theorem R_bounded_recursive (m n : ℕ) (posₘ : 0 < m) (posₙ : 0 < n)
    (rₘ : ∃ N, ramseyProp N (m + 1) n)
    (rₙ : ∃ N, ramseyProp N m (n + 1)) :
    ramseyProp (R(m, n + 1) + R(m + 1, n)) (m + 1) (n + 1) := by

This post aims to formalize the proof of the explicit bound \(R(k,k) \leq 2^{2k-3}\) given in the book:

An induction principle

The “familiar recursion for binomial coefficients” is proven by induction. However, it is not standard induction, proving a property of one natural number by providing proofs for zero and successor. This kind of proof would be straightforward to do in Lean, e.g. using the induction tactic. Instead, we encounter a proof about two natural numbers, using two base cases, and not even starting from zero! Luckily, Lean allows us to express abstract induction principles for more involved proofs, as we have discussed in a previous blog post on this topic. We will now see this technique in action!

First, let us figure out the shape of our motive, namely the statement we would like to prove by induction. There are two variables (\(m\) and \(n\)) of type ℕ, and both are required to be larger or equal 2. Our goal is to prove \(R(m,n) \leq \binom{m+n-1}{m-1}\), which translated to Lean will be of type Prop. Therefore, the type of our motive is

P : ∀ (m n : ℕ) , 2 ≤ m → 2 ≤ n → Prop

and the thing we would like to prove with our inductive proof is

∀ m n leₘ leₙ, P m n leₘ leₙ

Next, we examine the assumptions under which the proof will work out. We observe two base cases,

(baseₙ : ∀ m leₘ, P m 2 leₘ (AtLeastTwo.prop))
(baseₘ : ∀ n leₙ, P 2 n (AtLeastTwo.prop) leₙ)

as well as a recursive statement giving us a proof about \(R(m,n)\) from \(R(m−1, n)\) and \(R(m, n−1)\), which abstracted to P reads as

(succ  : ∀ m n leₘ leₙ, P (m + 1) n (le_succ_of_le leₘ) leₙ →
                        P m (n + 1) leₘ (le_succ_of_le leₙ) →
                        P (m + 1) (n + 1) (le_succ_of_le leₘ) (le_succ_of_le leₙ))

With these, we can write down the signature of our induction principle:

lemma two_le_orth_induction {P : ∀ m n, 2 ≤ m → 2 ≤ n → Prop}
    (baseₙ : ∀ m leₘ,       P m 2 leₘ (AtLeastTwo.prop))
    (baseₘ : ∀ n leₙ,       P 2 n (AtLeastTwo.prop) leₙ)
    (succ  : ∀ m n leₘ leₙ, P (m + 1) n (le_succ_of_le leₘ) leₙ →
                            P m (n + 1) leₘ (le_succ_of_le leₙ) →
                            P (m + 1) (n + 1) (le_succ_of_le leₘ) (le_succ_of_le leₙ)) :
    ∀ m n leₘ leₙ, P m n leₘ leₙ

If we can prove this lemma, for a general P, we will have a tool that allows us to perform inductive proofs of the shape described here, and we will be able to easily formalize our desired result!

We pattern-match on m and n, actually starting at zero and deriving a contradiction from the requirement that they be larger or equal 2:

| 0, _, le₀, _     => (two_ne_zero (eq_zero_of_le_zero le₀)).elim
| _, 0, _, le₀     => (two_ne_zero (eq_zero_of_le_zero le₀)).elim

For the successor pattern we either apply the base assumptions, if m or n are 2, or apply the recursive proof.

| m + 1, n + 1, le_sucₘ, le_sucₙ => by
   cases' le_sucₘ with _ leₘ
   · exact (baseₘ _ _)
   · cases' le_sucₙ with _ leₙ
     · exact (baseₙ _ _)
     · have Pₘ := two_le_orth_induction baseₙ baseₘ succ (m + 1) n (le_succ_of_le leₘ) leₙ
       have Pₙ := two_le_orth_induction baseₙ baseₘ succ m (n + 1) leₘ (le_succ_of_le leₙ)
       exact (succ m n _ _ Pₘ Pₙ)

The existence proof

So far, we have only proven a recursive statement about the Ramsey numbers. To prove our goal, we need a universal statement about existence:

theorem exists_N_ramseyProp {m n : ℕ} (leₘ : 2 ≤ m) (leₙ : 2 ≤ n) :
    (∃ N, ramseyProp N m n) := by

We can use our new induction principle to go from one to the other:

induction' m, n, leₘ, leₙ using two_le_orth_induction with m _ n _ m n leₘ leₙ ind_assump_rₘ ind_assump_rₙ

The infoview helpfully lists the three cases we have to prove now.

3 goals

case baseₙ
m✝ n m : ℕ
leₘ✝ : 2 ≤ m
⊢ ∃ N, ramseyProp N m 2

case baseₘ
m n✝ n : ℕ
leₙ✝ : 2 ≤ n
⊢ ∃ N, ramseyProp N 2 n

case succ
m✝ n✝ m n : ℕ
leₘ : 2 ≤ m
leₙ : 2 ≤ n
rₘ : ∃ N, ramseyProp N (m + 1) n
rₙ : ∃ N, ramseyProp N m (n + 1)
⊢ ∃ N, ramseyProp N (m + 1) (n + 1)

The first two cases follow from lemmata we proved in the previous post establishing prerequisites.

· exact ⟨m, ramseyProp_two⟩
· exact ⟨n, ramseyProp_symm _ _ _ ramseyProp_two⟩

For the last case, a simple invocation of the recursive lemma suffices!

· have := R_bounded_recursive m n (zero_lt_of_lt leₘ) (zero_lt_of_lt leₙ) ind_assump_rₘ ind_assump_rₙ
  exact ⟨R(m, n + 1) + R(m + 1, n), this⟩

The binomial bounds

Our next objective is to confirm the upper bound using the binomial coefficient:

theorem R_le_choose {m n : ℕ} (m1 : 2 ≤ m) (n1 : 2 ≤ n) :
    R(m, n) ≤ (m + n - 2).choose (m - 1) := by

It turns out we can use the same induction principle as before!

induction' m, n, m1, n1 using two_le_orth_induction with m rₘ n _ m n leₘ leₙ ind_assump_rₘ ind_assump_rₙ

Again, the base cases were already established in separate lemmata before.

· have := Nat.le_of_eq (choose_succ_left m m (zero_lt_of_lt rₘ))
  simp_all [ind_start_R_two]
· simp_all [ind_start_two_R]

For the inductive step, we use the existence proof we just made and combine it with the recursive bound.

have Rm_ex : ∃ N, ramseyProp N m (n + 1) := exists_N_ramseyProp leₘ (le_add_right_of_le leₙ)
have Rn_ex : ∃ N, ramseyProp N (m + 1) n := exists_N_ramseyProp (le_add_right_of_le leₘ) leₙ
have N_has_ramseyProp : ramseyProp (R(m,n + 1) + R(m + 1,n)) (m + 1) (n + 1) :=
  R_bounded_recursive _ _ (zero_lt_of_lt leₘ) (zero_lt_of_lt leₙ) Rn_ex Rm_ex

This allows us to write down an inequality chain using the induction hypotheses to arrive at an expression of binomial coefficients!

calc R(m + 1, n + 1)
  _ ≤ R(m, n + 1) + R(m + 1, n)                                     := Nat.sInf_le N_has_ramseyProp
  _ ≤ R(m, n + 1)  + (m + 1 + n - 2).choose (m + 1 - 1)             := by simp_all [R_symm, ind_assump_rₘ]
  _ ≤ (m + (n + 1) - 2).choose (m - 1) + (m + 1 + n - 2).choose m   := by simp [ind_assump_rₙ]

The remainder of the proof is just applications of results about the binomial coefficient.

  _ = (m + (n + 1) - 2).choose (m - 1) + (m + (n + 1) - 2).choose m := by simp [add_assoc, add_comm n 1]
  _ = (m + (n + 1) - 2 + 1).choose m                                := (choose_succ_left (m+(n+1)-2) m (zero_lt_of_lt leₘ)).symm
  _ = (m + 1 + (n + 1) - 2).choose m                                := by rw [add_comm, add_comm m 1, add_assoc, ← Nat.add_sub_assoc (le_add_right_of_le leₘ)]

This concludes the proof of the binomial upper bound! The bound on \(R(k,k)\) now follows by another small inequality chain, with the most important ingredient from mathlib being choose_succ_le_two_pow [20735] .

lemma R_le_two_pow {k : ℕ} (h : 2 ≤ k) : R(k) ≤ 2 ^ (2 * k - 3) := by
  calc R(k)
    _ ≤ (2*k - 2).choose (k - 1)               := by simp [R_le_choose, h, Nat.two_mul]
    _ = ((2 * k - 2 - 1) + 1).choose (k - 1)   := congrFun (congrArg Nat.choose ((Nat.sub_eq_iff_eq_add (le_sub_of_add_le (le_of_succ_le (Nat.mul_le_mul_left 2 h)))).mp rfl)) (k - 1)
    _ ≤ 2 ^ (2 * k - 3)                        := choose_succ_le_two_pow

Recall that we defined the Ramsey number as the infimum over the naturals that have the Ramsey property:

noncomputable def R (m n : ℕ) : ℕ := sInf { N | ramseyProp N m n}

The statement

We note a couple of adjustments we need to make to the statement before we can usefully formalize it in Lean. In our case, “existence of the Ramsey number” means the existence of a natural number that has the Ramsey property. If we show that \(R(m−1, n) + R(m, n−1)\) has the \((m,n)\)-Ramsey property, the stated inequality directly follows from the definition of the infimum. The inequality also does not actually hold for \(m=0\) or \(n=0\), since \(R(0,m) = 0\) and \(R(1,m) = 1\), but \[R(1,1) = 1 > 0 = 0 + 0 = R(0,1) + R(1,0),\] so we require both parameters to be strictly positive. Finally, dealing with subtraction of natural numbers in Lean is tiresome, so we shift everything by \(1\). Given these considerations, we can state the theorem we are going to prove as follows:

theorem R_bounded_recursive (m n : ℕ) (posₘ : 0 < m) (posₙ : 0 < n)
    (rₘ : ∃ N, ramseyProp N (m + 1) n)
    (rₙ : ∃ N, ramseyProp N m (n + 1)) :
    ramseyProp (R(m, n + 1) + R(m + 1, n)) (m + 1) (n + 1) := by

Establishing definitions

The first few sentences of the proof translate nicely into Lean. “ Suppose \(N = R(m − 1, n) + R(m, n − 1)\)…” We shift by 1, and use set instead of the usual let to name the definition.

set N := R(m, n + 1) + R(m + 1, n) with Neq

Next, “consider an arbitrary red-blue coloring of \(K_N\).” The definition of the Ramsey property already quantifies over an arbitrary coloring, so we can use the intro tactic to make it explicit from the goal.

intro V _ _ cardV C _

Now, “for a vertex \(v\), let \(A\) be the set of vertices joined to \(v\) by a red edge, and \(B\) the vertices joined by a blue edge.” We need to ensure that we’re not talking about the empty graph so that we can pick a vertex – we do this by proving the vertex set of our coloring is nonempty, since its cardinality is N and we have already proven the lemma R_pos the prerequisites, stating that 0 < R(m,n) for strictly positive m and n.

have V_nonempty : Nonempty V := by
  rw [← card_pos_iff, cardV]
  exact add_pos (R_pos m (n+1) posₘ (zero_lt_succ n) rₙ) (R_pos (m+1) n (zero_lt_succ m) posₙ rₘ)

Now we can define v and A. Recall that in our encoding of edge colorings, an edge (v,w) is colored red if m an n are nonadjacent in the encoding graph C. Hence, we define A as the neighbor set of v in the complement graph, which is all vertices with an edge to v in Cᶜ and therefore nonadjacent in C (a fact we will have to establish explicitly later).

let v : V := V_nonempty.some
let A := Cᶜ.neighborFinset v

Now, “we find that either \(|A| ≥ R(m − 1, n)\) or \(|B| ≥ R(m, n − 1)\). Suppose |A| ≥R(m −1, n), the other case being analogous.” We again shift by 1 and use the wlog tactic to get two cases:

wlog R_le_cardA : R(m, n + 1) ≤ #A with h

The goal of the first case is to prove that if our theorem statement follows from |A| ≥ R(m − 1, n) and we assume |A| < R(m − 1, n) (that is, |B| ≥ R(m, n − 1)), the theorem statement also follows. The goal of the second case is to prove that if our theorem statement follows from |A| ≥ R(m − 1, n).

