Syntax for sets

A set is a collection of distinct objects. For writing down concrete sets, it's conventional to use curly braces. We write bool, the set of booleans, as follows: We would write the set of single-digit odd numbers as: The empty set is ordinarily written as a circle with a slash from the top-right to the bottom left: ∅. The objects in a set should be distinct. For example, {1,2,1} isn't a well-formed set, because 1 shows up twice. Simply write {1,2} to refer to the set containing 1 and 2. We say that true is in the set bool but not the set sdos; similarly, 3 is a member of the set sdos. Sets and their various operations are useful programmatically and mathematically. To help you get a sense of how sets work, we'll give an axiomatic account of sets in Coq. That is, we'll assume a few basic definitions and explore their consequences.

A word about priorities

At this point in the course, the most important thing for you to focus on is informal proof. We've continued including a Coq development to allow you to have some formal definitions to follow along, but you should focus your energy on getting intuition by doing informal exercises. There are many optional Coq exercises in this file. Doing them will definitely help your intuition, but don't get bogged down! If it helps you prioritize, there are 29 points for informal work and a mere 16 for Coq proofs.

Adding sets to Coq

Ordinarily, we've defined all of our types inductively. The keyword Parameter here means we're not specifying how sets are actually defined—there are no constructors.

In lieu of constructors, we'll assume that there are three relevant sets:

• The empty set, typically written ∅.

• The universal set, which holds every object of type X. Typically called U or Univ.

• The set specified by a predicate: given P : X → Prop, the set of objects a : X such that P a.
  Such sets are typically constructed with set-builder notation, where {x | P} denotes the set of x such that P.
  Paper use of set-builder notation will sometimes indicate x's type or the set its being drawn from, e.g., {x : nat | ∃k, x = 2*k} specifies the even naturals. On paper, multiple premises will sometimes be separated by a comma, as in {x : nat | ∃ k, x = 2 * k, x > 2} denotes the evens counting from 4. A more precise notation would write {x : nat | (∃k, x = 2 * k) ∧ x > 2}.

Given our three set formers, there is one key predicate on sets: membership. A set contains its members, as {true,false} was seen to contain true above. We typically write a ∈ X to mean that a is in X. Other phrasing include "is an element of", "belongs to", "is a member of", "is included in". One might also say X contains a or has a as a member.

If two sets contain the same elements, they are the same set. (Compare to functional extensionality in Logic.v.

In our formulation of sets, there can be no ambiguity: each element is either in or not in the set. That is, we'll just assume that the law of the excluded middle applies to sets.

Nothing is a member of the empty set—it's empty!

But everything is a member of the universal set, since it contains everything.

Finally, an element is a member of a set built with set-builder notation when it satisfies the predicate. Stating this as separate axioms helps Coq do a better job with inference—if we state the iff explicitly, Coq sometimes guesses wrong when we apply the axiom.

Given these primitives, we can derive common notions of sets. We'll use Spec extensively. First, the singleton set holds just one element; it's written {x}.

The union of two sets holds all of those elements in either of those sets; it's written S₁ ∪ S₂.

The intersection of two sets holds the elements common to both sets; it's written S₁ ∩ S₂.

Note the deliberate similarity between union/intersection (∪/∩) and disjunction/conjunction (∨/∧). The difference between two sets are those elements in the first set but not the second. There are two notations in common use: S₁ \ S₂ and S₁ - S₂.

The complement of a set are those elements not in the set. To have a complement, we need a notion of a "universe" which elements are we to consider when picking those elements not in the set? Coq's types give us a natural notion: if S : set X, then Complement S consists of those values of type X that weren't in S. So, for example, Complement {true,false} = ∅ and the complement of the odd naturals are the even naturals. The common notation for complement is to draw a line over the set in question. One can also write U - S, where U stands for the universal set. (See complement__universe_difference for a justification.)

Given these definitions, we can use the axioms to characterize set membership for our various operations.

