_conv_of_real del: of_nat_Suc) also have "-(a ^ Suc n / of_nat (Suc n)) + sum ?f {1..Suc n} = sum ?f {0..Suc n}" by (subst (2) sum.atLeast_Suc_atMost) (simp_all add: scaleR_conv_of_real) also have "\ = - bernpoly (Suc n) a / of_nat (Suc n)" unfolding sum_negf sum_divide_distrib [symmetric] by (simp add: bernpoly_def atLeast0AtMost) finally show ?thesis . qed lemma hurwitz_zeta_0 [simp]: "a > 0 \ hurwitz_zeta a 0 = 1 / 2 - a" using hurwitz_zeta_neg_of_nat[of a 0] by (simp add: bernpoly_def) lemma zeta_0 [simp]: "zeta 0 = -1 / 2" by (simp add: zeta_def) theorem zeta_neg_of_nat: "zeta (-of_nat n) = -of_real (bernoulli' (Suc n)) / of_nat (Suc n)" unfolding zeta_def by (simp add: hurwitz_zeta_neg_of_nat bernpoly_1') corollary zeta_trivial_zero: assumes "even n" "n \ 0" shows "zeta (-of_nat n) = 0" using zeta_neg_of_nat[of n] assms by (simp add: bernoulli'_odd_eq_0) theorem zeta_even_nat: "zeta (2 * of_nat n) = of_real ((-1) ^ Suc n * bernoulli (2 * n) * (2 * pi) ^ (2 * n) / (2 * fact (2 * n)))" proof (cases "n = 0") case False hence "(\k. 1 / of_nat (Suc k) ^ (2 * n)) sums zeta (of_nat (2 * n))" by (intro sums_zeta_nat) auto from sums_unique2 [OF this nat_even_power_sums_complex] False show ?thesis by simp qed (insert zeta_neg_of_nat[of 0], simp_all) corollary zeta_even_numeral: "zeta (numeral (Num.Bit0 n)) = of_real ((- 1) ^ Suc (numeral n) * bernoulli (numeral (num.Bit0 n)) * (2 * pi) ^ numeral (num.Bit0 n) / (2 * fact (numeral (num.Bit0 n))))" (is "_ = ?rhs") proof - have *: "(2 * numeral n :: nat) = numeral (Num.Bit0 n)" by (subst numeral.numeral_Bit0, subst mult_2, rule refl) have "numeral (Num.Bit0 n) = (2 * numeral n :: complex)" by (subst numeral.numeral_Bit0, subst mult_2, rule refl) also have "\ = 2 * of_nat (numeral n)" by (simp only: of_nat_numeral of_nat_mult) also have "zeta \ = ?rhs" by (subst zeta_even_nat) (simp only: *) finally show ?thesis . qed corollary zeta_neg_even_numeral [simp]: "zeta (-numeral (Num.Bit0 n)) = 0" proof - have "-numeral (Num.Bit0 n) = (-of_nat (numeral (Num.Bit0 n)) :: complex)" by simp also have "zeta \ = 0" proof (rule zeta_trivial_zero) have "numeral (Num.Bit0 n) = (2 * numeral n :: nat)" by (subst numeral.numeral_Bit0, subst mult_2, rule refl) also have "even \" by (rule dvd_triv_left) finally show "even (numeral (Num.Bit0 n) :: nat)" . qed auto finally show ?thesis . qed corollary zeta_neg_numeral: "zeta (-numeral n) = -of_real (bernoulli' (numeral (Num.inc n)) / numeral (Num.inc n))" proof - have "-numeral n = (- of_nat (numeral n) :: complex)" by simp also have "zeta \ = -of_real (bernoulli' (numeral (Num.inc n)) / numeral (Num.inc n))" by (subst zeta_neg_of_nat) (simp add: numeral_inc) finally show ?thesis . qed corollary zeta_neg1: "zeta (-1) = - 1 / 12" using zeta_neg_of_nat[of 1] by (simp add: eval_bernoulli) corollary zeta_neg3: "zeta (-3) = 1 / 120" by (simp add: zeta_neg_numeral) corollary zeta_neg5: "zeta (-5) = - 1 / 252" by (simp add: zeta_neg_numeral) corollary zeta_2: "zeta 2 = pi ^ 2 / 6" by (simp add: zeta_even_numeral) corollary zeta_4: "zeta 4 = pi ^ 4 / 90" by (simp add: zeta_even_numeral fact_num_eq_if) corollary zeta_6: "zeta 6 = pi ^ 6 / 945" by (simp add: zeta_even_numeral fact_num_eq_if) corollary zeta_8: "zeta 8 = pi ^ 8 / 9450" by (simp add: zeta_even_numeral fact_num_eq_if) subsection \Integral relation between $\Gamma$ and $\zeta$ function\ lemma assumes z: "Re z > 0" and a: "a > 0" shows Gamma_hurwitz_zeta_aux_integral: "Gamma z / (of_nat n + of_real a) powr z = (\s\{0<..}. (s powr (z - 1) / exp ((n+a) * s)) \lebesgue)" and Gamma_hurwitz_zeta_aux_integrable: "set_integrable lebesgue {0<..} (\s. s powr (z - 1) / exp ((n+a) * s))" proof - note integrable = absolutely_integrable_Gamma_integral' [OF z] let ?INT = "set_lebesgue_integral lebesgue {0<..} :: (real \ complex) \ complex" let ?INT' = "set_lebesgue_integral lebesgue {0<..} :: (real \ real) \ real" have meas1: "set_borel_measurable lebesgue {0<..} (\x. of_real x powr (z - 1) / of_real (exp ((n+a) * x)))" unfolding set_borel_measurable_def by (intro measurable_completion, subst measurable_lborel2, intro borel_measurable_continuous_on_indicator) (auto intro!: continuous_intros) show integrable1: "set_integrable lebesgue {0<..} (\s. s powr (z - 1) / exp ((n+a) * s))" using assms by (intro absolutely_integrable_Gamma_integral) auto from assms have pos: "0 < real n + a" by (simp add: add_nonneg_pos) hence "complex_of_real 0 \ of_real (real n + a)" by (simp only: of_real_eq_iff) also have "complex_of_real (real n + a) = of_nat n + of_real a" by simp finally have nz: "\ \ 0" by auto have "((\t. complex_of_real t powr (z - 1) / of_real (exp t)) has_integral Gamma z) {0<..}" by (rule Gamma_integral_complex') fact+ hence "Gamma z = ?INT (\t. t powr (z - 1) / of_real (exp t))" using set_lebesgue_integral_eq_integral(2) [OF integrable] by (simp add: has_integral_iff exp_of_real) also have "lebesgue = density (distr lebesgue lebesgue (\t. (real n+a) * t)) (\x. ennreal (real n+a))" using lebesgue_real_scale[of "real n + a"] pos by auto also have "set_lebesgue_integral \ {0<..} (\t. of_real t powr (z - 1) / of_real (exp t)) = set_lebesgue_integral (distr lebesgue lebesgue (\t. (real n + a) * t)) {0<..} (\t. (real n + a) * t powr (z - 1) / exp t)" using integrable pos unfolding set_lebesgue_integral_def by (subst integral_density) (simp_all add: exp_of_real algebra_simps scaleR_conv_of_real set_integrable_def) also have "\ = ?INT (\s. (n + a) * (of_real (n+a) * of_real s) powr (z - 1) / of_real (exp ((n+a) * s)))" unfolding set_lebesgue_integral_def proof (subst integral_distr) show "(*) (real n + a) \ lebesgue \\<^sub>M lebesgue" using lebesgue_measurable_scaling[of "real n + a", where ?'a = real] unfolding real_scaleR_def . next have "(\x. (n+a) * (indicator {0<..} x *\<^sub>R (of_real x powr (z - 1) / of_real (exp x)))) \ lebesgue \\<^sub>M borel" using integrable unfolding set_integrable_def by (intro borel_measurable_times) simp_all thus "(\x. indicator {0<..} x *\<^sub>R (complex_of_real (real n + a) * complex_of_real x powr (z - 1) / exp x)) \ borel_measurable lebesgue" by simp qed (intro Bochner_Integration.integral_cong refl, insert pos, auto simp: indicator_def zero_less_mult_iff) also have "\ = ?INT (\s. ((n+a) powr z) * (s powr (z - 1) / exp ((n+a) * s)))" using pos by (intro set_lebesgue_integral_cong refl allI impI, simp, subst powr_times_real) (auto simp: powr_diff) also have "\ = (n + a) powr z * ?INT (\s. s powr (z - 1) / exp ((n+a) * s))" unfolding set_lebesgue_integral_def by (subst integral_mult_right_zero [symmetric]) simp_all finally show "Gamma z / (of_nat n + of_real a) powr z = ?INT (\s. s powr (z - 1) / exp ((n+a) * s))" using nz by (auto simp add: field_simps) qed lemma assumes x: "x > 0" and "a > 0" shows Gamma_hurwitz_zeta_aux_integral_real: "Gamma x / (real n + a) powr x = set_lebesgue_integral lebesgue {0<..} (\s. s powr (x - 1) / exp ((real n + a) * s))" and Gamma_hurwitz_zeta_aux_integrable_real: "set_integrable lebesgue {0<..} (\s. s powr (x - 1) / exp ((real n + a) * s))" proof - show "set_integrable lebesgue {0<..} (\s. s powr (x - 1) / exp ((real n + a) * s))" using absolutely_integrable_Gamma_integral[of "of_real x" "real n + a"] unfolding set_integrable_def proof (rule Bochner_Integration.integrable_bound, goal_cases) case 3 have "set_integrable lebesgue {0<..} (\xa. complex_of_real xa powr (of_real x - 1) / of_real (exp ((n + a) * xa)))" using assms by (intro Gamma_hurwitz_zeta_aux_integrable) auto also have "?this \ integrable lebesgue (\s. complex_of_real (indicator {0<..} s *\<^sub>R (s powr (x - 1) / (exp ((n+a) * s)))))" unfolding set_integrable_def by (intro Bochner_Integration.integrable_cong refl) (auto simp: powr_Reals_eq indicator_def) finally have "set_integrable lebesgue {0<..} (\s. s powr (x - 1) / exp ((n+a) * s))" unfolding set_integrable_def complex_of_real_integrable_eq . thus ?case by (simp add: set_integrable_def) qed (insert assms, auto intro!: AE_I2 simp: indicator_def norm_divide norm_powr_real_powr) from Gamma_hurwitz_zeta_aux_integral[of "of_real x" a n] and assms have "of_real (Gamma x / (real n + a) powr x) = set_lebesgue_integral lebesgue {0<..} (\s. complex_of_real s powr (of_real x - 1) / of_real (exp ((n+a) * s)))" (is "_ = ?I") by (auto simp: Gamma_complex_of_real powr_Reals_eq) also have "?I = lebesgue_integral lebesgue (\s. of_real (indicator {0<..} s *\<^sub>R (s powr (x - 1) / exp ((n+a) * s))))" unfolding set_lebesgue_integral_def using assms by (intro Bochner_Integration.integral_cong refl) (auto simp: indicator_def powr_Reals_eq) also have "\ = of_real (set_lebesgue_integral lebesgue {0<..} (\s. s powr (x - 1) / exp ((n+a) * s)))" unfolding set_lebesgue_integral_def by (rule Bochner_Integration.integral_complex_of_real) finally show "Gamma x / (real n + a) powr x = set_lebesgue_integral lebesgue {0<..} (\s. s powr (x - 1) / exp ((real n + a) * s))" by (subst (asm) of_real_eq_iff) qed theorem assumes "Re z > 1" and "a > (0::real)" shows Gamma_times_hurwitz_zeta_integral: "Gamma z * hurwitz_zeta a z = (\x\{0<..}. (of_real x powr (z - 1) * of_real (exp (-a*x) / (1 - exp (-x)))) \lebesgue)" and Gamma_times_hurwitz_zeta_integrable: "set_integrable lebesgue {0<..} (\x. of_real x powr (z - 1) * of_real (exp (-a*x) / (1 - exp (-x))))" proof - from assms have z: "Re z > 0" by simp let ?INT = "set_lebesgue_integral lebesgue {0<..} :: (real \ complex) \ complex" let ?INT' = "set_lebesgue_integral lebesgue {0<..} :: (real \ real) \ real" have 1: "complex_set_integrable lebesgue {0<..} (\x. of_real x powr (z - 1) / of_real (exp ((real n + a) * x)))" for n by (rule Gamma_hurwitz_zeta_aux_integrable) (use assms in simp_all) have 2: "summable (\n. norm (indicator {0<..} s *\<^sub>R (of_real s powr (z - 1) / of_real (exp ((n + a) * s)))))" for s proof (cases "s > 0") case True hence "summable (\n. norm (of_real s powr (z - 1)) * exp (-a * s) * exp (-s) ^ n)" using assms by (intro summable_mult summable_geometric) simp_all with True show ?thesis by (simp add: norm_mult norm_divide exp_add exp_diff exp_minus field_simps exp_of_nat_mult [symmetric]) qed simp_all have 3: "summable (\n. \x. norm (indicator {0<..} x *\<^sub>R (complex_of_real x powr (z - 1) / complex_of_real (exp ((n + a) * x)))) \lebesgue)" proof - have "summable (\n. Gamma (Re z) * (real n + a) powr -Re z)" using assms by (intro summable_mult summable_hurwitz_zeta_real) simp_all also have "?this \ summable (\n. ?INT' (\s. norm (of_real s powr (z - 1) / of_real (exp ((n+a) * s)))))" proof (intro summable_cong always_eventually allI, goal_cases) case (1 n) have "Gamma (Re z) * (real n + a) powr -Re z = Gamma (Re z) / (real n + a) powr Re z" by (subst powr_minus) (simp_all add: field_simps) also from assms have "\ = (\x\{0<..}. (x powr (Re z-1) / exp ((n+a) * x)) \lebesgue)" by (subst Gamma_hurwitz_zeta_aux_integral_real) simp_all also have "\ = (\xa\{0<..}. norm (of_real xa powr (z-1) / of_real (exp ((n+a) * xa))) \lebesgue)" unfolding set_lebesgue_integral_def by (intro Bochner_Integration.integral_cong refl) (auto simp: indicator_def norm_divide norm_powr_real_powr) finally show ?case . qed finally show ?thesis by (simp add: set_lebesgue_integral_def) qed have sum_eq: "(\n. indicator {0<..} s *\<^sub>R (of_real s powr (z - 1) / of_real (exp ((n+a) * s)))) = indicator {0<..} s *\<^sub>R (of_real s powr (z - 1) * of_real (exp (-a * s) / (1 - exp (-s))))" for s proof (cases "s > 0") case True hence "(\n. indicator {0..} s *\<^sub>R (of_real s powr (z - 1) / of_real (exp ((n+a) * s)))) = (\n. of_real s powr (z - 1) * of_real (exp (-a * s)) * of_real (exp (-s)) ^ n)" by (intro suminf_cong) (auto simp: exp_add exp_minus exp_of_nat_mult [symmetric] field_simps of_real_exp) also have "(\n. of_real s powr (z - 1) * of_real (exp (-a * s)) * of_real (exp (-s)) ^ n) = of_real s powr (z - 1) * of_real (exp (-a * s)) * (\n. of_real (exp (-s)) ^ n)" using True by (intro suminf_mult summable_geometric) simp_all also have "(\n. complex_of_real (exp (-s)) ^ n) = 1 / (1 - of_real (exp (-s)))" using True by (intro suminf_geometric) auto also have "of_real s powr (z - 1) * of_real (exp (-a * s)) * \ = of_real s powr (z - 1) * of_real (exp (-a * s) / (1 - exp (-s)))" using \a > 0\ by (auto simp add: divide_simps exp_minus) finally show ?thesis using True by simp qed simp_all show "set_integrable lebesgue {0<..} (\x. of_real x powr (z - 1) * of_real (exp (-a*x) / (1 - exp (-x))))" using 1 unfolding sum_eq [symmetric] set_integrable_def by (intro integrable_suminf[OF _ AE_I2] 2 3) have "(\n. ?INT (\s. s powr (z - 1) / exp ((n+a) * s))) sums lebesgue_integral lebesgue (\s. \n. indicator {0<..} s *\<^sub>R (s powr (z - 1) / exp ((n+a) * s)))" (is "?A sums ?B") using 1 unfolding set_lebesgue_integral_def set_integrable_def by (rule sums_integral[OF _ AE_I2[OF 2] 3]) also have "?A = (\n. Gamma z * (n + a) powr -z)" using assms by (subst Gamma_hurwitz_zeta_aux_integral [symmetric]) (simp_all add: powr_minus divide_simps) also have "?B = ?INT (\s. of_real s powr (z - 1) * of_real (exp (-a * s) / (1 - exp (-s))))" unfolding sum_eq set_lebesgue_integral_def .. finally have "(\n. Gamma z * (of_nat n + of_real a) powr -z) sums ?INT (\x. of_real x powr (z - 1) * of_real (exp (-a * x) / (1 - exp (-x))))" by simp moreover have "(\n. Gamma z * (of_nat n + of_real a) powr -z) sums (Gamma z * hurwitz_zeta a z)" using assms by (intro sums_mult sums_hurwitz_zeta) simp_all ultimately show "Gamma z * hurwitz_zeta a z = (\x\{0<..}. (of_real x powr (z - 1) * of_real (exp (-a * x) / (1 - exp (-x)))) \lebesgue)" by (rule sums_unique2 [symmetric]) qed corollary assumes "Re z > 1" shows Gamma_times_zeta_integral: "Gamma z * zeta z = (\x\{0<..}. (of_real x powr (z - 1) / of_real (exp x - 1)) \lebesgue)" (is ?th1) and Gamma_times_zeta_integrable: "set_integrable lebesgue {0<..} (\x. of_real x powr (z - 1) / of_real (exp x - 1))" (is ?th2) proof - have *: "(\x. indicator {0<..} x *\<^sub>R (of_real x powr (z - 1) * of_real (exp (-x) / (1 - exp (-x))))) = (\x. indicator {0<..} x *\<^sub>R (of_real x powr (z - 1) / of_real (exp x - 1)))" by (intro ext) (simp add: field_simps exp_minus indicator_def) from Gamma_times_hurwitz_zeta_integral [OF assms zero_less_one] and * show ?th1 by (simp add: zeta_def set_lebesgue_integral_def) from Gamma_times_hurwitz_zeta_integrable [OF assms zero_less_one] and * show ?th2 by (simp add: zeta_def set_integrable_def) qed corollary hurwitz_zeta_integral_Gamma_def: assumes "Re z > 1" "a > 0" shows "hurwitz_zeta a z = rGamma z * (\x\{0<..}. (of_real x powr (z - 1) * of_real (exp (-a * x) / (1 - exp (-x)))) \lebesgue)" proof - from assms have "Gamma z \ 0" by (subst Gamma_eq_zero_iff) (auto elim!: nonpos_Ints_cases) with Gamma_times_hurwitz_zeta_integral [OF assms] show ?thesis by (simp add: rGamma_inverse_Gamma field_simps) qed corollary zeta_integral_Gamma_def: assumes "Re z > 1" shows "zeta z = rGamma z * (\x\{0<..}. (of_real x powr (z - 1) / of_real (exp x - 1)) \lebesgue)" proof - from assms have "Gamma z \ 0" by (subst Gamma_eq_zero_iff) (auto elim!: nonpos_Ints_cases) with Gamma_times_zeta_integral [OF assms] show ?thesis by (simp add: rGamma_inverse_Gamma field_simps) qed +lemma Gamma_times_zeta_has_integral: + assumes "Re z > 1" + shows "((\x. x powr (z - 1) / (of_real (exp x) - 1)) has_integral (Gamma z * zeta z)) {0<..}" + (is "(?f has_integral _) _") +proof - + have "(?f has_integral set_lebesgue_integral lebesgue {0<..} ?f) {0<..}" + using Gamma_times_zeta_integrable[OF assms] + by (intro has_integral_set_lebesgue) auto + also have "set_lebesgue_integral lebesgue {0<..} ?f = Gamma z * zeta z" + using Gamma_times_zeta_integral[OF assms] by simp + finally show ?thesis . +qed + +lemma Gamma_times_zeta_has_integral_real: + fixes z :: real + assumes "z > 1" + shows "((\x. x powr (z - 1) / (exp x - 1)) has_integral (Gamma z * Re (zeta z))) {0<..}" +proof - + from assms have *: "Re (of_real z) > 1" by simp + have "((\x. Re (complex_of_real x powr (complex_of_real z - 1)) / (exp x - 1)) has_integral + Gamma z * Re (zeta (complex_of_real z))) {0<..}" + using has_integral_linear[OF Gamma_times_zeta_has_integral[OF *] bounded_linear_Re] + by (simp add: o_def Gamma_complex_of_real) + also have "?this \ ?thesis" + using assms by (intro has_integral_cong) (auto simp: powr_Reals_eq) + finally show ?thesis . +qed + +lemma Gamma_integral_real': + assumes x: "x > (0 :: real)" + shows "((\t. t powr (x - 1) / exp t) has_integral Gamma x) {0<..}" + using Gamma_integral_real[OF assms] by (subst has_integral_closure [symmetric]) auto + subsection \An analytic proof of the infinitude of primes\ text \ We can now also do an analytic proof of the infinitude of primes. \ lemma primes_infinite_analytic: "infinite {p :: nat. prime p}" proof \ \Suppose the set of primes were finite.\ define P :: "nat set" where "P = {p. prime p}" assume fin: "finite P" \ \Then the Euler product form of the $\zeta$ function ranges over a finite set, and since each factor is holomorphic in the positive real half-space, the product is, too.\ define zeta' :: "complex \ complex" where "zeta' = (\s. (\p\P. inverse (1 - 1 / of_nat p powr s)))" have holo: "zeta' holomorphic_on A" if "A \ {s. Re s > 0}" for A proof - { fix p :: nat and s :: complex assume p: "p \ P" and s: "s \ A" from p have p': "real p > 1" by (subst of_nat_1 [symmetric], subst of_nat_less_iff) (simp add: prime_gt_Suc_0_nat P_def) have "norm (of_nat p powr s) = real p powr Re s" by (simp add: norm_powr_real_powr) also have "\ > real p powr 0" using p p' s that by (subst powr_less_cancel_iff) (auto simp: prime_gt_1_nat) finally have "of_nat p powr s \ 1" using p by (auto simp: P_def) } thus ?thesis by (auto simp: zeta'_def P_def intro!: holomorphic_intros) qed \ \Since the Euler product expansion of $\zeta(s)$ is valid for all $s$ with real value at least 1, and both $\zeta(s)$ and the Euler product must be equal in the positive real half-space punctured at 1 by analytic continuation.\ have eq: "zeta s = zeta' s" if "Re s > 0" "s \ 1" for s proof (rule analytic_continuation_open[of "{s. Re s > 1}" "{s. Re s > 0} - {1}" zeta zeta']) fix s assume s: "s \ {s. Re s > 1}" let ?f = "(\n. \p\n. if prime p then inverse (1 - 1 / of_nat p powr s) else 1)" have "eventually (\n. ?f n = zeta' s) sequentially" using eventually_ge_at_top[of "Max P"] proof eventually_elim case (elim n) have "P \ {}" by (auto simp: P_def intro!: exI[of _ 2]) with elim have "P \ {..n}" using fin by auto thus ?case unfolding zeta'_def by (intro prod.mono_neutral_cong_right) (auto simp: P_def) qed moreover from s have "?f \ zeta s" by (intro euler_product_zeta) auto ultimately have "(\_. zeta' s) \ zeta s" by (blast intro: Lim_transform_eventually) thus "zeta s = zeta' s" by (simp add: LIMSEQ_const_iff) qed (auto intro!: exI[of _ 2] open_halfspace_Re_gt connected_open_delete convex_halfspace_Re_gt holomorphic_intros holo that intro: convex_connected) \ \However, since the Euler product is holomorphic on the entire positive real half-space, it cannot have a pole at 1, while $\zeta(s)$ does have a pole at 1. Since they are equal in the punctured neighbourhood of 1, this is a contradiction.\ have ev: "eventually (\s. s \ {s. Re s > 0} - {1}) (at 1)" by (auto simp: eventually_at_filter intro!: open_halfspace_Re_gt eventually_mono[OF eventually_nhds_in_open[of "{s. Re s > 0}"]]) have "\is_pole zeta' 1" by (rule not_is_pole_holomorphic [of "{s. Re s > 0}"]) (auto intro!: holo open_halfspace_Re_gt) also have "is_pole zeta' 1 \ is_pole zeta 1" unfolding is_pole_def by (intro filterlim_cong refl eventually_mono [OF ev] eq [symmetric]) auto finally show False using is_pole_zeta by contradiction qed subsection \The periodic zeta function\ text \ The periodic zeta function $F(s, q)$ (as described e.\,g.