The first case: reducing to symmetry

Proving the first case, only shrugged off as “analogous” in the text, is a bit technical. We examine the infoview to find our new state to be the following:

(...)
h : ∀ (m n : ℕ),
  0 < m →
    0 < n →
      (∃ N, ramseyProp N (m + 1) n) →
        (∃ N, ramseyProp N m (n + 1)) →
          let N := R(m,n + 1) + R(m + 1,n);
          N = R(m,n + 1) + R(m + 1,n) →
            ∀ (V : Type) [inst : Fintype V] [inst_1 : DecidableEq V],
              Fintype.card V = N →
                ∀ (C : SimpleGraph V) [inst_2 : DecidableRel C.Adj] (V_nonempty : Nonempty V),
                  let v := V_nonempty.some;
                  let A := Cᶜ.neighborFinset v;
                  R(m,n + 1) ≤ #A → ∃ s, C.IsNIndepSet (m + 1) s ∨ C.IsNClique (n + 1) s
R_le_cardA : ¬R(m,n + 1) ≤ #A
⊢ ∃ s, C.IsNIndepSet (m + 1) s ∨ C.IsNClique (n + 1) s

That’s quite a mouthful, but in essence we need to prove that given the previous context and R(m,n + 1) ≤ #A (this is the assumption called h here), and a proof that ¬R(m,n + 1) ≤ #A (this is the assumption R_le_cardA), we can prove the theorem statement, namely that ramseyProp (R(m, n + 1) + R(m + 1, n)) (m + 1) (n + 1), the definition of is already unfolded in the above infoview.

According to lemma R_symm from the prerequisites, the Ramsey number is symmetric. Also, we know that an N-independent set in a graph is an N-clique in the complement graph, and vice versa. These two facts will be sufficient to provide all the conditions of the hypothesis h! We start by defining B and establishing that |B| ≥ R(m, n − 1) indeed follows from the wlog assumption that |A| < R(m − 1, n).

let B := C.neighborFinset v
have R_le_cardB : R(n, m + 1) ≤ #B := by
      have : Fintype.card V - 1 = Cᶜ.degree v + C.degree v := by simp [degree_compl, degree_lt_card_verts, le_sub_one_of_lt]
      have := calc (R(m, n + 1) + R(n, m + 1)) - 1
          _ = #A + #B          := by rw [@R_symm n, ← Neq, ← cardV, card_neighborFinset_eq_degree]; exact this
          _ < R(m, n + 1) + #B := by simp [lt_of_not_le R_le_cardA]
  exact le_of_add_le_add_left (le_of_pred_lt this)

Next, we rewrite the required things in our context to match the signature of h.

have ex m n := Exists.imp (ramseyProp_symm m n)
apply ex at rₘ; apply ex at rₙ
rw [Neq, @R_symm m, @R_symm (m + 1), add_comm] at cardV
have : #B = Cᶜᶜ.degree v := by simp [B]; congr!; exact (compl_compl C).symm
rw [this] at R_le_cardB

We can now use h to obtain a monochromatic vertex subset of the complement graph Cᶜ.

simp only [forall_const, Nonempty.forall] at h
obtain ⟨s, rs⟩ := h n m posₙ posₘ rₙ rₘ V cardV Cᶜ v R_le_cardB

Rewriting with the mentioned facts about cliques and complements show that the obtained subset is monochromatic with the other color in C.

simp_rw [isNIndepSet_compl, ← isNIndepSet_compl Cᶜ, compl_compl] at rs
exact ⟨s, rs.symm⟩

This concludes the fist case, and lets us continue with the paper proof.

The second case: following the text

Before we continue with the proof, let us establish that the edges connecting v to the vertices in A are indeed colored red.

have A_all_red : ∀ {u}, u ∈ A → ¬ C.Adj v u := by
     intro u a
     simp_all only [mem_neighborFinset, compl_adj, not_false_eq_true, A, v]

The paper proof continues by stating that “(…) by the definition of \(R(m − 1, n)\), there either exists in \(A\) a subset \(A_R\) of size \(m − 1\) all of whose edges are colored red which together with \(v\) yields a red \(K_m\), or there is a subset \(A_B\) of size \(n\) with all edges colored blue.” Recall that we proved the following monotonicity property in the prerequisites:

lemma ramseyProp_mono {m n : ℕ} (N s : ℕ) (h : N ≤ s) (ramseyProp_N : ramseyProp N m n) : ramseyProp s m n := by

By assumption, |A| ≥ R m (n + 1), so the coloring A induces also has the Ramsey property according to this lemma. Hence, there exists a monochromatic subset of A. We call it Aₘ.

let ⟨Aₘ, monochrom⟩ := ramseyProp_mono R_le_cardA (sInf_mem rₙ) _ (card_coe A) C[A].coe

Aₘ is a subtype of the induced graph’s vertices A. We need to embed it into V to talk about corresponding vertices in the big graph C:

set AₘV : Finset V := (Finset.map ⟨Subtype.val, Subtype.val_injective⟩ Aₘ) with AVe

have AₘV_subset_A : AₘV ⊆ A := by
  intro _ memAV
  simp_all
  exact memAV.1

We are now ready to examine the two cases proposed in the paper proof.

cases' monochrom with all_red all_blue

Case one: AₘV has size m with all edges colored red, which together with v yields a red K_(m+1). We define the candidate set:

let Aᵥ := insert v AₘV

It indeed describes an all-red subgraph of C, which we show by establishing pairwise redness of some u, w ∈ Aᵥ.

have C_red : C.IsIndepSet Aᵥ := by
  intro u u_elem_Aᵥ w w_elem_Aᵥ unw

We need to handle the case that u or w happen to be v. It follows from the definition of A.

by_cases uvw : (u = v) ∨ (w = v)
  · have elem_A {x : V} (xnv : v ≠ x) (x_elem_Aᵥ : x ∈ Aᵥ) : x ∈ A := by
      cases' mem_insert.mp x_elem_Aᵥ with xeqv x_elem_AV
      · simp_all only [ne_eq, not_true_eq_false]
      · exact AₘV_subset_A x_elem_AV
    cases uvw
    all_goals simp_all [A]
    intro a
    exact (elem_A (Ne.symm unw) u_elem_Aᵥ) (C.adj_symm a)

Now for the interesting case: two members of Aᵥ that are not v have a red edge. We project them to A…

push_neg at uvw
obtain ⟨wₐ, ⟨wₐelem_Aₘ, cw⟩⟩ := mem_map.mp (mem_of_mem_insert_of_ne w_elem_Aᵥ uvw.right)
obtain ⟨uₐ, ⟨uₐelem_Aₘ, cu⟩⟩ := mem_map.mp (mem_of_mem_insert_of_ne u_elem_Aᵥ uvw.left)
rw [← cw, ← cu]

…and show that the projections are indeed red in the induced coloring.

have : uₐ ≠ wₐ := by intro a; simp_all only [ne_eq]
have := all_red.1 uₐelem_Aₘ wₐelem_Aₘ this
simp [Subgraph.coe_adj, Subgraph.induce_adj] at this
assumption

It remains to show the size of Aᵥ is m+1.

refine ⟨Aᵥ, (Or.inl ⟨C_red, ?_⟩)⟩
have : v ∉ AₘV := fun a => (not_mem_neighborFinset_self Cᶜ v) (AₘV_subset_A a)
simp_all [isNIndepSet_iff, Aᵥ, AₘV]

Case two: if Aₘ is all blue and of size n + 1, we’re done. We chose its embedding as the monochromatic set…

exists AₘV

…and prove it’s an (n + 1)-clique.

have : C.IsNClique (n + 1) AₘV :=
  have isClique : C.IsClique AₘV := by
    simp [AVe, coe_map]
    exact C.induce_isClique all_blue.1
  
  have card_eq : #AₘV = n + 1 := by
    rw [card_map]
    exact all_blue.2
  {isClique, card_eq}
exact Or.inr this

This concludes the proof of the central statement. It remains to resolve this recurrence and use some basic properties of the binomial coefficient to show that the Ramsey number is bounded above by \(2^{2k-3}\) in the next post.

Definition of Ramsey property

Before defining the Ramsey numbers, the book introduces the so-called “Ramsey property” of a complete graph.