Exercise: 2 stars, optional (set_properties)

These are some nice properties of sets; proving them shouldn't be too difficult and is nice practice both in Coq and, more importantly, working with sets.

If A is included in B but doesn't comprise all of B, then A is a proper subset of B; we write A ⊂ B or A ⊊ B. Be careful, though: some authors will write A ⊂ B to mean plain (not necessarily proper) subset.

The subset relation is reflexive and transitive.

Subset also provides a way to prove equality of sets: if two sets are subsets of each other, they must be equal. Such a proof of equality is "a proof by mutual inclusion".

Exercise: 2 stars, optional (subset_properties)

For example, the power set of the booleans is:

Exercise: 1 star (subset_power_set)

Define a set Y such that

Define a set Z such that where P(X) is the power set of X.

Define a set Q such that [ the empty set is a proper subset of Q ] (i.e., empty is a subset of Q but empty <> Q) and [ ∀y, if y ∈ Q then y = cheese. ]

Define a set R such that

For example, the product bool × unit is { (true,tt), (false,tt) }.

Exercise: 2 stars, optional (cartesian_properties)

A set-theoretic notion of relations and functions

We've defined many functions and relations in Coq. Function definitions have used the Definition and Fixpoint keywords. Relation definitions have used the Inductive keyword to define propositions. In fact, we've defined sets, as well—the Inductive keyword introduces recursive definitions for sets. Coq takes recursive functions and inductive definitions of sets and relations as primitive; another common perspective is to take sets as primitive, defining functions and relations on top of sets. For a relation on one thing—a unary relation, like ev or sorted—we simply use a set.

For relations on two things—_binary relations, like le or = or Permutation—we use a set of pairs.

For relations on more things—_ternary relations on three things, like R from IndProp.v—we can use larger pairs.

So a relation R between X and Y can be intrepreted as a set of pairs of (a,b), where a : X and b : Y. We say a R b when (a,b) ∈ R.

Exercise: 2 stars (R_functional)

If a function f is total, then its preimage and domain coincide.

Exercise: 3 stars (lifted_functions)

If f : A → B for some sets A and B, we can lift the function f to sets by defining f(S) = { f(s) | s ∈ S } for S is a subset of A. Prove that f(A) is the image of f.

Prove that f(S ∪ T) = f(S) ∪ f(T) for all S, T is a subset of A.

Prove that f(S ∩ T) is a subset of f(S) ∩ f(T).

Why can't you prove equality in the previous question? Give an example of a function f, sets A and B, and S, T is a subset of A where f(A) ∩ f(B) ⊊ f(A ∩ B).

Functions for counting: injections, surjections, and bijections

Recall the definition of injective from Logic.v. A function f : A → B is injective if each input is mapped to a distinct output. We also say f is one to one, also written 1:1.

A function f : A → B is surjective if for every value in B, there's a value in A that maps to it. We also call these functions onto, because f maps "onto" the entirety of B. f is surjective precisely when its codomain is equal to its image.

Both injectivitiy and surjectivity are preserved by function composition.

Exercise: 1 star (inj_composition)

There are three critical theorems about functions and inverses:

• If f : X → Y is injective, then there is a g : Y → X that is surjective.
• If f : X → Y is surjective, then there is a g : Y → X that is injective.
• If f : X → Y is bijective, then there exists a g : Y → X that is also bijective and is an inverse of f.

We can't prove these theorems in Coq (without assuming the LEM or properties of X and Y). There's a difference between knowing that a function must exist and knowing how to compute it. For example, we know that the function square : non-negative real → non-negative real that squares non-negative real numbers has an inverse—namely, the square-root function. But simply having the square function and knowing that it's bijective isn't enough to magically create the square-root function! It's up to us to find some implementation that actually knows how to find square roots using, e.g., Newton's method.

Cardinality

The size of a set is called its cardinality; we write the cardinality of X as |X| (not to be confused with absolute value). For finite sets, cardinality is easy: simply count the number of elements. So |bool| = 2, because it has two elements; |unit| = 1 because it has just one, and |∅| = 0. But cardinality for infinite sets is trickier. What cardinality is nat? What about real? What about nat → nat? Georg Cantor proposed a framework for understanding the cardinalities of infinite sets: use functions as counting arguments. Suppose we have two sets, A and B, and we want to determine their relative sizes. If we can define a function f : A → B that's injective, that means every element of A maps to a distinct element of B, like so: and so on, for each ai ∈ A. Since each of the bi are distinct, there have to be at least as many Bs as there are As. That is, if f : A → B is injective, then |A| ≤ |B|. Suppose instead that f : A → B is surjective. That means f covers all of B, though some elements might be covered twice. [ f a₁ |-> b₁ a₂ |-> b₂ a₃ |-> b₁ a₄ |-> b₃ ... ] and so on, where each bi ∈ B shows up at least once. Since every bi shows up, there have to be least as many As as there are Bs. That is, if f : A → B is surjective, then |B| ≤ |A|. Finally, we can combine the two properties to define a notion of "same cardinality": if there is a bijection f : A → B, then:

• every element of A gets mapped to a distinct element of B (injectivity), so |A| ≤ |B|;
• every element of B is accounted for in the mapping (surjectivity), so |B| ≤ |A|.

That is, if f : A → B is bijective, then |A| = |B|.

For example, we can define a set with two elements, two, and prove that it has the same cardinality as bool. To do so, we have to come up with a function that maps the elements of bool in a one-to-one and onto fashion, i.e., every element of bool is mapped to a distinct element of two and all elements of two are accounted for.

We'll have true map to column_a and false map to column_b. It doesn't really matter—we could have gone the other way. But we couldn't have had both true and false map to column_a, since that wouldn't be injective.

Exercise: 2 stars (bool_nat_cardinality)

Prove that bool and nat have different cardinalities.

Here's another example of the method, showing that |X| ≠ |P(X)|, i.e., a set and its powerset are of different cardinality. I'll provide the Coq proof; you provide the informal proof.

Exercise: 4 stars (set_powset_diag)

Prove that |X| ≠ |P(X)| for all X.

Countability

Given that injections, surjections, and bijections give an account of the relative sizes of infinite sets, we can go on to define a particularly interesting class of infinite sets: countable sets are those that are no bigger than the natural numbers. Since there are two ways to show relative size, there are two ways to show countability of a set X:

• define a function f : X → nat and prove that f is injective (so |X| ≤ |nat|)
• define a function g : nat → X and prove that g is surjective (so |X| ≤ |nat|)

Infinitely countable sets have the same cardinality as the nat—that is, we must exhibit a bijection. Our definition in Coq of infinite countability allows us to choose which direction our bijection points. Working informally, it doesn't matter, because bijections are invertible. But since Coq functions aren't automatically invertible, this definition makes our (formal) life easier.

We've already shown that list unit is infinitely countable.

There are many surprising results in infinite countability. First, we can add a finite number of elements to any countable set and it will still be countable. For example, you've already shown that option nat is countable, in nat_natopt_bij_correct!

It's possible to add or subtract an infinite number of elements and still have an infinitely countable set. Here's proof that there as many nats as there are even nats. Let evens = {x:nat| evenb x}. To show |nat| = |evens|, we must define f : nat → evens and prove that f is bijective. We want a mapping like: So let f(x) = double x. We must show that f is bijective, i.e., injective and surjective. We have f injective by double_injective. To see that f is surjective, let an even number m be given. We must show that there is some natural n such that f n = m. By even_bool_prop, we know that if m is even, then there exists a k such that m = double k, so let n be k. The argument underlying the previous proof is sometime called "Hilbert's Hotel", after the mathematician David Hilbert. Suppose an mathematical conference is being held at a hotel. There are countably infinitely many attendees, one per natural number. Fortunately, the hotel has a countably infinite number of rooms, so we just put the nth guest in the nth room. But what happens when another conference shows up at the hotel, this time with countably infinitely many computer scientists to crash the party? The hotel manager has a clever idea: switch it up so mathematicians are in every other room. There are now infintely many empty rooms for the CS folks!

Exercise: 3 stars (evens_nat)

We've exhibited a bijection f : nat → evens to prove that |nat| = |evens|. Prove it the other way: exhibit a bijection g : evens → nat. Hint: no need to be hyperformal here: if you know of an operation that works here but we haven't defined in Coq, you can use it. State the properties you assume.

Russell's paradox

Our definition of sets is typed: we say set X to mean a set of values of type X. What happens if we don't use types to "ramify" our sets, in the sense of "divide into branches or subdivisions; as, to ramify an art, subject, scheme" (Webster's unabridged 1913 dictionary). Allowing heteregeneous adds flexibility—we can define a set not just of nats, but nats mixed with bools and lists. Allowing such definitions of sets yields a dangerous circularity, though: can a set be a member of itself? Bertrand Russell discovered that allowing sets to be members of themselves is contradictory—it's simply not sound mathematics. His argument went as follows. Call a set that contains itself extraordinary; sets that don't contain themselves are ordinary. So S = {1,3,true} is ordinary, but T = {1,T} is extraordinary. Each set is ordinary or extraordinary—it either is a member of itself or it isn't.

• Russell's paradox. Let the set X bedefined as the set of ordinary sets, i.e. X = { A | A is ordinary}, i.e., X = {A | A ∉ A}.
  Is X ordinary or extraordinary? We find
  • If X is ordinary, then X ∉ X. But then, by definition, every ordinary set should be a member of X... including itself! So then X ∈ X and X is extraordinary... contradicting our assumption that it was ordinary.
  • If, on the other hand, that X is extraordinary, then X ∈ X. But X's members are exactly the ordinary sets, i.e., those A such that A ∉ A—so it's a contradiction to have X ∈ X.

We assumed that we could define X as the set of ordinary sets, but we arrived at a contradiction. We've typically arrived at a contradiction after assuming some proposition we're trying to disprove: to show ¬P, we assume P and then derive an absurdity. But this situation is different: we weren't trying to prove anything—we were just defining something! What does it mean to reach a contradiction from a definition? If you're concerned, the feeling is justified. If a definition can produce a contradiction, what does mathematics even mean? How do we make sure we only define good definitions, that won't produce such paradoxes? These concerns wracked the mathematical community in the first part of the 20th Century. Math has settled on two solutions to the problem.

• First, Russell and Whitehead produced an incredible work, Principia Mathematica, which showed how to build up a theory of "ramified sets"—sets where a set of subdivisions or levels indicated which sets could be members of others. So began type theory—the underlying framework that Coq uses. Type theory has come a long way—_Principia is famously unreadable, full of opaque and tedious calculations to find simple facts like 1 + 1 = 2. (It took them 352 pages to prove that fact!) Nothing like Coq, of course.
• Later, Ernst Zermelo and Abraham Fraenkel came up with a set of axioms for working with sets; they axioms are collectively called ZF. Rather than dealing with the tedium of ramified sets, they instituted an axiom called regularity (a/k/a the axiom of foundation) that prevents dangerous circularities (while still allowing heterogeneous sets):

That is, for every x, if there is some element a of x, then there is another element y of x such that x and y are disjoint (i.e., there are no z such that z is an element of both y and x). Most mathematicians work in ZF, but without ever really thinking about it. So long as you define ordinary sets, you'll never violate the ZF axioms. But if you're doing something weird—using extraordinary sets or really big infinite sets—you need to watch out. One particularly good litmus test for a definition is to try to put it into Coq. While there are some good definitions that Coq won't accept, if Coq does accept your definition, then so will mathematicians everywhere.