\ by Apostol~\cite{apostol1976analytic} is related to the Hurwitz zeta function. It is periodic in \q\ with period 1 and it can be represented by a Dirichlet series that is absolutely convergent for $\mathfrak{R}(s) > 1$. If \q \ \\, it furthermore convergent for $\mathfrak{R}(s) > 0$. It is clear that for integer \q\, we have $F(s, q) = F(s, 0) = \zeta(s)$. Moreover, for non-integer \q\, $F(s, q)$ can be analytically continued to an entire function. \ definition fds_perzeta :: "real \ complex fds" where "fds_perzeta q = fds (\m. exp (2 * pi * \ * m * q))" text \ The definition of the periodic zeta function on the full domain is a bit unwieldy. The precise reasoning for this definition will be given later, and, in any case, it is probably more instructive to look at the derived ``alternative'' definitions later. \ definition perzeta :: "real \ complex \ complex" where "perzeta q' s = (if q' \ \ then zeta s else let q = frac q' in if s = 0 then \ / (2 * pi) * (pre_zeta q 1 - pre_zeta (1 - q) 1 + ln (1 - q) - ln q + pi * \) else if s \ \ then eval_fds (fds_perzeta q) s else complex_of_real (2 * pi) powr (s - 1) * \ * Gamma (1 - s) * (\ powr (-s) * hurwitz_zeta q (1 - s) - \ powr s * hurwitz_zeta (1 - q) (1 - s)))" interpretation fds_perzeta: periodic_fun_simple' fds_perzeta by standard (simp_all add: fds_perzeta_def exp_add ring_distribs exp_eq_polar cis_mult [symmetric] cis_multiple_2pi) interpretation perzeta: periodic_fun_simple' perzeta proof - have [simp]: "n + 1 \ \ \ n \ \" for n :: real by (simp flip: frac_eq_0_iff add: frac.plus_1) show "periodic_fun_simple' perzeta" by standard (auto simp: fun_eq_iff perzeta_def Let_def frac.plus_1) qed lemma perzeta_frac [simp]: "perzeta (frac q) = perzeta q" by (auto simp: perzeta_def fun_eq_iff Let_def) lemma fds_perzeta_frac [simp]: "fds_perzeta (frac q) = fds_perzeta q" using fds_perzeta.plus_of_int[of "frac q" "\q\"] by (simp add: frac_def) lemma abs_conv_abscissa_perzeta: "abs_conv_abscissa (fds_perzeta q) \ 1" proof (rule abs_conv_abscissa_leI) fix c assume c: "ereal c > 1" hence "summable (\n. n powr -c)" by (simp add: summable_real_powr_iff) also have "?this \ fds_abs_converges (fds_perzeta q) (of_real c)" unfolding fds_abs_converges_def by (intro summable_cong eventually_mono[OF eventually_gt_at_top[of 0]]) (auto simp: norm_divide norm_powr_real_powr fds_perzeta_def powr_minus field_simps) finally show "\s. s \ 1 = c \ fds_abs_converges (fds_perzeta q) s" by (intro exI[of _ "of_real c"]) auto qed lemma conv_abscissa_perzeta: "conv_abscissa (fds_perzeta q) \ 1" by (rule order.trans[OF conv_le_abs_conv_abscissa abs_conv_abscissa_perzeta]) -lemma fds_perzeta_0 [simp]: "fds_perzeta 0 = fds_zeta" +lemma fds_perzeta__left_0 [simp]: "fds_perzeta 0 = fds_zeta" by (simp add: fds_perzeta_def fds_zeta_def) -lemma perzeta_0 [simp]: "Re s > 1 \ perzeta 0 s = zeta s" +lemma perzeta_0_left [simp]: "perzeta 0 s = zeta s" by (simp add: perzeta_def eval_fds_zeta) lemma perzeta_int: "q \ \ \ perzeta q = zeta" by (simp add: perzeta_def fun_eq_iff) lemma fds_perzeta_int: "q \ \ \ fds_perzeta q = fds_zeta" by (auto simp: fds_perzeta.of_int elim!: Ints_cases) lemma sums_fds_perzeta: assumes "Re s > 1" shows "(\m. exp (2 * pi * \ * Suc m * q) / of_nat (Suc m) powr s) sums eval_fds (fds_perzeta q) s" proof - have "conv_abscissa (fds_perzeta q) \ 1" by (rule conv_abscissa_perzeta) also have "\ < ereal (Re s)" using assms by (simp add: one_ereal_def) finally have "fds_converges (fds_perzeta q) s" by (intro fds_converges) auto hence "(\n. fds_nth (fds_perzeta q) (Suc n) / nat_power (Suc n) s) sums eval_fds (fds_perzeta q) s" by (subst sums_Suc_iff) (auto simp: fds_converges_iff) thus ?thesis by (simp add: fds_perzeta_def) qed lemma sum_tendsto_fds_perzeta: assumes "Re s > 1" shows "(\n. \k\{0<..n}. exp (2 * real k * pi * q * \) * of_nat k powr - s) \ eval_fds (fds_perzeta q) s" proof - have "(\m. exp (2 * pi * \ * Suc m * q) / of_nat (Suc m) powr s) sums eval_fds (fds_perzeta q) s" by (intro sums_fds_perzeta assms) hence "(\n. \k) * of_nat (Suc k) powr -s) \ eval_fds (fds_perzeta q) s" (is "filterlim ?f _ _") by (simp add: sums_def powr_minus field_simps) also have "?f = (\n. \k\{0<..n}. exp (2 * real k * pi * q * \) * of_nat k powr -s)" by (intro ext sum.reindex_bij_betw sum.reindex_bij_witness[of _ "\n. n - 1" Suc]) auto finally show ?thesis by simp qed text \ Using the geometric series, it is easy to see that the Dirichlet series for $F(s, q)$ has bounded partial sums for non-integer \q\, so it must converge for any \s\ with $\mathfrak{R}(s) > 0$. \ lemma conv_abscissa_perzeta': assumes "q \ \" shows "conv_abscissa (fds_perzeta q) \ 0" proof (rule conv_abscissa_leI) fix c :: real assume c: "ereal c > 0" have "fds_converges (fds_perzeta q) (of_real c)" proof (rule bounded_partial_sums_imp_fps_converges) define \ where "\ = exp (2 * pi * \ * q)" have [simp]: "norm \ = 1" by (simp add: \_def) define M where "M = 2 / norm (1 - \)" from \q \ \\ have "\ \ 1" by (auto simp: \_def exp_eq_1) hence "M > 0" by (simp add: M_def) show "Bseq (\n. \k\n. fds_nth (fds_perzeta q) k / nat_power k 0)" unfolding Bseq_def proof (rule exI, safe) fix n :: nat show "norm (\k\n. fds_nth (fds_perzeta q) k / nat_power k 0) \ M" proof (cases "n = 0") case False have "(\k\n. fds_nth (fds_perzeta q) k / nat_power k 0) = (\k\{1..1 + (n - 1)}. \ ^ k)" using False by (intro sum.mono_neutral_cong_right) (auto simp: fds_perzeta_def fds_nth_fds exp_of_nat_mult [symmetric] mult_ac \_def) also have "\ = \ * (1 - \ ^ n) / (1 - \)" using \\ \ 1\ and False by (subst sum_gp_offset) simp also have "norm \ \ 1 * (norm (1::complex) + norm (\ ^ n)) / norm (1 - \)" unfolding norm_mult norm_divide by (intro mult_mono divide_right_mono norm_triangle_ineq4) auto also have "\ = M" by (simp add: M_def norm_power) finally show ?thesis . qed (use \M > 0\ in simp_all) qed fact+ qed (insert c, auto) thus "\s. s \ 1 = c \ fds_converges (fds_perzeta q) s" by (intro exI[of _ "of_real c"]) auto qed +lemma fds_perzeta_one_half: "fds_perzeta (1 / 2) = fds (\n. (-1) ^ n)" + using Complex.DeMoivre[of pi] + by (intro fds_eqI) (auto simp: fds_perzeta_def exp_eq_polar mult_ac) + +lemma perzeta_one_half_1 [simp]: "perzeta (1 / 2) 1 = -ln 2" +proof (rule sums_unique2) + have *: "(1 / 2 :: real) \ \" + using fraction_not_in_ints[of 2 1] by auto + have "fds_converges (fds_perzeta (1 / 2)) 1" + by (rule fds_converges, rule le_less_trans, rule conv_abscissa_perzeta') (use * in auto) + hence "(\n. (-1) ^ Suc n / Suc n) sums eval_fds (fds_perzeta (1 / 2)) 1" + unfolding fds_converges_altdef by (simp add: fds_perzeta_one_half) + also from * have "eval_fds (fds_perzeta (1 / 2)) 1 = perzeta (1 / 2) 1" + by (simp add: perzeta_def) + finally show "(\n. -complex_of_real ((-1) ^ n / Suc n)) sums perzeta (1 / 2) 1" + by simp + hence "(\n. -complex_of_real ((-1) ^ n / Suc n)) sums -of_real (ln 2)" + by (intro sums_minus sums_of_real alternating_harmonic_series_sums) + thus "(\n. -complex_of_real ((-1) ^ n / Suc n)) sums -(ln 2)" + by (simp flip: Ln_of_real) +qed + subsection \Hurwitz's formula\ text \ We now move on to prove Hurwitz's formula relating the Hurwitz zeta function and the periodic zeta function. We mostly follow Apostol's proof, although we do make some small changes in order to make the proof more amenable to Isabelle's complex analysis library. The big difference is that Apostol integrates along a circle with a slit, where the two sides of the slit lie on different branches of the integrand. This makes sense when looking as the integrand as a Riemann surface, but we do not have a notion of Riemann surfaces in Isabelle. It is therefore much easier to simply cut the circle into an upper and a lower half. In fact, the integral on the lower half can be reduced to the one on the upper half easily by symmetry, so we really only need to handle the integral on the upper half. The integration contour that we will use is therefore a semi-annulus in the upper half of the complex plane, centred around the origin. Now, first of all, we prove the existence of an important improper integral that we will need later. \ (* TODO: Move *) lemma set_integrable_bigo: fixes f g :: "real \ 'a :: {banach, real_normed_field, second_countable_topology}" assumes "f \ O(\x. g x)" and "set_integrable lborel {a..} g" assumes "\b. b \ a \ set_integrable lborel {a.. 0" "\x. x \ x0 \ norm (f x) \ C * norm (g x)" by (fastforce elim!: landau_o.bigE simp: eventually_at_top_linorder) define x0' where "x0' = max a x0" have "set_integrable lborel {a..x. C *\<^sub>R (indicator {x0'..} x *\<^sub>R g x))" unfolding set_integrable_def by (intro integrable_scaleR_right) (simp add: abs_mult norm_mult) next from assms(4) have "set_borel_measurable borel {x0'..} f" by (rule set_borel_measurable_subset) (auto simp: x0'_def) thus "(\x. indicator {x0'..} x *\<^sub>R f x) \ borel_measurable lborel" by (simp add: set_borel_measurable_def) next show "AE x in lborel. norm (indicator {x0'..} x *\<^sub>R f x) \ norm (C *\<^sub>R (indicator {x0'..} x *\<^sub>R g x))" using C by (intro AE_I2) (auto simp: abs_mult indicator_def x0'_def) qed ultimately have "set_integrable lborel ({a.. {x0'..}) f" by (rule set_integrable_Un) auto also have "{a.. {x0'..} = {a..}" by (auto simp: x0'_def) finally show ?thesis . qed lemma set_integrable_Gamma_hurwitz_aux2_real: fixes s a :: real assumes "r > 0" and "a > 0" shows "set_integrable lborel {r..} (\x. x powr s * (exp (-a * x)) / (1 - exp (-x)))" (is "set_integrable _ _ ?g") proof (rule set_integrable_bigo) have "(\x. exp (-(a/2) * x)) integrable_on {r..}" using assms by (intro integrable_on_exp_minus_to_infinity) auto hence "set_integrable lebesgue {r..} (\x. exp (-(a/2) * x))" by (intro nonnegative_absolutely_integrable) simp_all thus "set_integrable lborel {r..} (\x. exp (-(a/2) * x))" by (simp add: set_integrable_def integrable_completion) next fix y :: real have "set_integrable lborel {r..y} ?g" using assms by (intro borel_integrable_atLeastAtMost') (auto intro!: continuous_intros) thus "set_integrable lborel {r.. O(\x. exp (-(a/2) * x))" by real_asymp qed (auto simp: set_borel_measurable_def) lemma set_integrable_Gamma_hurwitz_aux2: fixes s :: complex and a :: real assumes "r > 0" and "a > 0" shows "set_integrable lborel {r..} (\x. x powr -s * (exp (- a * x)) / (1 - exp (- x)))" (is "set_integrable _ _ ?g") proof - have "set_integrable lborel {r..} (\x. x powr -Re s * (exp (-a * x)) / (1 - exp (-x)))" (is "set_integrable _ _ ?g'") by (rule set_integrable_Gamma_hurwitz_aux2_real) (use assms in auto) also have "?this \ integrable lborel (\x. indicator {r..} x *\<^sub>R ?g' x)" by (simp add: set_integrable_def) also have "(\x. indicator {r..} x *\<^sub>R ?g' x) = (\x. norm (indicator {r..} x *\<^sub>R ?g x))" using assms by (auto simp: indicator_def norm_mult norm_divide norm_powr_real_powr fun_eq_iff exp_of_real exp_minus norm_inverse in_Reals_norm power2_eq_square divide_simps) finally show ?thesis unfolding set_integrable_def by (subst (asm) integrable_norm_iff) auto qed lemma closed_neg_Im_slit: "closed {z. Re z = 0 \ Im z \ 0}" proof - have "closed ({z. Re z = 0} \ {z. Im z \ 0})" by (intro closed_Int closed_halfspace_Re_eq closed_halfspace_Im_le) also have "{z. Re z = 0} \ {z. Im z \ 0} = {z. Re z = 0 \ Im z \ 0}" by blast finally show ?thesis . qed text \ We define tour semi-annulus path. When this path is mirrored into the lower half of the complex plane and subtracted from the original path and the outer radius tends to \\\, this becomes a Hankel contour extending to \-\\. \ definition hankel_semiannulus :: "real \ nat \ real \ complex" where "hankel_semiannulus r N = (let R = (2 * N + 1) * pi in part_circlepath 0 R 0 pi +++ \\Big half circle\ linepath (of_real (-R)) (of_real (-r)) +++ \\Line on the negative real axis\ part_circlepath 0 r pi 0 +++ \\Small half circle\ linepath (of_real r) (of_real R)) \\Line on the positive real axis\" lemma path_hankel_semiannulus [simp, intro]: "path (hankel_semiannulus r R)" and valid_path_hankel_semiannulus [simp, intro]: "valid_path (hankel_semiannulus r R)" and pathfinish_hankel_semiannulus [simp, intro]: "pathfinish (hankel_semiannulus r R) = pathstart (hankel_semiannulus r R)" by (simp_all add: hankel_semiannulus_def Let_def) text \ We set the stage for an application of the Residue Theorem. We define a function \[f(s, z) = z^{-s} \frac{\exp(az)}{1-\exp(-z)}\ ,\] which will be the integrand. However, the principal branch of $z^{-s}$ has a branch cut along the non-positive real axis, which is bad because a part of our integration path also lies on the non-positive real axis. We therefore choose a slightly different branch of $z^{-s}$ by moving the logarithm branch along by $90^{\circ}$ so that the branch cut lies on the non-positive imaginary axis instead. \ context fixes a :: real fixes f :: "complex \ complex \ complex" and g :: "complex \ real \ complex" and h :: "real \ complex \ real \ complex" and Res :: "complex \ nat \ complex" and Ln' :: "complex \ complex" and F :: "real \ complex \ complex" assumes a: "a \ {0<..1}" \\Our custom branch of the logarithm\ defines "Ln' \ (\z. ln (-\ * z) + \ * pi / 2)" \\The integrand\ defines "f \ (\s z. exp (Ln' z * (-s) + of_real a * z) / (1 - exp z))" \\The integrand on the negative real axis\ defines "g \ (\s x. complex_of_real x powr -s * of_real (exp (-a*x)) / of_real (1 - exp (-x)))" \\The integrand on the circular arcs\ defines "h \ (\r s t. r * \ * cis t * exp (a * (r * cis t) - (ln r + \ * t) * s) / (1 - exp (r * cis t)))" \\The interesting part of the residues\ defines "Res \ (\s k. exp (of_real (2 * real k * pi * a) * \) * of_real (2 * real k * pi) powr (-s))" \\The periodic zeta function (at least on $\mathfrak{R}(s) > 1$ half-plane)\ defines "F \ (\q. eval_fds (fds_perzeta q))" begin text \ First, some basic properties of our custom branch of the logarithm: \ lemma Ln'_i: "Ln' \ = \ * pi / 2" by (simp add: Ln'_def) lemma Ln'_of_real_pos: assumes "x > 0" shows "Ln' (of_real x) = of_real (ln x)" proof - have "Ln' (of_real x) = Ln (of_real x * (-\)) + \ * pi / 2" by (simp add: Ln'_def mult_ac) also have "\ = of_real (ln x)" using assms by (subst Ln_times_of_real) (auto simp: Ln_of_real) finally show ?thesis . qed lemma Ln'_of_real_neg: assumes "x < 0" shows "Ln' (of_real x) = of_real (ln (-x)) + \ * pi" proof - have "Ln' (of_real x) = Ln (of_real (-x) * \) + \ * pi / 2" by (simp add: Ln'_def mult_ac) also have "\ = of_real (ln (-x)) + \ * pi" using assms by (subst Ln_times_of_real) (auto simp: Ln_Reals_eq) finally show ?thesis . qed lemma Ln'_times_of_real: "Ln' (of_real x * z) = of_real (ln x) + Ln' z" if "x > 0" "z \ 0" for z x proof - have "Ln' (of_real x * z) = Ln (of_real x * (- \ * z)) + \ * pi / 2" by (simp add: Ln'_def mult_ac) also have "\ = of_real (ln x) + Ln' z" using that by (subst Ln_times_of_real) (auto simp: Ln'_def Ln_of_real) finally show ?thesis . qed lemma Ln'_cis: assumes "t \ {-pi / 2<..3 / 2 * pi}" shows "Ln' (cis t) = \ * t" proof - have "exp (\ * pi / 2) = \" by (simp add: exp_eq_polar) hence "Ln (- (\ * cis t)) = \ * (t - pi / 2)" using assms by (intro Ln_unique) (auto simp: algebra_simps exp_diff cis_conv_exp) thus ?thesis by (simp add: Ln'_def algebra_simps) qed text \ Next, we show that the line and circle integrals are holomorphic using Leibniz's rule: \ lemma contour_integral_part_circlepath_h: assumes r: "r > 0" shows "contour_integral (part_circlepath 0 r 0 pi) (f s) = integral {0..pi} (h r s)" proof - have "contour_integral (part_circlepath 0 r 0 pi) (f s) = integral {0..pi} (\t. f s (r * cis t) * r * \ * cis t)" by (simp add: contour_integral_part_circlepath_eq) also have "integral {0..pi} (\t. f s (r * cis t) * r * \ * cis t) = integral {0..pi} (h r s)" proof (intro integral_cong) fix t assume t: "t \ {0..pi}" have "-(pi / 2) < 0" by simp also have "0 \ t" using t by simp finally have "t \ {-(pi/2)<..3/2*pi}" using t by auto thus "f s (r * cis t) * r * \ * cis t = h r s t" using r by (simp add: f_def Ln'_times_of_real Ln'_cis h_def Ln_Reals_eq) qed finally show ?thesis . qed lemma integral_g_holomorphic: assumes "b > 0" shows "(\s. integral {b..c} (g s)) holomorphic_on A" proof - define g' where "g' = (\s t. - (of_real t powr (-s)) * complex_of_real (ln t) * of_real (exp (- (a * t))) / of_real (1 - exp (- t)))" have "(\s. integral (cbox b c) (g s)) holomorphic_on UNIV" proof (rule leibniz_rule_holomorphic) fix s :: complex and t :: real assume "t \ cbox b c" thus "((\s. g s t) has_field_derivative g' s t) (at s)" using assms by (auto simp: g_def g'_def powr_def Ln_Reals_eq intro!: derivative_eq_intros) next fix s show "g s integrable_on cbox b c" for s unfolding g_def using assms by (intro integrable_continuous continuous_intros) auto next show "continuous_on (UNIV \ cbox b c) (\(s, t). g' s t)" using assms by (auto simp: g'_def case_prod_unfold intro!: continuous_intros) qed auto thus ?thesis by auto qed lemma integral_h_holomorphic: assumes r: "r \ {0<..<2}" shows "(\s. integral {b..c} (h r s)) holomorphic_on A" proof - have no_sing: "exp (r * cis t) \ 1" for t proof define z where "z = r * cis t" assume "exp z = 1" then obtain n where "norm z = 2 * pi * of_int \n\" by (auto simp: exp_eq_1 cmod_def abs_mult) moreover have "norm z = r" using r by (simp add: z_def norm_mult) ultimately have r_eq: "r = 2 * pi * of_int \n\" by simp with r have "n \ 0" by auto moreover from r have "r < 2 * pi" using pi_gt3 by simp with r_eq have "\n\ < 1" by simp ultimately show False by simp qed define h' where "h' = (\s t. exp (a * r * cis t - (ln r + \ * t) * s) * (-ln r - \ * t) * (r * \ * cis t) / (1 - exp (r * cis t)))" have "(\s. integral (cbox b c) (h r s)) holomorphic_on UNIV" proof (rule leibniz_rule_holomorphic) fix s t assume "t \ cbox b c" thus "((\s. h r s t) has_field_derivative h' s t) (at s)" using no_sing r by (auto intro!: derivative_eq_intros simp: h_def h'_def mult_ac Ln_Reals_eq) next fix s show "h r s integrable_on cbox b c" using no_sing unfolding h_def by (auto intro!: integrable_continuous_real continuous_intros) next show "continuous_on (UNIV \ cbox b c) (\(s, t). h' s t)" using no_sing by (auto simp: h'_def case_prod_unfold intro!: continuous_intros) qed auto thus ?thesis by auto qed text \ We now move on to the core result, which uses the Residue Theorem to relate a contour integral along a semi-annulus to a partial sum of the periodic zeta function. \ lemma hurwitz_formula_integral_semiannulus: fixes N :: nat and r :: real and s :: complex defines "R \ real (2 * N + 1) * pi" assumes "r > 0" and "r < 2" shows "exp (-\ * pi * s) * integral {r..R} (\x. x powr (-s) * exp (-a * x) / (1 - exp (-x))) + integral {r..R} (\x. x powr (-s) * exp (a * x) / (1 - exp x)) + contour_integral (part_circlepath 0 R 0 pi) (f s) + contour_integral (part_circlepath 0 r pi 0) (f s) = -2 * pi * \ * exp (- s * of_real pi * \ / 2) * (\k\{0<..N}. Res s k)" (is ?thesis1) and "f s contour_integrable_on hankel_semiannulus r N" proof - have "2 < 1 * pi" using pi_gt3 by simp also have "\ \ R" unfolding R_def by (intro mult_right_mono) auto finally have "R > 2" by (auto simp: R_def) note r_R = \r > 0\ \r < 2\ this \\We integrate along the edge of a semi-annulus in the upper half of the complex plane. It consists of a big semicircle, a small semicircle, and two lines connecting the two circles, one on the positive real axis and one on the negative real axis. The integral along the big circle will vanish as the radius of the circle tends to \\\, whereas the remaining path becomes a Hankel contour, and the integral along that Hankel contour is what we are interested in, since it is connected to the Hurwitz zeta function.\ define big_circle where "big_circle = part_circlepath 0 R 0 pi" define small_circle where "small_circle = part_circlepath 0 r pi 0" define neg_line where "neg_line = linepath (complex_of_real (-R)) (complex_of_real (-r))" define pos_line where "pos_line = linepath (complex_of_real r) (complex_of_real R)" define \ where "\ = hankel_semiannulus r N" have \_altdef: "\ = big_circle +++ neg_line +++ small_circle +++ pos_line" by (simp add: \_def R_def add_ac hankel_semiannulus_def big_circle_def neg_line_def small_circle_def pos_line_def) have [simp]: "path \" "valid_path \" "pathfinish \ = pathstart \" by (simp_all add: \_def) \\The integrand has a branch cut along the non-positive imaginary axis and additional simple poles at $2n\pi i$ for any \n \ \\<^sub>>\<^sub>0\. The radius of the smaller circle will always be less than $2\pi$ and the radius of the bigger circle of the form $(2N+1)\pi$, so we always have precisely the first $N$ poles inside our path.\ define sngs where "sngs = (\n. of_real (2 * pi * real n) * \) ` {0<..}" define sngs' where "sngs' = (\n. of_real (2 * pi * real n) * \) ` {0<..N}" have sngs_subset: "sngs' \ sngs" unfolding sngs_def sngs'_def by (intro image_mono) auto have closed_sngs [intro]: "closed (sngs - sngs')" unfolding sngs_def proof (rule discrete_imp_closed[of "2 * pi"]; safe?) fix m n :: nat assume "dist (of_real (2 * pi * real m) * \) (of_real (2 * pi * real n) * \) < 2 * pi" also have "dist (of_real (2 * pi * real m) * \) (of_real (2 * pi * real n) * \) = norm (of_real (2 * pi * real m) * \ - of_real (2 * pi * real n) * \)" by (simp add: dist_norm) also have "of_real (2 * pi * real m) * \ - of_real (2 * pi * real n) * \ = of_real (2 * pi) * \ * of_int (int m - int n)" by (simp add: algebra_simps) also have "norm \ = 2 * pi * of_int \int m - int n\" unfolding norm_mult norm_of_int by (simp add: norm_mult) finally have "\real m - real n\ < 1" by simp hence "m = n" by linarith thus "of_real (2 * pi * real m) * \ = of_real (2 * pi * real n) * \" by simp qed auto \\We define an area within which the integrand is holomorphic. Choosing this area as big as possible makes things easier later on, so we only remove the branch cut and the poles.