We will already diverge from the literal definition in our implementation, because that will make our lives much easier: Since the theorem is only about two-colorings of the complete graph \(K_N\), we don’t need to actually use a data structure assigning colors to graph edges explicitly. Instead, we can represent the set of colorings in questions as the set of graphs \(C\) on \(N\) vertices, and consider an edge \((v, w)\) to be colored blue in \(K_N\) if the vertices \(v\) and \(w\) are adjacent in \(C\), and red if they are nonadjacent. This allows us to use the machinery for cliques and independent sets when talking about the Ramsey property, since our definition translates to the following:

This does not translate to Lean literally, since “a graph on \(N\) vertices” is not a builtin type. Instead, we need to quantify over the vertex types that are finite with N elements. This sorted, we can write down our definition!

def ramseyProp (N m n : ℕ) :=
    ∀ (V : Type) [Fintype V] [DecidableEq V] (_ : Fintype.card V = N)
      (C : SimpleGraph V) [DecidableRel C.Adj],
    ∃ (s : Finset V), (C.IsNIndepSet m s) ∨ (C.IsNClique n s)

Before we continue, let us introduce notation for subgraphs induces by vertex subsets:

notation:max G "[" A "]" => SimpleGraph.Subgraph.induce (⊤ : Subgraph G) (Finset.toSet A)

Definition of Ramsey number

A statement about monotonicity of this property follows:

lemma ramseyProp_mono {m n : ℕ} (N s : ℕ) (h : N ≤ s) (ramseyProp_N : ramseyProp N m n) :
    ramseyProp s m n := by

The proof is omitted in the book, but we spell it out. First, we pick any N-element subset of the vertex set W of our s-graph, and consider the subgraph induced by it.

  intros W _ _ Wcard C _
  rw [← Wcard, ← Fintype.card_fin N] at h
  obtain ⟨A, A_subset, A_card⟩ := exists_subset_card_eq h
  let C' := C[A]

Since \(K_N\) has the Ramsey property, we can find a monochromatic vertex subset A' in the induced subgraph.

    obtain ⟨A', red_or_blue⟩ := ramseyProp_N A (by simp [A_card]) C'.coe

We embed A' back into W.

  use map ⟨Subtype.val, Subtype.val_injective⟩ A'

Since cliques and independent sets in the induced subgraph are also cliques and independent sets in the supergraph, the Ramsey property of the supergraph directly follows with the embedding of A' being monochromatic.

  exact Or.imp (induce_isNIndepSet C).mp (induce_isNClique C) red_or_blue

With this settled, we move on to actually defining the Ramsey number:

We use the sInf instance of Nat to talk about the smallest number of a set. It is noteworthy that this definition is zero if the set is empty, so the Lean definition does not quite match the paper one – existence of a graph with this property is not a prerequisite.

noncomputable def R (m n : ℕ) : ℕ := sInf { N | ramseyProp N m n}

notation:max "R(" m "," n ")" => R m n
notation:max "R(" n ")" => R n n

Note that we need to mark this definition as noncomputable, since finding the minimum of a set requires the set to be non-empty, and we have not yet established the existence of the Ramsey number for all m and n (in fact, this will be the largest effort of this entire proof). We could condition the definition on the existence of a Ramsey number and explicitly pass a proof. For the sake of brevity and since computability is not of the essence here, we will make this concession and profit from the nice results the mathlib already containsabout sInf.

Lemma for induction base case \(R(m, 2) = m\)

Let us establish the inductive principle that will be used to prove the main result, see also the previous post on induction in Lean.

To this end, we will have to first prove that \(K_m\) actually has the \((m,2)\)-property, and then go on to prove that \(K_m\) is actually the smallest graph with this property. The first proof follows the book closely:

lemma ramseyProp_two {m : ℕ} : ramseyProp m m 2 := by
    intro _ _ _ cardV C _
    by_cases all_red : C.IsNIndepSet m univ

In the first case, all edges are red, so we’re done.

    · exact ⟨univ, (Or.inr all_red).symm⟩

In the second case, there is a blue edge, resulting in a blue \(K_2\).

    · simp [isNIndepSet_iff, isIndepSet_iff, Set.Pairwise, card_univ, cardV] at all_red
      obtain ⟨v, ⟨w, ⟨_, vwblue⟩⟩⟩ := all_red
      exact ⟨{v, w}, by simp_all [isNClique_iff]⟩

We can now prove the actual statement:

lemma ind_start_R_two {m : ℕ} : R(m, 2) = m := by

We bound the infimum by \(m\) from above and below. The bound from below follows by considering an all-red \(K_N\), in our representation the graph on \(N\) vertices with no edges ⊥, which has an \(N\)-independent set.

  have m_le_N (N : ℕ) (ram : ramseyProp N m 2) : m ≤ N := by
    obtain ⟨s, h⟩ := ram (Fin N) (Fintype.card_fin N) ⊥
    simp [isNClique_bot_iff] at h
    rw [← h.2]
    exact (card_finset_fin_le s)

The bound from above directly follows from the previous lemma, and we complete the proof.

  have r2 : ramseyProp m m 2 := ramseyProp_two
  exact le_antisymm (Nat.sInf_le r2) (le_csInf ⟨m, r2⟩ m_le_N)

Lemma for symmetry and induction base case

The other base case follows with symmetry, so we first need to establish that.

We start off showing symmetry for the Ramsey property.

lemma ramseyProp_symm (m n N : ℕ) (h : ramseyProp N m n) :
    (ramseyProp N n m) := by

To this end, the hypothesis allows us to find a monochromatic subset in the complement graph.

  intro W _ _ Wcard C _
  obtain ⟨s, red_or_blue⟩ := h W Wcard Cᶜ

The result follows directly from the fact that a clique in a graph is an independent set in its complement and vice versa.

  cases' red_or_blue with c₁ c₂
  · exact ⟨s, Or.inr ((isNIndepSet_compl C).mp c₁)⟩
  · exact ⟨s, (Or.inr ((isNClique_compl C).mp c₂)).symm⟩

This easily transfers to the Ramsey number.

lemma R_symm {m n : ℕ} : R(m,n) = R(n,m) := by
  have {N : ℕ} := Iff.intro (ramseyProp_symm m n N) (ramseyProp_symm n m N)
  simp [R, this]

With this, we obtain our second base case:

lemma ind_start_two_R {m : ℕ} : R(2, m) = m := by
  simp[R_symm]; exact ind_start_R_two

Strict positivity

The proof for the recursive bound that we are going to attempt silently uses the fact that if both summands exist, \(N = R(m - 1, n) + R(m, n - 1)\) is strictly positive, i.e., non-zero, and so we can pick a vertex from \(K_N\). We show that the Ramsey number, if it exists, is positive if both \(m\) and \(n\) are strictly positive.

lemma R_pos (m n : ℕ) (_ : 0 < m) (_ : 0 < n) (h : ∃ N, ramseyProp N m n) :
    0 < R(m, n) := by

To this end, we assume \(0 = R(m, n)\):

  by_contra R0; apply Nat.eq_zero_of_not_pos at R0

Then zero has the ramsey property.

  have : ramseyProp 0 m n := R0 ▸ sInf_mem h

We can hence find \(s\), an \(m\)-independent set or an \(n\)-clique, in the empty graph.

  obtain ⟨s, p⟩ := this (Fin 0) rfl (⊥ : SimpleGraph (Fin 0))

That leads to contradiction, since \(s\) must be empty but \(0 < m,n\).

  simp_rw [isNIndepSet_iff, isNClique_iff,
    eq_zero_of_le_zero (card_finset_fin_le s)] at p
  cases p <;> simp_all

With these prerequisites in place, we are ready to tackle the recursive bound on Ramsey numbers in the next post.

A basic example: Peano’s axiom of induction

Let us consider a basic inductive proof of the form most probably encounter first in their mathematics education: In order to prove that a statement (we call it motive in Lean proofs) motive : (n : Nat) → Prop about a natural number holds for all natural numbers n, it suffices to prove that it holds for n = 0, and that given a proof that it holds for some n : Nat we can derive that it also holds for n + 1, according to Peano’s axiom of induction. The induction tactic makes it straightforward to write such a proof in Lean, as done in this example taken from mathlib about the binomial coefficient:

example (n : Nat) : choose n 2 = n * (n - 1) / 2 := by
  induction' n with n ih
  · simp
  · rw [Nat.triangle_succ n]
    rw [Nat.choose, ih]
    simp [Nat.add_comm]

We actually used the induction' variant of the tactic that allowed us to assign the names n and ih to the induction variable and hypothesis. If we look at the goals the tactic produced here, we see that we are required to provide proofs for the base case 0 and the induction step:

2 goals

case zero
⊢ Nat.choose 0 2 = 0 * (0 - 1) / 2

case succ
n : Nat
ih : n.choose 2 = n * (n - 1) / 2
⊢ (n + 1).choose 2 = (n + 1) * (n + 1 - 1) / 2

Inductive Types and Recursors

That was smooth enough! However, many proofs by induction we encounter don’t follow the exact structure given by Peano’s axiom, or are not even about natural numbers. To formalise such proofs in Lean, we take a more abstract, structural view of induction, as a general method for proving statements of the form \(∀ a \in A, P(a)\), where \(A\) is some domain and \(P(a)\) is some proposition about elements of \(A\).

What do we require of \(A\) so we can make inductive proofs about its members? Each element \(a \in A\) needs to be representable as either an instance of some base cases, or constructed from other elements of \(A\) that are “smaller” than \(a\), meaning that they are closer than \(a\) to some base case according to a (partial) ordering on \(A\). In type theory, the domains of universal quantifications are types, and we say a type \(A\) is an inductive type if each of its members is generated from finite compositions of a finite number of constructors.¹

In Lean, they are defined by using the keyword inductive. Inductive types are so expressive that apart from type universes and dependent function types, all Lean types are inductive types, even though that fact is hiding underneath a thick layer of syntactic sugar. We’ve already encountered a prominent example of an inductive type with Nat, which is defined through one constant constructor zero and one recursive constructor succ:

inductive Nat : Type
| zero : Nat
| succ : Nat → Nat

We see that by definition, all natural numbers in Lean are either 0 or n + 1 for some natural number n, which means it suffices to prove a statement for those two cases to prove it for all of Nat. When we define any inductive type in Lean, this principle (called the recursor or eliminator of the type) is automatically derived from the definition and accessible in the .rec field. Looking at what it came up with for our definition of Nat through #print Nat.rec, we get something that looks suspiciously like Peano’s axiom:

>> recursor Nat.rec.{u} : {motive : Nat → Sort u} →
                          motive Nat.zero →
                          ((n : Nat) → motive n → motive n.succ) →
                          (t : Nat) → motive t

Different Induction Principles

The induction tactic is just a shortcut that allows us to choose the current goal as motive, creating goals for the constructor arguments, and handling variable naming. By default, it uses the recursor of the induction variable’s type as an induction principle specifying the shape of the generated proof though we can influence that choice through the using keyword. We can easily verify that the previous example remains valid when we explicitly demand Nat.rec to be used through induction' n using Nat.rec with n ih.

Mathlib provides a collection of alternative induction principles on Nat for frequently occuring proof techniques:

We can in fact easily reformulate the proof of our previous example using strong_induction_on. Note that it requires us to manually separate out the base case:

example (n : Nat) : choose n 2 = n * (n - 1) / 2 := by
  induction' n using Nat.strong_induction_on with k ik
  by_cases h : k = 0
  · simp [h]  
  · obtain ⟨n, rfl⟩ := Nat.exists_eq_succ_of_ne_zero h
    rw [Nat.triangle_succ n]
    rw [Nat.choose, ik n (Nat.lt_succ_self n)]
    simp [Nat.add_comm]

Let us also consider a slightly more complex example using le_induction. Looking at the signature of this induction principle through #print le_induction, we see that the form of the motive we can prove with this principle is P : (n : Nat) → m ≤ n → Prop, and that we need to prove the statement for the lower bound m (P m ⋯ in the signature), as well as for the induction step P n hmn → P (n + 1) ⋯) for all n within the bound:

>> theorem Nat.le_induction : ∀ {m : Nat} {P : (n : Nat) → m ≤ n → Prop},
  P m ⋯ → (∀ (n : Nat) (hmn : m ≤ n), P n hmn → P (n + 1) ⋯) → ∀ (n : Nat) (hmn : m ≤ n), P n hmn
...