\ define S where "S = - {z. Re z = 0 \ Im z \ 0} - (sngs - sngs')" define S' where "S' = - {z. Re z = 0 \ Im z \ 0}" have sngs: "exp z = 1 \ z \ sngs" if "Re z \ 0 \ Im z > 0" for z proof assume "exp z = 1" then obtain n where n: "z = 2 * pi * of_int n * \" unfolding exp_eq_1 by (auto simp: complex_eq_iff mult_ac) moreover from n and pi_gt_zero and that have "n > 0" by (auto simp: zero_less_mult_iff) ultimately have "z = of_real (2 * pi * nat n) * \" and "nat n \ {0<..}" by auto thus "z \ sngs" unfolding sngs_def by blast qed (insert that, auto simp: sngs_def exp_eq_polar) \\We show that the path stays within the well-behaved area.\ have "path_image neg_line = of_real ` {-R..-r}" using r_R by (auto simp: neg_line_def closed_segment_Reals closed_segment_eq_real_ivl) hence "path_image neg_line \ S - sngs'" using r_R sngs_subset by (auto simp: S_def sngs_def complex_eq_iff) have "path_image pos_line = of_real ` {r..R}" using r_R by (auto simp: pos_line_def closed_segment_Reals closed_segment_eq_real_ivl) hence "path_image pos_line \ S - sngs'" using r_R sngs_subset by (auto simp: S_def sngs_def complex_eq_iff) have part_circlepath_in_S: "z \ S - sngs'" if "z \ path_image (part_circlepath 0 r' 0 pi) \ z \ path_image (part_circlepath 0 r' pi 0)" and "r' > 0" "r' \ (\n. 2 * pi * real n) ` {0<..}" for z r' proof - have z: "norm z = r' \ Im z \ 0" using that by (auto simp: path_image_def part_circlepath_def norm_mult Im_exp linepath_def intro!: mult_nonneg_nonneg sin_ge_zero) hence "Re z \ 0 \ Im z > 0" using that by (auto simp: cmod_def) moreover from z and that have "z \ sngs" by (auto simp: sngs_def norm_mult image_iff) ultimately show "z \ S - sngs'" using sngs_subset by (auto simp: S_def) qed { fix n :: nat assume n: "n > 0" have "r < 2 * pi * 1" using pi_gt3 r_R by simp also have "\ \ 2 * pi * real n" using n by (intro mult_left_mono) auto finally have "r < \" . } hence "r \ (\n. 2 * pi * real n) ` {0<..}" using r_R by auto from part_circlepath_in_S[OF _ _ this] r_R have "path_image small_circle \ S - sngs'" by (auto simp: small_circle_def) { fix n :: nat assume n: "n > 0" "2 * pi * real n = real (2 * N + 1) * pi" hence "real (2 * n) = real (2 * N + 1)" unfolding of_nat_mult by simp hence False unfolding of_nat_eq_iff by presburger } hence "R \ (\n. 2 * pi * real n) ` {0<..}" unfolding R_def by force from part_circlepath_in_S[OF _ _ this] r_R have "path_image big_circle \ S - sngs'" by (auto simp: big_circle_def) note path_images = \path_image small_circle \ S - sngs'\ \path_image big_circle \ S - sngs'\ \path_image neg_line \ S - sngs'\ \path_image pos_line \ S - sngs'\ have "path_image \ \ S - sngs'" using path_images by (auto simp: \_altdef path_image_join big_circle_def neg_line_def small_circle_def pos_line_def) \\We need to show that the complex plane is still connected after we removed the branch cut and the poles. We do this by showing that the complex plane with the branch cut removed is starlike and therefore connected. Then we remove the (countably many) poles, which does not break connectedness either.\ have "open S" using closed_neg_Im_slit by (auto simp: S_def) have "starlike (UNIV - {z. Re z = 0 \ Im z \ 0})" (is "starlike ?S'") unfolding starlike_def proof (rule bexI ballI)+ have "1 \ 1 * pi" using pi_gt3 by simp also have "\ < (2 + 2 * real N) * pi" by (intro mult_strict_right_mono) auto finally show *: "\ \ ?S'" by (auto simp: S_def) fix z assume z: "z \ ?S'" have "closed_segment \ z \ {z. Re z = 0 \ Im z \ 0} = {}" proof safe fix s assume s: "s \ closed_segment \ z" "Re s = 0" "Im s \ 0" then obtain t where t: "t \ {0..1}" "s = linepath \ z t" using linepath_image_01 by blast with z s t have z': "Re z = 0" "Im z > 0" by (auto simp: Re_linepath' S_def linepath_0') with s have "Im s \ closed_segment 1 (Im z) \ Im s \ 0" by (subst (asm) closed_segment_same_Re) auto with z' show "s \ {}" by (auto simp: closed_segment_eq_real_ivl split: if_splits) qed thus "closed_segment \ z \ ?S'" by (auto simp: S_def) qed hence "connected ?S'" by (rule starlike_imp_connected) hence "connected S'" by (simp add: Compl_eq_Diff_UNIV S'_def) have "connected S" unfolding S_def by (rule connected_open_diff_countable) (insert \connected S'\, auto simp: sngs_def closed_neg_Im_slit S'_def) \\The integrand is now clearly holomorphic on @{term "S - sngs'"} and we can apply the Residue Theorem.\ have holo: "f s holomorphic_on (S - sngs')" unfolding f_def Ln'_def S_def using sngs by (auto intro!: holomorphic_intros simp: complex_nonpos_Reals_iff) have "contour_integral \ (f s) = of_real (2 * pi) * \ * (\z\sngs'. winding_number \ z * residue (f s) z)" proof (rule Residue_theorem) show "\z. z \ S \ winding_number \ z = 0" proof safe fix z assume "z \ S" hence "Re z = 0 \ Im z \ 0 \ z \ sngs - sngs'" by (auto simp: S_def) thus "winding_number \ z = 0" proof define x where "x = -Im z" assume "Re z = 0 \ Im z \ 0" hence x: "z = -of_real x * \" "x \ 0" unfolding complex_eq_iff by (simp_all add: x_def) obtain B where "\z. norm z \ B \ winding_number \ z = 0" using winding_number_zero_at_infinity[of \] by auto hence "winding_number \ (-of_real (max B 0) * \) = 0" by (auto simp: norm_mult) also have "winding_number \ (-of_real (max B 0) * \) = winding_number \ z" proof (rule winding_number_eq) from x have "closed_segment (-of_real (max B 0) * \) z \ {z. Re z = 0 \ Im z \ 0}" by (auto simp: closed_segment_same_Re closed_segment_eq_real_ivl) with \path_image \ \ S - sngs'\ show "closed_segment (-of_real (max B 0) * \) z \ path_image \ = {}" by (auto simp: S_def) qed auto finally show "winding_number \ z = 0" . next assume z: "z \ sngs - sngs'" show "winding_number \ z = 0" proof (rule winding_number_zero_outside) have "path_image \ = path_image big_circle \ path_image neg_line \ path_image small_circle \ path_image pos_line" unfolding \_altdef small_circle_def big_circle_def pos_line_def neg_line_def by (simp add: path_image_join Un_assoc) also have "\ \ cball 0 ((2 * N + 1) * pi)" using r_R by (auto simp: small_circle_def big_circle_def pos_line_def neg_line_def path_image_join norm_mult R_def path_image_part_circlepath' in_Reals_norm closed_segment_Reals closed_segment_eq_real_ivl) finally show "path_image \ \ \" . qed (insert z, auto simp: sngs_def sngs'_def norm_mult) qed qed qed (insert \path_image \ \ S - sngs'\ \connected S\ \open S\ holo, auto simp: sngs'_def) \\We can use Wenda Li's framework to compute the winding numbers at the poles and show that they are all 1.\ also have "winding_number \ z = 1" if "z \ sngs'" for z proof - have "r < 2 * pi * 1" using pi_gt3 r_R by simp also have "\ \ 2 * pi * real n" if "n > 0" for n using that by (intro mult_left_mono) auto finally have norm_z: "norm z > r" "norm z < R" using that r_R by (auto simp: sngs'_def norm_mult R_def) have "cindex_pathE big_circle z = -1" using r_R that unfolding big_circle_def by (subst cindex_pathE_circlepath_upper(1)) (auto simp: sngs'_def norm_mult R_def) have "cindex_pathE small_circle z = -1" using r_R that norm_z unfolding small_circle_def by (subst cindex_pathE_reversepath', subst reversepath_part_circlepath, subst cindex_pathE_circlepath_upper(2)) (auto simp: sngs'_def norm_mult) have "cindex_pathE neg_line z = 0" "cindex_pathE pos_line z = 0" unfolding neg_line_def pos_line_def using r_R that by (subst cindex_pathE_linepath; force simp: neg_line_def cindex_pathE_linepath closed_segment_Reals closed_segment_eq_real_ivl sngs'_def complex_eq_iff)+ note indices = \cindex_pathE big_circle z = -1\ \cindex_pathE small_circle z = -1\ \cindex_pathE neg_line z = 0\ \cindex_pathE pos_line z = 0\ show ?thesis unfolding \_altdef big_circle_def small_circle_def pos_line_def neg_line_def by eval_winding (insert indices path_images that, auto simp: big_circle_def small_circle_def pos_line_def neg_line_def) qed hence "(\z\sngs'. winding_number \ z * residue (f s) z) = (\z\sngs'. residue (f s) z)" by simp also have "\ = (\k\{0<..N}. residue (f s) (2 * pi * of_nat k * \))" unfolding sngs'_def by (subst sum.reindex) (auto intro!: inj_onI simp: o_def) \\Next, we compute the residues at each pole.\ also have "residue (f s) (2 * pi * of_nat k * \) = -exp (- s * of_real pi * \ / 2) * Res s k" if "k \ {0<..N}" for k unfolding f_def proof (subst residue_simple_pole_deriv) show "open S'" using closed_neg_Im_slit by (auto simp: S'_def) show "connected S'" by fact show "(\z. exp (Ln' z * (-s) + of_real a * z)) holomorphic_on S'" "(\z. 1 - exp z) holomorphic_on S'" by (auto simp: S'_def Ln'_def complex_nonpos_Reals_iff intro!: holomorphic_intros) have "((\z. 1 - exp z) has_field_derivative -exp (2 * pi * k * \)) (at (of_real (2 * pi * real k) * \))" by (auto intro!: derivative_eq_intros) also have "-exp (2 * pi * k * \) = -1" by (simp add: exp_eq_polar) finally show "((\z. 1 - exp z) has_field_derivative -1) (at (of_real (2 * pi * real k) * \))" . have "Im (of_real (2 * pi * real k) * \) > 0" using pi_gt_zero that by auto thus "of_real (2 * pi * real k) * \ \ S'" by (simp add: S'_def) have "exp (\ * pi / 2) = \" by (simp add: exp_eq_polar) hence "exp (Ln' (complex_of_real (2 * pi * real k) * \) * -s + of_real a * (of_real (2 * pi * real k) * \)) / -1 = - exp (2 * k * a * pi * \ - s * pi * \ / 2 - s * ln (2 * k * pi))" (is "?R = _") using that by (subst Ln'_times_of_real) (simp_all add: Ln'_i algebra_simps exp_diff) also have "\ = -exp (- s * of_real pi * \ / 2) * Res s k" using that by (simp add: Res_def exp_diff powr_def exp_minus inverse_eq_divide Ln_Reals_eq mult_ac) finally show "?R = -exp (- s * of_real pi * \ / 2) * Res s k" . qed (insert that, auto simp: S'_def exp_eq_polar) hence "(\k\{0<..N}. residue (f s) (2 * pi * of_nat k * \)) = -exp (- s * of_real pi * \ / 2) * (\k\{0<..N}. Res s k)" by (simp add: sum_distrib_left) \\This gives us the final result:\ finally have "contour_integral \ (f s) = -2 * pi * \ * exp (- s * of_real pi * \ / 2) * (\k\{0<..N}. Res s k)" by simp \\Lastly, we decompose the contour integral into its four constituent integrals because this makes them somewhat nicer to work with later on.\ also show "f s contour_integrable_on \" proof (rule contour_integrable_holomorphic_simple) show "path_image \ \ S - sngs'" by fact have "closed sngs'" by (intro finite_imp_closed) (auto simp: sngs'_def) with \open S\ show "open (S - sngs')" by auto qed (insert holo, auto) hence eq: "contour_integral \ (f s) = contour_integral big_circle (f s) + contour_integral neg_line (f s) + contour_integral small_circle (f s) + contour_integral pos_line (f s)" unfolding \_altdef big_circle_def neg_line_def small_circle_def pos_line_def by simp also have "contour_integral neg_line (f s) = integral {-R..-r} (\x. f s (complex_of_real x))" unfolding neg_line_def using r_R by (subst contour_integral_linepath_Reals_eq) auto also have "\ = exp (- \ * pi * s) * integral {r..R} (\x. exp (-ln x * s) * exp (-a * x) / (1 - exp (-x)))" (is "_ = _ * ?I") unfolding integral_mult_right [symmetric] using r_R by (subst Henstock_Kurzweil_Integration.integral_reflect_real [symmetric], intro integral_cong) (auto simp: f_def exp_of_real Ln'_of_real_neg exp_minus exp_Reals_eq exp_diff exp_add field_simps) also have "?I = integral {r..R} (\x. x powr (-s) * exp (-a * x) / (1 - exp (-x)))" using r_R by (intro integral_cong) (auto simp: powr_def Ln_Reals_eq exp_minus exp_diff field_simps) also have "contour_integral pos_line (f s) = integral {r..R} (\x. f s (complex_of_real x))" unfolding pos_line_def using r_R by (subst contour_integral_linepath_Reals_eq) auto also have "\ = integral {r..R} (\x. x powr (-s) * exp (a * x) / (1 - exp x))" using r_R by (intro integral_cong) (simp add: f_def Ln'_of_real_pos exp_diff exp_minus exp_Reals_eq field_simps powr_def Ln_Reals_eq) finally show ?thesis1 by (simp only: add_ac big_circle_def small_circle_def) qed text \ Next, we need bounds on the integrands of the two semicircles. \ lemma hurwitz_formula_bound1: defines "H \ \z. exp (complex_of_real a * z) / (1 - exp z)" assumes "r > 0" obtains C where "C \ 0" and "\z. z \ (\n::int. ball (2 * n * pi * \) r) \ norm (H z) \ C" proof - define A where "A = cbox (-1 - pi * \) (1 + pi * \) - ball 0 r" { fix z assume "z \ A" have "exp z \ 1" proof assume "exp z = 1" then obtain n :: int where [simp]: "z = 2 * n * pi * \" by (subst (asm) exp_eq_1) (auto simp: complex_eq_iff) from \z \ A\ have "(2 * n) * pi \ (-1) * pi" and "(2 * n) * pi \ 1 * pi" by (auto simp: A_def in_cbox_complex_iff) hence "n = 0" by (subst (asm) (1 2) mult_le_cancel_right) auto with \z \ A\ and \r > 0\ show False by (simp add: A_def) qed } hence "continuous_on A H" by (auto simp: A_def H_def intro!: continuous_intros) moreover have "compact A" by (auto simp: A_def compact_eq_bounded_closed) ultimately have "compact (H ` A)" by (rule compact_continuous_image) hence "bounded (H ` A)" by (rule compact_imp_bounded) then obtain C where bound_inside: "\z. z \ A \ norm (H z) \ C" by (auto simp: bounded_iff) have bound_outside: "norm (H z) \ exp 1 / (exp 1 - 1)" if "\Re z\ > 1" for z proof - have "norm (H z) = exp (a * Re z) / norm (1 - exp z)" by (simp add: H_def norm_divide) also have "\1 - exp (Re z)\ \ norm (1 - exp z)" by (rule order.trans[OF _ norm_triangle_ineq3]) simp hence "exp (a * Re z) / norm (1 - exp z) \ exp (a * Re z) / \1 - exp (Re z)\" using that by (intro divide_left_mono mult_pos_pos) auto also have "\ \ exp 1 / (exp 1 - 1)" proof (cases "Re z > 1") case True hence "exp (a * Re z) / \1 - exp (Re z)\ = exp (a * Re z) / (exp (Re z) - 1)" by simp also have "\ \ exp (Re z) / (exp (Re z) - 1)" using a True by (intro divide_right_mono) auto also have "\ = 1 / (1 - exp (-Re z))" by (simp add: exp_minus field_simps) also have "\ \ 1 / (1 - exp (-1))" using True by (intro divide_left_mono diff_mono) auto also have "\ = exp 1 / (exp 1 - 1)" by (simp add: exp_minus field_simps) finally show ?thesis . next case False with that have "Re z < -1" by simp hence "exp (a * Re z) / \1 - exp (Re z)\ = exp (a * Re z) / (1 - exp (Re z))" by simp also have "\ \ 1 / (1 - exp (Re z))" using a and \Re z < -1\ by (intro divide_right_mono) (auto intro: mult_nonneg_nonpos) also have "\ \ 1 / (1 - exp (-1))" using \Re z < -1\ by (intro divide_left_mono) auto also have "\ = exp 1 / (exp 1 - 1)" by (simp add: exp_minus field_simps) finally show ?thesis . qed finally show ?thesis . qed define D where "D = max C (exp 1 / (exp 1 - 1))" have "D \ 0" by (simp add: D_def max.coboundedI2) have "norm (H z) \ D" if "z \ (\n::int. ball (2 * n * pi * \) r)" for z proof (cases "\Re z\ \ 1") case False with bound_outside[of z] show ?thesis by (simp add: D_def) next case True define n where "n = \Im z / (2 * pi) + 1 / 2\" have "Im (z - 2 * n * pi * \) = frac (Im z / (2 * pi) + 1 / 2) * (2 * pi) - pi" by (simp add: n_def frac_def algebra_simps) also have "\ \ {-pi..)) \ C" using True that by (intro bound_inside) (auto simp: A_def in_cbox_complex_iff dist_norm n_def) also have "exp (2 * pi * n * \) = 1" by (simp add: exp_eq_polar) hence "norm (H (z - 2 * n * pi * \)) = norm (H z)" by (simp add: H_def norm_divide exp_diff mult_ac) also have "C \ D" by (simp add: D_def) finally show ?thesis . qed from \D \ 0\ and this show ?thesis by (rule that) qed lemma hurwitz_formula_bound2: obtains C where "C \ 0" and "\r z. r > 0 \ r < pi \ z \ sphere 0 r \ norm (f s z) \ C * r powr (-Re s - 1)" proof - have "2 * pi > 0" by auto have nz: "1 - exp z \ 0" if "z \ ball 0 (2 * pi) - {0}" for z :: complex proof assume "1 - exp z = 0" then obtain n where "z = 2 * pi * of_int n * \" by (auto simp: exp_eq_1 complex_eq_iff[of z]) moreover have "\real_of_int n\ < 1 \ n = 0" by linarith ultimately show False using that by (auto simp: norm_mult) qed have ev: "eventually (\z::complex. 1 - exp z \ 0) (at 0)" using eventually_at_ball'[OF \2 * pi > 0\] by eventually_elim (use nz in auto) have [simp]: "subdegree (1 - fps_exp (1 :: complex)) = 1" by (intro subdegreeI) auto hence "(\z. exp (a * z) * (if z = 0 then -1 else z / (1 - exp z :: complex))) has_fps_expansion fps_exp a * (fps_X / (fps_const 1 - fps_exp 1))" by (auto intro!: fps_expansion_intros) hence "(\z::complex. exp (a * z) * (if z = 0 then -1 else z / (1 - exp z))) \ O[at 0](\z. 1)" using continuous_imp_bigo_1 has_fps_expansion_imp_continuous by blast also have "?this \ (\z::complex. exp (a * z) * (z / (1 - exp z))) \ O[at 0](\z. 1)" by (intro landau_o.big.in_cong eventually_mono[OF ev]) auto finally have "\g. g holomorphic_on ball 0 (2 * pi) \ (\z\ball 0 (2 * pi) - {0}. g z = exp (of_real a * z) * (z / (1 - exp z)))" using nz by (intro holomorphic_on_extend holomorphic_intros) auto then guess g by (elim exE conjE) note g = this hence "continuous_on (ball 0 (2 * pi)) g" by (auto dest: holomorphic_on_imp_continuous_on) hence "continuous_on (cball 0 pi) g" by (rule continuous_on_subset) (subst cball_subset_ball_iff, use pi_gt_zero in auto) hence "compact (g ` cball 0 pi)" by (intro compact_continuous_image) auto hence "bounded (g ` cball 0 pi)" by (auto simp: compact_imp_bounded) then obtain C where C: "\x\cball 0 pi. norm (g x) \ C" by (auto simp: bounded_iff) { fix r :: real assume r: "r > 0" "r < pi" fix z :: complex assume z: "z \ sphere 0 r" define x where "x = (if Arg z \ -pi / 2 then Arg z + 2 * pi else Arg z)" have "exp (\ * (2 * pi)) = 1" by (simp add: exp_eq_polar) with z have "z = r * exp (\ * x)" using r pi_gt_zero Arg_eq[of z] by (auto simp: x_def exp_add distrib_left) have "x > - pi / 2" "x \ 3 / 2 * pi" using Arg_le_pi[of z] mpi_less_Arg[of z] by (auto simp: x_def) note x = \z = r * exp (\ * x)\ this from x r have z': "z \ cball 0 pi - {0}" using pi_gt3 by (auto simp: norm_mult) also have "cball 0 pi \ ball (0::complex) (2 * pi)" by (subst cball_subset_ball_iff) (use pi_gt_zero in auto) hence "cball 0 pi - {0} \ ball 0 (2 * pi) - {0::complex}" by blast finally have z'': "z \ ball 0 (2 * pi) - {0}" . hence bound: "norm (exp (a * z) * (z / (1 - exp z))) \ C" using C and g and z' by force have "exp z \ 1" using nz z'' by auto with bound z'' have bound': "norm (exp (a * z) / (1 - exp z)) \ C / norm z" by (simp add: norm_divide field_simps norm_mult) have "Ln' z = of_real (ln r) + Ln' (exp (\ * of_real x))" using x r by (simp add: Ln'_times_of_real) also have "exp (\ * pi / 2) = \" by (simp add: exp_eq_polar) hence "Ln' (exp (\ * of_real x)) = Ln (exp (\ * of_real (x - pi / 2))) + \ * pi / 2" by (simp add: algebra_simps Ln'_def exp_diff) also have "\ = \ * x" using x pi_gt3 by (subst Ln_exp) (auto simp: algebra_simps) finally have "norm (exp (-Ln' z * s)) = exp (x * Im s - ln r * Re s)" by simp also { have "x * Im s \ \x * Im s\" by (rule abs_ge_self) also have "\ \ (3/2 * pi) * \Im s\" unfolding abs_mult using x by (intro mult_right_mono) auto finally have "exp (x * Im s - ln r * Re s) \ exp (3 / 2 * pi * \Im s\ - ln r * Re s)" by simp } finally have "norm (exp (-Ln' z * s) * (exp (a * z) / (1 - exp z))) \ exp (3 / 2 * pi * \Im s\ - ln r * Re s) * (C / norm z)" unfolding norm_mult[of "exp t" for t] by (intro mult_mono bound') simp_all also have "norm z = r" using \r > 0\ by (simp add: x norm_mult) also have "exp (3 / 2 * pi * \Im s\ - ln r * Re s) = exp (3 / 2 * pi * \Im s\) * r powr (-Re s)" using r by (simp add: exp_diff powr_def exp_minus inverse_eq_divide) finally have "norm (f s z) \ C * exp (3 / 2 * pi * \Im s\) * r powr (-Re s - 1)" using r by (simp add: f_def exp_diff exp_minus field_simps powr_diff) also have "\ \ max 0 (C * exp (3 / 2 * pi * \Im s\)) * r powr (-Re s - 1)" by (intro mult_right_mono max.coboundedI2) auto finally have "norm (f s z) \ \" . } with that[of "max 0 (C * exp (3 / 2 * pi * \Im s\))"] show ?thesis by auto qed text \ We can now relate the integral along a partial Hankel contour that is cut off at $-\pi$ to $\zeta(1 - s, a) / \Gamma(s)$. \ lemma rGamma_hurwitz_zeta_eq_contour_integral: fixes s :: complex and r :: real assumes "s \ 0" and r: "r \ {1..<2}" and a: "a > 0" defines "err1 \ (\s r. contour_integral (part_circlepath 0 r pi 0) (f s))" defines "err2 \ (\s r. cnj (contour_integral (part_circlepath 0 r pi 0) (f (cnj s))))" shows "2 * \ * pi * rGamma s * hurwitz_zeta a (1 - s) = err2 s r - err1 s r + 2 * \ * sin (pi * s) * (CLBINT x:{r..}. g s x)" (is "?f s = ?g s") proof (rule analytic_continuation_open[where f = ?f]) fix s :: complex assume s: "s \ {s. Re s < 0}" \\We first show that the integrals along the Hankel contour cut off at $-\pi$ all have the same value, no matter what the radius of the circle is (as long as it is small enough). We call this value \C\. This argument could be done by a homotopy argument, but it is easier to simply re-use the above result about the contour integral along the annulus where we fix the radius of the outer circle to $\pi$.\ define C where "C = -contour_integral (part_circlepath 0 pi 0 pi) (f s) + cnj (contour_integral (part_circlepath 0 pi 0 pi) (f (cnj s)))" have integrable: "set_integrable lborel A (g s)" if "A \ sets lborel" "A \ {0<..}" for A proof (rule set_integrable_subset) show "set_integrable lborel {0<..} (g s)" using Gamma_times_hurwitz_zeta_integrable[of "1 - s" a] s a by (simp add: g_def exp_of_real exp_minus integrable_completion set_integrable_def) qed (insert that, auto) { fix r' :: real assume r': "r' \ {0<..<2}" from hurwitz_formula_integral_semiannulus(2)[of r' s 0] and r' have "f s contour_integrable_on part_circlepath 0 r' pi 0" by (auto simp: hankel_semiannulus_def add_ac) } note integrable_circle = this { fix r' :: real assume r': "r' \ {0<..<2}" from hurwitz_formula_integral_semiannulus(2)[of r' "cnj s" 0] and r' have "f (cnj s) contour_integrable_on part_circlepath 0 r' pi 0" by (auto simp: hankel_semiannulus_def add_ac) } note integrable_circle' = this have eq: "-2 * \ * sin (pi * s) * (CLBINT x:{r..pi}. g s x) + (err1 s r - err2 s r) = C" if r: "r \ {0<..<2}" for r :: real proof - have eq1: "integral {r..pi} (\x. cnj (x powr - cnj s) * (exp (- (a * x))) / (1 - (exp (- x)))) = integral {r..pi} (g s)" using r by (intro integral_cong) (auto simp: cnj_powr g_def exp_of_real exp_minus) have eq2: "integral {r..pi} (\x. cnj (x powr - cnj s) * (exp (a * x)) / (1 - (exp x))) = integral {r..pi} (\x. x powr - s * (exp (a * x)) / (1 - (exp x)))" using r by (intro integral_cong) (auto simp: cnj_powr) from hurwitz_formula_integral_semiannulus(1)[of r s 0] hurwitz_formula_integral_semiannulus(1)[of r "cnj s" 0] have "exp (-\*pi * s) * integral {r..real (2*0+1) * pi} (g s) + integral {r..real (2*0+1) * pi} (\x. x powr -s * exp (a * x) / (1 - exp x)) + contour_integral (part_circlepath 0 (real (2 * 0 + 1) * pi) 0 pi) (f s) + contour_integral (part_circlepath 0 r pi 0) (f s) - cnj ( exp (-\*pi * cnj s) * integral {r..real (2*0+1) * pi} (\x. x powr - cnj s * exp (-a*x) / (1 - exp (-x))) + integral {r..real (2*0+1) * pi} (\x. x powr - cnj s * exp (a*x) / (1 - exp x)) + contour_integral (part_circlepath 0 (real (2 * 0 + 1) * pi) 0 pi) (f (cnj s)) + contour_integral (part_circlepath 0 r pi 0) (f (cnj s))) = 0" (is "?lhs = _") unfolding g_def using r by (subst (1 2) hurwitz_formula_integral_semiannulus) auto also have "?lhs = -2 * \ * sin (pi * s) * integral {r..pi} (g s) + err1 s r - err2 s r - C" using eq1 eq2 by (auto simp: integral_cnj exp_cnj err1_def err2_def sin_exp_eq algebra_simps C_def) also have "integral {r..pi} (g s) = (CLBINT x:{r..pi}. g s x)" using r by (intro set_borel_integral_eq_integral(2) [symmetric] integrable) auto finally show "-2 * \ * sin (pi * s) * (CLBINT x:{r..pi}. g s x) + (err1 s r - err2 s r) = C" by (simp add: algebra_simps) qed \\Next, compute the value of @{term C} by letting the radius tend to 0 so that the contribution of the circle vanishes.\ have "((\r. -2 * \ * sin (pi * s) * (CLBINT x:{r..pi}. g s x) + (err1 s r - err2 s r)) \ -2 * \ * sin (pi * s) * (CLBINT x:{0<..pi}. g s x) + 0) (at_right 0)" proof (intro tendsto_intros tendsto_set_lebesgue_integral_at_right integrable) from hurwitz_formula_bound2[of s] guess C1 . note C1 = this from hurwitz_formula_bound2[of "cnj s"] guess C2 . note C2 = this have ev: "eventually (\r::real. r \ {0<..<2}) (at_right 0)" by (intro eventually_at_right_real) auto show "((\r. err1 s r - err2 s r) \ 0) (at_right 0)" proof (rule Lim_null_comparison[OF eventually_mono[OF ev]]) fix r :: real assume r: "r \ {0<..<2}" have "norm (err1 s r - err2 s r) \ norm (err1 s r) + norm (err2 s r)" by (rule norm_triangle_ineq4) also have "norm (err1 s r) \ C1 * r powr (- Re s - 1) * r * \0 - pi\" unfolding err1_def using C1(1) C1(2)[of r] pi_gt3 integrable_circle[of r] path_image_part_circlepath_subset'[of r 0 pi 0] r by (intro contour_integral_bound_part_circlepath) auto also have "\ = C1 * r powr (-Re s) * pi" using r by (simp add: powr_diff field_simps) also have "norm (err2 s r) \ C2 * r powr (- Re s - 1) * r * \0 - pi\" unfolding err2_def complex_mod_cnj using C2(1) C2(2)[of r] r pi_gt3 integrable_circle'[of r] path_image_part_circlepath_subset'[of r 0 pi 0] by (intro contour_integral_bound_part_circlepath) auto also have "\ = C2 * r powr (-Re s) * pi" using r by (simp add: powr_diff field_simps) also have "C1 * r powr (-Re s) * pi + C2 * r powr (-Re s) * pi = (C1 + C2) * pi * r powr (-Re s)" by (simp add: algebra_simps) finally show "norm (err1 s r - err2 s r) \ (C1 + C2) * pi * r powr - Re s" by simp next show "((\x. (C1 + C2) * pi * x powr - Re s) \ 0) (at_right 0)" using s by (auto intro!: tendsto_eq_intros simp: eventually_at exI[of _ 1]) qed qed auto moreover have "eventually (\r::real. r \ {0<..<2}) (at_right 0)" by (intro eventually_at_right_real) auto hence "eventually (\r. -2 * \ * sin (pi * s) * (CLBINT x:{r..pi}. g s x) + (err1 s r - err2 s r) = C) (at_right 0)" by eventually_elim (use eq in auto) hence "((\r. -2 * \ * sin (pi * s) * (CLBINT x:{r..pi}. g s x) + (err1 s r - err2 s r)) \ C) (at_right 0)" by (rule tendsto_eventually) ultimately have [simp]: "C = -2 * \ * sin (pi * s) * (CLBINT x:{0<..pi}. g s x)" using tendsto_unique by force \\We now rearrange everything and obtain the result.\ have "2 * \ * sin (pi * s) * ((CLBINT x:{0<..pi}. g s x) - (CLBINT x:{r..pi}. g s x)) = err2 s r - err1 s r" using eq[of r] r by (simp add: algebra_simps) also have "{0<..pi} = {0<.. {r..pi}" using r pi_gt3 by auto also have "(CLBINT x:\. g s x) - (CLBINT x:{r..pi}. g s x) = (CLBINT x:{0<.. {r..}. g s x) - (CLBINT x:{r..}. g s x)" using r pi_gt3 by (subst set_integral_Un[OF _ integrable integrable]) auto also have "{0<.. {r..} = {0<..}" using r by auto also have "(CLBINT x:{0<..}. g s x) = Gamma (1 - s) * hurwitz_zeta a (1 - s)" using Gamma_times_hurwitz_zeta_integral[of "1 - s" a] s a by (simp add: g_def exp_of_real exp_minus integral_completion set_lebesgue_integral_def) finally have "2 * \ * (sin (pi * s) * Gamma (1 - s)) * hurwitz_zeta a (1 - s) = err2 s r - err1 s r + 2 * \ * sin (pi * s) * (CLBINT x:{r..}. g s x)" by (simp add: algebra_simps) also have "sin (pi * s) * Gamma (1 - s) = pi * rGamma s" proof (cases "s \ \") case False with Gamma_reflection_complex[of s] show ?thesis by (auto simp: divide_simps sin_eq_0 Ints_def rGamma_inverse_Gamma mult_ac split: if_splits) next case True with s have "rGamma s = 0" by (auto simp: rGamma_eq_zero_iff nonpos_Ints_def Ints_def) moreover from True have "sin (pi * s) = 0" by (subst sin_eq_0) (auto elim!: Ints_cases) ultimately show ?thesis by simp qed finally show "2 * \ * pi * rGamma s * hurwitz_zeta a (1 - s) = err2 s r - err1 s r + 2 * \ * sin (pi * s) * (CLBINT x:{r..}. g s x)" by (simp add: mult_ac) next \\By analytic continuation, we lift the result to the case of any non-zero @{term s}.\ show "(\s. 2 * \ * pi * rGamma s * hurwitz_zeta a (1 - s)) holomorphic_on - {0}" using a by (auto intro!: holomorphic_intros) show "(\s. err2 s r - err1 s r + 2 * \ * sin (pi * s) * (CLBINT x:{r..}. g s x)) holomorphic_on -{0}" proof (intro holomorphic_intros) have "(\s. err2 s r) = (\s. - cnj (integral {0..pi} (h r (cnj s))))" using r by (simp add: err2_def contour_integral_part_circlepath_reverse' contour_integral_part_circlepath_h) also have "(\s. - cnj (integral {0..pi} (h r (cnj s)))) = (\s. (integral {0..pi} (\x. h r s (-x))))" using r by (simp add: integral_cnj h_def exp_cnj cis_cnj Ln_Reals_eq) also have "\ = (\s. integral {-pi..0} (h r s))" by (subst Henstock_Kurzweil_Integration.integral_reflect_real [symmetric]) simp finally have "(\s. err2 s r) = \" . moreover have "(\s. integral {-pi..0} (h r s)) holomorphic_on -{0}" using r by (intro integral_h_holomorphic) auto ultimately show "(\s. err2 s r) holomorphic_on -{0}" by simp next have "(\s. - integral {0..pi} (h r s)) holomorphic_on -{0}" using r by (intro holomorphic_intros integral_h_holomorphic) auto also have "(\s. - integral {0..pi} (h r s)) = (\s. err1 s r)" unfolding err1_def using r by (simp add: contour_integral_part_circlepath_reverse' contour_integral_part_circlepath_h) finally show "(\s. err1 s r) holomorphic_on -{0}" . next show "(\s. CLBINT x:{r..}. g s x) holomorphic_on -{0}" proof (rule holomorphic_on_balls_imp_entire') fix R :: real have "eventually (\b. b > r) at_top" by (rule eventually_gt_at_top) hence 1: "eventually (\b. continuous_on (cball 0 R) (\s. CLBINT x:{r..b}. g s x) \ (\s. CLBINT x:{r..b}. g s x) holomorphic_on ball 0 R) at_top" proof eventually_elim case (elim b) have integrable: "set_integrable lborel {r..b} (g s)" for s unfolding g_def using r by (intro borel_integrable_atLeastAtMost' continuous_intros) auto have "(\s. integral {r..b} (g s)) holomorphic_on UNIV" using r by (intro integral_g_holomorphic) auto also have "(\s. integral {r..b} (g s)) = (\s. CLBINT x:{r..b}. g s x)" by (intro ext set_borel_integral_eq_integral(2)[symmetric] integrable) finally have "\ holomorphic_on UNIV" . thus ?case by (auto intro!: holomorphic_on_imp_continuous_on) qed have 2: "uniform_limit (cball 0 R) (\b s. CLBINT x:{r..b}. g s x) (\s. CLBINT x:{r..}. g s x) at_top" proof (rule uniform_limit_set_lebesgue_integral_at_top) fix s :: complex and x :: real assume s: "s \ cball 0 R" and x: "x \ r" have "norm (g s x) = x powr -Re s * exp (-a * x) / (1 - exp (-x))" using x r by (simp add: g_def norm_mult norm_divide in_Reals_norm norm_powr_real_powr) also have "\ \ x powr R * exp (-a * x) / (1 - exp (-x))" using r s x abs_Re_le_cmod[of s] by (intro mult_right_mono divide_right_mono powr_mono) auto finally show "norm (g s x) \ x powr R * exp (- a * x) / (1 - exp (- x))" . next show "set_integrable lborel {r..} (\x. x powr R * exp (-a * x) / (1 - exp (-x)))" using r a by (intro set_integrable_Gamma_hurwitz_aux2_real) auto qed (simp_all add: set_borel_measurable_def g_def) show "(\s. CLBINT x:{r..}. g s x) holomorphic_on ball 0 R" using holomorphic_uniform_limit[OF 1 2] by auto qed qed qed (insert \s \ 0\, auto simp: connected_punctured_universe open_halfspace_Re_lt intro: exI[of _ "-1"]) text \ Finally, we obtain Hurwitz's formula by letting the radius of the outer circle tend to \\\. \ lemma hurwitz_zeta_formula_aux: fixes s :: complex assumes s: "Re s > 1" shows "rGamma s * hurwitz_zeta a (1 - s) = (2 * pi) powr -s * (\ powr (-s) * F a s + \ powr s * F (-a) s)" proof - from s have [simp]: "s \ 0" by auto define r where "r = (1 :: real)" have r: "r \ {0<..<2}" by (simp add: r_def) define R where "R = (\n. real (2 * n + 1) * pi)" define bigc where "bigc = (\n. contour_integral (part_circlepath 0 (R n) 0 pi) (f s) - cnj (contour_integral (part_circlepath 0 (R n) 0 pi) (f (cnj s))))" define smallc where "smallc = contour_integral (part_circlepath 0 r pi 0) (f s) - cnj (contour_integral (part_circlepath 0 r pi 0) (f (cnj s)))" define I where "I = (\n. CLBINT x:{r..R n}. g s x)" define F1 and F2 where "F1 = (\n. exp (-s * pi * \ / 2) * (\k\{0<..n}. exp (2 * real k * pi * a * \) * k powr (-s)))" "F2 = (\n. exp (s * pi * \ / 2) * (\k\{0<..n}. exp (2 * real k * pi * (-a) * \) * k powr (-s)))" have R: "R n \ pi" for n using r by (auto simp: R_def field_simps) have [simp]: "\(pi \ 0)" using pi_gt_zero by linarith have integrable: "set_integrable lborel A (g s)" if "A \ sets lborel" "A \ {r..}" for A proof - have "set_integrable lborel {r..} (g s)" using set_integrable_Gamma_hurwitz_aux2[of r a s] a r by (simp add: g_def exp_of_real exp_minus) thus ?thesis by (rule set_integrable_subset) (use that in auto) qed { fix n :: nat from hurwitz_formula_integral_semiannulus(2)[of "r" s n] and r R[of n] have "f s contour_integrable_on part_circlepath 0 (R n) 0 pi" by (auto simp: hankel_semiannulus_def R_def add_ac) } note integrable_circle = this { fix n :: nat from hurwitz_formula_integral_semiannulus(2)[of "r" "cnj s" n] and r R[of n] have "f (cnj s) contour_integrable_on part_circlepath 0 (R n) 0 pi" by (auto simp: hankel_semiannulus_def R_def add_ac) } note integrable_circle' = this { fix n :: nat have "(exp (-\ * pi * s) * integral {r..R n} (g s) + integral {r..R n} (\x. x powr (-s) * exp (a * x) / (1 - exp x)) + contour_integral (part_circlepath 0 (R n) 0 pi) (f s) + contour_integral (part_circlepath 0 r pi 0) (f s)) - cnj ( exp (-\ * pi * cnj s) * integral {r..R n} (g (cnj s)) + integral {r..R n} (\x. x powr (-cnj s) * exp (a * x) / (1 - exp x)) + contour_integral (part_circlepath 0 (R n) 0 pi) (f (cnj s)) + contour_integral (part_circlepath 0 r pi 0) (f (cnj s))) = -2 * pi * \ * exp (- s * of_real pi * \ / 2) * (\k\{0<..n}. Res s k) - cnj (-2 * pi * \ * exp (- cnj s * of_real pi * \ / 2) * (\k\{0<..n}. Res (cnj s) k))" (is "?lhs = ?rhs") unfolding R_def g_def using r by (subst (1 2) hurwitz_formula_integral_semiannulus) auto also have "?rhs = -2 * pi * \ * (exp (- s * pi * \ / 2) * (\k\{0<..n}. Res s k) + exp (s * pi * \ / 2) * (\k\{0<..n}. cnj (Res (cnj s) k)))" by (simp add: exp_cnj sum.distrib algebra_simps sum_distrib_left sum_distrib_right sum_negf) also have "(\k\{0<..n}. Res s k) = (2 * pi) powr (-s) * (\k\{0<..n}. exp (2 * k * pi * a * \) * k powr (-s))" (is "_ = ?S1") by (simp add: Res_def powr_times_real algebra_simps sum_distrib_left) also have "(\k\{0<..n}. cnj (Res (cnj s) k)) = (2 * pi) powr (-s) * (\k\{0<..n}. exp (-2 * k * pi * a * \) * k powr (-s))" by (simp add: Res_def cnj_powr powr_times_real algebra_simps exp_cnj sum_distrib_left) also have "exp (-s * pi * \ / 2) * ?S1 + exp (s * pi * \ / 2) * \ = (2 * pi) powr (-s) * (exp (-s * pi * \ / 2) * (\k\{0<..n}. exp (2 * k * pi * a * \) * k powr (-s)) + exp (s * pi * \ / 2) * (\k\{0<..n}. exp (-2 * k * pi * a * \) * k powr (-s)))" by (simp add: algebra_simps) also have 1: "integral {r..R n} (g s) = I n" unfolding I_def by (intro set_borel_integral_eq_integral(2) [symmetric] integrable) auto have 2: "cnj (integral {r..R n} (g (cnj s))) = integral {r..R n} (g s)" using r unfolding integral_cnj by (intro integral_cong) (auto simp: g_def cnj_powr) have 3: "integral {r..R n} (\x. exp (x * a) * cnj (x powr - cnj s) / (1 - exp x)) = integral {r..R n} (\x. exp (x * a) * of_real x powr - s / (1 - exp x))" unfolding I_def g_def using r R[of n] by (intro integral_cong; force simp: cnj_powr)+ from 1 2 3 have "?lhs = (exp (-\ * s * pi) - exp (\ * s * pi)) * I n + bigc n + smallc" by (simp add: integral_cnj cnj_powr algebra_simps exp_cnj bigc_def smallc_def g_def) also have "exp (-\ * s * pi) - exp (\ * s * pi) = -2 * \ * sin (s * pi)" by (simp add: sin_exp_eq' algebra_simps) finally have "(- 2 * \ * sin (s * pi) * I n + smallc) + bigc n = -2 * \ * pi * (2 * pi) powr (-s) * (F1 n + F2 n)" by (simp add: F1_F2_def algebra_simps) } note eq = this have "(\n. - 2 * \ * sin (s * pi) * I n + smallc + bigc n) \ (-2 * \ * sin (s * pi)) * (CLBINT x:{r..}. g s x) + smallc + 0" unfolding I_def proof (intro tendsto_intros filterlim_compose[OF tendsto_set_lebesgue_integral_at_top] integrable) show "filterlim R at_top sequentially" unfolding R_def by (intro filterlim_at_top_mult_tendsto_pos[OF tendsto_const] pi_gt_zero filterlim_compose[OF filterlim_real_sequentially] filterlim_subseq) (auto simp: strict_mono_Suc_iff) from hurwitz_formula_bound1[OF pi_gt_zero] guess C . note C = this define D where "D = C * exp (3 / 2 * pi * \Im s\)" from \C \ 0\ have "D \ 0" by (simp add: D_def) show "bigc \ 0" proof (rule Lim_null_comparison[OF always_eventually[OF allI]]) fix n :: nat have bound: "norm (f s' z) \ D * R n powr (-Re s')" if z: "z \ sphere 0 (R n)" "Re s' = Re s" "\Im s'\ = \Im s\" for z s' proof - from z and r R[of n] have [simp]: "z \ 0" by auto have not_in_ball: "z \ ball (2 * m * pi * \) pi" for m :: int proof - have "dist z (2 * m * pi * \) \ \dist z 0 - dist 0 (2 * m * pi * \)\" by (rule abs_dist_diff_le) also have "dist 0 (2 * m * pi * \) = 2 * \m\ * pi" by (simp add: norm_mult) also from z have "dist z 0 = R n" by simp also have "R n - 2 * \m\ * pi = (int (2 * n + 1) - 2 * \m\) * pi" by (simp add: R_def algebra_simps) also have "\\\ = \int (2 * n + 1) - 2 * \m\\ * pi" by (subst abs_mult) simp_all also have "\int (2 * n + 1) - 2 * \m\\ \ 1" by presburger hence "\ * pi \ 1 * pi" by (intro mult_right_mono) auto finally show ?thesis by (simp add: dist_commute) qed have "norm (f s' z) = norm (exp (-Ln' z * s')) * norm (exp (a * z) / (1 - exp z))" by (simp add: f_def exp_diff norm_mult norm_divide mult_ac exp_minus norm_inverse divide_simps del: norm_exp_eq_Re) also have "\ \ norm (exp (-Ln' z * s')) * C" using not_in_ball by (intro mult_left_mono C) auto also have "norm (exp (-Ln' z * s')) = exp (Im s' * (Im (Ln (- (\ * z))) + pi / 2)) / exp (Re s' * ln (R n))" using z r R[of n] pi_gt_zero by (simp add: Ln'_def norm_mult norm_divide exp_add exp_diff exp_minus norm_inverse algebra_simps inverse_eq_divide) also have "\ \ exp (3/2 * pi * \Im s'\) / exp (Re s' * ln (R n))" proof (intro divide_right_mono, subst exp_le_cancel_iff) have "Im s' * (Im (Ln (- (\ * z))) + pi / 2) \ \Im s' * (Im (Ln (- (\ * z))) + pi / 2)\" by (rule abs_ge_self) also have "\ \ \Im s'\ * (pi + pi / 2)" unfolding abs_mult using mpi_less_Im_Ln[of "- (\ * z)"] Im_Ln_le_pi[of "- (\ * z)"] by (intro mult_left_mono order.trans[OF abs_triangle_ineq] add_mono) auto finally show "Im s' * (Im (Ln (- (\ * z))) + pi / 2) \ 3/2 * pi * \Im s'\" by (simp add: algebra_simps) qed auto also have "exp (Re s' * ln (R n)) = R n powr Re s'" using r R[of n] by (auto simp: powr_def) finally show "norm (f s' z) \ D * R n powr (-Re s')" using \C \ 0\ by (simp add: that D_def powr_minus mult_right_mono mult_left_mono field_simps) qed have "norm (bigc n) \ norm (contour_integral (part_circlepath 0 (R n) 0 pi) (f s)) + norm (cnj (contour_integral (part_circlepath 0 (R n) 0 pi) (f (cnj s))))" (is "_ \ norm ?err1 + norm ?err2") unfolding bigc_def by (rule norm_triangle_ineq4) also have "norm ?err1 \ D * R n powr (-Re s) * R n * \pi - 0\" using \D \ 0\ and r R[of n] and pi_gt3 and integrable_circle and path_image_part_circlepath_subset[of 0 pi "R n" 0] and bound[of _ s] by (intro contour_integral_bound_part_circlepath) auto also have "\ = D * pi * R n powr (1 - Re s)" using r R[of n] pi_gt3 by (simp add: powr_diff field_simps powr_minus) also have "norm ?err2 \ D * R n powr (-Re s) * R n * \pi - 0\" unfolding complex_mod_cnj using \D \ 0\ and r R[of n] and pi_gt3 and integrable_circle'[of n] and path_image_part_circlepath_subset[of 0 pi "R n" 0] and bound[of _ "cnj s"] by (intro contour_integral_bound_part_circlepath) auto also have "\ = D * pi * R n powr (1 - Re s)" using r R[of n] pi_gt3 by (simp add: powr_diff field_simps powr_minus) finally show "norm (bigc n) \ 2 * D * pi * R n powr (1 - Re s)" by simp next have "filterlim R at_top at_top" by fact hence "(\x. 2 * D * pi * R x powr (1 - Re s)) \ 2 * D * pi * 0" using s unfolding R_def by (intro tendsto_intros tendsto_neg_powr) auto thus "(\x. 2 * D * pi * R x powr (1 - Re s)) \ 0" by simp qed qed auto also have "(\n. - 2 * \ * sin (s * pi) * I n + smallc + bigc n) = (\n. -2 * \ * pi * (2 * pi) powr -s * (F1 n + F2 n))" by (subst eq) auto finally have "\ \ (-2 * \ * sin (s * pi)) * (CLBINT x:{r..}. g s x) + smallc" by simp moreover have "(\n. -2 * \ * pi * (2 * pi) powr -s * (F1 n + F2 n)) \ -2 * \ * pi * (2 * pi) powr -s * (exp (-s * pi * \ / 2) * F a s + exp (s * pi * \ / 2) * F (-a) s)" unfolding F1_F2_def F_def using s by (intro tendsto_intros sum_tendsto_fds_perzeta) ultimately have "-2 * \ * pi * (2 * pi) powr -s * (exp (-s * pi * \ / 2) * F a s + exp (s * pi * \ / 2) * F (-a) s) = (-2 * \ * sin (s * pi)) * (CLBINT x:{r..}. g s x) + smallc" by (force intro: tendsto_unique) also have "\ = -2 * \ * pi * rGamma s * hurwitz_zeta a (1 - s)" using s r a using rGamma_hurwitz_zeta_eq_contour_integral[of s r] by (simp add: r_def smallc_def algebra_simps) also have "exp (- s * complex_of_real pi * \ / 2) = \ powr (-s)" by (simp add: powr_def field_simps) also have "exp (s * complex_of_real pi * \ / 2) = \ powr s" by (simp add: powr_def field_simps) finally show "rGamma s * hurwitz_zeta a (1 - s) = (2 * pi) powr -s * (\ powr (-s) * F a s + \ powr s * F (-a) s)" by simp qed end text \ We can now use Hurwitz's formula to prove the following nice formula that expresses the periodic zeta function in terms of the Hurwitz zeta function: \[F(s, a) = (2\pi)^{s-1} i \Gamma(1 - s) \left(i^{-s} \zeta(1 - s, a) - i^{s} \zeta(1 - s, 1 - a)\right)\] This holds for all \s\ with \\mathfrak{R}(s) > 0\ as long as \a \ \\. For convenience, we move the \\\ function to the left-hand side in order to avoid having to account for its poles. \ lemma perzeta_conv_hurwitz_zeta_aux: fixes a :: real and s :: complex assumes a: "a \ {0<..