The following easy example from mathlib, establishing that

\[\sum_{m = k}^{n} {m \choose k} = {n + 1 \choose k + 1},\]

demonstrates how to use le_induction, with the induction' tactic now invoked using two induction parameters as required by the motive P in the le_induction principle.

example (n k : Nat) (h : n ≥ k) : ∑ m ∈ Icc k n, m.choose k = (n + 1).choose (k + 1) := by
  induction' n, h using le_induction with n _ ih
  · simp
  · rw [← Ico_insert_right (by omega), sum_insert (by simp),
      show Ico k (n + 1) = Icc k n by rfl, ih, choose_succ_succ' (n + 1)]

Writing Your Own Principles

Now what happens if we want to prove a universal statement about a motive that’s more intricate than the simple unary predicate that we get from the recursor? We likely could, in theory, reduce it to nested induction using only type recursors on some obtuse inductive type, but there is a much nicer way.

As we have seen, the recursor of an inductive type \(A\) is a function from a proposition over a variable (the motive, itself a function mapping from \(A\) to Prop), and one argument for each constructor, to a proof of the motive under universal quantification over \(A\). The induction tactic can in fact use any function in place of the recursor, as long as it

• binds a variable for motive : (t₀ : T₀) → ... → (tₙ : Tₙ) → Sort*,
• binds variables (t₀ : T₀), …, (tₙ : Tₙ), and
• has motive t₀ ... tₙ as the result type.

The function can also bind other variables and the induction tactic will create a separate goal for each of them. It expects as input one bound variable for each t_i, and will result in a proof universally quantified over all those variables.

While this is such a general tactic I hesitate to call the resulting proofs “by induction” for all input principles, we can use it to generate proofs using nonstandard induction (not even necessarily over an inductively defined type!) by specifying an induction principle where the cases correspond to proofs about base cases and inductive steps.

We can look at an example from mathlib again: the two-step induction principle on the naturals, deriving the next case from the two previous ones.

def twoStepInduction {P : ℕ → Sort*} (zero : P 0) (one : P 1)
    (more : ∀ n, P n → P (n + 1) → P (n + 2)) : ∀ a, P a
  | 0 => zero
  | 1 => one
  | _ + 2 => more _ (twoStepInduction zero one more _) (twoStepInduction zero one more _)

We observe the motive, here called P, the bound variable a and the result type P a. The remaining bound variables, zero, one, and more, will each get a seperate case when we use this with the induction tactic, requiring us to prove P 0, P 1 and ∀ n, P n → P (n + 1) → P (n + 2) respectively. All that was needed to write this induction principle was proving that given those three things, we can infer ∀ a, P a.

Again, we focus on proving the upper bound for now. The following proof is supposed to be folklore, and uses the inequality of the arithmetic and geometric mean.

The theorem statement is the same as the one we’ve seen in the previous post:

theorem mantel (h: G.CliqueFree 3) : #E ≤ (n^2 / 4) := by

The proof begins with the words “Let \(\alpha\) be the size of a largest independent set \(A\), and set \(\beta = n - \alpha\)”. \(\alpha\) is also refered to as the coclique number and obtain the existence of a maximum independent set \(A\) attaining that number from maximumIndependentSet_exists [18446] [18694] :

let α := SimpleGraph.cocliqueNum G
let ⟨A, maxA⟩  := G.maximumIndependentSet_exists
have hA : #A = α := maximumIndependentSet_card_eq_cocliqueNum _ _ maxA

We then continue “and set \(\beta = n - \alpha\) ”.

let β := n - α
have hαβ: α + β = n := Nat.add_sub_of_le (le_of_eq_of_le (hA.symm) (card_le_card (subset_univ _)))

Note that we are again using subtraction in Nat, so the proof that α + β = n requires us to show that in fact α ≤ n, which follows by card_le_card and subset_univ. The proof thenmakes some brief statements that are used to justify the final inequality chain, beginning with “Since \(G\) is triangle-free, the neighbors of a vertex \(i\) form an independent set, and we infer \(d_i \leq \alpha\) for all \(i\).” The first half of that is the exact statement of theorem isIndependentSet_neighborSet_if_triangleFree [18694] , but we’ll have to adjust it to finite sets to use it in our proof.

have nbhd_ind_of_triangle_free : ∀ (i : γ), G.IsIndependentSet N(i) := by
  simp [Set.coe_toFinset, G.isIndependentSet_neighborSet_if_triangleFree h, neighborFinset]

The second half of the sentence, “we infer \(d_i \leq \alpha\) for all \(i\)”, requires us to use two more theorems about independent sets. The first is card_le_cocliqueNum [18446] [18447] , stating that the cardinality of any independent set is less than or equal to the coclique number. The second is maximumIndependentSet_card_eq_cocliqueNum [18446] [18447] , stating that the cardinality of a maximum independent set is precisely said coclique number. Combining them with our previous lemma using transitivity of inequality and equality, we obtain:

have degree_le_alpha : ∀ (i : γ) , d(i) ≤ α := fun i => 
  hA ▸ (le_of_le_of_eq (nbhd_ind_of_triangle_free i).card_le_cocliqueNum
                (G.maximumIndependentSet_card_eq_cocliqueNum A maxA).symm)

The next step is to prove the inequality \(|E| \leq \sum_{i \in B} d_i\). The proof states “The set \(B = V \setminus A\) of size \(\beta\) meets every edge of \(G\)”, which is the statement of the theorem compl_independentSet_meets_every_edge [18608] . Since we’re about to prove the next step in lean using a chain of inequalities with the calc tactic, we will turn the statement about “meeting every edge” into an inequality:

let B := V \ A
have hB : #B = β := by have := card_sdiff (subset_univ A); simp_all [hαβ]

have one_ge_num_incident_verts : ∀ e ∈ E, 1 ≤ #{ i ∈ B | i ∈ e } := by
  simp only [one_le_card, mem_edgeFinset]
  exact G.compl_independentSet_meets_every_edge maxA.independentSet

Equipped with this, we can prove our lemma using calc:

have count_edges_by_B := by calc
  #E = ∑ e ∈ E, 1                          := by simp
    _ ≤ ∑ e ∈ E, #{ i ∈ B | i ∈ e }         := sum_le_sum one_ge_num_incident_verts
    _ = ∑ e ∈ E, ∑ i ∈ {i ∈ B | i ∈ e}, 1   := by simp
    _ = ∑ i ∈ B, ∑ e ∈ {e ∈ E | i ∈ e}, 1   := sum_sum_bipartiteAbove_eq_sum_sum_bipartiteBelow _ _
    _ = ∑ i ∈ B, #{e ∈ E | i ∈ e}           := by simp
    _ = ∑ i ∈ B, d(i)                       := sum_congr rfl fun i _ => by
                                                rw [(G.card_incidenceFinset_eq_degree i).symm,
                                                      G.incidenceFinset_eq_filter]

Note that, like in the previous post, we use the weighted double counting lemma Finset.sum_sum_bipartiteAbove_eq_sum_sum_bipartiteBelow[17651] . We are now equipped to prove the final chain of inequalities: \[|E| \leq \sum_{i \in B} d_i \leq \alpha \beta \leq \left( \frac{ \alpha + \beta}{2} \right)^2 = \frac{n^2}{4}. \]

Since rational numbers are more involved to deal with, we start with proving the first two steps, using the lemmata about meeting all edges and bounded degree:

have card_E_bound := calc
  #E ≤ ∑ i ∈ B, d(i)      := by exact count_edges_by_B
    _ ≤ ∑ _ ∈ B, α         := sum_le_sum fun _ _ => degree_le_alpha _
    _ = α * β              := by simp [Nat.mul_comm, hB]

The remaining two steps are first proven multiplied by four, so we can stick to natural numbers and deal with the division in the end. This is where we use the inequality of the arithmetic and geometric mean that gives this post its name, by invoking four_mul_le_pow_two_add from Mathlib.Analysis.MeanInequalities [17877] .

4 * #E ≤ 4 * α * β        := by linarith
      _ ≤ (α + β)^2        := four_mul_le_pow_two_add _ _
      _ = n^2              := by simp only [hαβ, Nat.sub_add_cancel]

Finally, all that’s left to do is divide both sides by four [18694] , and we’re done!

  exact (Nat.le_div_iff_mul_le_comm Nat.ofNat_pos).mpr four_times_card_E_bd

This concludes the proof. 🎉

For now, we will limit ourselves to establishing the upper bound on the number of edges and leave the characterization of the extremal example for a future post. Here we will follow the proof using Cauchy’s inequality and the handshaking lemma, which Aigner and Ziegler attribute to Mantel himself.

As for the handshaking lemma, we first set up some notation, i.e., we use # to denote the cardinality of a set, V and E to denote the vertex¹ and edge set² of a given (G : SimpleGraph α), I(v) and d(v) to respectively denote the set of edges incident to a vertex v as well as its degree, and finally n to denote the order of G.

prefix:100 "#" => Finset.card
local notation "V" => @Finset.univ α _
local notation "E" => G.edgeFinset
local notation "I(" v ")" => G.incidenceFinset v
local notation "d(" v ")" => G.degree v
local notation "n" => Fintype.card α

Using this, we can now easily state (our simplified version of) Mantel’s theorem.

theorem mantel (h: G.CliqueFree 3) : #E ≤ (n^2 / 4) := by

At first it might seem like we cheated: \(n^2 / 4\) is not \( \lfloor n^2 / 4 \rfloor \)! But all involved quantities, that is #E, n^2, and 4 are integer, so n^2 / 4 in fact corresponds to the integer \(\lfloor n^2 / 4 \rfloor\) mathlib’s documentation of HDiv.

The proof now starts with “Suppose \(ij\) is an edge. Since \(G\) has no triangles, we find \(d_i + d_j \leq n\) since no vertex is a neighbor of both \(i\) and \(j\).” The statement of this fact is easily written down, but for its proof we need to be slightly more detailed.

  have adj_degree_bnd (i j : α) (hij: G.Adj i j) : d(i) + d(j) ≤ n := by
    by_contra hc; simp at hc
    obtain ⟨k, h⟩ := Finset.inter_nonempty_of_card_lt_card_add_card (by simp) (by simp) hc
    simp at h
    obtain ⟨hik, hjk⟩ := h
    exact h {k, j, i} ⟨by aesop (add safe G.adj_symm), by simp [hij.ne', hik.ne', hjk.ne']⟩

The proof follows by contradiction, i.e., using by_contra we assume that d(i) + d(j) > n. Of course, since there are only n vertices, this means that by pigeon-hole-principle, or by inter_nonempty_of_card_lt_card_add_card to be precise, the vertices i and j have a common neighbor k. But now, \(\{i,j,k\}\) would of course form a triangle, contradicting that G is assumed to betriangle-free.

For the next step we will need the sum \(\sum_{ij \in E} d(i) + d(j)\). There is a minor detail in this notation that is easily overlooked but that Lean does not let us get away with: the term d(i) + d(j) is only well-defined if it is independent of the order of i and j. This is of course true by commutativity, so we give Lean that information in a definition of the sum_deg of an edge. By the just established fact that two adjacent vertices i and j satisfy d(i) + d(j) ≤ n, sum_deg is of course also upper bounded by n.

  let sum_deg (e : Sym2 α) : ℕ := Sym2.lift ⟨λ x y ↦ d(x) + d(y), by simp [Nat.add_comm]⟩ e

  have adj_degree_bnd' (e : Sym2 α) (he: e ∈ E) : sum_deg e ≤ n := by
    induction e with | _ v w => simp at he; exact adj_degree_bnd v w (by simp [he])

Let us now address the statement that “\(d_i\) appears exactly \(d_i\) times in the sum, so we get \(\sum_{ij \in E} (d_i + d_j) = \sum_{i \in V} d_i^2\)”, which again requires a bit more detail to formally prove. The decisive step here uses Finset.sum_sum_bipartiteAbove_eq_sum_sum_bipartiteBelow, a weighted double counting lemma [17651] .

  have sum_sum_deg_eq_sum_deg_sq : ∑ e ∈ E, sum_deg e = ∑ v ∈ V, d(v)^2 := by
    calc  ∑ e ∈ E, sum_deg e
      _ = ∑ e ∈ E, ∑ v ∈ e, d(v)                  := Finset.sum_congr rfl (λ e he ↦ by induction e with | _ v w => simp at he; simp [sum_deg, he.ne])
      _ = ∑ e ∈ E, ∑ v ∈ {v' ∈ V | v' ∈ e}, d(v)  := Finset.sum_congr rfl (by intro e _; exact congrFun (congrArg Finset.sum (by ext; simp)) _)
      _ = ∑ v ∈ V, ∑ _ ∈ {e ∈ E | v ∈ e}, d(v)    := Finset.sum_sum_bipartiteAbove_eq_sum_sum_bipartiteBelow _ E V _
      _ = ∑ v ∈ V, ∑ _ ∈ I(v), d(v)               := Finset.sum_congr rfl (λ v ↦ by simp [G.incidenceFinset_eq_filter v])
      _ = ∑ v ∈ V, d(v)^2                         := by simp [Nat.pow_two]

This finally allows us to get to the meat of the argument, namely the following calculation. We have slightly modified it from the template by multplying with n to avoid moving from natural numbers to rationals. The most important step is the application of Cauchy’s inequality, or more specifically sum_mul_sq_le_sq_mul_sq³, and the handshaking lemma in the form of sum_degrees_eq_twice_card_edges.

  have := calc #E * n^2
    _ = (n * (∑ e ∈ E, 1)) * n               := by simp [Nat.pow_two, Nat.mul_assoc, Nat.mul_comm]
    _ = (∑ _ ∈ E, n) * n                     := by rw [Finset.mul_sum]; simp
    _ ≥ (∑ e ∈ E, sum_deg e) * n             := Nat.mul_le_mul_right n (Finset.sum_le_sum adj_degree_bnd')
    _ = (∑ v ∈ V, d(v)^2) * (∑ v ∈ V, 1^2)   := by simp [sum_sum_deg_eq_sum_deg_sq]
    _ ≥ (∑ v ∈ V, d(v) * 1)^2                := (Finset.sum_mul_sq_le_sq_mul_sq V (λ v ↦ d(v)) 1)
    _ = (2 * #E)^2                           := by simp [G.sum_degrees_eq_twice_card_edges]
    _ = 4 * #E^2                             := by ring

Aigner and Ziegler conclude with “… and the result follows.” Lean however does not let us get away with so easily. We first massage our ineqality into the right form through a series of rw.

  rw [Nat.pow_two (#E)] at this
  rw [(Nat.mul_assoc 4 (#E) (#E)).symm] at this
  rw [Nat.mul_comm (4 * #E) (#E)] at this

We then conclude by simply dividing by 4 * #E… which is only possibly if #E is not zero! So we need to do a case distinction using by_cases and only then are we able to get the desired statement.

  by_cases hE : #E = 0
  · simp [hE]
  · apply Nat.zero_lt_of_ne_zero at hE
    apply Nat.le_of_mul_le_mul_left this at hE
    rw [Nat.mul_comm] at hE
    exact (Nat.le_div_iff_mul_le (Nat.zero_lt_succ 3)).mpr hE

This concludes the proof. 🎉

The above formula is also sometimes referred to as the sum degree formula with the term handshaking lemma used to refer to the corollary that the number of vertices that touch an odd number of edges is even. The proof of the sum degree formula will be short and sweet and canonically relies on double counting. Aigner and Ziegler write it up as follows:

Graphs are represented by the SimpleGraph structure in mathlib:

structure SimpleGraph (V : Type u) where
  Adj : V → V → Prop
  symm : Symmetric Adj := by aesop_graph
  loopless : Irreflexive Adj := by aesop_graph

Given some type of vertices V, a graph consists of a symmetric and irreflexive (meaning loopless) relation on V. It is a finite graph if the type V has the typeclass Fintype. This notion is perhaps slightly different from how many extremal combinatorialists might think of it in two way: First, there is no underlying vertex set, but instead an underlying vertex type. We have already discussed this previously, but for now all this means is that we write ∑ v : V, ... or simply ∑ v, ... instead of ∑ v ∈ V, .... The second and more important distinction is that edges are not defined as sets of two vertices but through a relation on the type of vertices. Invoking edgeSet or edgeFinset does yield the set of edges. However, on closer inspection we will see that the underlying type of the elements of these is not Finset V but rather Sym2 V, the type of unordered pairs of elements of V. Notably this type inherently does not prohibit loops and instead one needs to invoke the irreflexivity of the adjacency relation to exclude them. See [17587] for an example of how this can make handling edges somewhat unintuitive.

Let us fix some notation to make the proof nicer to read, i.e., we use # to denote the cardinality of a Finset [17646] , E to denote the edgeFinset of a given G, and finally d(v) and I(v) to denote the degree and incidenceFinset of a given vertex v.

prefix:100 "#" => Finset.card
local notation "E" => G.edgeFinset
local notation "d(" v ")" => G.degree v
local notation "I(" v ")" => G.incidenceFinset v

Using this notation, we can state and prove the sum degree formula in a concise and readable form using the calc tactic.

lemma handshaking : ∑ v, d(v) = 2 * #E := by
  calc  ∑ v, d(v)
    _ = ∑ v, #I(v)             := by simp [G.card_incidenceFinset_eq_degree]
    _ = ∑ v, #{e ∈ E | v ∈ e}  := by simp [G.incidenceFinset_eq_filter]
    _ = ∑ e ∈ E, #{v | v ∈ e}  := Finset.sum_card_bipartiteAbove_eq_sum_card_bipartiteBelow _
    _ = ∑ e ∈ E, 2             := Finset.sum_congr rfl (λ e he ↦ (G.card_filter_mem_of_mem_edgeFinset e he))
    _ = 2 * ∑ e ∈ E, 1         := (Finset.mul_sum E (λ _ ↦ 1) 2).symm
    _ = 2 * #E                 := by rw [Finset.card_eq_sum_ones E]

The decisive step here is going from ∑ v, #{e ∈ E | v ∈ e} to ∑ e ∈ E, #{v | v ∈ e}, which is possible precisely due to the double counting argument. There are a number of double counting arguments in mathlib, but the one relevant for our purposes is sum_card_bipartiteAbove_eq_sum_card_bipartiteBelow. This lemma states that for any sets (s : Finset α) and (t : Finset β) along with a relation (r : α → β → Prop) the sum ∑ a ∈ s, #(t.bipartiteAbove r a) is the same as ∑ b ∈ t, #(s.bipartiteBelow r b); this means that summing the number of elements in t related to a given a ∈ s is the same as summing the number of elements in s related to a given b ∈ t. Everything before this step simply modifies the summand to make the application of this lemma possible: card_incidenceFinset_eq_degree allows us to rewrite the degree as the cardinality of the incidence finset, and incidenceFinset_eq_filter essentially unfolds the definition of the incidence finset. After this, we simple use the fact that an edge contains two vertices in the form of card_filter_mem_of_mem_edgeFinset [17587] and that summing ones over a finite set yields the cardinality of that set.

This concludes the proof. 🎉

We have previously already had a first look at types in Lean. In this post, we’ll take a closer look at type theory and type checking, and how they allow us to express and check the correctness of mathematics. We’ll first discuss types from a theoretical perspective, sketching type-checking in the process. Then we’ll illustrate how to encode mathematics in this framework using explicit examples.

Terms, types, expressions

In programming, types are used to prevent errors when performing operations on variables. Numbers and text for example will both be stored as a series of ones and zeros. so you may end up accidentally adding numbers and text. To prevent this from happening, the compiler or interpreter will ask you to label your variables with types (or it will try to infer them from context or during execution), and point you to the part of the code that may cause issues.

At a first glance, types can be thought of as having the same purpose in Lean. The objects of interest in Lean are expressions, such as 2+2 = 4 or List.append xs [1,2,3]. These expressions have a type: 2+2 = 4 for example has type Prop and List.append xs [1,2,3] has type List Nat. As we have previously already seen, these types are expressions too. This can for example be clearly seen in List Nat, which we think of as the type constructor List being applied to the type Nat. This illustrates that Lean’s types, the labels of our variables and constants, can be manipulated, and are therefore labeled as well. Indeed, if you try to get the type of natural numbers with #check Nat, Lean will tell you that it has type Type. You can then try #check Type to see that this type has type Type 1. The types Prop, Type, Type 1, Type 2, … are called sorts and they are built-in types of the theory.

We may add constant types via the axiom command axiom myType : Type. Most fundamental types of Lean, including Nat and List are however defined as inductive types, which can be thought of as introducing a multitude of axioms at each inductive declaration. We may also build further expressions with the introduction of functions. In Lean, one can define functions fun x : T => e(x), where T is some previously defined type and e(x) stands for some expression that may or may not contain the symbol x. The type of this function is of form T → E, (x : T) → E(x) or ∀ x : T, E(x) for some expression E potentially containing symbol x, which is the type of e(x). For some examples, consider the messages of:

#check fun x : Nat => true
#check fun x : Nat => (⟨x, rfl⟩ : Odd (2*x+1))
#check fun x : Nat => (0 : ZMod x)

T → E, (x : T) → E(x) or ∀ x : T, E(x) are all treated as the same expression. The first corresponds to the middle case, where we omit x in the case where the expression E doesn’t contain this symbol. The last is the mathematical interpretation of the middle one, that we’ll explore in a moment. What would be the use of functions if we couldn’t evaluate them? The answer is “representation”, as we’ll see soon, but we introduce function application, denoted f x (instead of the mathematician’s f(x)), as a valid way to form further expressions.

We now have the most essential ways in wich valid expressions may be formed in Lean. To see how any expression is formed, consider the following diagram (representing a grammar in Backus-Naur-Form), depicting rules and their names:

E --> V   (variables)
E --> C   (constants)
E --> fun V : E => E    (functions)
E --> ∀ x : E, E    (function-type)
E --> E E   (function-application)

To form an expression, start with symbol E and iteratively replace upper-case symbols with the right-hand-sides indicated above. V may be replaced by a symbol in an alphabet of variables, and C by a symbol in an alphabet of constants, which we imagine to be lower-case symbols. Once no upper-case symbols remain, the expression is formed. In our above description, some expressions may be ill-formed in a sense, as we allow for the presence of variables without guaranteeing that they are bound by an above fun. You can compare this with Lean’s built-in type Lean.Expr.

For example, let’s derive the expression 2+2 = 4, which is notation (or ‘syntactic sugar’) for (Eq (Nat.add 2 2)) 4. Recall that relations and binary operations are treated as functions of two arguments, and that functions of multiple arguments are treated as repeated application of one-variable functions that map to functions, a representation known as currying.

E --> E E
E E --> (E E) E
(E E) E --> (E (E E)) E
(E (E E)) E --> ... --> (C (C C)) C
(C (C C)) C --> ... --> (Eq (Nat.add 2 2)) 4

As we hinted at in the introduction, the parts of the Lean compiler responsible for turning the concrete syntax of your code into these expressions are parsing and elaboration. Tactics will produce such expressions as well, as you can tell when #print-ing the lemmata and definitions that made use of them (though the expressions can quickly get very big, even when pretty-printed).

Any expression has a type, that can be computed, or inferred, as we say in type theory, with the following recursive algorithm: for variables, we refer to the type declared in the function that introduced them. For constants, we refer to the context of previous definitions. For functions fun v : d => b, we take note that v has type d, and use this to find the type B of b, in a recursive call to the type inference process, and return type ∀ x : d, B. For function types, we’ll keep our exposition simple and just mention that the returned type will be a sort.

Finally, we reach function application, at which a new form of ill-formedness can be discovered for expressions. We want, in f x, for f to have a type of form ∀ y : d, B(y) and simultaneously have x of type d, so that we may assign type B(x) (with occurrences of y replaced by x) to f x. If this condition fails, Lean will not consider the expression valid, and throw an error. This is essentially where the type-checking happens. An extremely important aspect we will not discuss is that when checking types at f x, for f of type ∀ x : d1, B and x of type d2, we consider d1 and d2 equal not only for syntactic equality, but also equal up to reductions, such as alpha reduction (renaming of bound variables), beta reduction (replacing of (fun x : T => e(x)) v with e(v)) and delta reduction (replacement of constants with their value stored in context), among others.

Mathematics

Where does math fit into all this? So far, we have only described how to form expressions in Lean, and which ones Lean considers to be valid. We will now exemplify how to encode common mathematical objects and notions in this language, and how the process of checking if expressions are well-form corresponds to checking if proofs are correct.

A first example: the natural numbers

We can imagine the natural numbers to be defined via

axiom myNat : Type
axiom myZero : myNat
axiom mySuccessor : myNat → myNat

where 0 is encoded by myZero, 1 by mySuccessor myZero, 2 by mySuccessor (mySuccessor myZero), … . This is an encoding similar to Peano arithmetic. Lean’s actual definition of natural numbers is quote similar to this, bundled in the inductive type Nat and with the role of myZero and mySuccessor being fulfilled by Nat.zero and Nat.succ.

We can also define a “less or equal than” relation via

axiom myLe : myNat → myNat → Type
axiom myLe_symm : (x : myNat) → myLe x x
axiom myLe_step : (x : myNat) → (y : myNat) → myLe x y → myLe x (mySuccessor y)

The first axiom postulates the existence of a binary relation ≤. The second and third axiom say that we have ∀ n : myNat, n ≤ n and ∀ n : myNat, ∀ m : myNat,n ≤ m → n ≤ m + 1. In Lean, these are respectively captured through Nat.le, Nat.le.refl, Nat.le.step. Note that they are function types, which we interpret as universal quantifiers. Let’s look at what happens if we evaluate them:

#check myLe_symm myZero
#check myLe_step myZero myZero (myLe_symm myZero)
#check myLe_step myZero (mySuccessor myZero) (myLe_step myZero myZero (myLe_symm myZero))

The types of these expressions are 0 ≤ 0, 0 ≤ 1 and 0 ≤ 2, which is why we consider them proofs of these statements.

Let’s follow how the type of the second expression is derived. Due to currying, it is read as (myLe_step myZero myZero) (myLe_symm myZero), so we’re dealing with a function application, with function (myLe_step myZero myZero) and argument (myLe_symm myZero). We should therefore derive the type of both, check that the function truly has a function-type, with domain-type definitionally equal to the type of the argument. Let’s first look at the type of the argument myLe_symm myZero, which is itself a function application. Here, the function has type (x : myNat) → myLe x x, and the argument type myNat (which we get be querying the context for the type of constants). The domain-type and the type of the argument match, so the type check passes, and we assign myLe_symm myZero the type myLe myZero myZero, which was the image-type of the function, where we replace the symbol of the variable (x) with the argument. Now, let’s return to the task of finding the type of (myLe_step myZero myZero) (myLe_symm myZero), and assume that we recursively derived the type of myLe_step myZero myZero to be myLe myZero myZero → myLe myZero (mySuccessor myZero) (try doing this as an exercise). myLe_symm myZero has the domain-type of the function-type myLe_step myZero myZero, so type-checking passes and we obtain the desired 0 ≤ 1.

Next, let’s look at more examples of formalism. We can model equality of natural numbers as follows:

axiom myEq : myNat → myNat → Type
axiom myEq_refl: (x : myNat) → myEq x x
axiom myEq_subst : (x : myNat) → (y : myNat) → (P : myNat → Type) → myEq x y → P x →  P y

This says that there is a binary relation myEq, which is reflexive, in the sense that for any x, we may build a term (a proof) of type (statement) myEq x x, by the axiom myEq_refl. The last axiom says that if x and y are equal, then for any predicate P on natural numbers, if P x then P y. In actual Lean, myEq_refl is Eq.refl and myEq_subst is Eq.rec.

We’ll take a brief moment to illustrate the notion of definitional equality we hinted at earlier. Consider the following:

noncomputable
example:  myEq myZero myZero := myEq_refl ((fun _ : myNat => myZero) (mySuccessor myZero))

When we define something with def or example or state a theorem with lemma, Lean will compute the type of what follows := and check if it matches what follows :. Technically speaking, the term of the example has type (fun _ : myNat => myZero) (mySuccessor myZero) = (fun _ : myNat => myZero) (mySuccessor myZero), and not myZero = myZero. However these types are congruent up to reduction (in this case, beta-reduction), which is why Lean considers them to be the same, and is satisfied.

Next, we’ll define addition of natural numbers. Here, we will deviate slightly from the way addition is implemented for Nat in Lean in order to simplify the exposition.

axiom myAdd : myNat → myNat → myNat
axiom myAdd_reduce_zero : (x : myNat) → myEq x (myAdd x myZero)
axiom myAdd_reduce_succ : (x : myNat) → (y : myNat) → myEq (mySuccessor (myAdd x y)) (myAdd x (mySuccessor y))

We introduce function myAdd and provide two computation rules which are, morally speaking, ∀ x : myNat, x+0=0 and ∀ x : myNat, ∀ y : myNat, x+(y+1)=(x+y)+1. We can now show that 2 = 1+1.

noncomputable
def myProof :
  let one := mySuccessor myZero
  let two := mySuccessor (mySuccessor myZero)
  myEq two (myAdd one one)
    :=
    let one := mySuccessor myZero
    let two := mySuccessor (mySuccessor myZero)
    myEq_subst
      (mySuccessor (myAdd one myZero))
      (myAdd one one)
      (fun x : myNat => myEq two x)
      (myAdd_reduce_succ
        one
        myZero
        )
      (myEq_subst
        one
        (myAdd one myZero)
        (fun x : myNat => myEq two (mySuccessor x))
        (myAdd_reduce_zero one)
        (myEq_refl two)
        )

We highly recommend you explore the code: you may comment out lines with -- and write a placeholder _ in front of the comment, so as to have the infoview display the expected type we want the term to have. Alternatively, you may copy some parts out and #check them, as follows:

noncomputable def one := mySuccessor myZero
noncomputable def two := mySuccessor (mySuccessor myZero)

#check (myEq_refl two)
#check (myAdd_reduce_zero one)
#check (fun x : myNat => myEq two (mySuccessor x))
#check (myEq_subst one (myAdd one myZero))
#check (myEq_subst
        one
        (myAdd one myZero)
        (fun x : myNat => myEq two (mySuccessor x))
        (myAdd_reduce_zero one)
        (myEq_refl two)
        )

Both the claimed type and proof-term are expressions as we described them previously: they are made of functions, function applications, and constants. The claimed type encodes 2 = 1+1. To prove it, we will build a term of this type, which is the content after :=. We’ll get the claimed type from the application of myEq_subst, so that we use predicate fun x : myNat => myEq two x, to be able to get this from a proof of 2 = mySuccessor (1+0). This, in turn, we’ll also deduce from he application of myEq_subst, so that we use predicate fun x : myNat => myEq two (mySuccessor x)), to be able to get this from a proof of 2 = mySuccessor (mySuccessor 0). The axiom myEq_refl serves as proof for latter fact.

Type checking and inference thus ensure that we are using correct proofs of the hypotheses needed to be proven in intermediate steps of the proof, and that the proof truly produces evidence for the claimed type, which we interpret as statement. In the previous code excerpt, the #checks reveal that the type checker will be satisfied with the expression, as the arguments have the type that the function we apply them to requests in its type.

In actual Lean, addition is defined using a recursion principle for natural numbers, and the above computation holds by definitional equality, which in this context means that during type checking, a reduction specific to inductive (and quotient) types, called iota reduction, will be applied, so that the addition will be syntactically congruent to 2, and the proof therefore just requires reflexivity of equality.

We take a brief moment to look back at equality. Not all basic properties must be added as axioms. We may sometimes deduce certain basic properties from other ones. For example, the following proves that equality is symmetric, based on the previous axioms:

noncomputable
def myEq_symm :
  (x : myNat) → (y : myNat) →
  myEq x y → myEq y x
    :=
    fun x : myNat =>
      fun y : myNat =>
        fun eq : myEq x y =>
          (myEq_subst
           x
           y
           (fun z => myEq z x)
           eq
           (myEq_refl x))

We see that proving a universally quantified statement is equivalent to building a function that given a argument return a term of the quantified type. Indeed, this is (almost) the only way to get universal quantification in the type during type inference (we could also get it from querying the type of constants).

If we add a induction principle for natural numbers, which is the equivalent of Lean’s Nat.rec, we can show that for every natural number n, zero is less then or equal to n:

axiom myNat_rec : (P : myNat → Type) → (P myZero) → ((x : myNat) → (P x) →  P (mySuccessor x)) → (y : myNat) → P y

noncomputable
def myInductionProof :
    (n : myNat) → myLe myZero n
      :=
      fun n : myNat =>
        myNat_rec
          (fun x : myNat => myLe myZero x)
          (myLe_symm myZero)
          (fun x : myNat =>
            fun ineq : myLe myZero x =>
              (myLe_step myZero x ineq))
          n

When using the recursion principle, the first argument is the so-called motive, then we show the base case, which in the above corresponds to showing that 0 is less then 0, which follows from reflexivity, and finally we show the induction step. In the above, we get the implications as functions, and show that we may deduce the step from axiom myLe_step.

A second example: logic

So far, we looked mostly at computational proofs. But we can also model logic in this type theory. For example, consider this encoding of the logical “or”:

axiom myOr : Type → Type → Type
axiom myOr_inl : (P : Type) → (Q : Type) → (p : P) → myOr P Q
axiom myOr_inr : (P : Type) → (Q : Type) → (p : Q) → myOr P Q

This gives us two ways of proving P ∨ Q: either we build a proof of type P, or we build one of type Q. Can you guess how one could define the logical “and” ? Here is “or” in action, where we show that 2=1+1 ∨ 1=0:

noncomputable
def mySecondProof :
  let one := mySuccessor myZero
  let two := mySuccessor (mySuccessor myZero)
  myOr (myEq two (myAdd one one)) (myEq one myZero)
    :=
    let one := mySuccessor myZero
    let two := mySuccessor (mySuccessor myZero)
    myOr_inl
    (myEq two (myAdd one one))
    (myEq one myZero)
    myProof

Here is how one can encode existential quantification:

axiom myExists : (P : myNat → Type) → Type
axiom myExists_intro : (P : myNat → Type) → (e : myNat) → (he : P e) →  myExists P

The introduction rule allows us to produce type ∃ e, P e if we have an e and a proof of P e (a term of this type). Let’s use it to show that for every natural number, we may find a number greater or equal to it:

noncomputable
def myProofWithExists :
  (n : myNat) → myExists (fun x => myLe n x)
  :=
    fun n : myNat =>
      myExists_intro
        (fun x => myLe n x)
        (mySuccessor n)
        (myLe_step
          n
          n
          (myLe_symm n)
          )

The second argument to the introduction rule says that for n, one of the numbers greater then n that we claim to exists is n+1. The last argument is the proof to the fact that n+1 is greater than n. This is directly proven with axiom myLe_step. As an exercise, you may try to prove this statement with a different candidate as evidence for the existential quantifier.

Conclusion

This concludes our little trip around the basics of Lean’s type theory. It is quite stunning to see how the basic rules we introduced in the first section allow us to express basic mathematical objects, statements and proofs. In a future post, we’ll perhaps take a closer looks at further mathematical and logical foundational formalisms, as we started doing in the previous section, or at implementation aspects of type theory, as we did in the first section. In the meantime, we wish you happy proving!

The definition of \(N_{a,b}\) is taken care of easily.

def N (a b : ℤ) : Set ℤ := { a + b * n | n : ℤ}

Before continuing and defining the topology on \(\mathbb{Z}\), let us establish some trivial but important properties of \(N_{a,b}\) that will implicitly be used later in the proof. The first states that the sets \(N_{a,b}\) are infinite and is easily proven through an injective map \(f : \mathbb{Z} \hookrightarrow N_{a,b}\).

lemma N_infinite (a b : ℤ) (h : b ≠ 0) : (N a b).Infinite := by
  let f (n : ℤ) : N a b := ⟨a + b * n, by simp [N]⟩
  have f_inj : Function.Injective f := λ a₁ a₂ f_eq ↦ by simp [f, h] at f_eq; exact f_eq
  exact Set.infinite_coe_iff.mp (Infinite.of_injective f f_inj)

Next is a small but crucial statement in the form of el_N_of_dvd, that will make many arguments a lot easier: \(n\) is an element of \(N_{a,b}\) if and only if \(b ∣ (n - a)\). Note that for Lean \(0 \mid 0\). One immediate consequence of this (N_sub) states that \(N_{a, b \, m} \subseteq N_{a,b}\) for any integer \(m\).

lemma el_N_of_dvd (a b n : ℤ) : n ∈ N a b ↔ b ∣ (n - a) := by
  constructor <;> {intro ⟨c, _⟩; use c; linarith }

lemma N_sub (a b m: ℤ) : N a (b * m) ⊆ N a b := by
  intro n h
  rw [el_N_of_dvd] at *
  exact Int.dvd_trans (Exists.intro m rfl) h

Let us now tackle the specified topology on \(\mathbb{Z}\). We will talk in more detail about type categories in a future post, but let us already spoil that in order to give \(\mathbb{Z}\) a topology, we need to establish that ℤ is an instance of TopologicalSpace. That means that to any lemmas that require a topological structure we will simply pass ℤ and the notion of open and closed sets will be automatically inferred from int_topology. Note that this behavior is quite similar to how we inferred the information that some natural number p is primed from a Fact; in a sense a Fact behaves like a type class with a single property.

The first thing any topological space needs is a notion of open sets, which we deliver in the form of IsOpen. The fact that ℤ itself needs to be open (isOpen_univ) was skimmed over by Aigner and Ziegler, but thankfully Lean makes relatively easy work of this.

instance int_topology : TopologicalSpace ℤ where
  IsOpen O := O = ∅ ∨ (∀ a : O, ∃ b, b ≠ 0 ∧ N a b ⊆ O)
  isOpen_univ := by simp; exact exists_ne 0

The first non-trivial property of a topological space requires that the (not necessarily finite) union of open sets is again open (isOpen_sUnion). Aigner and Ziegler take care of this through “Clearly, the union of open sets is open again”, but we don’t have that luxury. Using by_cases, we need to distinguish whether all sets are empty (which is take care of easily) or if there exists some nonempty U₀ from which we can take the set \(N_{a,b}\).

  isOpen_sUnion U := by
    simp; intro sets_open
    by_cases h: ∀ s ∈ U, s = ∅
    · exact Or.inl h
    · rw [or_iff_right h]
      intro a U₀ U₀_in_U a_in_U₀
      specialize sets_open U₀ U₀_in_U
      simp [or_iff_right (Set.Nonempty.ne_empty (Exists.intro a a_in_U₀))] at sets_open
      obtain ⟨b, b_ne_zero, N_contained⟩ := sets_open a a_in_U₀
      exact ⟨b, b_ne_zero, λ _ a ↦ Set.subset_sUnion_of_mem U₀_in_U (N_contained a)⟩

Next, a topological space requires that any intersection of two open sets is again open (isOpen_inte). Aigner and Ziegler state the following: “If \(O_1, O_2\) are open, and \(a \in O_1 \cap O_2\) with \(N_{a,b_1} \subseteq O_1\) and \(N_{a,b_2} \subseteq O_2\), then \(a \in N_{a, b_1 b_2}\).” The case where the intersection is empty was again skipped, but otherwise we proceed very much the same way by using the set \(N_{a, b_1 \, b_2}\).

  isOpen_inter O₁ O₂ h₁ h₂ := by
    simp at *
    by_cases h: O₁ ∩ O₂ = ∅
    · exact Or.inl h
    · simp [h]
      intro a a_in_O₁ a_in_O₂
      simp [Set.Nonempty.ne_empty (Exists.intro a a_in_O₁)] at h₁
      simp [Set.Nonempty.ne_empty (Exists.intro a a_in_O₂)] at h₂
      obtain ⟨b₁, b₁_ne_zero, N₁_contained⟩ := h₁ a a_in_O₁
      obtain ⟨b₂, b₂_ne_zero, N₂_contained⟩ := h₂ a a_in_O₂
      use b₁ * b₂
      have Nab1b2_su_Nab1 := N_sub a b₁ b₂
      have Nab1b2_su_Nab2 := N_sub a b₂ b₁
      rw [mul_comm] at Nab1b2_su_Nab2
      exact ⟨mul_ne_zero b₁_ne_zero b₂_ne_zero, λ _ a => N₁_contained (Nab1b2_su_Nab1 a), λ _ a => N₂_contained (Nab1b2_su_Nab2 a)⟩

Before continuing, let es establish another trivial little fact about \(N_{a,b}\) likewise used implicitly later on, namely that it is obviously open (N_open).

lemma N_open (a b : ℤ) (h : b ≠ 0): IsOpen (N a b) := by 
  simp [IsOpen, TopologicalSpace.IsOpen, N]
  apply Or.inr
  exact λ a' ↦ (by use b; exact ⟨h, λ a'' ↦ by use a' + a''; ring_nf⟩)    

We are now ready to proceed with the second part of the proof.

We will have to be slightly more explicit than “the first fact follows from the definition” when establishing our proof of (A), but we can still keep it reasonably short. Note that Set.Nonempty O is generally prefered over O ≠ ∅, but we’ll keep the later notation to make the code slightly nicer to read.

lemma A (O : Set ℤ) (h₁ : IsOpen O) (h₂ : O ≠ ∅) : O.Infinite := by
  simp [IsOpen, TopologicalSpace.IsOpen, h₂] at h₁
  obtain ⟨a, a_in_O⟩ := (by push_neg at h₂; exact h₂)
  obtain ⟨b, b_ne_zero, N_su_O⟩ := h₁ a a_in_O
  exact Set.Infinite.mono N_su_O (N_infinite a b b_ne_zero)

Regarding statement (B), we first “observe \(N_{a,b} = \mathbb{Z} \setminus \bigcup_{i=1}^{b-1} N_{a+i,b}\) …” in the form of N_eq_Ubc; this requires a surprising amount of work. Using compl_unique we split the argument into two parts, first establishing that \(N_{a,b}\) does not intersect \(\bigcup_{i=1}^{b-1} N_{a+i,b}\) (N_disjoint) and then that together they make up \(\mathbb{Z}\) (N_covers).

lemma B (a : ℤ) (b : ℕ) (h : b > 0) : IsClosed (N a b) := by
  let Ub := (⋃ i : {x : ℕ // 1 ≤ x ∧ x < b}, N (a + i) b)

  have N_eq_Ubc : N a b = Ubᶜ := by

    have N_disjoint : Ub ∩ N a b = ∅ := by
      rw [Set.iUnion_inter]; simp
      intro idx idx_lw idx_up
      apply Set.disjoint_iff_inter_eq_empty.mp
      apply Set.disjoint_right.mpr
      intro n b_dvd b_dvd'
      simp [el_N_of_dvd] at b_dvd b_dvd'
      have b_dvd_idx : b ∣ idx := by have := Int.dvd_sub b_dvd' b_dvd; simp [Int.ofNat_dvd] at this; exact this
      exact (Nat.not_dvd_of_pos_of_lt idx_lw idx_up) b_dvd_idx

    have N_covers : Ub ∪ N a b = Set.univ := by
      apply Set.Subset.antisymm_iff.mpr
      constructor
      · exact λ _ _ ↦ trivial
      · intro n _
        simp [el_N_of_dvd, Ub]
        let i := (n - a) % (b : ℤ)
        by_cases i_cases : i = 0
        · exact Or.inr (Int.modEq_zero_iff_dvd.mp (i_cases))
        · apply Or.inl
          use Int.toNat i
          have i_ge_0 : i ≥ 0 := Int.emod_nonneg (n - a) (Int.coe_nat_ne_zero_iff_pos.mpr h)
          have nat_i_ge_0 := Int.lt_toNat.mpr (Ne.lt_of_le' i_cases i_ge_0)
          have nat_i_lt_b := (Int.toNat_lt i_ge_0).mpr (Int.emod_lt_of_pos (n - a) (Int.ofNat_pos.mpr h))
          have minus_i_dvd: (b : ℤ) ∣ (n - (a + i)) := Int.sub_sub n a i ▸ Int.dvd_sub_of_emod_eq rfl
          exact ⟨ ⟨nat_i_ge_0, nat_i_lt_b⟩, Int.toNat_of_nonneg i_ge_0 ▸ minus_i_dvd⟩

    exact (compl_unique N_disjoint N_covers).symm

Using this, the rest of the proof is straightforward and in fact almost shorter than stating that the just established N_eq_Ubc “proves that \(N_{a,b}\) is the complement of an open set and hence closed.”

  rw [N_eq_Ubc]
  apply isClosed_compl_iff.mpr
  apply isOpen_iUnion
  exact λ i ↦ N_open (a + i) b (Int.coe_nat_ne_zero_iff_pos.mpr h)

Finally, let’s look at the actual proof of the infinitude of primes using what we just established.

The main goal is to establish that “\(\mathbb{Z} \setminus \{1, -1\} = \bigcup_{p \in \mathbb{P}} N_{0,p}\)”, which we do through Z_as_U. The constructor splits the equality of the two sets up into establishing that each is contained in the other. For the direction \(\subseteq\), “any number \(n \ne 1, −1\) has a prime divisor \(p\)” is taken care of by Nat.exists_prime_and_dvd.

theorem infinitude_primes : { p : ℕ | Nat.Prime p }.Infinite := by
  have Z_as_U : {1, -1}ᶜ = (⋃ p ∈ {p : ℕ | Nat.Prime p}, N 0 p) := by
    apply Set.ext; intro n

    constructor <;> intro n_el
    · obtain ⟨p, p_prime, p_dvd_n⟩ := Nat.exists_prime_and_dvd (λ c ↦ n_el (Int.natAbs_eq_iff.mp c))
      have n_in_Np : n ∈ N 0 p := by simp [el_N_of_dvd]; exact Int.ofNat_dvd_left.mpr p_dvd_n
      simp; exact ⟨p, p_prime, n_in_Np⟩

    · simp [el_N_of_dvd] at *
      obtain ⟨p, p_prime, p_dvd_n⟩ := n_el
      have p_ndvd_one := Int.ofNat_dvd.not.mpr (Prime.not_dvd_one (Nat.prime_iff.mp p_prime))
      push_neg; constructor
      all_goals {by_contra c; rw [c, ←Nat.cast_one] at p_dvd_n ; simp [Int.dvd_neg.mpr] at p_dvd_n; exact p_ndvd_one p_dvd_n}

  by_contra h

Having established Z_as_U, the rest of the proof is a rather neat proof by contradiction. “if \(\mathbb{P}\) were finite, then \(\bigcup_{p \in \mathbb{P}} N_{0,p}\) would be a finite union of closed sets (by (B)), and hence closed” is taken care of by U_close and “\(\{1, −1\}\) would be an open set” by one_open. The violation of (A) comes in the form of one_infinite, which states that \(\{1, -1\}\) would need to be infinite, which is obviously not true.

  by_contra h
  
  have U_close : IsClosed (⋃ p ∈ {p : ℕ | Nat.Prime p}, N 0 p) := by
    have (p : ℕ) (p_prime : p ∈ {p : ℕ | Nat.Prime p}) : IsClosed (N 0 p) := by simp at p_prime; exact B 0 p (Nat.Prime.pos p_prime)
    exact Set.Finite.isClosed_biUnion (Set.not_infinite.mp h) this
  have one_open : IsOpen {1, -1} := isClosed_compl_iff.mp (Z_as_U ▸ U_close)
  have one_infinite := A {1, -1} one_open (Set.Nonempty.ne_empty (Set.insert_nonempty 1 {-1}))

  exact one_infinite (Set.toFinite {1, -1})

This concludes the proof. 🎉

The sentence “consider the so-called Mersenne number \(2^p - 1\) and show that any prime factor \(q\) of \(2^p - 1\) is bigger than \(p\)” indicates that we first establish the following lemma, from which the actual infinitude of primes will later be derived.

lemma mersenne_prime_dvd_gt (p q : ℕ) [p_prime: Fact (Nat.Prime p)] [q_prime : Fact (Nat.Prime q)] (h : q ∣ 2^p - 1) : p < q := by

Note that Fact is simply a neat way of letting Lean infer an assumption when applying a statement, so that you can just call some_theorem p instead of some_theorem p p_prime. We will use several statements that will automatically infer the info that p and q are prime, but we will also encounter statements that want to be given this info explicitly, in which case we simply turn the Fact back into its underlying assumption through p_prime.out or, more explicitly, Fact.out p_prime. In order to create a fact from an assumption, one can use Fact.mk.

The assumptions [q_prime: Fact (Nat.Prime q)] and (h : q ∣ 2^p - 1) express “(l)et \(q\) be a prime dividing \(2^p - 1\)” and the consequence “we have \(2^p \equiv 1 \: (\operatorname{mod} \, q)\)” follows from Nat.modEq_iff_dvd'. The Nat indicates this lemma applies to natural numbers (rather than integers) and indeed the expression 2^p - 1 also referred to subtraction in the natural numbers that saturates at zero. Thankfully this is not a problem, since \(2^p \geq 1\) due to Nat.one_le_two_pow.

  have two_pow_p_eq_one_mod_q : 2^p ≡ 1 [MOD q] := ((λ x ↦ (Nat.modEq_iff_dvd' x).mpr) (Nat.one_le_two_pow) h).symm

Next up, the proof states that “(s)ince \(p\) is prime, this means that the element \(2\) has order \(p\) in the multiplicative group \(\mathbb{Z}_q \setminus \{0\}\) of the field \(\mathbb{Z}_q\).” Fortunately, the orderOf_eq_prime lemma in mathlib directly supports this argument.

  have two_pow_p_eq_one := ((ZMod.eq_iff_modEq_nat q).mpr two_pow_p_eq_one_mod_q)
  rw [Nat.cast_pow, Nat.cast_one] at two_pow_p_eq_one
  have order_two_eq_p := orderOf_eq_prime two_pow_p_eq_one (by apply sub_eq_zero.not.mp; norm_num)

There are some nuances here: the first is that orderOf_eq_prime also requires a proof that \(2 \ne 1\) in \(\mathbb{Z}_q\), which we take care of through (by apply sub_eq_zero.not.mp; norm_num). The second is that two_pow_p_eq_one_mod_q was a statement about natural numbers 2 and 1, but we need a statement that \(2^p = 1\) in \(\mathbb{Z}_q\). ZMod.eq_iff_modEq_nat takes us most of the way there, but it takes 2^p as an integer and casts it in its entirety to \(\mathbb{Z}_q\). This is expressed in the Infoview through ↑(2 ^ p). However, what we actually want is the p-th exponent of the element 2 in \(\mathbb{Z}_q\). Rewriting with Nat.cast_pow gives us exactly that and turns the ↑(2 ^ p) into an ↑2 ^ p. However, one tiny issue remains: mathlib right now does not understand that ↑1 is also the multiplicative unit of \(\mathbb{Z}_q\). This important for orderOf_eq_prime, so we rewrite ↑1 to 1 using Nat.cast_one.

The proof continues by stating that “(t)his group has \(q-1\) elements.” and “(b)y Lagrange’s theorem […] we know that the order of every element divides the size of the group, that is, we have \(p \mid q-1\)”. Thankfully we do not have to go all the way to Lagrange’s theorem, since there is a lemma in mathlib in the form of ZMod.orderOf_dvd_card_sub_one stating this very fact.¹ We just again need to supply it with a small, easily overlooked detail: we must have \(2 \ne 0\) in \(\mathbb{Z}_q\) (two_ne_zero). This is of course the case as long as \(q \ne 2\), which somewhat cumbersomely derive from h : q ∣ 2^p - 1.

  have two_ne_zero : (2 : ZMod q) ≠ 0 := by
    by_contra contra
    have q_lq_two : q ≤ 2 := (Nat.Prime.dvd_factorial q_prime.out).mp ((ZMod.nat_cast_zmod_eq_zero_iff_dvd 2 q).mp contra)
    have q_gt_two : q > 2 := Nat.lt_of_le_of_ne (Nat.Prime.two_le q_prime.out) (Odd.ne_two_of_dvd_nat (Nat.Even.sub_odd (Nat.one_le_two_pow) ( even_iff_two_dvd.mpr (dvd_pow_self 2 (Nat.Prime.ne_zero p_prime.out))) (Exists.intro Nat.zero rfl)) h).symm
    exact (Nat.not_lt.mpr q_lq_two) q_gt_two
    
  have p_dvd_q_minus_1 : p ∣ (q - 1) := order_two_eq_p ▸ (ZMod.orderOf_dvd_card_sub_one two_ne_zero)

Finally, we conclude the proof of our main lemma by deriving that “\(p < q\)”.

  exact Nat.lt_of_le_pred (Nat.Prime.pos q_prime.out) (Nat.le_of_dvd (Nat.sub_pos_of_lt (Nat.Prime.two_le q_prime.out)) p_dvd_q_minus_1)

This however does not conclude the actual proof of the infinitude of primes. The proof simply suggests we “(s)uppose \(\mathbb{P}\) is finite and \(p\) is the largest prime” and use the previous lemma to derive a contradiction. Let us do just that! We start by defining P as the set of primes and supposing that it is finite using by_contra, which allows us to define p as its maximum

theorem infinitude_of_primes : { p : ℕ | Nat.Prime p}.Infinite := by
  by_contra contra
  have : Fintype { p : ℕ | Nat.Prime p} := Set.Finite.fintype (Set.not_infinite.mp contra)
  let P := { p : ℕ | Nat.Prime p}.toFinset
  let P_nonenmpty : P.Nonempty := (Set.nonempty_of_mem (Set.mem_toFinset.mpr Nat.prime_two))
  let p := Finset.max' P P_nonenmpty
  have p_in_P : p ∈ P := Finset.max'_mem P P_nonenmpty
  have p_prime : Nat.Prime p := by simp [P] at p_in_P; exact p_in_P

Using this, we let \(q\) be an arbitrary prime divisor of \(2^p-1\), after establishing that \(2^p - 1 \neq 1\) (two_pow_p_minus_one_ne_one), and apply mersenne_prime_dvd_gt to obtain the fact that \(q > p\).

  have two_pow_p_minus_one_ne_one : 2^p - 1 ≠ 1 := Nat.ne_of_gt (Nat.lt_sub_of_add_lt ((@Nat.size_le 2 p).mp (Nat.Prime.two_le p_prime)))
  let ⟨q, q_prime, q_dvd⟩ := Nat.exists_prime_and_dvd two_pow_p_minus_one_ne_one
  have q_gt_p : q > p := @mersenne_prime_dvd_gt p q (Fact.mk p_prime) (Fact.mk q_prime) q_dvd

But this is of course a contradiction, since \(p\) was the largest prime and \(q\) is prime, so we must also have \(q \leq p\).

  have q_lt_p : q ≤ p := Finset.le_max' P q (Set.mem_toFinset.mpr q_prime)
  exact Nat.lt_irrefl p (Nat.lt_of_lt_of_le q_gt_p q_lt_p)

This concludes the proof. 🎉