<1}" and s: "Re s > 0" shows "rGamma (1 - s) * eval_fds (fds_perzeta a) s = (2 * pi) powr (s - 1) * \ * (\ powr -s * hurwitz_zeta a (1 - s) - \ powr s * hurwitz_zeta (1 - a) (1 - s))" (is "?lhs s = ?rhs s") proof (rule analytic_continuation_open[where f = ?lhs]) show "connected {s. Re s > 0}" by (intro convex_connected convex_halfspace_Re_gt) show "{s. Re s > 1} \ {}" by (auto intro: exI[of _ 2]) show "(\s. rGamma (1 - s) * eval_fds (fds_perzeta a) s) holomorphic_on {s. 0 < Re s}" unfolding perzeta_def using a by (auto intro!: holomorphic_intros le_less_trans[OF conv_abscissa_perzeta'] elim!: Ints_cases) show "?rhs holomorphic_on {s. 0 < Re s}" using assms by (auto intro!: holomorphic_intros) next fix s assume s: "s \ {s. Re s > 1}" have [simp]: "fds_perzeta (1 - a) = fds_perzeta (-a)" using fds_perzeta.plus_of_nat[of "-a" 1] by simp have [simp]: "fds_perzeta (a - 1) = fds_perzeta a" using fds_perzeta.minus_of_nat[of a 1] by simp from s have [simp]: "Gamma s \ 0" by (auto simp: Gamma_eq_zero_iff elim!: nonpos_Ints_cases) have "(2 * pi) powr (-s) * (\ * (\ powr (-s) * (rGamma s * hurwitz_zeta a (1 - s)) - \ powr s * (rGamma s * hurwitz_zeta (1 - a) (1 - s)))) = (2 * pi) powr (-s) * ((\ powr (1 - s) * (rGamma s * hurwitz_zeta a (1 - s)) + \ powr (s - 1) * (rGamma s * hurwitz_zeta (1 - a) (1 - s))))" by (simp add: powr_diff field_simps powr_minus) also have "\ = ((2 * pi) powr (-s)) ^ 2 * ( eval_fds (fds_perzeta a) s * (\ powr s * \ powr (s - 1) + \ powr (-s) * \ powr (1 - s)) + eval_fds (fds_perzeta (-a)) s * (\ powr s * \ powr (1 - s) + \ powr (-s) * \ powr (s - 1)))" using s a by (subst (1 2) hurwitz_zeta_formula_aux) (auto simp: algebra_simps power2_eq_square) also have "(\ powr s * \ powr (1 - s) + \ powr (-s) * \ powr (s - 1)) = exp (\ * complex_of_real pi / 2) + exp (- (\ * complex_of_real pi / 2))" by (simp add: powr_def exp_add [symmetric] field_simps) also have "\ = 0" by (simp add: exp_eq_polar) also have "\ powr s * \ powr (s - 1) = \ powr (2 * s - 1)" by (simp add: powr_def exp_add [symmetric] field_simps) also have "\ powr (-s) * \ powr (1 - s) = \ powr (1 - 2 * s)" by (simp add: powr_def exp_add [symmetric] field_simps) also have "\ powr (2 * s - 1) + \ powr (1 - 2 * s) = 2 * cos ((2 * s - 1) * pi / 2)" by (simp add: powr_def cos_exp_eq algebra_simps minus_divide_left cos_sin_eq) also have "\ = 2 * sin (pi - s * pi)" by (simp add: cos_sin_eq field_simps) also have "\ = 2 * sin (s * pi)" by (simp add: sin_diff) finally have "\ * (rGamma s * \ powr (-s) * hurwitz_zeta a (1 - s) - rGamma s * \ powr s * hurwitz_zeta (1 - a) (1 - s)) = 2 * (2 * pi) powr -s * sin (s * pi) * eval_fds (fds_perzeta a) s" by (simp add: power2_eq_square mult_ac) hence "(2 * pi) powr s / 2 * \ * (\ powr (-s) * hurwitz_zeta a (1 - s) - \ powr s * hurwitz_zeta (1 - a) (1 - s)) = Gamma s * sin (s * pi) * eval_fds (fds_perzeta a) s" by (subst (asm) (2) powr_minus) (simp add: field_simps rGamma_inverse_Gamma) also have "Gamma s * sin (s * pi) = pi * rGamma (1 - s)" using Gamma_reflection_complex[of s] by (auto simp: divide_simps rGamma_inverse_Gamma mult_ac split: if_splits) finally show "?lhs s = ?rhs s" by (simp add: powr_diff) qed (insert s, auto simp: open_halfspace_Re_gt) text \ We can now use the above equation as a defining equation to continue the periodic zeta function $F$ to the entire complex plane except at non-negative integer values for \s\. However, the positive integers are already covered by the original Dirichlet series definition of $F$, so we only need to take care of \s = 0\. We do this by cancelling the pole of \\\ at \0\ with the zero of $i^{-s} \zeta(1 - s, a) - i^s \zeta(1 - s, 1 - a)$. \ lemma assumes "q' \ \" shows holomorphic_perzeta': "perzeta q' holomorphic_on A" and perzeta_altdef2: "Re s > 0 \ perzeta q' s = eval_fds (fds_perzeta q') s" proof - define q where "q = frac q'" from assms have q: "q \ {0<..<1}" by (auto simp: q_def frac_lt_1) hence [simp]: "q \ \" by (auto elim!: Ints_cases) have [simp]: "frac q = q" by (simp add: q_def frac_def) define f where "f = (\s. complex_of_real (2 * pi) powr (s - 1) * \ * Gamma (1 - s) * (\ powr (-s) * hurwitz_zeta q (1 - s) - \ powr s * hurwitz_zeta (1 - q) (1 - s)))" { fix s :: complex assume "1 - s \ \\<^sub>\\<^sub>0" then obtain n where "1 - s = of_int n" "n \ 0" by (auto elim!: nonpos_Ints_cases) hence "s = 1 - of_int n" by (simp add: algebra_simps) also have "\ \ \" using \n \ 0\ by (auto simp: Nats_altdef1 intro: exI[of _ "1 - n"]) finally have "s \ \" . } note * = this hence "f holomorphic_on -\" using q by (auto simp: f_def Nats_altdef2 nonpos_Ints_altdef not_le intro!: holomorphic_intros) also have "?this \ perzeta q holomorphic_on -\" using assms by (intro holomorphic_cong refl) (auto simp: perzeta_def Let_def f_def) finally have holo: "perzeta q holomorphic_on -\" . have f_altdef: "f s = eval_fds (fds_perzeta q) s" if "Re s > 0" and "s \ \" for s using perzeta_conv_hurwitz_zeta_aux[OF q, of s] that * by (auto simp: rGamma_inverse_Gamma Gamma_eq_zero_iff divide_simps f_def perzeta_def split: if_splits) show "perzeta q' s = eval_fds (fds_perzeta q') s" if "Re s > 0" for s using f_altdef[of s] that assms by (auto simp: f_def perzeta_def Let_def q_def) have cont: "isCont (perzeta q) s" if "s \ \" for s proof (cases "s = 0") case False with that obtain n where [simp]: "s = of_nat n" and n: "n > 0" by (auto elim!: Nats_cases) have *: "open ({s. Re s > 0} - (\ - {of_nat n}))" using Nats_subset_Ints by (intro open_Diff closed_subset_Ints open_halfspace_Re_gt) auto have "eventually (\s. s \ {s. Re s > 0} - (\ - {of_nat n})) (nhds (of_nat n))" using \n > 0\ by (intro eventually_nhds_in_open *) auto hence ev: "eventually (\s. eval_fds (fds_perzeta q) s = perzeta q s) (nhds (of_nat n))" proof eventually_elim case (elim s) thus ?case using q f_altdef[of s] by (auto simp: perzeta_def dist_of_nat f_def elim!: Nats_cases Ints_cases) qed have "isCont (eval_fds (fds_perzeta q)) (of_nat n)" using q and \n > 0\ by (intro continuous_eval_fds le_less_trans[OF conv_abscissa_perzeta']) (auto elim!: Ints_cases) also have "?this \ isCont (perzeta q) (of_nat n)" using ev by (intro isCont_cong ev) finally show ?thesis by simp next assume [simp]: "s = 0" define a where "a = Complex (ln q) (-pi / 2)" define b where "b = Complex (ln (1 - q)) (pi / 2)" have "eventually (\s::complex. s \ \) (at 0)" unfolding eventually_at_topological using Nats_subset_Ints by (intro exI[of _ "-(\-{0})"] conjI open_Compl closed_subset_Ints) auto hence ev: "eventually (\s. perzeta q s = (2 * pi) powr (s - 1) * Gamma (1 - s) * \ * (\ powr - s * pre_zeta q (1 - s) -\ powr s * pre_zeta (1 - q) (1 - s) + (exp (b * s) - exp (a * s)) / s)) (at (0::complex))" (is "eventually (\s. _ = ?f s) _") proof eventually_elim case (elim s) have "perzeta q s = (2 * pi) powr (s - 1) * Gamma (1 - s) * \ * (\ powr (-s) * hurwitz_zeta q (1 - s) - \ powr s * hurwitz_zeta (1 - q) (1 - s))" (is "_ = _ * ?T") using elim by (auto simp: perzeta_def powr_diff powr_minus field_simps) also have "?T = \ powr (-s) * pre_zeta q (1 - s) - \ powr s * pre_zeta (1 - q) (1 - s) + (\ powr s * (1 - q) powr s - \ powr (-s) * q powr s) / s" using elim by (auto simp: hurwitz_zeta_def field_simps) also have "\ powr s * (1 - q) powr s = exp (b * s)" using q by (simp add: powr_def exp_add algebra_simps Ln_Reals_eq Complex_eq b_def) also have "\ powr (-s) * q powr s = exp (a * s)" using q by (simp add: powr_def exp_add Ln_Reals_eq exp_diff exp_minus diff_divide_distrib ring_distribs inverse_eq_divide mult_ac Complex_eq a_def) finally show ?case . qed have [simp]: "\(pi \ 0)" using pi_gt_zero by (simp add: not_le) have "(\s::complex. if s = 0 then b - a else (exp (b * s) - exp (a * s)) / s) has_fps_expansion (fps_exp b - fps_exp a) / fps_X" (is "?f' has_fps_expansion _") by (rule fps_expansion_intros)+ (auto intro!: subdegree_geI simp: Ln_Reals_eq a_def b_def) hence "isCont ?f' 0" by (rule has_fps_expansion_imp_continuous) hence "?f' \0\ b - a" by (simp add: isCont_def) also have "?this \ (\s. (exp (b * s) - exp (a * s)) / s) \0\ b - a" by (intro filterlim_cong refl) (auto simp: eventually_at intro: exI[of _ 1]) finally have "?f \0\ of_real (2 * pi) powr (0 - 1) * Gamma (1 - 0) * \ * (\ powr -0 * pre_zeta q (1 - 0) -\ powr 0 * pre_zeta (1 - q) (1 - 0) + (b - a))" (is "filterlim _ (nhds ?c) _") using q by (intro tendsto_intros isContD) (auto simp: complex_nonpos_Reals_iff intro!: continuous_intros) also have "?c = perzeta q 0" using q by (simp add: powr_minus perzeta_def Ln_Reals_eq a_def b_def Complex_eq mult_ac inverse_eq_divide) also have "?f \0\ \ \ perzeta q \0\ \" by (rule sym, intro filterlim_cong refl ev) finally show "isCont (perzeta q) s" by (simp add: isCont_def) qed have "perzeta q field_differentiable at s" for s proof (cases "s \ \") case False with holo have "perzeta q field_differentiable at s within -\" unfolding holomorphic_on_def by blast also have "at s within -\ = at s" using False by (intro at_within_open) auto finally show ?thesis . next case True hence *: "perzeta q holomorphic_on (ball s 1 - {s})" by (intro holomorphic_on_subset[OF holo]) (auto elim!: Nats_cases simp: dist_of_nat) have "perzeta q holomorphic_on ball s 1" using cont True by (intro no_isolated_singularity'[OF _ *]) (auto simp: at_within_open[of _ "ball s 1"] isCont_def) hence "perzeta q field_differentiable at s within ball s 1" unfolding holomorphic_on_def by auto thus ?thesis by (simp add: at_within_open[of _ "ball s 1"]) qed hence "perzeta q holomorphic_on UNIV" by (auto simp: holomorphic_on_def) also have "perzeta q = perzeta q'" by (simp add: q_def) finally show "perzeta q' holomorphic_on A" by auto qed lemma perzeta_altdef1: "Re s > 1 \ perzeta q' s = eval_fds (fds_perzeta q') s" by (cases "q' \ \") (auto simp: perzeta_int eval_fds_zeta fds_perzeta_int perzeta_altdef2) lemma holomorphic_perzeta: "q \ \ \ 1 \ A \ perzeta q holomorphic_on A" by (cases "q \ \") (auto simp: perzeta_int intro: holomorphic_perzeta' holomorphic_zeta) lemma holomorphic_perzeta'' [holomorphic_intros]: assumes "f holomorphic_on A" and "q \ \ \ (\x\A. f x \ 1)" shows "(\x. perzeta q (f x)) holomorphic_on A" proof - have "perzeta q \ f holomorphic_on A" using assms by (intro holomorphic_on_compose holomorphic_perzeta) auto thus ?thesis by (simp add: o_def) qed text \ Using this analytic continuation of the periodic zeta function, Hurwitz's formula now holds (almost) on the entire complex plane. \ theorem hurwitz_zeta_formula: fixes a :: real and s :: complex assumes "a \ {0<..1}" and "s \ 0" and "a \ 1 \ s \ 1" shows "rGamma s * hurwitz_zeta a (1 - s) = (2 * pi) powr - s * (\ powr - s * perzeta a s + \ powr s * perzeta (-a) s)" (is "?f s = ?g s") proof - define A where "A = UNIV - (if a \ \ then {0, 1} else {0 :: complex})" show ?thesis proof (rule analytic_continuation_open[where f = ?f]) show "?f holomorphic_on A" using assms by (auto intro!: holomorphic_intros simp: A_def) show "?g holomorphic_on A" using assms by (auto intro!: holomorphic_intros simp: A_def minus_in_Ints_iff) next fix s assume "s \ {s. Re s > 1}" thus "?f s = ?g s" using hurwitz_zeta_formula_aux[of a s] assms by (simp add: perzeta_altdef1) qed (insert assms, auto simp: open_halfspace_Re_gt A_def elim!: Ints_cases intro: connected_open_delete_finite exI[of _ 2]) qed text \ The equation expressing the periodic zeta function in terms of the Hurwitz zeta function can be extened similarly. \ theorem perzeta_conv_hurwitz_zeta: fixes a :: real and s :: complex assumes "a \ {0<..<1}" and "s \ 0" shows "rGamma (1 - s) * perzeta a s = (2 * pi) powr (s - 1) * \ * (\ powr (-s) * hurwitz_zeta a (1 - s) - \ powr s * hurwitz_zeta (1 - a) (1 - s))" (is "?f s = ?g s") proof (rule analytic_continuation_open[where f = ?f]) show "?f holomorphic_on -{0}" using assms by (auto intro!: holomorphic_intros elim: Ints_cases) show "?g holomorphic_on -{0}" using assms by (auto intro!: holomorphic_intros) next fix s assume "s \ {s. Re s > 1}" thus "?f s = ?g s" using perzeta_conv_hurwitz_zeta_aux[of a s] assms by (simp add: perzeta_altdef1) qed (insert assms, auto simp: open_halfspace_Re_gt connected_punctured_universe intro: exI[of _ 2]) text \ As a simple corollary, we derive the reflection formula for the Riemann zeta function: \ corollary zeta_reflect: fixes s :: complex assumes "s \ 0" "s \ 1" shows "rGamma s * zeta (1 - s) = 2 * (2 * pi) powr -s * cos (s * pi / 2) * zeta s" using hurwitz_zeta_formula[of 1 s] assms by (simp add: zeta_def cos_exp_eq powr_def perzeta_int algebra_simps) corollary zeta_reflect': fixes s :: complex assumes "s \ 0" "s \ 1" shows "rGamma (1 - s) * zeta s = 2 * (2 * pi) powr (s - 1) * sin (s * pi / 2) * zeta (1 - s)" using zeta_reflect[of "1 - s"] assms by (simp add: cos_sin_eq field_simps) text \ It is now easy to see that all the non-trivial zeroes of the Riemann zeta function must lie the critical strip $(0;1)$, and they must be symmetric around the $\mathfrak{R}(z) = \frac{1}{2}$ line. \ corollary zeta_zeroD: assumes "zeta s = 0" "s \ 1" shows "Re s \ {0<..<1} \ (\n::nat. n > 0 \ even n \ s = -real n)" proof (cases "Re s \ 0") case False with zeta_Re_ge_1_nonzero[of s] assms have "Re s < 1" by (cases "Re s < 1") auto with False show ?thesis by simp next case True { assume *: "\n. n > 0 \ even n \ s \ -real n" have "s \ of_int n" for n :: int proof assume [simp]: "s = of_int n" show False proof (cases n "0::int" rule: linorder_cases) assume "n < 0" show False proof (cases "even n") case True hence "nat (-n) > 0" "even (nat (-n))" using \n < 0\ by (auto simp: even_nat_iff) with * have "s \ -real (nat (-n))" . with \n < 0\ and True show False by auto next case False with \n < 0\ have "of_int n = (-of_nat (nat (-n)) :: complex)" by simp also have "zeta \ = -(bernoulli' (Suc (nat (-n)))) / of_nat (Suc (nat (-n)))" using \n < 0\ by (subst zeta_neg_of_nat) (auto) finally have "bernoulli' (Suc (nat (-n))) = 0" using assms by (auto simp del: of_nat_Suc) with False and \n < 0\ show False by (auto simp: bernoulli'_zero_iff even_nat_iff) qed qed (insert assms True, auto) qed hence "rGamma s \ 0" by (auto simp: rGamma_eq_zero_iff nonpos_Ints_def) moreover from assms have [simp]: "s \ 0" by auto ultimately have "zeta (1 - s) = 0" using zeta_reflect[of s] and assms by auto with True zeta_Re_ge_1_nonzero[of "1 - s"] have "Re s > 0" by auto } with True show ?thesis by auto qed lemma zeta_zero_reflect: assumes "Re s \ {0<..<1}" and "zeta s = 0" shows "zeta (1 - s) = 0" proof - from assms have "rGamma s \ 0" by (auto simp: rGamma_eq_zero_iff elim!: nonpos_Ints_cases) moreover from assms have "s \ 0" and "s \ 1" by auto ultimately show ?thesis using zeta_reflect[of s] and assms by auto qed corollary zeta_zero_reflect_iff: assumes "Re s \ {0<..<1}" shows "zeta (1 - s) = 0 \ zeta s = 0" using zeta_zero_reflect[of s] zeta_zero_reflect[of "1 - s"] assms by auto subsection \More functional equations\ lemma perzeta_conv_hurwitz_zeta_multiplication: fixes k :: nat and a :: int and s :: complex assumes "k > 0" "s \ 1" shows "k powr s * perzeta (a / k) s = (\n=1..k. exp (2 * pi * n * a / k * \) * hurwitz_zeta (n / k) s)" (is "?lhs s = ?rhs s") proof (rule analytic_continuation_open[where ?f = ?lhs and ?g = ?rhs]) show "connected (-{1::complex})" by (rule connected_punctured_universe) auto show "{s. Re s > 1} \ {}" by (auto intro!: exI[of _ 2]) next fix s assume s: "s \ {s. Re s > 1}" let ?f = "\n. exp (2 * pi * n * a / k * \)" show "?lhs s = ?rhs s" proof (rule sums_unique2) have "(\m. \n=1..k. ?f n * (of_nat m + of_real (real n / real k)) powr -s) sums (\n=1..k. ?f n * hurwitz_zeta (real n / real k) s)" using assms s by (intro sums_sum sums_mult sums_hurwitz_zeta) auto also have "(\m. \n=1..k. ?f n * (of_nat m + of_real (real n / real k)) powr -s) = (\m. of_nat k powr s * (\n=1..k. ?f n * of_nat (m * k + n) powr -s))" unfolding sum_distrib_left proof (intro ext sum.cong, goal_cases) case (2 m n) hence "m * k + n > 0" by (intro add_nonneg_pos) auto hence "of_nat 0 \ (of_nat (m * k + n) :: complex)" by (simp only: of_nat_eq_iff) also have "of_nat (m * k + n) = of_nat m * of_nat k + (of_nat n :: complex)" by simp finally have nz: "\ \ 0" by auto have "of_nat m + of_real (real n / real k) = (inverse (of_nat k) * of_nat (m * k + n) :: complex)" using assms (* TODO: Field_as_Ring messing up things again *) by (simp add: field_simps del: div_mult_self1 div_mult_self2 div_mult_self3 div_mult_self4) also from nz have "\ powr -s = of_nat k powr s * of_nat (m * k + n) powr -s" by (subst powr_times_real) (auto simp: add_eq_0_iff powr_def exp_minus Ln_inverse) finally show ?case by simp qed auto finally show "\ sums (\n=1..k. ?f n * hurwitz_zeta (real n / real k) s)" . next define g where "g = (\m. exp (2 * pi * \ * m * (real_of_int a / real k)))" have "(\m. g (Suc m) / (Suc m) powr s) sums eval_fds (fds_perzeta (a / k)) s" unfolding g_def using s by (intro sums_fds_perzeta) auto also have "(\m. g (Suc m) / (Suc m) powr s) = (\m. ?f (Suc m) * (Suc m) powr -s)" by (simp add: powr_minus field_simps g_def) also have "eval_fds (fds_perzeta (a / k)) s = perzeta (a / k) s" using s by (simp add: perzeta_altdef1) finally have "(\m. \n=m*k..k > 0\ by (rule sums_group) also have "(\m. \n=m*k..m. \n=1..k. ?f (m * k + n) * of_nat (m * k + n) powr -s)" proof (rule ext, goal_cases) case (1 m) show ?case using assms by (intro ext sum.reindex_bij_witness[of _ "\n. m * k + n - 1" "\n. Suc n - m * k"]) auto qed also have "(\m n. ?f (m * k + n)) = (\m n. ?f n)" proof (intro ext) fix m n :: nat have "?f (m * k + n) / ?f n = exp (2 * pi * m * a * \)" using \k > 0\ by (auto simp: ring_distribs add_divide_distrib exp_add mult_ac) also have "\ = cis (2 * pi * (m * a))" by (simp add: exp_eq_polar mult_ac) also have "\ = 1" by (rule cis_multiple_2pi) auto finally show "?f (m * k + n) = ?f n" by simp qed finally show "(\m. of_nat k powr s * (\n=1..k. ?f n * of_nat (m * k + n) powr -s)) sums (of_nat k powr s * perzeta (a / k) s)" by (rule sums_mult) qed qed (use assms in \auto intro!: holomorphic_intros simp: finite_imp_closed open_halfspace_Re_gt\) - lemma perzeta_conv_hurwitz_zeta_multiplication': fixes k :: nat and a :: int and s :: complex assumes "k > 0" "s \ 1" shows "perzeta (a / k) s = k powr -s * (\n=1..k. exp (2 * pi * n * a / k * \) * hurwitz_zeta (n / k) s)" using perzeta_conv_hurwitz_zeta_multiplication[of k s a] assms by (simp add: powr_minus field_simps) lemma zeta_conv_hurwitz_zeta_multiplication: fixes k a :: nat and s :: complex assumes "k > 0" "s \ 1" shows "k powr s * zeta s = (\n=1..k. hurwitz_zeta (n / k) s)" using perzeta_conv_hurwitz_zeta_multiplication[of k s 0] using assms by (simp add: perzeta_int) lemma hurwitz_zeta_one_half_left: assumes "s \ 1" shows "hurwitz_zeta (1 / 2) s = (2 powr s - 1) * zeta s" using zeta_conv_hurwitz_zeta_multiplication[of 2 s] assms by (simp add: eval_nat_numeral zeta_def field_simps) theorem hurwitz_zeta_functional_equation: fixes h k :: nat and s :: complex assumes hk: "k > 0" "h \ {0<..k}" and s: "s \ {0, 1}" defines "a \ real h / real k" shows "rGamma s * hurwitz_zeta a (1 - s) = 2 * (2 * pi * k) powr -s * (\n=1..k. cos (s*pi/2 - 2*pi*n*h/k) * hurwitz_zeta (n / k) s)" proof - from hk have a: "a \ {0<..1}" by (auto simp: a_def) have "rGamma s * hurwitz_zeta a (1 - s) = (2 * pi) powr - s * (\ powr - s * perzeta a s + \ powr s * perzeta (- a) s)" using s a by (intro hurwitz_zeta_formula) auto also have "\ = (2 * pi) powr - s * (\ powr - s * perzeta (of_int (int h) / k) s + \ powr s * perzeta (of_int (-int h) / k) s)" by (simp add: a_def) also have "\ = (2 * pi) powr -s * k powr -s * ((\n=1..k. \ powr -s * cis (2 * pi * n * h / k) * hurwitz_zeta (n / k) s) + (\n=1..k. \ powr s * cis (-2 * pi * n * h / k) * hurwitz_zeta (n / k) s))" (is "_ = _ * (?S1 + ?S2)") using hk a s by (subst (1 2) perzeta_conv_hurwitz_zeta_multiplication') (auto simp: field_simps sum_distrib_left sum_distrib_right exp_eq_polar) also have "(2 * pi) powr -s * k powr -s = (2 * k * pi) powr -s" using hk pi_gt_zero by (simp add: powr_def Ln_times_Reals field_simps exp_add exp_diff exp_minus) also have "?S1 + ?S2 = (\n=1..k. (\ powr -s * cis (2*pi*n*h/k) + \ powr s * cis (-2*pi*n*h/k)) * hurwitz_zeta (n / k) s)" (is "_ = (\n\_. ?c n * _)") by (simp add: algebra_simps sum.distrib) also have "?c = (\n. 2 * cos (s*pi/2 - 2*pi*n*h/k))" proof fix n :: nat have "\ powr -s * cis (2*pi*n*h/k) = exp (-s*pi/2*\ + 2*pi*n*h/k*\)" unfolding exp_add by (simp add: powr_def cis_conv_exp mult_ac) moreover have "\ powr s * cis (-2*pi*n*h/k) = exp (s*pi/2*\ + -2*pi*n*h/k*\)" unfolding exp_add by (simp add: powr_def cis_conv_exp mult_ac) ultimately have "?c n = exp (\ * (s*pi/2 - 2*pi*n*h/k)) + exp (-(\ * (s*pi/2 - 2*pi*n*h/k)))" by (simp add: mult_ac ring_distribs) also have "\ / 2 = cos (s*pi/2 - 2*pi*n*h/k)" by (rule cos_exp_eq [symmetric]) finally show "?c n = 2 * cos (s*pi/2 - 2*pi*n*h/k)" by simp qed also have "(2 * k * pi) powr -s * (\n=1..k. \ n * hurwitz_zeta (n / k) s) = 2 * (2 * pi * k) powr -s * (\n=1..k. cos (s*pi/2 - 2*pi*n*h/k) * hurwitz_zeta (n / k) s)" by (simp add: sum_distrib_left sum_distrib_right mult_ac) finally show ?thesis . qed + +lemma perzeta_one_half_left: "s \ 1 \ perzeta (1 / 2) s = (2 powr (1-s) - 1) * zeta s" + using perzeta_conv_hurwitz_zeta_multiplication'[of 2 s 1] + by (simp add: eval_nat_numeral hurwitz_zeta_one_half_left powr_minus + field_simps zeta_def powr_diff) + +lemma perzeta_one_half_left': + "perzeta (1 / 2) s = + (if s = 1 then -ln 2 else (2 powr (1 - s) - 1) / (s - 1)) * ((s - 1) * pre_zeta 1 s + 1)" + by (cases "s = 1") (auto simp: perzeta_one_half_left field_simps zeta_def hurwitz_zeta_def) end diff --git a/thys/Zeta_Function/Zeta_Laurent_Expansion.thy b/thys/Zeta_Function/Zeta_Laurent_Expansion.thy new file mode 100644 --- /dev/null +++ b/thys/Zeta_Function/Zeta_Laurent_Expansion.thy @@ -0,0 +1,481 @@ +section \The Laurent series expansion of $\zeta$ at 1\ +theory Zeta_Laurent_Expansion + imports Zeta_Function +begin + +text \ + In this section, we shall derive the Laurent series expansion of $\zeta(s)$ at $s = 1$, which + is of the form + \[\zeta(s) = \frac{1}{s-1} + \sum_{n=0}^\infty \frac{(-1)^n\,\gamma_n}{n!} (s-1)^n\] + where the $\gamma_n$ are the \<^emph>\Stieltjes constants\. Notably, $\gamma_0$ is equal to + the Euler--Mascheroni constant $\gamma$. +\ + +subsection \Definition of the Stieltjes constants\ + +text \ + We define the Stieltjes constants by their infinite series form, since it is fairly + easy to show the convergence of the series by the comparison test. +\ +definition%important stieltjes_gamma :: "nat \ 'a :: real_algebra_1" where + "stieltjes_gamma n = + of_real (\k. ln (k+1) ^ n / (k+1) - (ln (k+2) ^ (n+1) - ln (k+1) ^ (n + 1)) / (n + 1))" + +lemma stieltjes_gamma_0 [simp]: "stieltjes_gamma 0 = euler_mascheroni" + using euler_mascheroni_sum_real by (simp add: sums_iff stieltjes_gamma_def field_simps) + +lemma stieltjes_gamma_summable: + "summable (\k. ln (k+1) ^ n / (k+1) - (ln (k+2) ^ (n+1) - ln (k+1) ^ (n + 1)) / (n + 1))" + (is "summable ?f") +proof (rule summable_comparison_test_bigo) + (* TODO: good real_asymp example *) + (* TODO: investigate how to make this more automatic *) + have "eventually (\x::real. ln x ^ n - ln x ^ (n+1) * (inverse (ln x) * (1 + real n)) * + inverse (real n + 1) = 0) at_top" + using eventually_gt_at_top[of 1] by eventually_elim (auto simp: field_simps) + thus "?f \ O(\k. k powr (-3/2))" + by real_asymp +qed (simp_all add: summable_real_powr_iff) + +lemma of_real_stieltjes_gamma [simp]: "of_real (stieltjes_gamma k) = stieltjes_gamma k" + by (simp add: stieltjes_gamma_def) + +lemma sums_stieltjes_gamma: + "(\k. ln (k+1) ^ n / (k+1) - (ln (k+2) ^ (n+1) - ln (k+1) ^ (n + 1)) / (n + 1)) + sums stieltjes_gamma n" + using stieltjes_gamma_summable[of n] unfolding stieltjes_gamma_def by (simp add: summable_sums) + +text \ + We can now derive the alternative definition of the Stieltjes constants as a limit. + This limit can also be written in the Euler--MacLaurin-style form + \[\lim\limits_{m\to\infty} \left(\sum\limits_{k=1}^m \frac{\ln^n k}{k} - + \int_1^m \frac{\ln^n x}{x}\,\text{d}x\right)\,,\] + which is perhaps a bit more illuminating. +\ +lemma stieltjes_gamma_real_limit_form: + "(\m. (\k = 1..m. ln (real k) ^ n / real k) - ln (real m) ^ (n + 1) / real (n + 1)) + \ stieltjes_gamma n" +proof - + have "(\m::nat. \k stieltjes_gamma n" + using sums_stieltjes_gamma[of n] by (simp add: add_ac sums_def) + also have "(\m::nat. \km::nat. (\k=1..m. ln k ^ n / k) - ln (m + 1) ^ (n + 1) / (n + 1))" + (is "?lhs = ?rhs") + proof (rule ext, goal_cases) + fix m :: nat + have "(\kkkkk=1..m. ln k ^ n / k)" + by (rule sum.reindex_bij_witness[of _ "\k. k-1" Suc]) auto + also have "(\km. (\k = 1..m. ln k ^ n / k) - ln (m + 1) ^ (n + 1) / (n + 1)) + \ stieltjes_gamma n" . + have **: "(\m. ln (m + 1) ^ (n + 1) / (n + 1) - ln m ^ (n + 1) / (n + 1)) \ 0" + by real_asymp + from tendsto_add[OF * **] show ?thesis by (simp add: algebra_simps) +qed + +lemma stieltjes_gamma_limit_form: + "(\m. of_real ((\k=1..m. ln (real k) ^ n / real k) - ln (real m) ^ (n + 1) / real (n + 1))) + \ (stieltjes_gamma n :: 'a :: real_normed_algebra_1)" +proof - + have "(\m. of_real ((\k=1..m. ln (real k) ^ n / real k) - ln m ^ (n + 1) / real (n + 1))) + \ (of_real (stieltjes_gamma n) :: 'a)" + using stieltjes_gamma_real_limit_form[of n] by (intro tendsto_of_real) (auto simp: add_ac) + thus ?thesis by simp +qed + +lemma stieltjes_gamma_real_altdef: + "(stieltjes_gamma n :: real) = + lim (\m. (\k = 1..m. ln (real k) ^ n / real k) - + ln (real m) ^ (n + 1) / real (n + 1))" + by (rule sym, rule limI, rule stieltjes_gamma_real_limit_form) + + +subsection \Proof of the Laurent expansion\ + +text \ + We shall follow the proof by Briggs and Chowla~\cite{briggs55}, which examines the entire + function $g(s) = (2^{1-s}-1)\zeta(s)$. They determine the value of $g^{(k)}(1)$ in two + different ways: First by the Dirichlet series of $g$ and then by its power series expansion + around 1. We shall do the same here. +\ + +context + fixes g and G1 G2 G2' G :: "complex fps" and A :: "nat \ complex" + defines "g \ perzeta (1 / 2)" + defines "G1 \ fps_shift 1 (fps_exp (-ln 2 :: complex) - 1)" + defines "G2 \ fps_expansion (\s. (s - 1) * pre_zeta 1 s + 1) 1" + defines "G2' \ fps_expansion (pre_zeta 1) 1" + defines "G \ G1 * G2" + defines "A \ fps_nth G2" +begin + +text \ + @{term "G1"}, @{term "G2"}, @{term "G2'"}, and @{term "G2"} are the formal power series + expansions of functions around \s = 1\ of the entire functions + + \<^item> $(2^{1-s} - 1) / (s - 1)$, + + \<^item> $(s - 1) \zeta(s)$, + + \<^item> $\zeta(s) - \frac{1}{s-1}$, + + \<^item> $(2^{1-s}-1) \zeta(s)$, + + respectively. + + Our goal is to determine the coefficients of @{term G2'}, and we shall do so + by determining the coefficients of @{term G2} (which are the same, but shifted by 1). + This in turn will be done by determining the coefficients of @{term "G = G1 * G2"}. + + Note that $(2^{1-s} - 1) \zeta(s)$ is written as @{term "perzeta (1/2)"} in Isabelle + (using the periodic \\\ function) and the analytic continuation of $\zeta(s) - \frac{1}{s-1}$ + is written as @{term "pre_zeta 1 s"} (@{const pre_zeta} is an artefact from the definition of + @{const zeta}, which comes in useful here). +\ + +lemma stieltjes_gamma_aux1: "(\n. (-1)^(n+1) * ln(n+1)^k / (n+1)) sums ((-1)^k * (deriv^^k) g 1)" +proof - + define H where "H = fds_perzeta (1 / 2)" + have conv: "conv_abscissa H < 1" unfolding H_def + by (rule le_less_trans[OF conv_abscissa_perzeta']) (use fraction_not_in_ints[of 2 1] in auto) + have [simp]: "eval_fds H s = g s" if "Re s > 0" for s + unfolding H_def g_def using fraction_not_in_ints[of 2 1] that + by (subst perzeta_altdef2) auto + have ev: "eventually (\s. s \ {s. Re s > 0}) (nhds 1)" + by (intro eventually_nhds_in_open open_halfspace_Re_gt) auto + have [simp]: "(deriv ^^ k) (eval_fds H) 1 = (deriv ^^ k) g 1" + by (intro higher_deriv_cong_ev eventually_mono[OF ev]) auto + + have "fds_converges ((fds_deriv ^^ k) H) 1" + by (intro fds_converges le_less_trans[OF conv_abscissa_higher_deriv_le]) + (use conv in \simp add: one_ereal_def\) + hence "(\n. fds_nth ((fds_deriv ^^ k) H) (n+1) / real (n+1)) sums eval_fds ((fds_deriv ^^ k) H) 1" + by (simp add: fds_converges_altdef) + also have "eval_fds ((fds_deriv ^^ k) H) 1 = (deriv ^^ k) (eval_fds H) 1" + using conv by (intro eval_fds_higher_deriv) (auto simp: one_ereal_def) + also have "(\n. fds_nth ((fds_deriv ^^ k) H) (n+1) / real (n+1)) = + (\n. (-1)^k * (-1)^(n+1) * ln (real (n+1)) ^ k / (n+1))" + by (auto simp: fds_nth_higher_deriv algebra_simps H_def fds_perzeta_one_half Ln_Reals_eq) + finally have "(\n. (- 1) ^ k * complex_of_real ((-1)^(n+1) * ln (real (n+1)) ^ k / real (n+1))) sums + ((deriv ^^ k) g 1)" by (simp add: algebra_simps) + + hence "(\n. (-1)^k * ((-1)^k * complex_of_real ((-1)^(n+1) * ln (real (n+1)) ^ k / real (n+1)))) sums + ((-1)^k * (deriv ^^ k) g 1)" by (intro sums_mult) + also have "(\n. (-1)^k * ((-1)^k * complex_of_real ((-1)^(n+1) * ln (real (n+1)) ^ k / real (n+1)))) = + (\n. complex_of_real ((-1)^(n+1) * ln (real (n+1)) ^ k / real (n+1)))" + by (intro ext) auto + finally show ?thesis . +qed + +lemma stieltjes_gamma_aux2: "(deriv^^k) g 1 = fact k * fps_nth G k" + and stieltjes_gamma_aux3: "G2 = fps_X * G2' + 1" +proof - + have [simp]: "fps_conv_radius G1 = \" + using fps_conv_radius_diff[of "fps_exp (-Ln 2)" 1] by (simp add: G1_def) + have "fps_conv_radius G2 \ \" + unfolding G2_def by (intro conv_radius_fps_expansion holomorphic_intros) auto + hence [simp]: "fps_conv_radius G2 = \" + by simp + have "fps_conv_radius G2' \ \" + unfolding G2'_def by (intro conv_radius_fps_expansion holomorphic_intros) auto + hence [simp]: "fps_conv_radius G2' = \" + by simp + have [simp]: "fps_conv_radius G = \" + using fps_conv_radius_mult[of G1 G2] by (simp add: G_def) + + have eval_G1: "eval_fps G1 (s - 1) = + (if s = 1 then -ln 2 else (2 powr (1 - s) - 1) / (s - 1))" for s + unfolding G1_def using fps_conv_radius_diff[of "fps_exp (-Ln 2)" 1] + by (subst eval_fps_shift) + (auto intro!: subdegree_geI simp: eval_fps_diff powr_def exp_diff exp_minus algebra_simps) + have eval_G2: "eval_fps G2 (s - 1) = (s - 1) * pre_zeta 1 s + 1" for s + unfolding G2_def by (subst eval_fps_expansion[where r = \]) (auto intro!: holomorphic_intros) + have eval_G: "eval_fps G (s - 1) = g s" for s + unfolding G_def by (simp add: eval_fps_mult eval_G1 eval_G2 g_def perzeta_one_half_left') + have eval_G': "eval_fps G s = g (1 + s)" for s + using eval_G[of "s + 1"] by (simp add: add_ac) + have eval_G2': "eval_fps G2' (s - 1) = pre_zeta 1 s" for s + unfolding G2'_def by (intro eval_fps_expansion[where r = \]) (auto intro!: holomorphic_intros) + + show "G2 = fps_X * G2' + 1" + proof (intro eval_fps_eqD always_eventually allI) + have *: "fps_conv_radius (fps_X * G2') = \" + using fps_conv_radius_mult[of fps_X G2'] by simp + from * show "fps_conv_radius (fps_X * G2' + 1) > 0" + using fps_conv_radius_add[of "fps_X * G2'" 1] by auto + show "eval_fps G2 s = eval_fps (fps_X * G2' + 1) s" for s + using * eval_G2[of "1 + s"] eval_G2'[of "1 + s"] + by (simp add: eval_fps_add eval_fps_mult) + qed auto + + have "G = fps_expansion g 1" + proof (rule eval_fps_eqD) + have "fps_conv_radius (fps_expansion g 1) \ \" + using fraction_not_in_ints[of 2 1] + by (intro conv_radius_fps_expansion) (auto intro!: holomorphic_intros simp: g_def) + thus "fps_conv_radius (fps_expansion g 1) > 0" by simp + next + have "eval_fps (fps_expansion g 1) z = g (1 + z)" for z + using fraction_not_in_ints[of 2 1] + by (subst eval_fps_expansion'[where r = \]) (auto simp: g_def intro!: holomorphic_intros) + thus "eventually (\z. eval_fps G z = eval_fps (fps_expansion g 1) z) (nhds 0)" + by (simp add: eval_G') + qed auto + thus "(deriv ^^ k) g 1 = fact k * fps_nth G k" + by (simp add: fps_eq_iff fps_expansion_def) +qed + +lemma stieltjes_gamma_aux4: "fps_nth G k = (\i=1..k+1. (-ln 2)^i * A (k-(i-1)) / fact i)" +proof - + have "fps_nth G k = (\i\k. fps_nth G1 i * A (k - i))" + unfolding G_def fps_mult_nth A_def by (intro sum.cong) auto + also have "\ = (\i\k. (-ln 2)^(i+1) * A (k - i) / fact (i+1))" + by (simp add: G1_def algebra_simps) + also have "\ = (\i=1..k+1. (-ln 2)^i * A (k-(i-1)) / fact i)" + by (intro sum.reindex_bij_witness[of _ "\i. i-1" Suc]) (auto simp: Suc_diff_Suc) + finally show ?thesis . +qed + +lemma stieltjes_gamma_aux5: "(\tk x. (\n=1..x. ln(real n)^k / real n) - + ln (real x)^(k+1) / real(k+1) - stieltjes_gamma k)" + have h_eq: "(\n=1..x. ln n ^ k / n) = ln x^(k+1) / real (k+1) + stieltjes_gamma k + h k x" + for k x :: nat by (simp add: h_def) + define h' where "h' = (\x. \t=0..k. (k choose t) * ln 2 ^ (k - t) * h t x)" + define S1 where "S1 = (\x. (\t=0..k. (k choose t) * ln 2 ^ (k - t) * ln x ^ (t + 1) / (t + 1)))" + define S2 where "S2 = (\x. (\t=0..k. (k choose t) * ln 2 ^ (k - t) * ln x ^ (t + 1) / (k + 1)))" + + have [THEN filterlim_compose, tendsto_intros]: "h t \ 0" for t + using tendsto_diff[OF stieltjes_gamma_real_limit_form[of t] tendsto_const[of "stieltjes_gamma t"]] + by (simp add: h_def) + + have eq: "(\n=1..2 * x. (-1)^(n+1) * ln n ^ k / n) = + ln 2 ^ (k+1) / real (k+1) - + (\t 0" for x :: nat + proof - + have "2 * (\n=1..x. ln (2*n)^k/(2*n)) = + (\n=1..x. \t=0..k. 1/n * (k choose t) * ln 2 ^ (k-t) * ln n ^ t)" + unfolding sum_distrib_left + proof (rule sum.cong) + fix n :: nat assume n: "n \ {1..x}" + have "2 * (ln (2*n)^k / (2*n)) = 1/n * (ln n + ln 2) ^ k" + using n by (simp add: ln_mult add_ac) + also have "(ln n + ln 2) ^ k = (\t=0..k. (k choose t) * ln 2 ^ (k-t) * ln n ^ t)" + by (subst binomial_ring, rule sum.cong) auto + also have "1/n * \ = (\t=0..k. 1/n * (k choose t) * ln 2 ^ (k-t) * ln n ^ t)" + by (subst sum_distrib_left) (simp add: mult_ac) + finally show "2 * (ln (2*n)^k / (2*n)) = \" . + qed auto + also have "\ = (\t=0..k. \n=1..x. 1/n * (k choose t) * ln 2 ^ (k-t) * ln n ^ t)" + by (rule sum.swap) + also have "\ = (\t=0..k. (k choose t) * ln 2 ^ (k - t) * + (ln x ^ (t+1) / (t+1) + stieltjes_gamma t + h t x))" + proof (rule sum.cong) + fix t :: nat assume t: "t \ {0..k}" + have "(\n=1..x. 1/n * (k choose t) * ln 2 ^ (k-t) * ln n ^ t) = + (k choose t) * ln 2 ^ (k - t) * (\n=1..x. ln n ^ t / n)" + by (subst sum_distrib_left) (simp add: mult_ac) + also have "(\n=1..x. ln n ^ t / n) = ln x ^ (t+1) / (t+1) + stieltjes_gamma t + h t x" + using h_eq[of t] by simp + finally show "(\n=1..x. 1/n * (k choose t) * ln 2 ^ (k-t) * ln n ^ t) = + (k choose t) * ln 2 ^ (k - t) * \" . + qed simp_all + also have "\ = (\t=0..k. (k choose t) / (t + 1) * ln 2 ^ (k - t) * ln x ^ (t + 1)) + + (\t=0..k. (k choose t) * ln 2 ^ (k - t) * stieltjes_gamma t) + h' x" + by (simp add: ring_distribs sum.distrib h'_def) + also have "(\t=0..k. (k choose t) / (t + 1) * ln 2 ^ (k - t) * ln x ^ (t + 1)) = + (\t=0..k. (Suc k choose Suc t) / (k + 1) * ln 2 ^ (k - t) * ln x ^ (t + 1))" + proof (intro sum.cong refl, goal_cases) + case (1 t) + have "of_nat (k choose t) * (of_nat (k + 1) :: real) = of_nat ((k choose t) * (k + 1))" + by (simp only: of_nat_mult) + also have "(k choose t) * (k + 1) = (Suc k choose Suc t) * (t + 1)" + using Suc_times_binomial_eq[of k t] by (simp add: algebra_simps) + also have "of_nat \ = of_nat (Suc k choose Suc t) * (of_nat (t + 1) :: real)" + by (simp only: of_nat_mult) + finally have *: "of_nat (k choose t) / of_nat (t + 1) = + (of_nat (Suc k choose Suc t) / (k + 1) :: real)" + by (simp add: divide_simps flip: of_nat_Suc del: binomial_Suc_Suc) + show ?case by (simp only: *) + qed + also have "\ = (\t=1..Suc k. (Suc k choose t) / (k + 1) * ln 2 ^ (Suc k - t) * ln x ^ t)" + by (intro sum.reindex_bij_witness[of _ "\t. t-1" Suc]) auto + also have "{1..Suc k} = {..Suc k} - {0}" by auto + also have "(\t\\. (Suc k choose t) / (k + 1) * ln 2 ^ (Suc k - t) * ln x ^ t) = + (\t\Suc k. (Suc k choose t) / (k + 1) * ln 2 ^ (Suc k - t) * ln x ^ t) - + ln 2 ^ Suc k / (k + 1)" + by (subst sum_diff1) auto + also have "(\t\Suc k. (Suc k choose t) / (k + 1) * ln 2 ^ (Suc k - t) * ln x ^ t) = + (ln x + ln 2) ^ Suc k / (k + 1)" + unfolding binomial_ring by (subst sum_divide_distrib) (auto simp: algebra_simps) + also have "ln x + ln 2 = ln (2 * x)" + using \x > 0\ by (simp add: ln_mult) + finally have eq1: "2 * (\n=1..x. ln (real (2*n))^k / real (2*n)) = + ln (real (2*x))^(k+1) / real (k+1) - ln 2^(k+1) / real (k+1) + + (\t=0..k. (k choose t) * ln 2^(k - t) * stieltjes_gamma t) + h' x" + by (simp add: algebra_simps) + + have eq2: "(\n=1..2*x. ln n ^ k / n) = ln (real (2*x))^(k+1) / real (k+1) + stieltjes_gamma k + h k (2*x)" + by (simp only: h_eq) + + have "(\n=1..2*x. (-1)^(n+1) * ln n ^ k / n) = + (\n=1..2*x. ln n ^ k / n - 2 * (if even n then ln n ^ k / n else 0))" + by (intro sum.cong) auto + also have "\ = (\n=1..2*x. ln n ^ k / n) - + 2 * (\n=1..2*x. if even n then ln n ^ k / n else 0)" + by (simp only: sum_subtractf sum_distrib_left) + also have "(\n=1..2*x. if even n then ln n ^ k / n else 0) = + (\n | n \ {1..2*x} \ even n. ln n ^ k / n)" + by (intro sum.mono_neutral_cong_right) auto + also have "\ = (\n=1..x. ln (real (2*n)) ^ k / real (2*n))" + by (intro sum.reindex_bij_witness[of _ "\n. 2*n" "\n. n div 2"]) auto + also have "(\n=1..2*x. ln n ^ k / n) - 2 * \ = + ln 2^(k+1) / real (k+1) - + ((\t=0..k. (k choose t) * ln 2^(k - t) * stieltjes_gamma t) - stieltjes_gamma k) + + h k (2*x) - h' x" + using arg_cong2[OF eq1 eq2, of "(-)"] by simp + also have "{0..k} = insert k {..t\\. (k choose t) * ln 2^(k - t) * stieltjes_gamma t) - stieltjes_gamma k = + (\t ln 2 ^ (k+1) / real (k+1) - + (\tx. ?rhs x = ?lhs x) sequentially" + using eventually_gt_at_top[of 0] by eventually_elim (simp only: eq) + ultimately have *: "?lhs \ ln 2 ^ (k+1) / real (k+1) - + (\tx. \n=1..2*x. (-1)^(n+1) * ln (real n)^k / real n) = + (\x. \n<2*x. -((-1)^(n+1) * ln (real (n+1))^k / real (n+1)))" + by (intro ext sum.reindex_bij_witness[of _ Suc "\n. n - 1"]) (auto simp: power_diff) + also have "\ = (\x. -(\n<2*x. ((-1)^(n+1) * ln (real (n+1))^k / real (n+1))))" + by (subst sum_negf) auto + finally have *: "\ \ (ln 2 ^ (k+1) / real (k+1) - + (\tx. (\n<2*x. complex_of_real ((-1)^(n+1) * ln (real (n+1))^k / real (n+1)))) + \ -(ln 2 ^ (k+1) / of_nat (k+1) - + (\t _") + using tendsto_of_real[OF tendsto_minus[OF *], where ?'a = complex] + by (simp add: Ln_Reals_eq) + + moreover have "?lhs' \ ((- 1) ^ k * (deriv ^^ k) g 1)" + proof - + have **: "filterlim (\n::nat. 2 * n) sequentially sequentially" by real_asymp + have "(\x. (\n<2*x. complex_of_real ((-1)^(n+1) * ln (real (n+1))^k / real (n+1)))) + \ ((- 1) ^ k * (deriv ^^ k) g 1)" + by (rule filterlim_compose[OF _ **]) (use stieltjes_gamma_aux1 in \simp add: sums_def\) + thus ?thesis . + qed + + ultimately have "-(ln 2 ^ (k+1) / of_nat (k+1) - + (\tti=1..k+1. (-Ln 2) ^ i * A (k-(i-1)) / fact i)" +proof - + have "(\ti=1..k + 1. (-Ln 2) ^ i * A (k - (i - 1)) / fact i)" + by (rule stieltjes_gamma_aux4) + finally show ?thesis by (simp add: mult_ac) +qed + +theorem higher_deriv_pre_zeta_1_1: "(deriv ^^ k) (pre_zeta 1) 1 = (-1) ^ k * stieltjes_gamma k" +proof - + have eq: "A k = (if k = 0 then 1 else (-1)^(k+1) * stieltjes_gamma (k - 1) / fact (k - 1))" for k + proof (induction k rule: less_induct) + case (less k) + show ?case + proof (cases "k = 0") + case True + with stieltjes_gamma_aux6[of 0] show ?thesis by simp + next + case False + have "k * Ln 2 * stieltjes_gamma (k - 1) + + (\tt\insert (k-1) {..ti = 1..k + 1. (- Ln 2) ^ i * A (k - (i - 1)) / fact i)" + using stieltjes_gamma_aux6[of k] by (simp add: algebra_simps) + also have "{1..k+1} = {1,k+1} \ {2..k}" by auto + also have "(- 1) ^ k * fact k * (\i\\. (- Ln 2) ^ i * A (k - (i - 1)) / fact i) = + (\i=2..k. (-1)^k * fact k * (- Ln 2) ^ i * A (k - (i - 1)) / fact i) + -Ln 2 * A k * (- 1) ^ k * fact k + + (-Ln 2)^(k+1) * A 0 / fact (k+1) * (- 1) ^ k * fact k" + using False by (subst sum.union_disjoint) + (auto simp: algebra_simps sum_distrib_left sum_distrib_right) + also have "(\i=2..k. (-1)^k * fact k * (-Ln 2) ^ i * A (k-(i-1)) / fact i) = + (\ii. k - i" "\i. k - i"]) + (auto simp: binomial_fact Suc_diff_le less field_simps power_neg_one_If) + finally have "k * Ln 2 * stieltjes_gamma (k - 1) = + (-1)^(k+1) * fact k * Ln 2 * A k" + using False by (simp add: less power_minus') + also have "\ * (-1)^(k+1) / fact k / Ln 2 = A k" + by simp + also have "k * Ln 2 * stieltjes_gamma (k - 1) * (-1)^(k+1) / fact k / Ln 2 = + (-1)^(k+1) * stieltjes_gamma (k - 1) / fact (k - 1)" + using False by (simp add: field_simps fact_reduce) + finally have "A k = (- 1) ^ (k + 1) * stieltjes_gamma (k - 1) / fact (k - 1)" .. + thus ?thesis using False by simp + qed + qed + + have "fps_nth G2' k = fps_nth G2 (Suc k)" + by (simp add: stieltjes_gamma_aux3) + also have "\ = A (Suc k)" + by (simp add: A_def) + also have "\ = (-1) ^ k * stieltjes_gamma k / fact k" + by (simp add: eq) + finally show "(deriv ^^ k) (pre_zeta 1) 1 = (-1) ^ k * stieltjes_gamma k" + by (simp add: G2'_def fps_eq_iff fps_expansion_def) +qed + +corollary pre_zeta_1_1 [simp]: "pre_zeta 1 1 = euler_mascheroni" + using higher_deriv_pre_zeta_1_1[of 0] by simp + +corollary zeta_minus_pole_limit: "(\s. zeta s - 1 / (s - 1)) \1\ euler_mascheroni" +proof (rule Lim_transform_eventually) + show "eventually (\s. pre_zeta 1 s = zeta s - 1 / (s - 1)) (at 1)" + by (auto simp: zeta_minus_pole_eq [symmetric] eventually_at_filter) + have "isCont (pre_zeta 1) 1" + by (intro continuous_intros) auto + thus "pre_zeta 1 \1\ euler_mascheroni" + by (simp add: isCont_def) +qed + +corollary fps_expansion_pre_zeta_1_1: + "fps_expansion (pre_zeta 1) 1 = Abs_fps (\n. (-1)^n * stieltjes_gamma n / fact n)" + by (simp add: fps_expansion_def higher_deriv_pre_zeta_1_1) + +end + +end \ No newline at end of file diff --git a/thys/Zeta_Function/Zeta_Library.thy b/thys/Zeta_Function/Zeta_Library.thy new file mode 100644 --- /dev/null +++ b/thys/Zeta_Function/Zeta_Library.thy @@ -0,0 +1,897 @@ +section \Various preliminary material\ +theory Zeta_Library +imports + "HOL-Complex_Analysis.Complex_Analysis" + "HOL-Real_Asymp.Real_Asymp" + "Dirichlet_Series.Dirichlet_Series_Analysis" +begin + +subsection \Facts about limits\ + +lemma at_within_altdef: + "at x within A = (INF S\{S. open S \ x \ S}. principal (S \ (A - {x})))" + unfolding at_within_def nhds_def inf_principal [symmetric] + by (subst INF_inf_distrib [symmetric]) (auto simp: INF_constant) + +lemma tendsto_at_left_realI_sequentially: + fixes f :: "real \ 'b::first_countable_topology" + assumes *: "\X. filterlim X (at_left c) sequentially \ (\n. f (X n)) \ y" + shows "(f \ y) (at_left c)" +proof - + obtain A where A: "decseq A" "open (A n)" "y \ A n" "nhds y = (INF n. principal (A n))" for n + by (rule nhds_countable[of y]) (rule that) + + have "\m. \dx\{d<.. A m" + proof (rule ccontr) + assume "\ (\m. \dx\{d<.. A m)" + then obtain m where **: "\d. d < c \ \x\{d<.. A m" + by auto + have "\X. \n. (f (X n) \ A m \ X n < c) \ X (Suc n) > c - max 0 ((c - X n) / 2)" + proof (intro dependent_nat_choice, goal_cases) + case 1 + from **[of "c - 1"] show ?case by auto + next + case (2 x n) + with **[of "c - max 0 (c - x) / 2"] show ?case by force + qed + then obtain X where X: "\n. f (X n) \ A m" "\n. X n < c" "\n. X (Suc n) > c - max 0 ((c - X n) / 2)" + by auto + have X_ge: "X n \ c - (c - X 0) / 2 ^ n" for n + proof (induction n) + case (Suc n) + have "c - (c - X 0) / 2 ^ Suc n = c - (c - (c - (c - X 0) / 2 ^ n)) / 2" + by simp + also have "c - (c - (c - (c - X 0) / 2 ^ n)) / 2 \ c - (c - X n) / 2" + by (intro diff_left_mono divide_right_mono Suc diff_right_mono) auto + also have "\ = c - max 0 ((c - X n) / 2)" + using X[of n] by (simp add: max_def) + also have "\ < X (Suc n)" + using X[of n] by simp + finally show ?case by linarith + qed auto + + have "X \ c" + proof (rule tendsto_sandwich) + show "eventually (\n. X n \ c) sequentially" + using X by (intro always_eventually) (auto intro!: less_imp_le) + show "eventually (\n. X n \ c - (c - X 0) / 2 ^ n) sequentially" + using X_ge by (intro always_eventually) auto + qed real_asymp+ + hence "filterlim X (at_left c) sequentially" + by (rule tendsto_imp_filterlim_at_left) + (use X in \auto intro!: always_eventually less_imp_le\) + from topological_tendstoD[OF *[OF this] A(2, 3), of m] X(1) show False + by auto + qed + + then obtain d where d: "d m < c" "x \ {d m<.. f x \ A m" for m x + by metis + have ***: "at_left c = (INF S\{S. open S \ c \ S}. principal (S \ {..m. {d m<..}"]) auto +qed + +lemma + shows at_right_PInf [simp]: "at_right (\ :: ereal) = bot" + and at_left_MInf [simp]: "at_left (-\ :: ereal) = bot" +proof - + have "{(\::ereal)<..} = {}" "{..<-(\::ereal)} = {}" + by auto + thus "at_right (\ :: ereal) = bot" "at_left (-\ :: ereal) = bot" + by (simp_all add: at_within_def) +qed + +lemma tendsto_at_left_erealI_sequentially: + fixes f :: "ereal \ 'b::first_countable_topology" + assumes *: "\X. filterlim X (at_left c) sequentially \ (\n. f (X n)) \ y" + shows "(f \ y) (at_left c)" +proof (cases c) + case [simp]: PInf + have "((\x. f (ereal x)) \ y) at_top" using assms + by (intro tendsto_at_topI_sequentially assms) + (simp_all flip: ereal_tendsto_simps add: o_def filterlim_at) + thus ?thesis + by (simp add: at_left_PInf filterlim_filtermap) +next + case [simp]: MInf + thus ?thesis by auto +next + case [simp]: (real c') + have "((\x. f (ereal x)) \ y) (at_left c')" + proof (intro tendsto_at_left_realI_sequentially assms) + fix X assume *: "filterlim X (at_left c') sequentially" + show "filterlim (\n. ereal (X n)) (at_left c) sequentially" + by (rule filterlim_compose[OF _ *]) + (simp add: sequentially_imp_eventually_within tendsto_imp_filterlim_at_left) + qed + thus ?thesis + by (simp add: at_left_ereal filterlim_filtermap) +qed + +lemma tendsto_at_right_realI_sequentially: + fixes f :: "real \ 'b::first_countable_topology" + assumes *: "\X. filterlim X (at_right c) sequentially \ (\n. f (X n)) \ y" + shows "(f \ y) (at_right c)" +proof - + obtain A where A: "decseq A" "open (A n)" "y \ A n" "nhds y = (INF n. principal (A n))" for n + by (rule nhds_countable[of y]) (rule that) + + have "\m. \d>c. \x\{c<.. A m" + proof (rule ccontr) + assume "\ (\m. \d>c. \x\{c<.. A m)" + then obtain m where **: "\d. d > c \ \x\{c<.. A m" + by auto + have "\X. \n. (f (X n) \ A m \ X n > c) \ X (Suc n) < c + max 0 ((X n - c) / 2)" + proof (intro dependent_nat_choice, goal_cases) + case 1 + from **[of "c + 1"] show ?case by auto + next + case (2 x n) + with **[of "c + max 0 (x - c) / 2"] show ?case by force + qed + then obtain X where X: "\n. f (X n) \ A m" "\n. X n > c" "\n. X (Suc n) < c + max 0 ((X n - c) / 2)" + by auto + have X_le: "X n \ c + (X 0 - c) / 2 ^ n" for n + proof (induction n) + case (Suc n) + have "X (Suc n) < c + max 0 ((X n - c) / 2)" + by (intro X) + also have "\ = c + (X n - c) / 2" + using X[of n] by (simp add: field_simps max_def) + also have "\ \ c + (c + (X 0 - c) / 2 ^ n - c) / 2" + by (intro add_left_mono divide_right_mono Suc diff_right_mono) auto + also have "\ = c + (X 0 - c) / 2 ^ Suc n" + by simp + finally show ?case by linarith + qed auto + + have "X \ c" + proof (rule tendsto_sandwich) + show "eventually (\n. X n \ c) sequentially" + using X by (intro always_eventually) (auto intro!: less_imp_le) + show "eventually (\n. X n \ c + (X 0 - c) / 2 ^ n) sequentially" + using X_le by (intro always_eventually) auto + qed real_asymp+ + hence "filterlim X (at_right c) sequentially" + by (rule tendsto_imp_filterlim_at_right) + (use X in \auto intro!: always_eventually less_imp_le\) + from topological_tendstoD[OF *[OF this] A(2, 3), of m] X(1) show False + by auto + qed + + then obtain d where d: "d m > c" "x \ {c<.. f x \ A m" for m x + by metis + have ***: "at_right c = (INF S\{S. open S \ c \ S}. principal (S \ {c<..}))" + by (simp add: at_within_altdef) + from d show ?thesis + unfolding *** A using A(1,2) by (intro filterlim_base[of _ "\m. {.. 'b::first_countable_topology" + assumes *: "\X. filterlim X (at_right c) sequentially \ (\n. f (X n)) \ y" + shows "(f \ y) (at_right c)" +proof (cases c) + case [simp]: MInf + have "((\x. f (-ereal x)) \ y) at_top" using assms + by (intro tendsto_at_topI_sequentially assms) + (simp_all flip: uminus_ereal.simps ereal_tendsto_simps add: o_def filterlim_at) + thus ?thesis + by (simp add: at_right_MInf filterlim_filtermap at_top_mirror) +next + case [simp]: PInf + thus ?thesis by auto +next + case [simp]: (real c') + have "((\x. f (ereal x)) \ y) (at_right c')" + proof (intro tendsto_at_right_realI_sequentially assms) + fix X assume *: "filterlim X (at_right c') sequentially" + show "filterlim (\n. ereal (X n)) (at_right c) sequentially" + by (rule filterlim_compose[OF _ *]) + (simp add: sequentially_imp_eventually_within tendsto_imp_filterlim_at_right) + qed + thus ?thesis + by (simp add: at_right_ereal filterlim_filtermap) +qed + +proposition analytic_continuation': + assumes hol: "f holomorphic_on S" "g holomorphic_on S" + and "open S" and "connected S" + and "U \ S" and "\ \ S" + and "\ islimpt U" + and fU0 [simp]: "\z. z \ U \ f z = g z" + and "w \ S" + shows "f w = g w" + using analytic_continuation[OF holomorphic_on_diff[OF hol] assms(3-7) _ assms(9)] assms(8) + by simp + + +subsection \Various facts about integrals\ + +lemma continuous_on_imp_set_integrable_cbox: + fixes h :: "'a :: euclidean_space \ 'b :: euclidean_space" + assumes "continuous_on (cbox a b) h" + shows "set_integrable lborel (cbox a b) h" +proof - + from assms have "h absolutely_integrable_on cbox a b" + by (rule absolutely_integrable_continuous) + moreover have "(\x. indicat_real (cbox a b) x *\<^sub>R h x) \ borel_measurable borel" + by (rule borel_measurable_continuous_on_indicator) (use assms in auto) + ultimately show ?thesis + unfolding set_integrable_def using assms by (subst (asm) integrable_completion) auto +qed + +lemma set_nn_integral_cong: + assumes "M = M'" "A = B" "\x. x \ space M \ A \ f x = g x" + shows "set_nn_integral M A f = set_nn_integral M' B g" + using assms unfolding assms(1,2) by (intro nn_integral_cong) (auto simp: indicator_def) + +lemma set_integrable_bound: + fixes f :: "'a \ 'b::{banach, second_countable_topology}" + and g :: "'a \ 'c::{banach, second_countable_topology}" + assumes "set_integrable M A f" "set_borel_measurable M A g" + assumes "AE x in M. x \ A \ norm (g x) \ norm (f x)" + shows "set_integrable M A g" + unfolding set_integrable_def +proof (rule Bochner_Integration.integrable_bound) + from assms(1) show "integrable M (\x. indicator A x *\<^sub>R f x)" + by (simp add: set_integrable_def) + from assms(2) show "(\x. indicat_real A x *\<^sub>R g x) \ borel_measurable M" + by (simp add: set_borel_measurable_def) + from assms(3) show "AE x in M. norm (indicat_real A x *\<^sub>R g x) \ norm (indicat_real A x *\<^sub>R f x)" + by eventually_elim (simp add: indicator_def) +qed + +(* TODO replace version in library. Better name? *) +lemma nn_integral_has_integral_lebesgue: + fixes f :: "'a::euclidean_space \ real" + assumes nonneg: "\x. x \ \ \ 0 \ f x" and I: "(f has_integral I) \" + shows "integral\<^sup>N lborel (\x. indicator \ x * f x) = I" +proof - + from I have "(\x. indicator \ x *\<^sub>R f x) \ lebesgue \\<^sub>M borel" + by (rule has_integral_implies_lebesgue_measurable) + then obtain f' :: "'a \ real" + where [measurable]: "f' \ borel \\<^sub>M borel" and eq: "AE x in lborel. indicator \ x * f x = f' x" + by (auto dest: completion_ex_borel_measurable_real) + + from I have "((\x. abs (indicator \ x * f x)) has_integral I) UNIV" + using nonneg by (simp add: indicator_def if_distrib[of "\x. x * f y" for y] cong: if_cong) + also have "((\x. abs (indicator \ x * f x)) has_integral I) UNIV \ ((\x. abs (f' x)) has_integral I) UNIV" + using eq by (intro has_integral_AE) auto + finally have "integral\<^sup>N lborel (\x. abs (f' x)) = I" + by (rule nn_integral_has_integral_lborel[rotated 2]) auto + also have "integral\<^sup>N lborel (\x. abs (f' x)) = integral\<^sup>N lborel (\x. abs (indicator \ x * f x))" + using eq by (intro nn_integral_cong_AE) auto + also have "(\x. abs (indicator \ x * f x)) = (\x. indicator \ x * f x)" + using nonneg by (auto simp: indicator_def fun_eq_iff) + finally show ?thesis . +qed + + +subsection \Uniform convergence of integrals\ + +lemma has_absolute_integral_change_of_variables_1': + fixes f :: "real \ real" and g :: "real \ real" + assumes S: "S \ sets lebesgue" + and der_g: "\x. x \ S \ (g has_field_derivative g' x) (at x within S)" + and inj: "inj_on g S" + shows "(\x. \g' x\ *\<^sub>R f(g x)) absolutely_integrable_on S \ + integral S (\x. \g' x\ *\<^sub>R f(g x)) = b + \ f absolutely_integrable_on (g ` S) \ integral (g ` S) f = b" +proof - + have "(\x. \g' x\ *\<^sub>R vec (f(g x)) :: real ^ 1) absolutely_integrable_on S \ + integral S (\x. \g' x\ *\<^sub>R vec (f(g x))) = (vec b :: real ^ 1) + \ (\x. vec (f x) :: real ^ 1) absolutely_integrable_on (g ` S) \ + integral (g ` S) (\x. vec (f x)) = (vec b :: real ^ 1)" + using assms unfolding has_field_derivative_iff_has_vector_derivative + by (intro has_absolute_integral_change_of_variables_1 assms) auto + thus ?thesis + by (simp add: absolutely_integrable_on_1_iff integral_on_1_eq) +qed + +lemma set_nn_integral_lborel_eq_integral: + fixes f::"'a::euclidean_space \ real" + assumes "set_borel_measurable borel A f" + assumes "\x. x \ A \ 0 \ f x" "(\\<^sup>+x\A. f x \lborel) < \" + shows "(\\<^sup>+x\A. f x \lborel) = integral A f" +proof - + have eq: "(\\<^sup>+x\A. f x \lborel) = (\\<^sup>+x. ennreal (indicator A x * f x) \lborel)" + by (intro nn_integral_cong) (auto simp: indicator_def) + also have "\ = integral UNIV (\x. indicator A x * f x)" + using assms eq by (intro nn_integral_lborel_eq_integral) + (auto simp: indicator_def set_borel_measurable_def) + also have "integral UNIV (\x. indicator A x * f x) = integral A (\x. indicator A x * f x)" + by (rule integral_spike_set) (auto simp: indicator_def) + also have "\ = integral A f" + by (rule integral_cong) (auto simp: indicator_def) + finally show ?thesis . +qed + +lemma nn_integral_has_integral_lebesgue': + fixes f :: "'a::euclidean_space \ real" + assumes nonneg: "\x. x \ \ \ 0 \ f x" and I: "(f has_integral I) \" + shows "integral\<^sup>N lborel (\x. ennreal (f x) * indicator \ x) = ennreal I" +proof - + have "integral\<^sup>N lborel (\x. ennreal (f x) * indicator \ x) = + integral\<^sup>N lborel (\x. ennreal (indicator \ x * f x))" + by (intro nn_integral_cong) (auto simp: indicator_def) + also have "\ = ennreal I" + using assms by (intro nn_integral_has_integral_lebesgue) + finally show ?thesis . +qed + +lemma uniform_limit_set_lebesgue_integral: + fixes f :: "'a \ 'b :: euclidean_space \ 'c :: {banach, second_countable_topology}" + assumes "set_integrable lborel X' g" + assumes [measurable]: "X' \ sets borel" + assumes [measurable]: "\y. y \ Y \ set_borel_measurable borel X' (f y)" + assumes "\y. y \ Y \ (AE t\X' in lborel. norm (f y t) \ g t)" + assumes "eventually (\x. X x \ sets borel \ X x \ X') F" + assumes "filterlim (\x. set_lebesgue_integral lborel (X x) g) + (nhds (set_lebesgue_integral lborel X' g)) F" + shows "uniform_limit Y + (\x y. set_lebesgue_integral lborel (X x) (f y)) + (\y. set_lebesgue_integral lborel X' (f y)) F" +proof (rule uniform_limitI, goal_cases) + case (1 \) + have integrable_g: "set_integrable lborel U g" + if "U \ sets borel" "U \ X'" for U + by (rule set_integrable_subset[OF assms(1)]) (use that in auto) + have "eventually (\x. dist (set_lebesgue_integral lborel (X x) g) + (set_lebesgue_integral lborel X' g) < \) F" + using \\ > 0\ assms by (auto simp: tendsto_iff) + from this show ?case using \eventually (\_. _ \ _) F\ + proof eventually_elim + case (elim x) + hence [measurable]:"X x \ sets borel" and "X x \ X'" by auto + have integrable: "set_integrable lborel U (f y)" + if "y \ Y" "U \ sets borel" "U \ X'" for y U + apply (rule set_integrable_subset) + apply (rule set_integrable_bound[OF assms(1)]) + apply (use assms(3) that in \simp add: set_borel_measurable_def\) + using assms(4)[OF \y \ Y\] apply eventually_elim apply force + using that apply simp_all + done + show ?case + proof + fix y assume "y \ Y" + have "dist (set_lebesgue_integral lborel (X x) (f y)) + (set_lebesgue_integral lborel X' (f y)) = + norm (set_lebesgue_integral lborel X' (f y) - + set_lebesgue_integral lborel (X x) (f y))" + by (simp add: dist_norm norm_minus_commute) + also have "set_lebesgue_integral lborel X' (f y) - + set_lebesgue_integral lborel (X x) (f y) = + set_lebesgue_integral lborel (X' - X x) (f y)" + unfolding set_lebesgue_integral_def + apply (subst Bochner_Integration.integral_diff [symmetric]) + unfolding set_integrable_def [symmetric] + apply (rule integrable; (fact | simp)) + apply (rule integrable; fact) + apply (intro Bochner_Integration.integral_cong) + apply (use \X x \ X'\ in \auto simp: indicator_def\) + done + also have "norm \ \ (\t\X'-X x. norm (f y t) \lborel)" + by (intro set_integral_norm_bound integrable) (fact | simp)+ + also have "AE t\X' - X x in lborel. norm (f y t) \ g t" + using assms(4)[OF \y \ Y\] by eventually_elim auto + with \y \ Y\ have "(\t\X'-X x. norm (f y t) \lborel) \ (\t\X'-X x. g t \lborel)" + by (intro set_integral_mono_AE set_integrable_norm integrable integrable_g) auto + also have "\ = (\t\X'. g t \lborel) - (\t\X x. g t \lborel)" + unfolding set_lebesgue_integral_def + apply (subst Bochner_Integration.integral_diff [symmetric]) + unfolding set_integrable_def [symmetric] + apply (rule integrable_g; (fact | simp)) + apply (rule integrable_g; fact) + apply (intro Bochner_Integration.integral_cong) + apply (use \X x \ X'\ in \auto simp: indicator_def\) + done + also have "\ \ dist (\t\X x. g t \lborel) (\t\X'. g t \lborel)" + by (simp add: dist_norm) + also have "\ < \" by fact + finally show "dist (set_lebesgue_integral lborel (X x) (f y)) + (set_lebesgue_integral lborel X' (f y)) < \" . + qed + qed +qed + +lemma integral_dominated_convergence_at_right: + fixes s :: "real \ 'a \ 'b::{banach, second_countable_topology}" and w :: "'a \ real" + and f :: "'a \ 'b" and M and c :: real + assumes "f \ borel_measurable M" "\t. s t \ borel_measurable M" "integrable M w" + assumes lim: "AE x in M. ((\i. s i x) \ f x) (at_right c)" + assumes bound: "\\<^sub>F i in at_right c. AE x in M. norm (s i x) \ w x" + shows "((\t. integral\<^sup>L M (s t)) \ integral\<^sup>L M f) (at_right c)" +proof (rule tendsto_at_right_realI_sequentially) + fix X :: "nat \ real" assume X: "filterlim X (at_right c) sequentially" + from filterlim_iff[THEN iffD1, OF this, rule_format, OF bound] + obtain N where w: "\n. N \ n \ AE x in M. norm (s (X n) x) \ w x" + by (auto simp: eventually_sequentially) + + show "(\n. integral\<^sup>L M (s (X n))) \ integral\<^sup>L M f" + proof (rule LIMSEQ_offset, rule integral_dominated_convergence) + show "AE x in M. norm (s (X (n + N)) x) \ w x" for n + by (rule w) auto + show "AE x in M. (\n. s (X (n + N)) x) \ f x" + using lim + proof eventually_elim + fix x assume "((\i. s i x) \ f x) (at_right c)" + then show "(\n. s (X (n + N)) x) \ f x" + by (intro LIMSEQ_ignore_initial_segment filterlim_compose[OF _ X]) + qed + qed fact+ +qed + +lemma integral_dominated_convergence_at_left: + fixes s :: "real \ 'a \ 'b::{banach, second_countable_topology}" and w :: "'a \ real" + and f :: "'a \ 'b" and M and c :: real + assumes "f \ borel_measurable M" "\t. s t \ borel_measurable M" "integrable M w" + assumes lim: "AE x in M. ((\i. s i x) \ f x) (at_left c)" + assumes bound: "\\<^sub>F i in at_left c. AE x in M. norm (s i x) \ w x" + shows "((\t. integral\<^sup>L M (s t)) \ integral\<^sup>L M f) (at_left c)" +proof (rule tendsto_at_left_realI_sequentially) + fix X :: "nat \ real" assume X: "filterlim X (at_left c) sequentially" + from filterlim_iff[THEN iffD1, OF this, rule_format, OF bound] + obtain N where w: "\n. N \ n \ AE x in M. norm (s (X n) x) \ w x" + by (auto simp: eventually_sequentially) + + show "(\n. integral\<^sup>L M (s (X n))) \ integral\<^sup>L M f" + proof (rule LIMSEQ_offset, rule integral_dominated_convergence) + show "AE x in M. norm (s (X (n + N)) x) \ w x" for n + by (rule w) auto + show "AE x in M. (\n. s (X (n + N)) x) \ f x" + using lim + proof eventually_elim + fix x assume "((\i. s i x) \ f x) (at_left c)" + then show "(\n. s (X (n + N)) x) \ f x" + by (intro LIMSEQ_ignore_initial_segment filterlim_compose[OF _ X]) + qed + qed fact+ +qed + +lemma uniform_limit_interval_integral_right: + fixes f :: "'a \ real \ 'c :: {banach, second_countable_topology}" + assumes "interval_lebesgue_integrable lborel a b g" + assumes [measurable]: "\y. y \ Y \ set_borel_measurable borel (einterval a b) (f y)" + assumes "\y. y \ Y \ (AE t\einterval a b in lborel. norm (f y t) \ g t)" + assumes "a < b" + shows "uniform_limit Y (\b' y. LBINT t=a..b'. f y t) (\y. LBINT t=a..b. f y t) (at_left b)" +proof (cases "Y = {}") + case False + have g_nonneg: "AE t\einterval a b in lborel. g t \ 0" + proof - + from \Y \ {}\ obtain y where "y \ Y" by auto + from assms(3)[OF this] show ?thesis + by eventually_elim (auto elim: order.trans[rotated]) + qed + + have ev: "eventually (\b'. b' \ {a<..a < b\ by (intro eventually_at_leftI) + with \a < b\ have "?thesis \ uniform_limit Y (\b' y. \t\einterval a (min b b'). f y t \lborel) + (\y. \t\einterval a b. f y t \lborel) (at_left b)" + by (intro filterlim_cong arg_cong2[where f = uniformly_on]) + (auto simp: interval_lebesgue_integral_def fun_eq_iff min_def + intro!: eventually_mono[OF ev]) + also have \ + proof (rule uniform_limit_set_lebesgue_integral[where g = g], goal_cases) + show "\\<^sub>F b' in at_left b. einterval a (min b b') \ sets borel \ + einterval a (min b b') \ einterval a b" + using ev by eventually_elim (auto simp: einterval_def) + next + show "((\b'. set_lebesgue_integral lborel (einterval a (min b b')) g) \ + set_lebesgue_integral lborel (einterval a b) g) (at_left b)" + unfolding set_lebesgue_integral_def + proof (intro tendsto_at_left_erealI_sequentially integral_dominated_convergence) + have *: "set_borel_measurable borel (einterval a b) g" + using assms(1) less_imp_le[OF \a < b\] + by (simp add: interval_lebesgue_integrable_def set_integrable_def set_borel_measurable_def) + show "(\x. indicat_real (einterval a b) x *\<^sub>R g x) \ borel_measurable lborel" + using * by (simp add: set_borel_measurable_def) + fix X :: "nat \ ereal" and n :: nat + have "set_borel_measurable borel (einterval a (min b (X n))) g" + by (rule set_borel_measurable_subset[OF *]) (auto simp: einterval_def) + thus "(\x. indicat_real (einterval a (min b (X n))) x *\<^sub>R g x) \ borel_measurable lborel" + by (simp add: set_borel_measurable_def) + next + fix X :: "nat \ ereal" + assume X: "filterlim X (at_left b) sequentially" + show "AE x in lborel. (\n. indicat_real (einterval a (min b (X n))) x *\<^sub>R g x) + \ indicat_real (einterval a b) x *\<^sub>R g x" + proof (rule AE_I2) + fix x :: real + have "(\t. indicator (einterval a (min b (X t))) x :: real) \ + indicator (einterval a b) x" + proof (cases "x \ einterval a b") + case False + hence "x \ einterval a (min b (X t))"for t by (auto simp: einterval_def) + with False show ?thesis by (simp add: indicator_def) + next + case True + with \a < b\ have "eventually (\t. t \ {max a x<..t. X t \ {max a x<..t. indicator (einterval a (min b (X t))) x = (1 :: real)) sequentially" + by eventually_elim (use True in \auto simp: indicator_def einterval_def\) + from tendsto_eventually[OF this] and True show ?thesis + by (simp add: indicator_def) + qed + thus "(\n. indicat_real (einterval a (min b (X n))) x *\<^sub>R g x) + \ indicat_real (einterval a b) x *\<^sub>R g x" by (intro tendsto_intros) + qed + next + fix X :: "nat \ ereal" and n :: nat + show "AE x in lborel. norm (indicator (einterval a (min b (X n))) x *\<^sub>R g x) \ + indicator (einterval a b) x *\<^sub>R g x" + using g_nonneg by eventually_elim (auto simp: indicator_def einterval_def) + qed (use assms less_imp_le[OF \a < b\] in + \auto simp: interval_lebesgue_integrable_def set_integrable_def\) + qed (use assms in \auto simp: interval_lebesgue_integrable_def\) + finally show ?thesis . +qed auto + +lemma uniform_limit_interval_integral_left: + fixes f :: "'a \ real \ 'c :: {banach, second_countable_topology}" + assumes "interval_lebesgue_integrable lborel a b g" + assumes [measurable]: "\y. y \ Y \ set_borel_measurable borel (einterval a b) (f y)" + assumes "\y. y \ Y \ (AE t\einterval a b in lborel. norm (f y t) \ g t)" + assumes "a < b" + shows "uniform_limit Y (\a' y. LBINT t=a'..b. f y t) (\y. LBINT t=a..b. f y t) (at_right a)" +proof (cases "Y = {}") + case False + have g_nonneg: "AE t\einterval a b in lborel. g t \ 0" + proof - + from \Y \ {}\ obtain y where "y \ Y" by auto + from assms(3)[OF this] show ?thesis + by eventually_elim (auto elim: order.trans[rotated]) + qed + + have ev: "eventually (\b'. b' \ {a<..a < b\ by (intro eventually_at_rightI) + with \a < b\ have "?thesis \ uniform_limit Y (\a' y. \t\einterval (max a a') b. f y t \lborel) + (\y. \t\einterval a b. f y t \lborel) (at_right a)" + by (intro filterlim_cong arg_cong2[where f = uniformly_on]) + (auto simp: interval_lebesgue_integral_def fun_eq_iff max_def + intro!: eventually_mono[OF ev]) + also have \ + proof (rule uniform_limit_set_lebesgue_integral[where g = g], goal_cases) + show "\\<^sub>F a' in at_right a. einterval (max a a') b \ sets borel \ + einterval (max a a') b \ einterval a b" + using ev by eventually_elim (auto simp: einterval_def) + next + show "((\a'. set_lebesgue_integral lborel (einterval (max a a') b) g) \ + set_lebesgue_integral lborel (einterval a b) g) (at_right a)" + unfolding set_lebesgue_integral_def + proof (intro tendsto_at_right_erealI_sequentially integral_dominated_convergence) + have *: "set_borel_measurable borel (einterval a b) g" + using assms(1) less_imp_le[OF \a < b\] + by (simp add: interval_lebesgue_integrable_def set_integrable_def set_borel_measurable_def) + show "(\x. indicat_real (einterval a b) x *\<^sub>R g x) \ borel_measurable lborel" + using * by (simp add: set_borel_measurable_def) + fix X :: "nat \ ereal" and n :: nat + have "set_borel_measurable borel (einterval (max a (X n)) b) g" + by (rule set_borel_measurable_subset[OF *]) (auto simp: einterval_def) + thus "(\x. indicat_real (einterval (max a (X n)) b) x *\<^sub>R g x) \ borel_measurable lborel" + by (simp add: set_borel_measurable_def) + next + fix X :: "nat \ ereal" + assume X: "filterlim X (at_right a) sequentially" + show "AE x in lborel. (\n. indicat_real (einterval (max a (X n)) b) x *\<^sub>R g x) + \ indicat_real (einterval a b) x *\<^sub>R g x" + proof (rule AE_I2) + fix x :: real + have "(\t. indicator (einterval (max a (X t)) b) x :: real) \ + indicator (einterval a b) x" + proof (cases "x \ einterval a b") + case False + hence "x \ einterval (max a (X t)) b"for t by (auto simp: einterval_def) + with False show ?thesis by (simp add: indicator_def) + next + case True + with \a < b\ have "eventually (\t. t \ {a<..t. X t \ {a<..t. indicator (einterval (max a (X t)) b) x = (1 :: real)) sequentially" + by eventually_elim (use True in \auto simp: indicator_def einterval_def\) + from tendsto_eventually[OF this] and True show ?thesis + by (simp add: indicator_def) + qed + thus "(\n. indicat_real (einterval (max a (X n)) b) x *\<^sub>R g x) + \ indicat_real (einterval a b) x *\<^sub>R g x" by (intro tendsto_intros) + qed + next + fix X :: "nat \ ereal" and n :: nat + show "AE x in lborel. norm (indicator (einterval (max a (X n)) b) x *\<^sub>R g x) \ + indicator (einterval a b) x *\<^sub>R g x" + using g_nonneg by eventually_elim (auto simp: indicator_def einterval_def) + qed (use assms less_imp_le[OF \a < b\] in + \auto simp: interval_lebesgue_integrable_def set_integrable_def\) + qed (use assms in \auto simp: interval_lebesgue_integrable_def\) + finally show ?thesis . +qed auto + +lemma uniform_limit_interval_integral_sequentially: + fixes f :: "'a \ real \ 'c :: {banach, second_countable_topology}" + assumes "interval_lebesgue_integrable lborel a b g" + assumes [measurable]: "\y. y \ Y \ set_borel_measurable borel (einterval a b) (f y)" + assumes "\y. y \ Y \ (AE t\einterval a b in lborel. norm (f y t) \ g t)" + assumes a': "filterlim a' (at_right a) sequentially" + assumes b': "filterlim b' (at_left b) sequentially" + assumes "a < b" + shows "uniform_limit Y (\n y. LBINT t=a' n..b' n. f y t) + (\y. LBINT t=a..b. f y t) sequentially" +proof (cases "Y = {}") + case False + have g_nonneg: "AE t\einterval a b in lborel. g t \ 0" + proof - + from \Y \ {}\ obtain y where "y \ Y" by auto + from assms(3)[OF this] show ?thesis + by eventually_elim (auto elim: order.trans[rotated]) + qed + + have ev: "eventually (\n. a < a' n \ a' n < b' n \ b' n < b) sequentially" + proof - + from ereal_dense2[OF \a < b\] obtain t where t: "a < ereal t" "ereal t < b" by blast + from t have "eventually (\n. a' n \ {a<..n. b' n \ {t<..n. a < a' n \ a' n < b' n \ b' n < b) sequentially" + by eventually_elim auto + qed + + have "?thesis \ uniform_limit Y (\n y. \t\einterval (max a (a' n)) (min b (b' n)). f y t \lborel) + (\y. \t\einterval a b. f y t \lborel) sequentially" using \a < b\ + by (intro filterlim_cong arg_cong2[where f = uniformly_on]) + (auto simp: interval_lebesgue_integral_def fun_eq_iff min_def max_def + intro!: eventually_mono[OF ev]) + also have \ + proof (rule uniform_limit_set_lebesgue_integral[where g = g], goal_cases) + show "\\<^sub>F n in sequentially. einterval (max a (a' n)) (min b (b' n)) \ sets borel \ + einterval (max a (a' n)) (min b (b' n)) \ einterval a b" + using ev by eventually_elim (auto simp: einterval_def) + next + show "((\n. set_lebesgue_integral lborel (einterval (max a (a' n)) (min b (b' n))) g) \ + set_lebesgue_integral lborel (einterval a b) g) sequentially" + unfolding set_lebesgue_integral_def + proof (intro integral_dominated_convergence) + have *: "set_borel_measurable borel (einterval a b) g" + using assms(1) less_imp_le[OF \a < b\] + by (simp add: interval_lebesgue_integrable_def set_integrable_def set_borel_measurable_def) + show "(\x. indicat_real (einterval a b) x *\<^sub>R g x) \ borel_measurable lborel" + using * by (simp add: set_borel_measurable_def) + fix n :: nat + have "set_borel_measurable borel (einterval (max a (a' n)) (min b (b' n))) g" + by (rule set_borel_measurable_subset[OF *]) (auto simp: einterval_def) + thus "(\x. indicat_real (einterval (max a (a' n)) (min b (b' n))) x *\<^sub>R g x) \ borel_measurable lborel" + by (simp add: set_borel_measurable_def) + next + show "AE x in lborel. (\n. indicat_real (einterval (max a (a' n)) (min b (b' n))) x *\<^sub>R g x) + \ indicat_real (einterval a b) x *\<^sub>R g x" + proof (rule AE_I2) + fix x :: real + have "(\t. indicator (einterval (max a (a' t)) (min b (b' t))) x :: real) \ + indicator (einterval a b) x" + proof (cases "x \ einterval a b") + case False + hence "x \ einterval (max a (a' t)) (min b (b' t))"for t + by (auto simp: einterval_def) + with False show ?thesis by (simp add: indicator_def) + next + case True + with \a < b\ have "eventually (\t. t \ {a<..n. x \ {a' n<..n. a' n \ {a<..n. b' n \ {x<..n. x \ {a' n<..t. indicator (einterval (max a (a' t)) (min b (b' t))) x = (1 :: real)) sequentially" + by eventually_elim (use True in \auto simp: indicator_def einterval_def\) + from tendsto_eventually[OF this] and True show ?thesis + by (simp add: indicator_def) + qed + thus "(\n. indicat_real (einterval (max a (a' n)) (min b (b' n))) x *\<^sub>R g x) + \ indicat_real (einterval a b) x *\<^sub>R g x" by (intro tendsto_intros) + qed + next + fix X :: "nat \ ereal" and n :: nat + show "AE x in lborel. norm (indicator (einterval (max a (a' n)) (min b (b' n))) x *\<^sub>R g x) \ + indicator (einterval a b) x *\<^sub>R g x" + using g_nonneg by eventually_elim (auto simp: indicator_def einterval_def) + qed (use assms less_imp_le[OF \a < b\] in + \auto simp: interval_lebesgue_integrable_def set_integrable_def\) + qed (use assms in \auto simp: interval_lebesgue_integrable_def\) + finally show ?thesis . +qed auto + +lemma interval_lebesgue_integrable_combine: + assumes "interval_lebesgue_integrable lborel A B f" + assumes "interval_lebesgue_integrable lborel B C f" + assumes "set_borel_measurable borel (einterval A C) f" + assumes "A \ B" "B \ C" + shows "interval_lebesgue_integrable lborel A C f" +proof - + have meas: "set_borel_measurable borel (einterval A B \ einterval B C) f" + by (rule set_borel_measurable_subset[OF assms(3)]) (use assms in \auto simp: einterval_def\) + have "set_integrable lborel (einterval A B \ einterval B C) f" + using assms by (intro set_integrable_Un) (auto simp: interval_lebesgue_integrable_def) + also have "?this \ set_integrable lborel (einterval A C) f" + proof (cases "B \ {\, -\}") + case True + with assms have "einterval A B \ einterval B C = einterval A C" + by (auto simp: einterval_def) + thus ?thesis by simp + next + case False + then obtain B' where [simp]: "B = ereal B'" + by (cases B) auto + have "indicator (einterval A C) x = (indicator (einterval A B \ einterval B C) x :: real)" + if "x \ B'" for x using assms(4,5) that + by (cases A; cases C) (auto simp: einterval_def indicator_def) + hence "{x \ space lborel. indicat_real (einterval A B \ einterval B C) x *\<^sub>R f x \ + indicat_real (einterval A C) x *\<^sub>R f x} \ {B'}" by force + thus ?thesis unfolding set_integrable_def using meas assms + by (intro integrable_cong_AE AE_I[of _ _ "{B'}"]) + (simp_all add: set_borel_measurable_def) + qed + also have "\ \ ?thesis" + using order.trans[OF assms(4,5)] by (simp add: interval_lebesgue_integrable_def) + finally show ?thesis . +qed + +lemma interval_lebesgue_integrable_bigo_right: + fixes A B :: real + fixes f :: "real \ real" + assumes "f \ O[at_left B](g)" + assumes cont: "continuous_on {A.. 0" "eventually (\x. norm (f x) \ c * norm (g x)) (at_left B)" + by (elim landau_o.bigE) + then obtain B' where B': "B' < B" "\x. x \ {B'<.. norm (f x) \ c * norm (g x)" + using \A < B\ by (auto simp: Topological_Spaces.eventually_at_left[of A]) + + show ?thesis + proof (rule interval_lebesgue_integrable_combine) + show "interval_lebesgue_integrable lborel A (max A B') f" + using B' assms + by (intro interval_integrable_continuous_on continuous_on_subset[OF cont]) auto + show "set_borel_measurable borel (einterval (ereal A) (ereal B)) f" + using assms by simp + have meas': "set_borel_measurable borel {max A B'<..x. c * g x)" + using assms by (simp add: interval_lebesgue_integrable_def) + thus "set_integrable lborel {max A B'<..x. c * g x)" + by (rule set_integrable_subset) auto + next + fix x assume "x \ {max A B'<.. c * norm (g x)" + by (intro B') auto + also have "\ \ norm (c * g x)" + unfolding norm_mult by (intro mult_right_mono) auto + finally show "norm (f x) \ norm (c * g x)" . + qed (use meas' in \simp_all add: set_borel_measurable_def\) + thus "interval_lebesgue_integrable lborel (ereal (max A B')) (ereal B) f" + unfolding interval_lebesgue_integrable_def einterval_eq_Icc using \B' < B\ assms by simp + qed (use B' assms in auto) +qed + +lemma interval_lebesgue_integrable_bigo_left: + fixes A B :: real + fixes f :: "real \ real" + assumes "f \ O[at_right A](g)" + assumes cont: "continuous_on {A<..B} f" + assumes meas: "set_borel_measurable borel {A<.. 0" "eventually (\x. norm (f x) \ c * norm (g x)) (at_right A)" + by (elim landau_o.bigE) + then obtain A' where A': "A' > A" "\x. x \ {A<.. norm (f x) \ c * norm (g x)" + using \A < B\ by (auto simp: Topological_Spaces.eventually_at_right[of A]) + + show ?thesis + proof (rule interval_lebesgue_integrable_combine) + show "interval_lebesgue_integrable lborel (min B A') B f" + using A' assms + by (intro interval_integrable_continuous_on continuous_on_subset[OF cont]) auto + show "set_borel_measurable borel (einterval (ereal A) (ereal B)) f" + using assms by simp + have meas': "set_borel_measurable borel {A<..x. c * g x)" + using assms by (simp add: interval_lebesgue_integrable_def) + thus "set_integrable lborel {A<..x. c * g x)" + by (rule set_integrable_subset) auto + next + fix x assume "x \ {A<.. c * norm (g x)" + by (intro A') auto + also have "\ \ norm (c * g x)" + unfolding norm_mult by (intro mult_right_mono) auto + finally show "norm (f x) \ norm (c * g x)" . + qed (use meas' in \simp_all add: set_borel_measurable_def\) + thus "interval_lebesgue_integrable lborel (ereal A) (ereal (min B A')) f" + unfolding interval_lebesgue_integrable_def einterval_eq_Icc using \A' > A\ assms by simp + qed (use A' assms in auto) +qed + + +subsection \Other material\ + +(* TODO: Library *) +lemma summable_comparison_test_bigo: + fixes f :: "nat \ real" + assumes "summable (\n. norm (g n))" "f \ O(g)" + shows "summable f" +proof - + from \f \ O(g)\ obtain C where C: "eventually (\x. norm (f x) \ C * norm (g x)) at_top" + by (auto elim: landau_o.bigE) + thus ?thesis + by (rule summable_comparison_test_ev) (insert assms, auto intro: summable_mult) +qed + +lemma fps_expansion_cong: + assumes "eventually (\x. g x = h x) (nhds x)" + shows "fps_expansion g x = fps_expansion h x" +proof - + have "(deriv ^^ n) g x = (deriv ^^ n) h x" for n + by (intro higher_deriv_cong_ev assms refl) + thus ?thesis by (simp add: fps_expansion_def) +qed + +lemma fps_expansion_eq_zero_iff: + assumes "g holomorphic_on ball z r" "r > 0" + shows "fps_expansion g z = 0 \ (\z\ball z r. g z = 0)" +proof + assume *: "\z\ball z r. g z = 0" + have "eventually (\w. w \ ball z r) (nhds z)" + using assms by (intro eventually_nhds_in_open) auto + hence "eventually (\z. g z = 0) (nhds z)" + by eventually_elim (use * in auto) + hence "fps_expansion g z = fps_expansion (\_. 0) z" + by (intro fps_expansion_cong) + thus "fps_expansion g z = 0" + by (simp add: fps_expansion_def fps_zero_def) +next + assume *: "fps_expansion g z = 0" + have "g w = 0" if "w \ ball z r" for w + by (rule holomorphic_fun_eq_0_on_ball[OF assms(1) that]) + (use * in \auto simp: fps_expansion_def fps_eq_iff\) + thus "\w\ball z r. g w = 0" by blast +qed + +lemma fds_nth_higher_deriv: + "fds_nth ((fds_deriv ^^ k) F) = (\n. (-1) ^ k * of_real (ln n) ^ k * fds_nth F n)" + by (induction k) (auto simp: fds_nth_deriv fun_eq_iff simp flip: scaleR_conv_of_real) + +lemma binomial_n_n_minus_one [simp]: "n > 0 \ n choose (n - Suc 0) = n" + by (cases n) auto + +lemma has_field_derivative_complex_powr_right: + "w \ 0 \ ((\z. w powr z) has_field_derivative Ln w * w powr z) (at z within A)" + by (rule DERIV_subset, rule has_field_derivative_powr_right) auto + +lemmas has_field_derivative_complex_powr_right' = + has_field_derivative_complex_powr_right[THEN DERIV_chain2] + +end \ No newline at end of file diff --git a/thys/Zeta_Function/document/root.bib b/thys/Zeta_Function/document/root.bib --- a/thys/Zeta_Function/document/root.bib +++ b/thys/Zeta_Function/document/root.bib @@ -1,31 +1,71 @@ @book{apostol1976analytic, series = "Undergraduate {T}exts in {M}athematics", title = "Introduction to {A}nalytic {N}umber {T}heory", year = 1976, author = "Tom M. Apostol", publisher = "Springer-Verlag", doi = "10.1007/978-1-4757-5579-4", isbn = "978-0-387-90163-3" } @book{newman1998analytic, title={{A}nalytic {N}umber {T}heory}, author={Newman, D.J.}, number={177}, isbn={9780387983080}, lccn={97026431}, series={Graduate Texts in Mathematics}, year={1998}, doi = {10.1007/b98872}, publisher={Springer} } @ARTICLE{harrison2009pnt, author = "John Harrison", title = "Formalizing an analytic proof of the {P}rime {N}umber {T}heorem (Dedicated to {M}ike {G}ordon on the occasion of his 60th birthday)", journal = "Journal of Automated Reasoning", year = 2009, volume = 43, pages = "243--261"} + +@misc{chapman2004, + title={A proof of {H}adjicostas's conjecture}, + author={Robin Chapman}, + year={2004}, + eprint={math/0405478}, + archivePrefix={arXiv}, + primaryClass={math.NT} +} + +@misc{hadjicostas2004, + title={A conjecture-generalization of {S}ondow's formula}, + author={Petros Hadjicostas}, + year={2004}, + eprint={math/0405423}, + archivePrefix={arXiv}, + primaryClass={math.NT} +} + +@article{briggs55, + ISSN = {00029890, 19300972}, + author = {W. E. Briggs and S. Chowla}, + journal = {The American Mathematical Monthly}, + number = {5}, + pages = {323--325}, + publisher = {Mathematical Association of America}, + title = {The Power Series Coefficients of $\zeta(s)$}, + volume = {62}, + year = {1955} +} + +@misc{sondow2002, + title="Double Integrals for {E}uler's Constant and $\ln\frac{4}{\pi}$", + author={Jonathan Sondow}, + year={2002}, + eprint={math/0211148}, + archivePrefix={arXiv}, + primaryClass={math.CA} +} + diff --git a/thys/Zeta_Function/document/root.tex b/thys/Zeta_Function/document/root.tex --- a/thys/Zeta_Function/document/root.tex +++ b/thys/Zeta_Function/document/root.tex @@ -1,43 +1,52 @@ \documentclass[11pt,a4paper]{article} \usepackage{isabelle,isabellesym} \usepackage{amsfonts, amsmath, amssymb} % this should be the last package used \usepackage{pdfsetup} % urls in roman style, theory text in math-similar italics \urlstyle{rm} \isabellestyle{it} \begin{document} \title{The Hurwitz and Riemann $\zeta$ functions} \author{Manuel Eberl} \maketitle \begin{abstract} -This entry builds upon the results about formal and analytic Dirichlet series to define the Hurwitz $\zeta$ function and, -based on that, the Riemann $\zeta$ function. This is done by first defining them for $\mathfrak{R}(z) > 1$ and then successively +This entry builds upon the results about formal and analytic Dirichlet series to define the Hurwitz $\zeta$ function $\zeta(a,s)$ and, +based on that, the Riemann $\zeta$ function $\zeta(s)$. This is done by first defining them for $\mathfrak{R}(z) > 1$ and then successively extending the domain to the left using the Euler--MacLaurin formula. -Some basic results about these functions are also shown, such as their analyticity on $\mathbb{C}\setminus\{1\}$, that they have a simple pole with residue 1 at 1, their non-vanishing for $\mathfrak{R}(s)\geq 1$, their relation to the $\Gamma$ function, and the special values at negative integers and positive even integers -- including the famous $\zeta(-1) = -\frac{1}{12}$ and $\zeta(2) = \frac{\pi^2}{6}$. +Apart from the most basic facts such as analyticity, the following results are provided: +\begin{itemize} +\item the Stieltjes constants and the Laurent expansion of $\zeta(s)$ at $s = 1$ +\item the non-vanishing of $\zeta(s)$ for $\mathfrak{R}(s)\geq 1$ +\item the relationship between $\zeta(a,s)$ and $\Gamma$ +\item the special values at negative integers and positive even integers +\item Hurwitz's formula and the reflection formula for $\zeta(s)$ +\item the Hadjicostas--Chapman formula~\cite{chapman2004,hadjicostas2004} +\end{itemize} -Lastly, the entry also contains Euler's analytic proof of the infinitude of primes, based on the fact that $\zeta(s)$ has a pole at $s = 1$. +The entry also contains Euler's analytic proof of the infinitude of primes, based on the fact that $\zeta(s)$ has a pole at $s = 1$. \end{abstract} +\newpage \tableofcontents \newpage \parindent 0pt\parskip 0.5ex \input{session} \bibliographystyle{abbrv} \bibliography{root} \end{document} %%% Local Variables: %%% mode: latex %%% TeX-master: t %%% End: