Moving sofa: related mathematical developments

• LeanCert.Contrib.Sinc.
• LeanCert.Core.DerivativeIntervals.
• LeanCert.Core.Dyadic.
• LeanCert.Core.Expr.
• LeanCert.Core.Interval.
• LeanCert.Core.IntervalRat.Basic.
• LeanCert.Core.IntervalRat.LogReduction.
• LeanCert.Core.IntervalRat.Transcendental.
• LeanCert.Core.Support.
• LeanCert.Core.Taylor.
• LeanCert.Core.IntervalRat.Taylor.
• LeanCert.Core.IntervalReal.
• LeanCert.Core.IntervalDyadic.
• LeanCert.Core.IntervalRealEndpoints.
• LeanCert.Core.TrigReduction.
• LeanCert.Core.IntervalRat.TrigReduced.
• LeanCert.Engine.Eval.Core.
• LeanCert.Engine.Eval.Result.
• LeanCert.Engine.Eval.Extended.
• LeanCert.Engine.Bounds.Lemmas.
• LeanCert.Engine.IntervalEval.
• LeanCert.Engine.AD.Basic.
• LeanCert.Engine.AD.Transcendental.
• LeanCert.Engine.AD.Eval.
• LeanCert.Engine.AD.Correctness.
• LeanCert.Engine.AD.Computable.
• LeanCert.Engine.AD.DomainChecked.

Differentiability of sinc and dslope

This file proves that the sinc function is differentiable everywhere, including at 0.

Main results

• Real.differentiableAt_sinc: sinc is differentiable at every point
• Real.hasDerivAt_sinc_zero: sinc has derivative 0 at x = 0

Mathematical background

The sinc function is defined as:

• sinc x = sin x / x for x ≠ 0
• sinc 0 = 1

Equivalently, sinc = dslope sin 0.

The derivative of sinc at 0 can be computed using Taylor expansion:

• sin x = x - x³/6 + x⁵/120 - ...
• sinc x = 1 - x²/6 + x⁴/120 - ...
• sinc'(0) = 0

theorem Real.abs_sin_sub_self_le (x : ℝ) (_hx : |x| ≤ 1) : |sin x - x| ≤ |x| ^ 3 / 4

Bound on |sin x - x| in terms of |x|³. For x > 0: sin x < x and x - x³/4 < sin x, so 0 < x - sin x < x³/4. By symmetry (sin(-x) = -sin(x)), |sin x - x| ≤ |x|³/4 for all x with |x| ≤ 1.

theorem Real.hasDerivAt_sinc_zero : HasDerivAt sinc 0 0

The derivative of sinc at 0 is 0.

The proof uses the squeeze theorem with the bound |sinc x - 1| ≤ |x|² / 4, which follows from sin bounds in Mathlib.

theorem Real.differentiableAt_sinc_zero : DifferentiableAt ℝ sinc 0

theorem Real.differentiableAt_sinc (x : ℝ) : DifferentiableAt ℝ sinc x

sinc is differentiable everywhere.

theorem Real.differentiable_sinc : Differentiable ℝ sinc

sinc is a differentiable function.

theorem Real.sinc_eq_integral_cos (x : ℝ) : sinc x = ∫ (t : ℝ) in 0..1, cos (x * t)

Integral representation of sinc: sinc x = ∫ t in 0..1, cos (x * t). This is the standard average-cosine form used for derivative bounds.

theorem Real.hasDerivAt_sinc_of_ne_zero {x : ℝ} (hx : x ≠ 0) : HasDerivAt sinc ((x * cos x - sin x) / x ^ 2) x

The derivative of sinc at a nonzero point.

theorem Real.deriv_sinc {x : ℝ} : deriv sinc x = if x = 0 then 0 else (x * cos x - sin x) / x ^ 2

The derivative of sinc. For x = 0, deriv sinc 0 = 0. For x ≠ 0, deriv sinc x = (x cos x - sin x) / x².

@[simp]

theorem Real.deriv_sinc_zero : deriv sinc 0 = 0

theorem Real.abs_x_mul_cos_sub_sin_le_sq (x : ℝ) : |x * cos x - sin x| ≤ x ^ 2

Bound: |x cos x - sin x| ≤ x² for all x. Proof uses monotonicity of auxiliary functions on [0, ∞).

theorem Real.abs_deriv_sinc_le_one (x : ℝ) : |deriv sinc x| ≤ 1

theorem Real.deriv_sinc_mem_Icc (x : ℝ) : deriv sinc x ∈ Set.Icc (-1) 1

deriv sinc x is in [-1, 1] for all x

Integral representation and smoothness of sinc

The sinc function is smooth (C^∞). The key insight is the integral representation: sinc(x) = ∫ t in 0..1, cos(t * x) dt

This works because:

• For x ≠ 0: ∫₀¹ cos(tx) dt = [sin(tx)/x]₀¹ = sin(x)/x = sinc(x)
• For x = 0: ∫₀¹ cos(0) dt = ∫₀¹ 1 dt = 1 = sinc(0)

Smoothness follows from differentiation under the integral sign (Leibniz rule): since cos(t*x) is C^∞ in x and the domain [0,1] is compact, the integral is C^∞.

theorem Real.sinc_eq_integral (x : ℝ) : sinc x = ∫ (t : ℝ) in 0..1, cos (t * x)

The integral representation of sinc: sinc(x) = ∫ t in 0..1, cos(t * x)

theorem Real.deriv_sinc_eq_dslope : deriv sinc = dslope (cos - sinc) 0

The derivative of sinc equals dslope (cos - sinc) at 0.

For x ≠ 0: dslope (cos - sinc) 0 x = (cos x - sinc x) / x = (x cos x - sin x) / x² = deriv sinc x

For x = 0: dslope (cos - sinc) 0 0 = deriv (cos - sinc) 0 = -sin 0 - deriv sinc 0 = 0 = deriv sinc 0

theorem Real.contDiffAt_sinc_of_ne_zero {x : ℝ} (hx : x ≠ 0) : ContDiffAt ℝ ⊤ sinc x

sinc is smooth at every nonzero point.

theorem Real.analyticAt_sinc_zero : AnalyticAt ℝ sinc 0

sinc is analytic at 0.

The proof uses the order theory of analytic functions. Since sin is analytic at 0 with order ≥ 1 (because sin(0) = 0), there exists an analytic function g such that sin(z) = z • g(z) near 0. This g must equal sinc away from 0, and by continuity of both functions at 0, g = sinc everywhere near 0. Therefore sinc is analytic at 0.

theorem Real.analyticAt_sinc (x : ℝ) : AnalyticAt ℝ sinc x

sinc is analytic at every point.

theorem Real.contDiff_sinc : ContDiff ℝ ⊤ sinc

sinc is smooth (infinitely differentiable).

The proof uses that sinc is analytic everywhere (analyticAt_sinc), and analytic functions are smooth.

theorem Real.analyticOnNhd_sinc : AnalyticOnNhd ℝ sinc Set.univ

sinc is an analytic function.

Derivative Interval Library

This file provides a systematic collection of derivative interval facts for basic functions. These lemmas establish that derivatives of common functions lie within specified intervals, which feeds into:

• Monotonicity analysis
• Lipschitz/contractivity bounds
• Newton method analysis
• Global optimization pruning

Main theorems

Exp (derivative = exp, always positive)

• exp_deriv_pos - exp' x > 0 for all x
• exp_deriv_interval - exp' x ∈ [exp a, exp b] for x ∈ [a, b]

Log (derivative = 1/x on (0, ∞))

• log_deriv_interval - log' x ∈ [1/b, 1/a] for x ∈ [a, b] with 0 < a

Arctan (derivative = 1/(1+x²) ∈ (0, 1])

• arctan_deriv_interval - arctan' x ∈ (0, 1] for all x
• arctan_deriv_mem_Icc - arctan' x ∈ [0, 1] for all x

Arsinh (derivative = 1/√(1+x²) ∈ (0, 1])

• arsinh_deriv_interval - arsinh' x ∈ (0, 1] for all x
• arsinh_deriv_mem_Icc - arsinh' x ∈ [0, 1] for all x

Sin/Cos (derivatives bounded by 1)

• sin_deriv_interval - |sin' x| = |cos x| ≤ 1
• cos_deriv_interval - |cos' x| = |sin x| ≤ 1

Sinh/Cosh (derivative relationships)

• sinh_deriv_eq_cosh - sinh' = cosh
• cosh_deriv_eq_sinh - cosh' = sinh
• cosh_deriv_interval - cosh' x = sinh x, monotonicity facts

Design notes

These lemmas are independent of any specific algorithm; they're just facts about functions. They're designed to be composable with the chain rule for AD correctness proofs.

Exp derivative intervals

theorem LeanCert.Core.DerivativeIntervals.exp_deriv_pos (x : ℝ) : 0 < deriv Real.exp x

The derivative of exp is positive everywhere

theorem LeanCert.Core.DerivativeIntervals.exp_strictMono : StrictMono Real.exp

exp is strictly increasing (follows from positive derivative)

theorem LeanCert.Core.DerivativeIntervals.exp_deriv_interval {a b x : ℝ} (hx : x ∈ Set.Icc a b) : deriv Real.exp x ∈ Set.Icc (Real.exp a) (Real.exp b)

For x ∈ [a, b], we have exp' x = exp x ∈ [exp a, exp b]

Log derivative intervals

theorem LeanCert.Core.DerivativeIntervals.log_deriv_eq_inv {x : ℝ} (_hx : 0 < x) : deriv Real.log x = x⁻¹

The derivative of log at x > 0 is x⁻¹

theorem LeanCert.Core.DerivativeIntervals.log_deriv_interval {a b x : ℝ} (ha : 0 < a) (hx : x ∈ Set.Icc a b) : deriv Real.log x ∈ Set.Icc b⁻¹ a⁻¹

For x ∈ [a, b] with 0 < a ≤ b, we have log' x = 1/x ∈ [1/b, 1/a]

theorem LeanCert.Core.DerivativeIntervals.log_strictMonoOn : StrictMonoOn Real.log (Set.Ioi 0)

log is strictly increasing on (0, ∞)

Arctan derivative intervals

theorem LeanCert.Core.DerivativeIntervals.arctan_deriv_eq (x : ℝ) : deriv Real.arctan x = (1 + x ^ 2)⁻¹

The derivative of arctan at x is 1/(1+x²)

theorem LeanCert.Core.DerivativeIntervals.arctan_deriv_pos (x : ℝ) : 0 < deriv Real.arctan x

1/(1+x²) is always positive

theorem LeanCert.Core.DerivativeIntervals.arctan_deriv_le_one (x : ℝ) : deriv Real.arctan x ≤ 1

1/(1+x²) ≤ 1 for all x

theorem LeanCert.Core.DerivativeIntervals.arctan_deriv_interval (x : ℝ) : deriv Real.arctan x ∈ Set.Ioc 0 1

arctan' x ∈ (0, 1] for all x

theorem LeanCert.Core.DerivativeIntervals.arctan_deriv_mem_Icc (x : ℝ) : deriv Real.arctan x ∈ Set.Icc 0 1

arctan' x ∈ [0, 1] for all x (closed interval version for interval arithmetic)

theorem LeanCert.Core.DerivativeIntervals.arctan_strictMono : StrictMono Real.arctan

arctan is strictly increasing (follows from positive derivative)

Arsinh derivative intervals

theorem LeanCert.Core.DerivativeIntervals.arsinh_deriv_eq (x : ℝ) : deriv Real.arsinh x = (√(1 + x ^ 2))⁻¹

The derivative of arsinh at x is (√(1+x²))⁻¹

theorem LeanCert.Core.DerivativeIntervals.sqrt_one_add_sq_ge_one (x : ℝ) : 1 ≤ √(1 + x ^ 2)

√(1+x²) ≥ 1 for all x

theorem LeanCert.Core.DerivativeIntervals.sqrt_one_add_sq_pos (x : ℝ) : 0 < √(1 + x ^ 2)

√(1+x²) > 0 for all x

theorem LeanCert.Core.DerivativeIntervals.arsinh_deriv_pos (x : ℝ) : 0 < deriv Real.arsinh x

arsinh' x > 0 for all x

theorem LeanCert.Core.DerivativeIntervals.arsinh_deriv_le_one (x : ℝ) : deriv Real.arsinh x ≤ 1

arsinh' x ≤ 1 for all x

theorem LeanCert.Core.DerivativeIntervals.arsinh_deriv_interval (x : ℝ) : deriv Real.arsinh x ∈ Set.Ioc 0 1

arsinh' x ∈ (0, 1] for all x

theorem LeanCert.Core.DerivativeIntervals.arsinh_deriv_mem_Icc (x : ℝ) : deriv Real.arsinh x ∈ Set.Icc 0 1

arsinh' x ∈ [0, 1] for all x (closed interval version)

theorem LeanCert.Core.DerivativeIntervals.arsinh_strictMono : StrictMono Real.arsinh

arsinh is strictly increasing

Sin derivative intervals

theorem LeanCert.Core.DerivativeIntervals.sin_deriv_eq (x : ℝ) : deriv Real.sin x = Real.cos x

The derivative of sin is cos

theorem LeanCert.Core.DerivativeIntervals.sin_deriv_abs_le_one (x : ℝ) : |deriv Real.sin x| ≤ 1

|sin' x| = |cos x| ≤ 1

theorem LeanCert.Core.DerivativeIntervals.sin_deriv_mem_Icc (x : ℝ) : deriv Real.sin x ∈ Set.Icc (-1) 1

sin' x ∈ [-1, 1] for all x

Cos derivative intervals

theorem LeanCert.Core.DerivativeIntervals.cos_deriv_eq (x : ℝ) : deriv Real.cos x = -Real.sin x

The derivative of cos is -sin

theorem LeanCert.Core.DerivativeIntervals.cos_deriv_abs_le_one (x : ℝ) : |deriv Real.cos x| ≤ 1

|cos' x| = |sin x| ≤ 1

theorem LeanCert.Core.DerivativeIntervals.cos_deriv_mem_Icc (x : ℝ) : deriv Real.cos x ∈ Set.Icc (-1) 1

cos' x ∈ [-1, 1] for all x

Sinh derivative intervals

theorem LeanCert.Core.DerivativeIntervals.sinh_deriv_eq (x : ℝ) : deriv Real.sinh x = Real.cosh x

The derivative of sinh is cosh

theorem LeanCert.Core.DerivativeIntervals.sinh_deriv_ge_one (x : ℝ) : 1 ≤ deriv Real.sinh x

sinh' x = cosh x ≥ 1 for all x

theorem LeanCert.Core.DerivativeIntervals.sinh_deriv_pos (x : ℝ) : 0 < deriv Real.sinh x

sinh' x > 0 for all x

theorem LeanCert.Core.DerivativeIntervals.sinh_strictMono : StrictMono Real.sinh

sinh is strictly increasing

Cosh derivative intervals

theorem LeanCert.Core.DerivativeIntervals.cosh_deriv_eq (x : ℝ) : deriv Real.cosh x = Real.sinh x

The derivative of cosh is sinh

theorem LeanCert.Core.DerivativeIntervals.cosh_deriv_zero : deriv Real.cosh 0 = 0

cosh' 0 = sinh 0 = 0

theorem LeanCert.Core.DerivativeIntervals.cosh_deriv_pos_of_pos {x : ℝ} (hx : 0 < x) : 0 < deriv Real.cosh x

For x > 0, cosh' x = sinh x > 0

theorem LeanCert.Core.DerivativeIntervals.cosh_deriv_neg_of_neg {x : ℝ} (hx : x < 0) : deriv Real.cosh x < 0

For x < 0, cosh' x = sinh x < 0

theorem LeanCert.Core.DerivativeIntervals.cosh_strictAntiOn_nonpos : StrictAntiOn Real.cosh (Set.Iic 0)

cosh is strictly decreasing on (-∞, 0]

theorem LeanCert.Core.DerivativeIntervals.cosh_strictMonoOn_nonneg : StrictMonoOn Real.cosh (Set.Ici 0)

cosh is strictly increasing on [0, ∞)

One-Sided Taylor Bounds

For convex functions, the Taylor polynomial provides a one-sided bound. For exp on [0, ∞), the n-th Taylor polynomial is a lower bound. For concave functions, similar upper bounds hold.

These bounds are tighter than symmetric remainder bounds at endpoints, which is important for verified numerics.

Exp lower bounds (convexity gives Taylor poly ≤ function)

theorem LeanCert.Core.OneSidedTaylor.one_le_exp_of_nonneg (x : ℝ) (hx : 0 ≤ x) : 1 ≤ Real.exp x

1 ≤ exp x for x ≥ 0 (Taylor degree 0)

theorem LeanCert.Core.OneSidedTaylor.one_add_le_exp (x : ℝ) : 1 + x ≤ Real.exp x

1 + x ≤ exp x for all x (Taylor degree 1)

theorem LeanCert.Core.OneSidedTaylor.add_one_le_exp' (x : ℝ) : x + 1 ≤ Real.exp x

x + 1 ≤ exp x for all x (alternate form)

Monotonicity from derivative bounds

These wrap the Mathlib lemmas for convenience with our naming.

theorem LeanCert.Core.OneSidedTaylor.monotoneOn_of_deriv_nonneg {f : ℝ → ℝ} {a b : ℝ} (hf : ContinuousOn f (Set.Icc a b)) (hf' : DifferentiableOn ℝ f (Set.Ioo a b)) (hderiv : ∀ x ∈ Set.Ioo a b, 0 ≤ deriv f x) : MonotoneOn f (Set.Icc a b)

If f' ≥ 0 on [a, b], then f is monotone increasing on [a, b]

theorem LeanCert.Core.OneSidedTaylor.strictMonoOn_of_deriv_pos {f : ℝ → ℝ} {a b : ℝ} (_hab : a < b) (hf : ContinuousOn f (Set.Icc a b)) (_hf' : DifferentiableOn ℝ f (Set.Ioo a b)) (hderiv : ∀ x ∈ Set.Ioo a b, 0 < deriv f x) : StrictMonoOn f (Set.Icc a b)

If f' > 0 on (a, b), then f is strictly monotone on [a, b]

theorem LeanCert.Core.OneSidedTaylor.antitoneOn_of_deriv_nonpos {f : ℝ → ℝ} {a b : ℝ} (hf : ContinuousOn f (Set.Icc a b)) (hf' : DifferentiableOn ℝ f (Set.Ioo a b)) (hderiv : ∀ x ∈ Set.Ioo a b, deriv f x ≤ 0) : AntitoneOn f (Set.Icc a b)

If f' ≤ 0 on [a, b], then f is antitone (monotone decreasing) on [a, b]

theorem LeanCert.Core.OneSidedTaylor.strictAntiOn_of_deriv_neg {f : ℝ → ℝ} {a b : ℝ} (_hab : a < b) (hf : ContinuousOn f (Set.Icc a b)) (_hf' : DifferentiableOn ℝ f (Set.Ioo a b)) (hderiv : ∀ x ∈ Set.Ioo a b, deriv f x < 0) : StrictAntiOn f (Set.Icc a b)

If f' < 0 on (a, b), then f is strictly antitone on [a, b]

Dyadic Rationals (n * 2^e)

This file defines Dyadic rationals, which are the backbone of high-performance verified numerics. Unlike arbitrary Rat, Dyadics do not require GCD normalization, making them significantly faster for kernel evaluation.

Main definitions

• Dyadic - A dyadic rational number: mantissa * 2^exponent
• Dyadic.toRat - Convert to standard rational
• Dyadic.add, Dyadic.mul, Dyadic.neg - Arithmetic operations
• Dyadic.shiftDown, Dyadic.shiftUp - Directed rounding for interval bounds

Design notes

Dyadics use power-of-2 multiplications instead of GCD-based normalization. This makes them orders of magnitude faster for kernel evaluation via native_decide, since 2^n can be computed by simple bit operations.

For interval arithmetic, we use directed rounding:

• Lower bounds use shiftDown (round toward -∞)
• Upper bounds use shiftUp (round toward +∞)

This ensures mathematical soundness even when truncating precision.

structure LeanCert.Core.Dyadic : Type

A Dyadic rational number: mantissa * 2^exponent

This representation allows fast arithmetic without GCD normalization.

• mantissa : ℤ

  The significand/mantissa

• exponent : ℤ

  The exponent (power of 2)

@[instance_reducible]

instance LeanCert.Core.instReprDyadic : Repr Dyadic

Equations

• LeanCert.Core.instReprDyadic = { reprPrec := LeanCert.Core.instReprDyadic.repr }

def LeanCert.Core.instReprDyadic.repr : Dyadic → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instDecidableEqDyadic : DecidableEq Dyadic

Equations

• LeanCert.Core.instDecidableEqDyadic = LeanCert.Core.instDecidableEqDyadic.decEq

def LeanCert.Core.instDecidableEqDyadic.decEq (x✝ x✝¹ : Dyadic) : Decidable (x✝ = x✝¹)

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instInhabitedDyadic : Inhabited Dyadic

Equations

• LeanCert.Core.instInhabitedDyadic = { default := LeanCert.Core.instInhabitedDyadic.default }

Helper: Power of 2

def LeanCert.Core.Dyadic.pow2Nat (n : ℕ) : ℕ

Compute 2^n for natural n

Equations

• LeanCert.Core.Dyadic.pow2Nat n = Nat.shiftLeft 1 n

def LeanCert.Core.Dyadic.shiftLeftInt (m : ℤ) (n : ℕ) : ℤ

Shift an integer left by n bits (multiply by 2^n)

Equations

• LeanCert.Core.Dyadic.shiftLeftInt m n = m * ↑(LeanCert.Core.Dyadic.pow2Nat n)

def LeanCert.Core.Dyadic.shiftRightInt (m : ℤ) (n : ℕ) : ℤ

Shift an integer right by n bits (divide by 2^n, floor toward -∞)

Equations

• LeanCert.Core.Dyadic.shiftRightInt m n = m / ↑(LeanCert.Core.Dyadic.pow2Nat n)

def LeanCert.Core.Dyadic.hasLowBits (m : ℤ) (n : ℕ) : Bool

Check if any of the low n bits are set

Equations

• LeanCert.Core.Dyadic.hasLowBits m n = decide (m % ↑(LeanCert.Core.Dyadic.pow2Nat n) ≠ 0)

Conversion to Rat

def LeanCert.Core.Dyadic.toRat (d : Dyadic) : ℚ

Convert Dyadic to standard Rat.

For non-negative exponents: mantissa * 2^exponent For negative exponents: mantissa / 2^(-exponent)

Equations

• d.toRat = if d.exponent ≥ 0 then ↑d.mantissa * ↑↑(LeanCert.Core.Dyadic.pow2Nat d.exponent.toNat) else ↑d.mantissa / ↑(LeanCert.Core.Dyadic.pow2Nat (-d.exponent).toNat)

@[instance_reducible]

instance LeanCert.Core.Dyadic.instCoeRat : Coe Dyadic ℚ

Equations

• LeanCert.Core.Dyadic.instCoeRat = { coe := LeanCert.Core.Dyadic.toRat }

def LeanCert.Core.Dyadic.ValueEq (d₁ d₂ : Dyadic) : Prop

Equality of represented values, ignoring noncanonical mantissa/exponent pairs.

Equations

• d₁.ValueEq d₂ = (d₁.toRat = d₂.toRat)

@[instance_reducible]

instance LeanCert.Core.Dyadic.instDecidableValueEq (d₁ d₂ : Dyadic) : Decidable (d₁.ValueEq d₂)

Equations

• d₁.instDecidableValueEq d₂ = LeanCert.Core.Dyadic.instDecidableValueEq._aux_1 d₁ d₂

@[instance_reducible]

instance LeanCert.Core.Dyadic.instSetoid : Setoid Dyadic

Equations

• LeanCert.Core.Dyadic.instSetoid = { r := LeanCert.Core.Dyadic.ValueEq, iseqv := LeanCert.Core.Dyadic.instSetoid._proof_1 }

@[simp]

theorem LeanCert.Core.Dyadic.valueEq_iff (d₁ d₂ : Dyadic) : d₁.ValueEq d₂ ↔ d₁.toRat = d₂.toRat

structure LeanCert.Core.Dyadic.CanonicalKey : Type

A lawful identity key for caches, sets, serialization, and deduplication.

Arithmetic keeps the fast, noncanonical Dyadic representation. Converting at an identity boundary collapses all representations of the same rational value.

• value : ℚ

  The exact rational value used to compare normalized dyadic numbers.

@[instance_reducible]

instance LeanCert.Core.Dyadic.instReprCanonicalKey : Repr CanonicalKey

Equations

• LeanCert.Core.Dyadic.instReprCanonicalKey = { reprPrec := LeanCert.Core.Dyadic.instReprCanonicalKey.repr }

def LeanCert.Core.Dyadic.instReprCanonicalKey.repr : CanonicalKey → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.Dyadic.instDecidableEqCanonicalKey.decEq (x✝ x✝¹ : CanonicalKey) : Decidable (x✝ = x✝¹)

Equations

• LeanCert.Core.Dyadic.instDecidableEqCanonicalKey.decEq { value := a } { value := b } = if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯

@[instance_reducible]

instance LeanCert.Core.Dyadic.instDecidableEqCanonicalKey : DecidableEq CanonicalKey

Equations

• LeanCert.Core.Dyadic.instDecidableEqCanonicalKey = LeanCert.Core.Dyadic.instDecidableEqCanonicalKey.decEq

@[instance_reducible]

instance LeanCert.Core.Dyadic.instBEqCanonicalKey : BEq CanonicalKey

Equations

• LeanCert.Core.Dyadic.instBEqCanonicalKey = { beq := LeanCert.Core.Dyadic.instBEqCanonicalKey.beq }

def LeanCert.Core.Dyadic.instBEqCanonicalKey.beq : CanonicalKey → CanonicalKey → Bool

Equations

• LeanCert.Core.Dyadic.instBEqCanonicalKey.beq { value := a } { value := b } = (a == b)
• LeanCert.Core.Dyadic.instBEqCanonicalKey.beq x✝¹ x✝ = false

@[instance_reducible]

instance LeanCert.Core.Dyadic.instHashableCanonicalKey : Hashable CanonicalKey

Equations

• LeanCert.Core.Dyadic.instHashableCanonicalKey = { hash := LeanCert.Core.Dyadic.instHashableCanonicalKey.hash }

def LeanCert.Core.Dyadic.instHashableCanonicalKey.hash : CanonicalKey → UInt64

Equations

• LeanCert.Core.Dyadic.instHashableCanonicalKey.hash { value := a } = mixHash 0 (hash a)

def LeanCert.Core.Dyadic.canonicalKey (d : Dyadic) : CanonicalKey

Convert a dyadic value to its canonical identity key.

Equations

• d.canonicalKey = { value := d.toRat }

@[simp]

theorem LeanCert.Core.Dyadic.canonicalKey_value (d : Dyadic) : d.canonicalKey.value = d.toRat

theorem LeanCert.Core.Dyadic.canonicalKey_eq_iff (d₁ d₂ : Dyadic) : d₁.canonicalKey = d₂.canonicalKey ↔ d₁.ValueEq d₂

Canonical keys agree exactly when represented dyadic values agree.

def LeanCert.Core.Dyadic.toReal (d : Dyadic) : ℝ

Cast a Dyadic to ℝ by going through ℚ

Equations

• d.toReal = ↑d.toRat

@[instance_reducible]

instance LeanCert.Core.Dyadic.instCoeReal : Coe Dyadic ℝ

Equations

• LeanCert.Core.Dyadic.instCoeReal = { coe := LeanCert.Core.Dyadic.toReal }

theorem LeanCert.Core.Dyadic.valueEq_of_toRat_eq {d₁ d₂ : Dyadic} (h : d₁.toRat = d₂.toRat) : d₁.ValueEq d₂

Equality of rational denotations gives semantic dyadic equality.

Construction

def LeanCert.Core.Dyadic.ofInt (i : ℤ) : Dyadic

Create a dyadic from an integer (exponent = 0)

Equations

• LeanCert.Core.Dyadic.ofInt i = { mantissa := i, exponent := 0 }

def LeanCert.Core.Dyadic.pow2 (n : ℤ) : Dyadic

Create a dyadic for 2^n

Equations

• LeanCert.Core.Dyadic.pow2 n = { mantissa := 1, exponent := n }

def LeanCert.Core.Dyadic.zero : Dyadic

Zero as a Dyadic

Equations

• LeanCert.Core.Dyadic.zero = { mantissa := 0, exponent := 0 }

def LeanCert.Core.Dyadic.one : Dyadic

One as a Dyadic

Equations

• LeanCert.Core.Dyadic.one = { mantissa := 1, exponent := 0 }

@[instance_reducible]

instance LeanCert.Core.Dyadic.instZero : Zero Dyadic

Equations

• LeanCert.Core.Dyadic.instZero = { zero := LeanCert.Core.Dyadic.zero }

@[instance_reducible]

instance LeanCert.Core.Dyadic.instOne : One Dyadic

Equations

• LeanCert.Core.Dyadic.instOne = { one := LeanCert.Core.Dyadic.one }

theorem LeanCert.Core.Dyadic.toRat_ofInt (i : ℤ) : (ofInt i).toRat = ↑i

@[simp]

theorem LeanCert.Core.Dyadic.toRat_zero : toRat 0 = 0

@[simp]

theorem LeanCert.Core.Dyadic.toRat_one : toRat 1 = 1

Arithmetic Operations

def LeanCert.Core.Dyadic.neg (d : Dyadic) : Dyadic

Negation of a Dyadic

Equations

• d.neg = { mantissa := -d.mantissa, exponent := d.exponent }

@[instance_reducible]

instance LeanCert.Core.Dyadic.instNeg : Neg Dyadic

Equations

• LeanCert.Core.Dyadic.instNeg = { neg := LeanCert.Core.Dyadic.neg }

def LeanCert.Core.Dyadic.add (d₁ d₂ : Dyadic) : Dyadic

Addition of Dyadics. Aligns exponents by shifting the mantissa with larger exponent to match the smaller one.

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.Dyadic.instAdd : Add Dyadic

Equations

• LeanCert.Core.Dyadic.instAdd = { add := LeanCert.Core.Dyadic.add }

def LeanCert.Core.Dyadic.sub (d₁ d₂ : Dyadic) : Dyadic

Subtraction of Dyadics

Equations

• d₁.sub d₂ = d₁.add d₂.neg

@[instance_reducible]

instance LeanCert.Core.Dyadic.instSub : Sub Dyadic

Equations

• LeanCert.Core.Dyadic.instSub = { sub := LeanCert.Core.Dyadic.sub }

def LeanCert.Core.Dyadic.mul (d₁ d₂ : Dyadic) : Dyadic

Multiplication of Dyadics. Simply multiplies mantissas and adds exponents.

Equations

• d₁.mul d₂ = { mantissa := d₁.mantissa * d₂.mantissa, exponent := d₁.exponent + d₂.exponent }

@[instance_reducible]

instance LeanCert.Core.Dyadic.instMul : Mul Dyadic

Equations

• LeanCert.Core.Dyadic.instMul = { mul := LeanCert.Core.Dyadic.mul }

def LeanCert.Core.Dyadic.abs (d : Dyadic) : Dyadic

Absolute value of a Dyadic

Equations

• d.abs = { mantissa := ↑d.mantissa.natAbs, exponent := d.exponent }

def LeanCert.Core.Dyadic.scale2 (d : Dyadic) (n : ℤ) : Dyadic

Scale by a power of 2 (efficient: just adjusts exponent)

Equations

• d.scale2 n = { mantissa := d.mantissa, exponent := d.exponent + n }

Directed Rounding for Interval Arithmetic

def LeanCert.Core.Dyadic.shiftDown (d : Dyadic) (newExp : ℤ) : Dyadic

Shift a dyadic to a new (larger) exponent with "Down" rounding (for lower bounds).

If newExp > d.exponent, we lose precision by right-shifting the mantissa. Bits are discarded (floor division toward -∞).

Equations

• d.shiftDown newExp = if newExp ≤ d.exponent then d else have diff := (newExp - d.exponent).toNat; { mantissa := LeanCert.Core.Dyadic.shiftRightInt d.mantissa diff, exponent := newExp }

def LeanCert.Core.Dyadic.shiftUp (d : Dyadic) (newExp : ℤ) : Dyadic

Shift a dyadic to a new (larger) exponent with "Up" rounding (for upper bounds).

If newExp > d.exponent, we lose precision by right-shifting the mantissa. If any bits are lost, we add 1 to ensure upward rounding (ceiling toward +∞).

Equations

• One or more equations did not get rendered due to their size.

Normalization (Mantissa Control)

def LeanCert.Core.Dyadic.natBitLength (n : ℕ) : ℕ

Get the bit length of a natural number

Equations

• LeanCert.Core.Dyadic.natBitLength n = if n = 0 then 0 else n.log2 + 1

def LeanCert.Core.Dyadic.bitLength (m : ℤ) : ℕ

Get the bit length of the absolute value of an integer

Equations

• LeanCert.Core.Dyadic.bitLength m = LeanCert.Core.Dyadic.natBitLength m.natAbs

def LeanCert.Core.Dyadic.normalize (d : Dyadic) (maxBits : ℕ := 256) (roundUp : Bool := false) : Dyadic

Normalize a Dyadic to keep the mantissa within a reasonable bit-limit.

This prevents mantissas from growing without bound during repeated multiplications. Similar to how hardware floats work, but with directed rounding.

• maxBits: Maximum allowed bits for mantissa (default 256)
• roundUp: If true, round toward +∞; if false, round toward -∞

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.Dyadic.normalizeDown (d : Dyadic) (maxBits : ℕ := 256) : Dyadic

Normalize for lower bounds (round down)

Equations

• d.normalizeDown maxBits = d.normalize maxBits

def LeanCert.Core.Dyadic.normalizeUp (d : Dyadic) (maxBits : ℕ := 256) : Dyadic

Normalize for upper bounds (round up)

Equations

• d.normalizeUp maxBits = d.normalize maxBits true

Comparison

def LeanCert.Core.Dyadic.compare (d₁ d₂ : Dyadic) : Ordering

Compare two Dyadics (decidable)

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.Dyadic.instOrd : Ord Dyadic

Equations

• LeanCert.Core.Dyadic.instOrd = { compare := LeanCert.Core.Dyadic.compare }

def LeanCert.Core.Dyadic.le (d₁ d₂ : Dyadic) : Bool

Less-than-or-equal for Dyadics

Equations

• d₁.le d₂ = (d₁.compare d₂ != Ordering.gt)

def LeanCert.Core.Dyadic.lt (d₁ d₂ : Dyadic) : Bool

Less-than for Dyadics

Equations

• d₁.lt d₂ = (d₁.compare d₂ == Ordering.lt)

@[instance_reducible]

instance LeanCert.Core.Dyadic.instLE : LE Dyadic

Equations

• LeanCert.Core.Dyadic.instLE = { le := fun (d₁ d₂ : LeanCert.Core.Dyadic) => d₁.le d₂ = true }

@[instance_reducible]

instance LeanCert.Core.Dyadic.instLT : LT Dyadic

Equations

• LeanCert.Core.Dyadic.instLT = { lt := fun (d₁ d₂ : LeanCert.Core.Dyadic) => d₁.lt d₂ = true }

@[instance_reducible]

instance LeanCert.Core.Dyadic.instDecidableRelLe : DecidableRel fun (x1 x2 : Dyadic) => x1 ≤ x2

Equations

• d₁.instDecidableRelLe d₂ = if h : d₁.le d₂ = true then isTrue h else isFalse h

@[instance_reducible]

instance LeanCert.Core.Dyadic.instDecidableRelLt : DecidableRel fun (x1 x2 : Dyadic) => x1 < x2

Equations

• d₁.instDecidableRelLt d₂ = if h : d₁.lt d₂ = true then isTrue h else isFalse h

def LeanCert.Core.Dyadic.min (d₁ d₂ : Dyadic) : Dyadic

Minimum of two Dyadics

Equations

• d₁.min d₂ = if d₁.le d₂ = true then d₁ else d₂

def LeanCert.Core.Dyadic.max (d₁ d₂ : Dyadic) : Dyadic

Maximum of two Dyadics

Equations

• d₁.max d₂ = if d₁.le d₂ = true then d₂ else d₁

def LeanCert.Core.Dyadic.min4 (a b c d : Dyadic) : Dyadic

Minimum of four Dyadics

Equations

• a.min4 b c d = (a.min b).min (c.min d)

def LeanCert.Core.Dyadic.max4 (a b c d : Dyadic) : Dyadic

Maximum of four Dyadics

Equations

• a.max4 b c d = (a.max b).max (c.max d)

Correctness Theorems

Helper lemmas for shift proofs

theorem LeanCert.Core.Dyadic.toRat_neg (d : Dyadic) : d.neg.toRat = -d.toRat

Arithmetic Homomorphisms

theorem LeanCert.Core.Dyadic.toRat_eq (d : Dyadic) : d.toRat = ↑d.mantissa * 2 ^ d.exponent

Unification lemma: toRat d = d.mantissa * 2^d.exponent

theorem LeanCert.Core.Dyadic.toRat_add (d₁ d₂ : Dyadic) : (d₁.add d₂).toRat = d₁.toRat + d₂.toRat

theorem LeanCert.Core.Dyadic.toRat_mul (d₁ d₂ : Dyadic) : (d₁.mul d₂).toRat = d₁.toRat * d₂.toRat

Rounding Properties

theorem LeanCert.Core.Dyadic.toRat_shiftDown_le (d : Dyadic) (newExp : ℤ) : (d.shiftDown newExp).toRat ≤ d.toRat

shiftDown produces a value ≤ the original

theorem LeanCert.Core.Dyadic.toRat_shiftUp_ge (d : Dyadic) (newExp : ℤ) : d.toRat ≤ (d.shiftUp newExp).toRat

shiftUp produces a value ≥ the original

Comparison Helper Lemmas

Comparison Theorems

theorem LeanCert.Core.Dyadic.le_iff_toRat_le (d₁ d₂ : Dyadic) : d₁.le d₂ = true ↔ d₁.toRat ≤ d₂.toRat

le is correct with respect to toRat ordering

theorem LeanCert.Core.Dyadic.compare_lt_iff (d₁ d₂ : Dyadic) : d₁.compare d₂ = Ordering.lt ↔ d₁.toRat < d₂.toRat

compare reflects toRat ordering: lt case

theorem LeanCert.Core.Dyadic.compare_gt_iff (d₁ d₂ : Dyadic) : d₁.compare d₂ = Ordering.gt ↔ d₁.toRat > d₂.toRat

compare reflects toRat ordering: gt case

theorem LeanCert.Core.Dyadic.compare_eq_iff (d₁ d₂ : Dyadic) : d₁.compare d₂ = Ordering.eq ↔ d₁.toRat = d₂.toRat

compare reflects toRat ordering: eq case

Min/Max Lemmas

theorem LeanCert.Core.Dyadic.min_toRat_le_left (d₁ d₂ : Dyadic) : (d₁.min d₂).toRat ≤ d₁.toRat

min produces value ≤ first argument

theorem LeanCert.Core.Dyadic.min_toRat_le_right (d₁ d₂ : Dyadic) : (d₁.min d₂).toRat ≤ d₂.toRat

min produces value ≤ second argument

theorem LeanCert.Core.Dyadic.le_max_toRat_left (d₁ d₂ : Dyadic) : d₁.toRat ≤ (d₁.max d₂).toRat

first argument ≤ max

theorem LeanCert.Core.Dyadic.le_max_toRat_right (d₁ d₂ : Dyadic) : d₂.toRat ≤ (d₁.max d₂).toRat

second argument ≤ max

theorem LeanCert.Core.Dyadic.min_toRat (d₁ d₂ : Dyadic) : (d₁.min d₂).toRat = Min.min d₁.toRat d₂.toRat

Dyadic.min commutes with toRat

theorem LeanCert.Core.Dyadic.max_toRat (d₁ d₂ : Dyadic) : (d₁.max d₂).toRat = Max.max d₁.toRat d₂.toRat

Dyadic.max commutes with toRat

theorem LeanCert.Core.Dyadic.min4_le_max4 (a b c d : Dyadic) : (a.min4 b c d).toRat ≤ (a.max4 b c d).toRat

min4 ≤ max4

Normalize Lemmas

theorem LeanCert.Core.Dyadic.toRat_normalizeDown_le (d : Dyadic) (maxBits : ℕ) : (d.normalizeDown maxBits).toRat ≤ d.toRat

normalizeDown produces value ≤ original

theorem LeanCert.Core.Dyadic.toRat_normalizeUp_ge (d : Dyadic) (maxBits : ℕ) : d.toRat ≤ (d.normalizeUp maxBits).toRat

normalizeUp produces value ≥ original

Scale2 Lemmas

theorem LeanCert.Core.Dyadic.toRat_scale2 (d : Dyadic) (n : ℤ) : (d.scale2 n).toRat = d.toRat * 2 ^ n

scale2 multiplies by 2^n

theorem LeanCert.Core.Dyadic.toRat_scale2_le_scale2 (d₁ d₂ : Dyadic) (n : ℤ) (h : d₁.toRat ≤ d₂.toRat) : (d₁.scale2 n).toRat ≤ (d₂.scale2 n).toRat

scale2 preserves order

Square Root Operations

def LeanCert.Core.Dyadic.intSqrtNat (n : ℕ) : ℕ

Integer square root of a natural number. Satisfies: (intSqrtNat n)^2 ≤ n < (intSqrtNat n + 1)^2

Equations

• LeanCert.Core.Dyadic.intSqrtNat n = n.sqrt

def LeanCert.Core.Dyadic.intSqrt (n : ℤ) : ℤ

Integer square root of a non-negative integer. Returns 0 for negative inputs.

Equations

• LeanCert.Core.Dyadic.intSqrt n = if n < 0 then 0 else Int.ofNat (LeanCert.Core.Dyadic.intSqrtNat n.toNat)

theorem LeanCert.Core.Dyadic.intSqrt_sq_le {n : ℤ} (hn : 0 ≤ n) : intSqrt n ^ 2 ≤ n

intSqrt n ^ 2 ≤ n for n ≥ 0

theorem LeanCert.Core.Dyadic.int_lt_succ_sqrt_sq {n : ℤ} (hn : 0 ≤ n) : n < (intSqrt n + 1) ^ 2

n < (intSqrt n + 1) ^ 2 for n ≥ 0

theorem LeanCert.Core.Dyadic.intSqrt_nonneg {n : ℤ} (hn : 0 ≤ n) : 0 ≤ intSqrt n

intSqrt is nonnegative for nonnegative inputs

def LeanCert.Core.Dyadic.sqrtDown (d : Dyadic) (prec : ℤ) : Dyadic

Compute sqrt(d) with a target exponent prec. Returns a Dyadic with exponent prec such that result ≤ sqrt(d).

For d = m * 2^e, we compute:

• shift = e - 2*prec (to align for sqrt)
• m' = m * 2^shift (or m / 2^(-shift) if shift < 0)
• result = floor(sqrt(m')) * 2^prec

This ensures: result.toRat ≤ sqrt(d.toRat)

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.Dyadic.sqrtUp (d : Dyadic) (prec : ℤ) : Dyadic

Compute sqrt(d) rounded up with target exponent prec. Returns a Dyadic with exponent prec such that result ≥ sqrt(d).

Uses the same computation as sqrtDown, but if the result is not a perfect square, adds 1 to round up.

Equations

• One or more equations did not get rendered due to their size.

Sqrt Correctness Theorems

theorem LeanCert.Core.Dyadic.sqrtDown_nonneg (d : Dyadic) (prec : ℤ) (hd : 0 ≤ d.mantissa) : 0 ≤ (d.sqrtDown prec).mantissa

sqrtDown is non-negative for non-negative inputs

theorem LeanCert.Core.Dyadic.sqrtUp_nonneg (d : Dyadic) (prec : ℤ) (hd : 0 ≤ d.mantissa) : 0 ≤ (d.sqrtUp prec).mantissa

sqrtUp is non-negative for non-negative inputs

theorem LeanCert.Core.Dyadic.sqrtDown_le_sqrtUp (d : Dyadic) (prec : ℤ) (hd : 0 ≤ d.mantissa) : (d.sqrtDown prec).toRat ≤ (d.sqrtUp prec).toRat

sqrtDown.toRat ≤ sqrtUp.toRat for non-negative inputs

Unified Expression AST

This file defines the unified AST for real expressions (Expr) and its evaluation semantics. All numerical algorithms in LeanCert operate on this single expression type.

Main definitions

• LeanCert.Core.Expr - The expression AST supporting algebraic and transcendental operations
• LeanCert.Core.Expr.eval - Evaluation of expressions given a variable assignment

Design notes

The expression type uses natural number indices for variables. This simplifies the interval evaluation and automatic differentiation implementations.

Auxiliary definition for atanh

Since Mathlib doesn't provide Real.atanh, we define it here using the standard formula: atanh x = (1/2) * log((1+x)/(1-x)) for |x| < 1.

noncomputable def LeanCert.Core.Real.atanh (x : ℝ) : ℝ

The inverse hyperbolic tangent function. Defined as atanh x = (1/2) * log((1+x)/(1-x)) for |x| < 1.

Equations

• LeanCert.Core.Real.atanh x = 1 / 2 * Real.log ((1 + x) / (1 - x))

theorem LeanCert.Core.Real.atanh_arg_pos {x : ℝ} (hx : |x| < 1) : 0 < (1 + x) / (1 - x)

For |x| < 1, the argument (1+x)/(1-x) is positive.

@[simp]

theorem LeanCert.Core.Real.atanh_zero : atanh 0 = 0

atanh(0) = 0

theorem LeanCert.Core.Real.atanh_neg {x : ℝ} (hx : |x| < 1) : atanh (-x) = -atanh x

atanh(-x) = -atanh(x) for |x| < 1

theorem LeanCert.Core.Real.atanh_strictMonoOn : StrictMonoOn atanh (Set.Ioo (-1) 1)

atanh is strictly monotone on (-1, 1)

theorem LeanCert.Core.Real.atanh_mono {x y : ℝ} (hx : |x| < 1) (hy : |y| < 1) (hxy : x ≤ y) : atanh x ≤ atanh y

atanh is monotone on (-1, 1): if x ≤ y then atanh x ≤ atanh y

noncomputable def LeanCert.Core.Real.erf (x : ℝ) : ℝ

The error function: erf(x) = (2/√π) ∫₀ˣ exp(-t²) dt. Essential for statistical and financial modeling (normal distribution CDF). Uses interval integral notation (∫ t in 0..x) which handles negative x correctly.

Equations

• LeanCert.Core.Real.erf x = 2 / √Real.pi * ∫ (t : ℝ) in 0..x, Real.exp (-t ^ 2)

theorem LeanCert.Core.Real.erf_le_one (x : ℝ) : erf x ≤ 1

The error function is bounded above by 1.

theorem LeanCert.Core.Real.neg_one_le_erf (x : ℝ) : -1 ≤ erf x

The error function is bounded below by -1.

theorem LeanCert.Core.Real.erf_mem_Icc (x : ℝ) : erf x ∈ Set.Icc (-1) 1

The error function always lies in [-1, 1].

theorem LeanCert.Core.Real.sinc_mem_Icc (x : ℝ) : Real.sinc x ∈ Set.Icc (-1) 1

The normalized sinc function always lies in [-1, 1].

inductive LeanCert.Core.MathConst : Type

Named mathematical constants with known interval bounds. Adding a new constant (e.g., Catalan's) only requires extending this enum and its lookup tables — zero evaluator files need updating.

• pi : MathConst
• eulerMascheroni : MathConst

def LeanCert.Core.instReprMathConst.repr : MathConst → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instReprMathConst : Repr MathConst

Equations

• LeanCert.Core.instReprMathConst = { reprPrec := LeanCert.Core.instReprMathConst.repr }

@[instance_reducible]

instance LeanCert.Core.instDecidableEqMathConst : DecidableEq MathConst

Equations

• LeanCert.Core.instDecidableEqMathConst x✝ y✝ = if h : x✝.ctorIdx = y✝.ctorIdx then isTrue ⋯ else isFalse ⋯

@[instance_reducible]

instance LeanCert.Core.instInhabitedMathConst : Inhabited MathConst

Equations

• LeanCert.Core.instInhabitedMathConst = { default := LeanCert.Core.instInhabitedMathConst.default }

noncomputable def LeanCert.Core.MathConst.toReal : MathConst → ℝ

The real value of a named mathematical constant.

Equations

• LeanCert.Core.MathConst.pi.toReal = Real.pi
• LeanCert.Core.MathConst.eulerMascheroni.toReal = Real.eulerMascheroniConstant

def LeanCert.Core.MathConst.toFloat : MathConst → Float

Float approximation for heuristic evaluation (unverified).

Equations

• LeanCert.Core.MathConst.pi.toFloat = 3.141592653589793
• LeanCert.Core.MathConst.eulerMascheroni.toFloat = 0.5772156649015329

def LeanCert.Core.MathConst.toRatApprox : MathConst → ℚ

Rational approximation for display/debugging (unverified).

Equations

• LeanCert.Core.MathConst.pi.toRatApprox = 157 / 50
• LeanCert.Core.MathConst.eulerMascheroni.toRatApprox = 577 / 1000

inductive LeanCert.Core.Expr : Type

Unified AST for real-valued expressions.

• const (q : ℚ) : Expr

  Rational constant

• var (idx : ℕ) : Expr

  Variable with de Bruijn-style index

• add (e₁ e₂ : Expr) : Expr

  Addition

• mul (e₁ e₂ : Expr) : Expr

  Multiplication

• neg (e : Expr) : Expr

  Negation

• inv (e : Expr) : Expr

  Multiplicative inverse (partial: undefined at 0)

• exp (e : Expr) : Expr

  Exponential function

• sin (e : Expr) : Expr

  Sine function

• cos (e : Expr) : Expr

  Cosine function

• log (e : Expr) : Expr

  Natural logarithm (partial: undefined for x ≤ 0)

• atan (e : Expr) : Expr

  Arctangent function

• arsinh (e : Expr) : Expr

  Inverse hyperbolic sine (arsinh)

• atanh (e : Expr) : Expr

  Inverse hyperbolic tangent (partial: undefined for |x| ≥ 1)

• sinc (e : Expr) : Expr

  Sinc function: sinc(x) = sin(x)/x for x ≠ 0, sinc(0) = 1

• erf (e : Expr) : Expr

  Error function: erf(x) = (2/√π) ∫₀ˣ exp(-t²) dt

• sinh (e : Expr) : Expr

  Hyperbolic sine: sinh(x) = (exp(x) - exp(-x)) / 2

• cosh (e : Expr) : Expr

  Hyperbolic cosine: cosh(x) = (exp(x) + exp(-x)) / 2

• tanh (e : Expr) : Expr

  Hyperbolic tangent: tanh(x) = sinh(x) / cosh(x) ∈ (-1, 1)

• sqrt (e : Expr) : Expr

  Square root (partial: undefined for x < 0)

• namedConst (c : MathConst) : Expr

  A named mathematical constant (π, γ, …) looked up from a table.

def LeanCert.Core.instReprExpr.repr : Expr → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instReprExpr : Repr Expr

Equations

• LeanCert.Core.instReprExpr = { reprPrec := LeanCert.Core.instReprExpr.repr }

def LeanCert.Core.instDecidableEqExpr.decEq (x✝ x✝¹ : Expr) : Decidable (x✝ = x✝¹)

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instDecidableEqExpr : DecidableEq Expr

Equations

• LeanCert.Core.instDecidableEqExpr = LeanCert.Core.instDecidableEqExpr.decEq

@[instance_reducible]

instance LeanCert.Core.instInhabitedExpr : Inhabited Expr

Equations

• LeanCert.Core.instInhabitedExpr = { default := LeanCert.Core.instInhabitedExpr.default }

def LeanCert.Core.Expr.sub (e₁ e₂ : Expr) : Expr

Subtraction as a derived operation

Equations

• e₁.sub e₂ = e₁.add e₂.neg

def LeanCert.Core.Expr.div (e₁ e₂ : Expr) : Expr

Division as a derived operation

Equations

• e₁.div e₂ = e₁.mul e₂.inv

def LeanCert.Core.Expr.pow (e : Expr) : ℕ → Expr

Integer power (non-negative exponent)

Equations

• e.pow 0 = LeanCert.Core.Expr.const 1
• e.pow n.succ = e.mul (e.pow n)

def LeanCert.Core.Expr.abs (e : Expr) : Expr

Absolute value as a derived operation: |x| = sqrt(x²) This gives correct results for all real x (except at 0 for interval purposes)

Equations

• e.abs = (e.mul e).sqrt

noncomputable def LeanCert.Core.Expr.eval (ρ : ℕ → ℝ) : Expr → ℝ

Evaluate an expression given a variable assignment ρ : Nat → ℝ

Equations

• LeanCert.Core.Expr.eval ρ (LeanCert.Core.Expr.const q) = ↑q
• LeanCert.Core.Expr.eval ρ (LeanCert.Core.Expr.var idx) = ρ idx
• LeanCert.Core.Expr.eval ρ (e₁.add e₂) = LeanCert.Core.Expr.eval ρ e₁ + LeanCert.Core.Expr.eval ρ e₂
• LeanCert.Core.Expr.eval ρ (e₁.mul e₂) = LeanCert.Core.Expr.eval ρ e₁ * LeanCert.Core.Expr.eval ρ e₂
• LeanCert.Core.Expr.eval ρ e.neg = -LeanCert.Core.Expr.eval ρ e
• LeanCert.Core.Expr.eval ρ e.inv = (LeanCert.Core.Expr.eval ρ e)⁻¹
• LeanCert.Core.Expr.eval ρ e.exp = Real.exp (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.sin = Real.sin (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.cos = Real.cos (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.log = Real.log (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.atan = Real.arctan (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.arsinh = Real.arsinh (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.atanh = LeanCert.Core.Real.atanh (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.sinc = Real.sinc (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.erf = LeanCert.Core.Real.erf (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.sinh = Real.sinh (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.cosh = Real.cosh (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.tanh = Real.tanh (LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ e.sqrt = √(LeanCert.Core.Expr.eval ρ e)
• LeanCert.Core.Expr.eval ρ (LeanCert.Core.Expr.namedConst c) = c.toReal

def LeanCert.Core.Expr.updateVar (ρ : ℕ → ℝ) (idx : ℕ) (x : ℝ) : ℕ → ℝ

Update variable assignment at a specific index

Equations

• (ρ[idx ↦ x]) i = if i = idx then x else ρ i

def LeanCert.Core.Expr.«term_[_↦_]» : Lean.TrailingParserDescr

Notation for replacing one coordinate of a variable environment.

Equations

• One or more equations did not get rendered due to their size.

@[simp]

theorem LeanCert.Core.Expr.updateVar_same (ρ : ℕ → ℝ) (idx : ℕ) (x : ℝ) : (ρ[idx ↦ x]) idx = x

@[simp]

theorem LeanCert.Core.Expr.updateVar_other (ρ : ℕ → ℝ) (idx i : ℕ) (x : ℝ) (h : i ≠ idx) : (ρ[idx ↦ x]) i = ρ i

theorem LeanCert.Core.Expr.updateVar_self (ρ : ℕ → ℝ) (idx : ℕ) : ρ[idx ↦ ρ idx] = ρ

@[reducible, inline]

noncomputable abbrev LeanCert.Core.Expr.evalAlong (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : ℝ → ℝ

Evaluate e as a scalar function of variable idx, with all other variables fixed by ρ. This represents the map t ↦ eval ρ[idx ↦ t] e.

Equations

• e.evalAlong ρ idx t = LeanCert.Core.Expr.eval (ρ[idx ↦ t]) e

def LeanCert.Core.Expr.freeVars : Expr → Finset ℕ

The set of free variable indices in an expression

Equations

• (LeanCert.Core.Expr.const q).freeVars = ∅
• (LeanCert.Core.Expr.var idx).freeVars = {idx}
• (e₁.add e₂).freeVars = e₁.freeVars ∪ e₂.freeVars
• (e₁.mul e₂).freeVars = e₁.freeVars ∪ e₂.freeVars
• e.neg.freeVars = e.freeVars
• e.inv.freeVars = e.freeVars
• e.exp.freeVars = e.freeVars
• e.sin.freeVars = e.freeVars
• e.cos.freeVars = e.freeVars
• e.log.freeVars = e.freeVars
• e.atan.freeVars = e.freeVars
• e.arsinh.freeVars = e.freeVars
• e.atanh.freeVars = e.freeVars
• e.sinc.freeVars = e.freeVars
• e.erf.freeVars = e.freeVars
• e.sinh.freeVars = e.freeVars
• e.cosh.freeVars = e.freeVars
• e.tanh.freeVars = e.freeVars
• e.sqrt.freeVars = e.freeVars
• (LeanCert.Core.Expr.namedConst c).freeVars = ∅

def LeanCert.Core.Expr.isClosed (e : Expr) : Prop

An expression is closed if it has no free variables

Equations

• e.isClosed = (e.freeVars = ∅)

@[simp]

theorem LeanCert.Core.Expr.eval_const (ρ : ℕ → ℝ) (q : ℚ) : eval ρ (const q) = ↑q

@[simp]

theorem LeanCert.Core.Expr.eval_var (ρ : ℕ → ℝ) (idx : ℕ) : eval ρ (var idx) = ρ idx

@[simp]

theorem LeanCert.Core.Expr.eval_add (ρ : ℕ → ℝ) (e₁ e₂ : Expr) : eval ρ (e₁.add e₂) = eval ρ e₁ + eval ρ e₂

@[simp]

theorem LeanCert.Core.Expr.eval_mul (ρ : ℕ → ℝ) (e₁ e₂ : Expr) : eval ρ (e₁.mul e₂) = eval ρ e₁ * eval ρ e₂

@[simp]

theorem LeanCert.Core.Expr.eval_neg (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.neg = -eval ρ e

@[simp]

theorem LeanCert.Core.Expr.eval_inv (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.inv = (eval ρ e)⁻¹

@[simp]

theorem LeanCert.Core.Expr.eval_exp (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.exp = Real.exp (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_sin (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.sin = Real.sin (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_cos (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.cos = Real.cos (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_log (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.log = Real.log (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_atan (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.atan = Real.arctan (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_arsinh (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.arsinh = Real.arsinh (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_atanh (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.atanh = Real.atanh (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_sinc (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.sinc = Real.sinc (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_erf (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.erf = Real.erf (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_sinh (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.sinh = Real.sinh (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_cosh (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.cosh = Real.cosh (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_tanh (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.tanh = Real.tanh (eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_sqrt (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.sqrt = √(eval ρ e)

@[simp]

theorem LeanCert.Core.Expr.eval_namedConst (ρ : ℕ → ℝ) (c : MathConst) : eval ρ (namedConst c) = c.toReal

theorem LeanCert.Core.Expr.eval_eulerMascheroni (ρ : ℕ → ℝ) : eval ρ (namedConst MathConst.eulerMascheroni) = Real.eulerMascheroniConstant

@[simp]

theorem LeanCert.Core.Expr.eval_sub (ρ : ℕ → ℝ) (e₁ e₂ : Expr) : eval ρ (e₁.sub e₂) = eval ρ e₁ - eval ρ e₂

@[simp]

theorem LeanCert.Core.Expr.eval_div (ρ : ℕ → ℝ) (e₁ e₂ : Expr) : eval ρ (e₁.div e₂) = eval ρ e₁ / eval ρ e₂

@[simp]

theorem LeanCert.Core.Expr.eval_pow (ρ : ℕ → ℝ) (e : Expr) (n : ℕ) : eval ρ (e.pow n) = eval ρ e ^ n

theorem LeanCert.Core.Expr.eval_abs (ρ : ℕ → ℝ) (e : Expr) : eval ρ e.abs = |eval ρ e|

Evaluation of abs for any argument: |x| = sqrt(x²)

theorem LeanCert.Core.Expr.eval_sqrt_mul_self_eq_abs (ρ : ℕ → ℝ) (e : Expr) : eval ρ (e.mul e).sqrt = |eval ρ e|

Evaluation of sqrt(x * x) = |x| (unfolded form of abs).

theorem LeanCert.Core.Expr.sqrt_mul_self_eq_abs (x : ℝ) : √(x * x) = |x|

√(x * x) = |x| — LeanCert-namespaced alias of Real.sqrt_mul_self_eq_abs.

theorem LeanCert.Core.Expr.eval_sqrt_sq_of_pos (ρ : ℕ → ℝ) (e : Expr) (hpos : 0 < eval ρ e) : eval ρ (e.mul e).sqrt = eval ρ e

For positive x, sqrt(x²) = x

theorem LeanCert.Core.Expr.eval_abs_of_pos (ρ : ℕ → ℝ) (e : Expr) (hpos : 0 < eval ρ e) : eval ρ e.abs = eval ρ e

Abs correctly computes absolute value for positive inputs

theorem LeanCert.Core.Expr.eval_abs_of_neg (ρ : ℕ → ℝ) (e : Expr) (hneg : eval ρ e < 0) : eval ρ e.abs = -eval ρ e

Abs correctly computes absolute value for negative inputs

theorem LeanCert.Core.Expr.evalAlong_eq (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) (t : ℝ) : e.evalAlong ρ idx t = eval (ρ[idx ↦ t]) e

theorem LeanCert.Core.Expr.evalAlong_at_ρ (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.evalAlong ρ idx (ρ idx) = eval ρ e

theorem LeanCert.Core.Expr.evalAlong_const' (ρ : ℕ → ℝ) (idx : ℕ) (q : ℚ) : (const q).evalAlong ρ idx = fun (x : ℝ) => ↑q

evalAlong for a constant is constant

theorem LeanCert.Core.Expr.evalAlong_var_active (ρ : ℕ → ℝ) (idx : ℕ) : (var idx).evalAlong ρ idx = id

evalAlong for the active variable is the identity

theorem LeanCert.Core.Expr.evalAlong_var_passive (ρ : ℕ → ℝ) (idx i : ℕ) (h : i ≠ idx) : (var i).evalAlong ρ idx = fun (x : ℝ) => ρ i

evalAlong for a passive variable is constant

theorem LeanCert.Core.Expr.evalAlong_add (e₁ e₂ : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : (e₁.add e₂).evalAlong ρ idx = fun (t : ℝ) => e₁.evalAlong ρ idx t + e₂.evalAlong ρ idx t

evalAlong for addition

theorem LeanCert.Core.Expr.evalAlong_add_pi (e₁ e₂ : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : (e₁.add e₂).evalAlong ρ idx = e₁.evalAlong ρ idx + e₂.evalAlong ρ idx

evalAlong for addition (Pi form for compatibility with deriv_add)

theorem LeanCert.Core.Expr.evalAlong_mul (e₁ e₂ : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : (e₁.mul e₂).evalAlong ρ idx = fun (t : ℝ) => e₁.evalAlong ρ idx t * e₂.evalAlong ρ idx t

evalAlong for multiplication

theorem LeanCert.Core.Expr.evalAlong_mul_pi (e₁ e₂ : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : (e₁.mul e₂).evalAlong ρ idx = e₁.evalAlong ρ idx * e₂.evalAlong ρ idx

evalAlong for multiplication (Pi form for compatibility with deriv_mul)

theorem LeanCert.Core.Expr.evalAlong_neg (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.neg.evalAlong ρ idx = fun (t : ℝ) => -e.evalAlong ρ idx t

evalAlong for negation

theorem LeanCert.Core.Expr.evalAlong_neg_pi (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.neg.evalAlong ρ idx = -e.evalAlong ρ idx

evalAlong for negation (Pi form for compatibility with deriv.neg)

theorem LeanCert.Core.Expr.evalAlong_sin (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.sin.evalAlong ρ idx = fun (t : ℝ) => Real.sin (e.evalAlong ρ idx t)

evalAlong for sin

theorem LeanCert.Core.Expr.evalAlong_cos (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.cos.evalAlong ρ idx = fun (t : ℝ) => Real.cos (e.evalAlong ρ idx t)

evalAlong for cos

theorem LeanCert.Core.Expr.evalAlong_exp (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.exp.evalAlong ρ idx = fun (t : ℝ) => Real.exp (e.evalAlong ρ idx t)

evalAlong for exp

theorem LeanCert.Core.Expr.evalAlong_inv (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.inv.evalAlong ρ idx = fun (t : ℝ) => (e.evalAlong ρ idx t)⁻¹

evalAlong for inv

theorem LeanCert.Core.Expr.evalAlong_log (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.log.evalAlong ρ idx = fun (t : ℝ) => Real.log (e.evalAlong ρ idx t)

evalAlong for log

theorem LeanCert.Core.Expr.evalAlong_atan (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.atan.evalAlong ρ idx = fun (t : ℝ) => Real.arctan (e.evalAlong ρ idx t)

evalAlong for atan

theorem LeanCert.Core.Expr.evalAlong_arsinh (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.arsinh.evalAlong ρ idx = fun (t : ℝ) => Real.arsinh (e.evalAlong ρ idx t)

evalAlong for arsinh

theorem LeanCert.Core.Expr.evalAlong_atanh (e : Expr) (ρ : ℕ → ℝ) (idx : ℕ) : e.atanh.evalAlong ρ idx = fun (t : ℝ) => Real.atanh (e.evalAlong ρ idx t)

evalAlong for atanh

Single-variable expressions

For 1D optimization and root finding, we often work with expressions that only use variable 0. These lemmas establish that such expressions can be evaluated equivalently with different environment representations.

def LeanCert.Core.Expr.usesOnlyVar0 : Expr → Bool

Check if an expression only uses variable 0 (computable)

Equations

• (LeanCert.Core.Expr.const q).usesOnlyVar0 = true
• (LeanCert.Core.Expr.var idx).usesOnlyVar0 = (idx == 0)
• (e₁.add e₂).usesOnlyVar0 = (e₁.usesOnlyVar0 && e₂.usesOnlyVar0)
• (e₁.mul e₂).usesOnlyVar0 = (e₁.usesOnlyVar0 && e₂.usesOnlyVar0)
• e.neg.usesOnlyVar0 = e.usesOnlyVar0
• e.inv.usesOnlyVar0 = e.usesOnlyVar0
• e.exp.usesOnlyVar0 = e.usesOnlyVar0
• e.sin.usesOnlyVar0 = e.usesOnlyVar0
• e.cos.usesOnlyVar0 = e.usesOnlyVar0
• e.log.usesOnlyVar0 = e.usesOnlyVar0
• e.atan.usesOnlyVar0 = e.usesOnlyVar0
• e.arsinh.usesOnlyVar0 = e.usesOnlyVar0
• e.atanh.usesOnlyVar0 = e.usesOnlyVar0
• e.sinc.usesOnlyVar0 = e.usesOnlyVar0
• e.erf.usesOnlyVar0 = e.usesOnlyVar0
• e.sinh.usesOnlyVar0 = e.usesOnlyVar0
• e.cosh.usesOnlyVar0 = e.usesOnlyVar0
• e.tanh.usesOnlyVar0 = e.usesOnlyVar0
• e.sqrt.usesOnlyVar0 = e.usesOnlyVar0
• (LeanCert.Core.Expr.namedConst c).usesOnlyVar0 = true

theorem LeanCert.Core.Expr.eval_usesOnlyVar0_eq (e : Expr) (he : e.usesOnlyVar0 = true) (ρ₁ ρ₂ : ℕ → ℝ) (h0 : ρ₁ 0 = ρ₂ 0) : eval ρ₁ e = eval ρ₂ e

If two environments agree on variable 0, then a usesOnlyVar0 expression evaluates the same

theorem LeanCert.Core.Expr.eval_1d_equiv (e : Expr) (he : e.usesOnlyVar0 = true) (x : ℝ) : eval (fun (n : ℕ) => if n = 0 then x else 0) e = eval (fun (x_1 : ℕ) => x) e

For single-variable expressions, fun n => if n = 0 then x else 0 and fun _ => x give the same evaluation result.

theorem LeanCert.Core.Expr.eval_box1d_eq_eval1d (e : Expr) (he : e.usesOnlyVar0 = true) (x : ℝ) : eval (fun (n : ℕ) => if n = 0 then x else 0) e = eval (fun (x_1 : ℕ) => x) e

Alternative: evaluation with Box-style environment equals 1D evaluation

Abstract Interval Interface

This file defines the abstract notion of intervals as subsets of ℝ, with semantic properties. This provides the mathematical foundation that IntervalReal will implement computationally.

Main definitions

• Lemmas about Set.Icc (closed intervals) relevant to interval arithmetic
• Convexity and integrability properties

Design notes

We primarily use Set.Icc a b from Mathlib as our semantic interval type. This file collects lemmas and abstractions useful for verified numerics.

Interval membership and operations

@[reducible, inline]

abbrev LeanCert.Core.memIcc (x a b : ℝ) : Prop

A real number is in the interval [a, b]

Equations

• LeanCert.Core.memIcc x a b = (a ≤ x ∧ x ≤ b)

theorem LeanCert.Core.mem_Icc_iff (x a b : ℝ) : memIcc x a b ↔ x ∈ Set.Icc a b

Interval arithmetic semantics

These lemmas establish the semantic foundation for interval arithmetic: if x ∈ [a, b] and y ∈ [c, d], then x ⊕ y ∈ [a ⊕ c, b ⊕ d] (for appropriate ⊕).

theorem LeanCert.Core.add_mem_Icc {x y a b c d : ℝ} (hx : x ∈ Set.Icc a b) (hy : y ∈ Set.Icc c d) : x + y ∈ Set.Icc (a + c) (b + d)

Addition preserves interval membership

theorem LeanCert.Core.neg_mem_Icc {x a b : ℝ} (hx : x ∈ Set.Icc a b) : -x ∈ Set.Icc (-b) (-a)

Negation reverses interval bounds

theorem LeanCert.Core.sub_mem_Icc {x y a b c d : ℝ} (hx : x ∈ Set.Icc a b) (hy : y ∈ Set.Icc c d) : x - y ∈ Set.Icc (a - d) (b - c)

Subtraction on intervals

Convexity

theorem LeanCert.Core.Icc_convex (a b : ℝ) : Convex ℝ (Set.Icc a b)

Closed intervals are convex

Compactness

theorem LeanCert.Core.Icc_compact (a b : ℝ) : IsCompact (Set.Icc a b)

Nonempty closed bounded intervals are compact

Continuous functions on intervals

theorem LeanCert.Core.continuous_Icc_bounds {f : ℝ → ℝ} {a b : ℝ} (hab : a ≤ b) (hf : Continuous f) : ∃ (lo : ℝ) (hi : ℝ), (∀ x ∈ Set.Icc a b, lo ≤ f x ∧ f x ≤ hi) ∧ (∃ x ∈ Set.Icc a b, f x = lo) ∧ ∃ x ∈ Set.Icc a b, f x = hi

A continuous function on a compact interval attains its bounds

Rational Endpoint Intervals - Core Definitions

This file defines IntervalRat, a concrete interval type with rational endpoints suitable for computation. We prove the Fundamental Theorem of Interval Arithmetic (FTIA) for each operation.

Main definitions

• LeanCert.Core.IntervalRat - Intervals with rational endpoints
• LeanCert.Core.IntervalRat.toSet - Semantic interpretation as a subset of ℝ
• Operations: add, neg, sub, mul, inv, div

Main theorems

• mem_add - FTIA for addition
• mem_neg - FTIA for negation
• mem_sub - FTIA for subtraction
• mem_mul - FTIA for multiplication

Design notes

All operations maintain the invariant lo ≤ hi. Domain restrictions for partial operations (like inv) are encoded via separate types or explicit hypotheses.

structure LeanCert.Core.IntervalRat : Type

An interval with rational endpoints

• lo : ℚ

  Lower endpoint of the interval.

• hi : ℚ

  Upper endpoint of the interval.

• le : self.lo ≤ self.hi

def LeanCert.Core.instReprIntervalRat.repr : IntervalRat → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instReprIntervalRat : Repr IntervalRat

Equations

• LeanCert.Core.instReprIntervalRat = { reprPrec := LeanCert.Core.instReprIntervalRat.repr }

def LeanCert.Core.instDecidableEqIntervalRat.decEq (x✝ x✝¹ : IntervalRat) : Decidable (x✝ = x✝¹)

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Core.instDecidableEqIntervalRat : DecidableEq IntervalRat

Equations

• LeanCert.Core.instDecidableEqIntervalRat = LeanCert.Core.instDecidableEqIntervalRat.decEq

@[instance_reducible]

instance LeanCert.Core.instInhabitedIntervalRat : Inhabited IntervalRat

Default interval [0, 0] for unsupported expression branches

Equations

• LeanCert.Core.instInhabitedIntervalRat = { default := { lo := 0, hi := 0, le := LeanCert.Core.instInhabitedIntervalRat._proof_1 } }

def LeanCert.Core.IntervalRat.toSet (I : IntervalRat) : Set ℝ

The set of reals contained in this interval

Equations

• I.toSet = Set.Icc ↑I.lo ↑I.hi

@[instance_reducible]

instance LeanCert.Core.IntervalRat.instMembershipReal : Membership ℝ IntervalRat

Membership in an interval

Equations

• LeanCert.Core.IntervalRat.instMembershipReal = { mem := fun (I : LeanCert.Core.IntervalRat) (x : ℝ) => ↑I.lo ≤ x ∧ x ≤ ↑I.hi }

@[simp]

theorem LeanCert.Core.IntervalRat.mem_def (x : ℝ) (I : IntervalRat) : x ∈ I ↔ ↑I.lo ≤ x ∧ x ≤ ↑I.hi

theorem LeanCert.Core.IntervalRat.mem_iff_mem_Icc (x : ℝ) (I : IntervalRat) : x ∈ I ↔ x ∈ Set.Icc ↑I.lo ↑I.hi

Membership in IntervalRat is the same as membership in Set.Icc

theorem LeanCert.Core.IntervalRat.forall_mem_iff_forall_Icc {P : ℝ → Prop} (I : IntervalRat) : (∀ x ∈ I, P x) ↔ ∀ x ∈ Set.Icc ↑I.lo ↑I.hi, P x

Universal quantifier over IntervalRat equals universal over Set.Icc

theorem LeanCert.Core.IntervalRat.exists_mem_iff_exists_Icc {P : ℝ → Prop} (I : IntervalRat) : (∃ x ∈ I, P x) ↔ ∃ x ∈ Set.Icc ↑I.lo ↑I.hi, P x

Existence in IntervalRat equals existence in Set.Icc

def LeanCert.Core.IntervalRat.singleton (q : ℚ) : IntervalRat

Create an interval from a single rational

Equations

• LeanCert.Core.IntervalRat.singleton q = { lo := q, hi := q, le := ⋯ }

theorem LeanCert.Core.IntervalRat.mem_singleton (q : ℚ) : ↑q ∈ singleton q

def LeanCert.Core.IntervalRat.width (I : IntervalRat) : ℚ

The width of an interval

Equations

• I.width = I.hi - I.lo

theorem LeanCert.Core.IntervalRat.width_nonneg (I : IntervalRat) : 0 ≤ I.width

def LeanCert.Core.IntervalRat.midpoint (I : IntervalRat) : ℚ

Midpoint of an interval

Equations

• I.midpoint = (I.lo + I.hi) / 2

theorem LeanCert.Core.IntervalRat.midpoint_mem (I : IntervalRat) : ↑I.midpoint ∈ I

The midpoint of an interval is contained in the interval

Interval addition

def LeanCert.Core.IntervalRat.add (I J : IntervalRat) : IntervalRat

Add two intervals

Equations

• I.add J = { lo := I.lo + J.lo, hi := I.hi + J.hi, le := ⋯ }

theorem LeanCert.Core.IntervalRat.mem_add {x y : ℝ} {I J : IntervalRat} (hx : x ∈ I) (hy : y ∈ J) : x + y ∈ I.add J

FTIA for addition

Interval negation

def LeanCert.Core.IntervalRat.neg (I : IntervalRat) : IntervalRat

Negate an interval

Equations

• I.neg = { lo := -I.hi, hi := -I.lo, le := ⋯ }

theorem LeanCert.Core.IntervalRat.mem_neg {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : -x ∈ I.neg

FTIA for negation

Interval subtraction

def LeanCert.Core.IntervalRat.sub (I J : IntervalRat) : IntervalRat

Subtract two intervals

Equations

• I.sub J = I.add J.neg

theorem LeanCert.Core.IntervalRat.mem_sub {x y : ℝ} {I J : IntervalRat} (hx : x ∈ I) (hy : y ∈ J) : x - y ∈ I.sub J

FTIA for subtraction

Interval multiplication

def LeanCert.Core.IntervalRat.min4 (a b c d : ℚ) : ℚ

Helper: minimum of four rationals

Equations

• LeanCert.Core.IntervalRat.min4 a b c d = min (min a b) (min c d)

def LeanCert.Core.IntervalRat.max4 (a b c d : ℚ) : ℚ

Helper: maximum of four rationals

Equations

• LeanCert.Core.IntervalRat.max4 a b c d = max (max a b) (max c d)

theorem LeanCert.Core.IntervalRat.min4_le_all (a b c d : ℚ) : min4 a b c d ≤ a ∧ min4 a b c d ≤ b ∧ min4 a b c d ≤ c ∧ min4 a b c d ≤ d

theorem LeanCert.Core.IntervalRat.all_le_max4 (a b c d : ℚ) : a ≤ max4 a b c d ∧ b ≤ max4 a b c d ∧ c ≤ max4 a b c d ∧ d ≤ max4 a b c d

theorem LeanCert.Core.IntervalRat.le_min4_iff (x a b c d : ℚ) : x ≤ min4 a b c d ↔ x ≤ a ∧ x ≤ b ∧ x ≤ c ∧ x ≤ d

theorem LeanCert.Core.IntervalRat.max4_le_iff (x a b c d : ℚ) : max4 a b c d ≤ x ↔ a ≤ x ∧ b ≤ x ∧ c ≤ x ∧ d ≤ x

def LeanCert.Core.IntervalRat.mul (I J : IntervalRat) : IntervalRat

Multiply two intervals

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.mulFast (I J : IntervalRat) : IntervalRat

Fast interval multiplication using sign-based case splitting. Reduces from 4 multiplications + 12 comparisons to 2 multiplications in the common case (both intervals positive or both negative). Falls back to the full 4-way product for mixed-sign intervals.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.mem_mul {x y : ℝ} {I J : IntervalRat} (hx : x ∈ I) (hy : y ∈ J) : x * y ∈ I.mul J

FTIA for multiplication

theorem LeanCert.Core.IntervalRat.eq_min4_of_le {a b c d : ℚ} (h1 : a ≤ b) (h2 : a ≤ c) (h3 : a ≤ d) : a = min4 a b c d

Helper: show a = min4 a b c d when a ≤ b, a ≤ c, a ≤ d

theorem LeanCert.Core.IntervalRat.eq_min4_of_le2 {a b c d : ℚ} (h1 : b ≤ a) (h2 : b ≤ c) (h3 : b ≤ d) : b = min4 a b c d

theorem LeanCert.Core.IntervalRat.eq_min4_of_le3 {a b c d : ℚ} (h1 : c ≤ a) (h2 : c ≤ b) (h3 : c ≤ d) : c = min4 a b c d

theorem LeanCert.Core.IntervalRat.eq_min4_of_le4 {a b c d : ℚ} (h1 : d ≤ a) (h2 : d ≤ b) (h3 : d ≤ c) : d = min4 a b c d

theorem LeanCert.Core.IntervalRat.eq_max4_of_ge {a b c d : ℚ} (h1 : b ≤ a) (h2 : c ≤ a) (h3 : d ≤ a) : a = max4 a b c d

theorem LeanCert.Core.IntervalRat.eq_max4_of_ge2 {a b c d : ℚ} (h1 : a ≤ b) (h2 : c ≤ b) (h3 : d ≤ b) : b = max4 a b c d

theorem LeanCert.Core.IntervalRat.eq_max4_of_ge3 {a b c d : ℚ} (h1 : a ≤ c) (h2 : b ≤ c) (h3 : d ≤ c) : c = max4 a b c d

theorem LeanCert.Core.IntervalRat.eq_max4_of_ge4 {a b c d : ℚ} (h1 : a ≤ d) (h2 : b ≤ d) (h3 : c ≤ d) : d = max4 a b c d

theorem LeanCert.Core.IntervalRat.mem_mulFast {x y : ℝ} {I J : IntervalRat} (hx : x ∈ I) (hy : y ∈ J) : x * y ∈ I.mulFast J

mulFast preserves the containment property of mul. This is retained as documentation and a future audited optimization hook; production certificate checking currently uses mul directly.

Interval containing zero check

def LeanCert.Core.IntervalRat.containsZero (I : IntervalRat) : Prop

Check if an interval contains zero

Equations

• I.containsZero = (I.lo ≤ 0 ∧ 0 ≤ I.hi)

@[instance_reducible]

instance LeanCert.Core.IntervalRat.instDecidableContainsZero (I : IntervalRat) : Decidable I.containsZero

Decidable containsZero

Equations

• I.instDecidableContainsZero = { decide := decide (I.lo ≤ 0) && decide (0 ≤ I.hi), reflects_decide := ⋯ }

structure LeanCert.Core.IntervalRat.IntervalRatNonzeroextends LeanCert.Core.IntervalRat : Type

An interval that is guaranteed not to contain zero

• lo : ℚ
• hi : ℚ
• le : self.lo ≤ self.hi
• nonzero : ¬self.containsZero

Interval inversion (for nonzero intervals)

def LeanCert.Core.IntervalRat.invNonzero (I : IntervalRatNonzero) : IntervalRat

Invert an interval that doesn't contain zero

Equations

• LeanCert.Core.IntervalRat.invNonzero I = if h : 0 < I.lo then { lo := I.hi⁻¹, hi := I.lo⁻¹, le := ⋯ } else { lo := I.hi⁻¹, hi := I.lo⁻¹, le := ⋯ }

FTIA for inversion

theorem LeanCert.Core.IntervalRat.mem_invNonzero {x : ℝ} {I : IntervalRatNonzero} (hx : x ∈ I.toIntervalRat) (_hxne : x ≠ 0) : x⁻¹ ∈ invNonzero I

Scalar operations

def LeanCert.Core.IntervalRat.scale (q : ℚ) (I : IntervalRat) : IntervalRat

Scale an interval by a rational

Equations

• LeanCert.Core.IntervalRat.scale q I = if hq : 0 ≤ q then { lo := q * I.lo, hi := q * I.hi, le := ⋯ } else { lo := q * I.hi, hi := q * I.lo, le := ⋯ }

theorem LeanCert.Core.IntervalRat.mem_scale {x : ℝ} {I : IntervalRat} (q : ℚ) (hx : x ∈ I) : ↑q * x ∈ scale q I

FTIA for scaling

Interval splitting

def LeanCert.Core.IntervalRat.bisect (I : IntervalRat) : IntervalRat × IntervalRat

Split an interval at its midpoint

Equations

• I.bisect = ({ lo := I.lo, hi := I.midpoint, le := ⋯ }, { lo := I.midpoint, hi := I.hi, le := ⋯ })

theorem LeanCert.Core.IntervalRat.mem_bisect_left {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hm : x ≤ ↑I.midpoint) : x ∈ I.bisect.1

theorem LeanCert.Core.IntervalRat.mem_bisect_right {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hm : ↑I.midpoint ≤ x) : x ∈ I.bisect.2

theorem LeanCert.Core.IntervalRat.midpoint_sub_lo (I : IntervalRat) : ↑I.midpoint - ↑I.lo = (↑I.hi - ↑I.lo) / 2

Distance from midpoint to lo is half the width

theorem LeanCert.Core.IntervalRat.hi_sub_midpoint (I : IntervalRat) : ↑I.hi - ↑I.midpoint = (↑I.hi - ↑I.lo) / 2

Distance from hi to midpoint is half the width

theorem LeanCert.Core.IntervalRat.midpoint_ge_lo (I : IntervalRat) : I.lo ≤ I.midpoint

Midpoint is at least lo

theorem LeanCert.Core.IntervalRat.midpoint_le_hi (I : IntervalRat) : I.midpoint ≤ I.hi

Midpoint is at most hi

theorem LeanCert.Core.IntervalRat.midpoint_ge_lo_real (I : IntervalRat) : ↑I.lo ≤ ↑I.midpoint

Midpoint is at least lo (real version)

theorem LeanCert.Core.IntervalRat.midpoint_le_hi_real (I : IntervalRat) : ↑I.midpoint ≤ ↑I.hi

Midpoint is at most hi (real version)

theorem LeanCert.Core.IntervalRat.mem_of_mem_bisect_left {x : ℝ} {I : IntervalRat} (hx : x ∈ I.bisect.1) : x ∈ I

Left bisection is a subset of the original interval

theorem LeanCert.Core.IntervalRat.mem_of_mem_bisect_right {x : ℝ} {I : IntervalRat} (hx : x ∈ I.bisect.2) : x ∈ I

Right bisection is a subset of the original interval

theorem LeanCert.Core.IntervalRat.mem_bisect_or {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : x ∈ I.bisect.1 ∨ x ∈ I.bisect.2

Any point in an interval is in one of its bisected halves

theorem LeanCert.Core.IntervalRat.mem_default (x : ℝ) : x ∈ default ↔ x = 0

The default interval [0,0] contains only 0

Interval intersection

def LeanCert.Core.IntervalRat.intersect (I J : IntervalRat) : Option IntervalRat

Intersect two intervals. Returns none if they don't intersect.

Equations

• I.intersect J = if h : max I.lo J.lo ≤ min I.hi J.hi then some { lo := max I.lo J.lo, hi := min I.hi J.hi, le := h } else none

theorem LeanCert.Core.IntervalRat.mem_intersect {x : ℝ} {I J : IntervalRat} (hI : x ∈ I) (hJ : x ∈ J) : ∃ (K : IntervalRat), I.intersect J = some K ∧ x ∈ K

If intersection succeeds, the result contains any point in both intervals

theorem LeanCert.Core.IntervalRat.intersect_subset_left {I J K : IntervalRat} (h : I.intersect J = some K) : K.lo ≥ I.lo ∧ K.hi ≤ I.hi

If intersection returns some K, then K ⊆ I

theorem LeanCert.Core.IntervalRat.intersect_subset_right {I J K : IntervalRat} (h : I.intersect J = some K) : K.lo ≥ J.lo ∧ K.hi ≤ J.hi

If intersection returns some K, then K ⊆ J

Verified Argument Reduction for Logarithm

This file provides argument reduction for computing log(q) using the identity: log(q) = log(m) + k * log(2) where m = q * 2^(-k) is in a "good" range [1/2, 2] for Taylor series convergence.

Main definitions

• reductionExponent - Find k such that q * 2^(-k) is in [1/2, 2]
• reduceMantissa - The reduced mantissa m = q * 2^(-k)

Main theorems

• reconstruction_eq - Algebraic identity: q = m * 2^k
• reduced_bounds - Bounds on m: 1 / 2 ≤ m ≤ 2 for q > 0

Design notes

This reduction allows us to use the rapidly converging atanh-based series: log(m) = 2 * atanh((m-1)/(m+1)) For m ∈ [1/2, 2], we have (m-1)/(m+1) ∈ [-1/3, 1/3], where atanh converges very fast.

Argument Reduction

def LeanCert.Core.LogReduction.reductionExponent (q : ℚ) : ℤ

Find k such that q * 2^(-k) is approximately in [1/2, 2]. Implementation: k = log2(num) - log2(den) approximately.

Equations

• LeanCert.Core.LogReduction.reductionExponent q = if q ≤ 0 then 0 else have n_log := q.num.natAbs.log2; have d_log := q.den.log2; ↑n_log - ↑d_log

def LeanCert.Core.LogReduction.reduceMantissa (q : ℚ) : ℚ

The reduced mantissa m = q * 2^(-k).

Equations

• LeanCert.Core.LogReduction.reduceMantissa q = if q ≤ 0 then 1 else have k := LeanCert.Core.LogReduction.reductionExponent q; q * 2 ^ (-k)

theorem LeanCert.Core.LogReduction.reconstruction_eq {q : ℚ} (hq : 0 < q) : have k := reductionExponent q; have m := reduceMantissa q; q = m * 2 ^ k

The main algebraic theorem: q = m * 2^k for positive q

theorem LeanCert.Core.LogReduction.reduced_bounds_weak {q : ℚ} (hq : 0 < q) : have m := reduceMantissa q; 1 / 4 ≤ m ∧ m ≤ 4

The reduced mantissa is bounded: 1/4 ≤ m ≤ 4 for q > 0. (We use slightly weaker bounds than [1/2, 2] for simpler proofs, but the series still converges rapidly.)

theorem LeanCert.Core.LogReduction.reduced_bounds {q : ℚ} (hq : 0 < q) : have m := reduceMantissa q; 1 / 2 ≤ m ∧ m ≤ 2

Tighter bounds: 1 / 2 ≤ m ≤ 2 for most q > 0

theorem LeanCert.Core.LogReduction.reduced_pos {q : ℚ} (hq : 0 < q) : 0 < reduceMantissa q

The reduced mantissa is positive for positive input

Connection to Real.log

theorem LeanCert.Core.LogReduction.log_reduction {q : ℚ} (hq : 0 < q) : have k := reductionExponent q; have m := reduceMantissa q; Real.log ↑q = Real.log ↑m + ↑k * Real.log 2

Key algebraic identity for Real.log: log(q) = log(m) + k * log(2)

theorem LeanCert.Core.LogReduction.atanh_arg_bounds {m : ℚ} (hlo : 1 / 2 ≤ m) (hhi : m ≤ 2) : have y := (m - 1) / (m + 1); -1 / 3 ≤ y ∧ y ≤ 1 / 3

The transformation y = (m-1)/(m+1) maps m ∈ [1/2, 2] to y ∈ [-1/3, 1/3]

theorem LeanCert.Core.LogReduction.log_via_atanh {m : ℚ} (hm_pos : 0 < m) : Real.log ↑m = 2 * Real.atanh ((↑m - 1) / (↑m + 1))

log(m) = 2 * atanh((m-1)/(m+1)) for m > 0 with m ≠ 1

Rational Endpoint Intervals - Transcendental Functions

This file provides noncomputable interval bounds for transcendental functions using floor/ceiling to obtain rational endpoints.

Main definitions

• ofRealEndpoints - Create rational interval from real bounds using floor/ceil
• expInterval - Interval bound for exponential
• logInterval - Interval bound for logarithm (positive intervals)
• atanhIntervalComputed - Interval bound for atanh (intervals in (-1, 1))
• sqrtInterval - Interval bound for square root

Main theorems

• mem_expInterval - FTIA for exp
• mem_logInterval - FTIA for log
• mem_atanhIntervalComputed - FTIA for atanh
• mem_sqrtInterval - FTIA for sqrt

Design notes

All definitions in this file are noncomputable as they use Real.exp, Real.log, etc. For computable versions, see IntervalRat.Taylor.

Rational enclosure of real intervals

noncomputable def LeanCert.Core.IntervalRat.ofRealEndpoints (lo hi : ℝ) (hle : lo ≤ hi) : IntervalRat

Coarse rational enclosure of a real interval using floor/ceil. Given a real interval [lo, hi], returns a rational interval [⌊lo⌋, ⌈hi⌉] that is guaranteed to contain all points in the original interval.

Equations

• LeanCert.Core.IntervalRat.ofRealEndpoints lo hi hle = { lo := ↑⌊lo⌋, hi := ↑⌈hi⌉, le := ⋯ }

theorem LeanCert.Core.IntervalRat.mem_ofRealEndpoints {x lo hi : ℝ} (hle : lo ≤ hi) (hx : lo ≤ x ∧ x ≤ hi) : x ∈ ofRealEndpoints lo hi hle

Any point in [lo, hi] is in the rational enclosure [⌊lo⌋, ⌈hi⌉]

Exponential interval

noncomputable def LeanCert.Core.IntervalRat.expInterval (I : IntervalRat) : IntervalRat

Interval bound for exp on rational intervals. Since exp is strictly increasing, exp([a,b]) ⊆ [⌊exp(a)⌋, ⌈exp(b)⌉]. This uses Real.exp and floor/ceil to get rational bounds.

Equations

• I.expInterval = LeanCert.Core.IntervalRat.ofRealEndpoints (Real.exp ↑I.lo) (Real.exp ↑I.hi) ⋯

theorem LeanCert.Core.IntervalRat.mem_expInterval {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : Real.exp x ∈ I.expInterval

FTIA for exp: if x ∈ I, then exp(x) ∈ expInterval(I)

Positive interval check

def LeanCert.Core.IntervalRat.isPositive (I : IntervalRat) : Prop

Check if an interval is strictly positive (lo > 0)

Equations

• I.isPositive = (0 < I.lo)

@[instance_reducible]

instance LeanCert.Core.IntervalRat.instDecidableIsPositive (I : IntervalRat) : Decidable I.isPositive

Decidable isPositive

Equations

• I.instDecidableIsPositive = LeanCert.Core.IntervalRat.instDecidableIsPositive._aux_1 I

structure LeanCert.Core.IntervalRat.IntervalRatPosextends LeanCert.Core.IntervalRat : Type

An interval that is guaranteed to be strictly positive

• lo : ℚ
• hi : ℚ
• le : self.lo ≤ self.hi
• lo_pos : 0 < self.lo

Logarithm interval (for positive intervals)

noncomputable def LeanCert.Core.IntervalRat.logInterval (I : IntervalRatPos) : IntervalRat

Interval bound for log on positive rational intervals. Since log is strictly increasing on (0, ∞), log([a,b]) ⊆ [⌊log(a)⌋, ⌈log(b)⌉] for a > 0. This uses Real.log and floor/ceil to get rational bounds.

Equations

• LeanCert.Core.IntervalRat.logInterval I = LeanCert.Core.IntervalRat.ofRealEndpoints (Real.log ↑I.lo) (Real.log ↑I.hi) ⋯

theorem LeanCert.Core.IntervalRat.mem_logInterval {x : ℝ} {I : IntervalRatPos} (hx : x ∈ I.toIntervalRat) : Real.log x ∈ logInterval I

FTIA for log: if x ∈ I with lo > 0, then log(x) ∈ logInterval(I)

Atanh interval (for intervals in (-1, 1))

structure LeanCert.Core.IntervalRat.IntervalRatInUnitBall : Type

An interval strictly contained in (-1, 1), suitable for atanh

• lo : ℚ

  Lower endpoint of the interval.

• hi : ℚ

  Upper endpoint of the interval.

• le : self.lo ≤ self.hi
• lo_gt : -1 < self.lo
• hi_lt : self.hi < 1

def LeanCert.Core.IntervalRat.IntervalRatInUnitBall.toIntervalRat (I : IntervalRatInUnitBall) : IntervalRat

Convert to standard interval

Equations

• I.toIntervalRat = { lo := I.lo, hi := I.hi, le := ⋯ }

@[instance_reducible]

instance LeanCert.Core.IntervalRat.instMembershipRealIntervalRatInUnitBall : Membership ℝ IntervalRatInUnitBall

Membership in the underlying interval

Equations

• LeanCert.Core.IntervalRat.instMembershipRealIntervalRatInUnitBall = { mem := fun (I : LeanCert.Core.IntervalRat.IntervalRatInUnitBall) (x : ℝ) => ↑I.lo ≤ x ∧ x ≤ ↑I.hi }

theorem LeanCert.Core.IntervalRat.IntervalRatInUnitBall.mem_def {x : ℝ} {I : IntervalRatInUnitBall} : x ∈ I ↔ ↑I.lo ≤ x ∧ x ≤ ↑I.hi

noncomputable def LeanCert.Core.IntervalRat.atanhIntervalComputed (I : IntervalRatInUnitBall) : IntervalRat

Interval bound for atanh on intervals strictly inside (-1, 1). Since atanh is strictly increasing on (-1, 1), atanh([a,b]) ⊆ [⌊atanh(a)⌋, ⌈atanh(b)⌉].

Equations

• LeanCert.Core.IntervalRat.atanhIntervalComputed I = LeanCert.Core.IntervalRat.ofRealEndpoints (LeanCert.Core.Real.atanh ↑I.lo) (LeanCert.Core.Real.atanh ↑I.hi) ⋯

theorem LeanCert.Core.IntervalRat.mem_atanhIntervalComputed {x : ℝ} {I : IntervalRatInUnitBall} (hx : x ∈ I) : Real.atanh x ∈ atanhIntervalComputed I

FTIA for atanh: if x ∈ I and I ⊂ (-1, 1), then atanh(x) ∈ atanhIntervalComputed(I)

Square Root Interval

def LeanCert.Core.IntervalRat.intSqrtNat (n : ℕ) : ℕ

Integer square root (floor of sqrt). Satisfies: (intSqrtNat n)^2 ≤ n < (intSqrtNat n + 1)^2

Equations

• LeanCert.Core.IntervalRat.intSqrtNat n = n.sqrt

def LeanCert.Core.IntervalRat.sqrtRatLower (q : ℚ) : ℚ

Rational lower bound for sqrt. For q ≥ 0 with q = num/den, we compute floor(sqrt(num * den)) / den. This gives: sqrtRatLower q ≤ sqrt(q).

The idea: sqrt(num/den) = sqrt(num*den)/den when properly scaled.

Equations

• LeanCert.Core.IntervalRat.sqrtRatLower q = if q ≤ 0 then 0 else have num := q.num.natAbs; have den := q.den; have s := LeanCert.Core.IntervalRat.intSqrtNat (num * den); ↑s / ↑den

def LeanCert.Core.IntervalRat.sqrtRatUpper (q : ℚ) : ℚ

Rational upper bound for sqrt. For q ≥ 0, we compute ceil(sqrt(num * den)) / den. This gives: sqrt(q) ≤ sqrtRatUpper q.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.sqrtScaleBits : ℕ

Scaling exponent for precise sqrt bounds (2^scaleBits = scaling factor for denominator)

Equations

• LeanCert.Core.IntervalRat.sqrtScaleBits = 20

def LeanCert.Core.IntervalRat.sqrtRatLowerPrec (q : ℚ) (scaleBits : ℕ := sqrtScaleBits) : ℚ

Rational lower bound for sqrt with high precision. For q ≥ 0, we scale by 4^k, compute integer sqrt, and scale back by 2^k. This gives: sqrtRatLowerPrec q ≤ sqrt(q) with precision ~2^(-k).

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.sqrtRatUpperPrec (q : ℚ) (scaleBits : ℕ := sqrtScaleBits) : ℚ

Rational upper bound for sqrt with high precision. For q ≥ 0, we scale by 4^k, compute ceil of integer sqrt, and scale back by 2^k. This gives: sqrt(q) ≤ sqrtRatUpperPrec q with precision ~2^(-k).

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.sqrtRatLower_le_sqrt {q : ℚ} (hq : 0 ≤ q) : ↑(sqrtRatLower q) ≤ √↑q

Soundness of sqrtRatLower: sqrtRatLower q ≤ Real.sqrt q for q ≥ 0

theorem LeanCert.Core.IntervalRat.sqrt_le_sqrtRatUpper {q : ℚ} (hq : 0 ≤ q) : √↑q ≤ ↑(sqrtRatUpper q)

Soundness of sqrtRatUpper: Real.sqrt q ≤ sqrtRatUpper q for q ≥ 0

def LeanCert.Core.IntervalRat.sqrtInterval (I : IntervalRat) : IntervalRat

Square root interval with conservative bounds. For a non-negative interval [lo, hi], sqrt is monotone so: sqrt([lo, hi]) ⊆ [0, max(hi, 1)]

The lower bound is 0 (always sound for sqrt). The upper bound uses max(hi, 1) which satisfies sqrt(x) ≤ max(x, 1) for x ≥ 0.

Equations

• I.sqrtInterval = { lo := 0, hi := max I.hi 1, le := ⋯ }

def LeanCert.Core.IntervalRat.sqrtIntervalTight (I : IntervalRat) : IntervalRat

Improved square root interval with tight lower bounds. For a non-negative interval [lo, hi] with lo ≥ 0:

• Lower bound: sqrtRatLower(lo)
• Upper bound: sqrtRatUpper(hi)

For intervals crossing zero, we use 0 as lower bound.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.sqrtRatLowerPrec_le_sqrt {q : ℚ} (hq : 0 ≤ q) (k : ℕ) : ↑(sqrtRatLowerPrec q k) ≤ √↑q

Soundness of sqrtRatLowerPrec: sqrtRatLowerPrec q k ≤ Real.sqrt q for q ≥ 0

theorem LeanCert.Core.IntervalRat.sqrt_le_sqrtRatUpperPrec {q : ℚ} (hq : 0 ≤ q) (k : ℕ) : √↑q ≤ ↑(sqrtRatUpperPrec q k)

Soundness of sqrtRatUpperPrec: Real.sqrt q ≤ sqrtRatUpperPrec q k for q ≥ 0

def LeanCert.Core.IntervalRat.sqrtIntervalTightPrec (I : IntervalRat) : IntervalRat

High-precision square root interval. For a non-negative interval [lo, hi] with lo ≥ 0:

• Lower bound: sqrtRatLowerPrec(lo)
• Upper bound: sqrtRatUpperPrec(hi)

Uses scaling to achieve ~6 decimal digits of precision.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.mem_sqrtIntervalTightPrec' {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : √x ∈ I.sqrtIntervalTightPrec

Membership theorem for sqrtIntervalTightPrec

theorem LeanCert.Core.IntervalRat.mem_sqrtInterval {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hx_nn : 0 ≤ x) : √x ∈ I.sqrtInterval

Soundness of sqrt interval: if x ∈ I and x ≥ 0, then sqrt(x) ∈ sqrtInterval I

theorem LeanCert.Core.IntervalRat.mem_sqrtInterval' {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : √x ∈ I.sqrtInterval

General soundness of sqrt interval: works for any x ∈ I (including negative). When x < 0, Real.sqrt x = 0, which is always in [0, max(hi, 1)].

theorem LeanCert.Core.IntervalRat.mem_sqrtIntervalTight {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hx_nn : 0 ≤ x) : √x ∈ I.sqrtIntervalTight

Soundness of tight sqrt interval: if x ∈ I and x ≥ 0, then sqrt(x) ∈ sqrtIntervalTight I

theorem LeanCert.Core.IntervalRat.mem_sqrtIntervalTight' {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : √x ∈ I.sqrtIntervalTight

General soundness of tight sqrt interval: works for any x ∈ I (including negative). When x < 0, Real.sqrt x = 0, which is always in the result interval.

Expression Support Predicates

This file defines predicates indicating which expressions are supported by different interval evaluation strategies.

Main definitions

• ExprSupportedCore - Predicate for expressions in the computable subset (const, var, add, mul, neg, sin, cos, exp, log, sqrt, sinh, cosh, tanh, erf, pi)

• ADSupported - Predicate for the noncomputable AD subset (const, var, add, mul, neg, sin, cos, exp)

Design notes

ADSupported is the differentiable fragment used by automatic differentiation. It is contained in ExprSupportedCore via ADSupported.toCore. Checked evaluators accept arbitrary expressions and encode domain failure in their result type, so they need no syntactic support predicate.

The core subset is kept computable so that tactics can use native_decide for interval bound checking. The extended subset uses Real.exp with floor/ceil bounds, which requires noncomputability.

Core supported expression subset (computable)

inductive LeanCert.Core.ExprSupportedCore : Expr → Prop

Predicate indicating an expression is in the computable core subset. Supports: const, var, add, mul, neg, sin, cos, exp, log, sqrt, sinh, cosh, tanh, erf, pi

Note: log requires positive domain for correctness. The correctness theorem evalIntervalCore_correct has an additional hypothesis evalDomainValid that ensures log arguments evaluate to positive intervals.

• const (q : ℚ) : ExprSupportedCore (Expr.const q)
• var (idx : ℕ) : ExprSupportedCore (Expr.var idx)
• add {e₁ e₂ : Expr} : ExprSupportedCore e₁ → ExprSupportedCore e₂ → ExprSupportedCore (e₁.add e₂)
• mul {e₁ e₂ : Expr} : ExprSupportedCore e₁ → ExprSupportedCore e₂ → ExprSupportedCore (e₁.mul e₂)
• neg {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.neg
• sin {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.sin
• cos {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.cos
• exp {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.exp
• log {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.log
• sqrt {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.sqrt
• sinh {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.sinh
• cosh {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.cosh
• tanh {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.tanh
• erf {e : Expr} : ExprSupportedCore e → ExprSupportedCore e.erf
• namedConst (c : MathConst) : ExprSupportedCore (Expr.namedConst c)

Extended supported expression subset (with exp)

inductive LeanCert.Core.ADSupported : Expr → Prop

Predicate indicating an expression is in the fully-verified subset for AD. Supports: const, var, add, mul, neg, sin, cos, exp Does NOT support:

• sqrt (not differentiable at 0 - use ExprSupportedCore for interval evaluation only)
• inv (requires nonzero interval checks)
• log (requires positive interval checks)
• atan/arsinh/atanh (derivative proofs incomplete in the total AD evaluator)

• const (q : ℚ) : ADSupported (Expr.const q)
• var (idx : ℕ) : ADSupported (Expr.var idx)
• add {e₁ e₂ : Expr} : ADSupported e₁ → ADSupported e₂ → ADSupported (e₁.add e₂)
• mul {e₁ e₂ : Expr} : ADSupported e₁ → ADSupported e₂ → ADSupported (e₁.mul e₂)
• neg {e : Expr} : ADSupported e → ADSupported e.neg
• sin {e : Expr} : ADSupported e → ADSupported e.sin
• cos {e : Expr} : ADSupported e → ADSupported e.cos
• exp {e : Expr} : ADSupported e → ADSupported e.exp

theorem LeanCert.Core.ADSupported.toCore {e : Expr} (h : ADSupported e) : ExprSupportedCore e

ADSupported expressions are also in ExprSupportedCore

def LeanCert.Core.Expr.checkADSupported : Expr → Bool

Computable recognition of the differentiable ADSupported subset used by Newton/AD backends.

Equations

• (LeanCert.Core.Expr.const q).checkADSupported = true
• (LeanCert.Core.Expr.var idx).checkADSupported = true
• (e₁.add e₂).checkADSupported = (e₁.checkADSupported && e₂.checkADSupported)
• (e₁.mul e₂).checkADSupported = (e₁.checkADSupported && e₂.checkADSupported)
• e.neg.checkADSupported = e.checkADSupported
• e.exp.checkADSupported = e.checkADSupported
• e.sin.checkADSupported = e.checkADSupported
• e.cos.checkADSupported = e.checkADSupported
• x✝.checkADSupported = false

theorem LeanCert.Core.Expr.checkADSupported_eq_true_iff (e : Expr) : e.checkADSupported = true ↔ ADSupported e

The executable support check recognizes exactly the differentiable ADSupported fragment used by the checked AD/monotonicity backend.

def LeanCert.Core.Expr.checkSupportedCore : Expr → Bool

Computable recognition of ExprSupportedCore.

Equations

• (LeanCert.Core.Expr.const q).checkSupportedCore = true
• (LeanCert.Core.Expr.var idx).checkSupportedCore = true
• (LeanCert.Core.Expr.namedConst c).checkSupportedCore = true
• (e₁.add e₂).checkSupportedCore = (e₁.checkSupportedCore && e₂.checkSupportedCore)
• (e₁.mul e₂).checkSupportedCore = (e₁.checkSupportedCore && e₂.checkSupportedCore)
• e.neg.checkSupportedCore = e.checkSupportedCore
• e.exp.checkSupportedCore = e.checkSupportedCore
• e.sin.checkSupportedCore = e.checkSupportedCore
• e.cos.checkSupportedCore = e.checkSupportedCore
• e.log.checkSupportedCore = e.checkSupportedCore
• e.sqrt.checkSupportedCore = e.checkSupportedCore
• e.sinh.checkSupportedCore = e.checkSupportedCore
• e.cosh.checkSupportedCore = e.checkSupportedCore
• e.tanh.checkSupportedCore = e.checkSupportedCore
• e.erf.checkSupportedCore = e.checkSupportedCore
• x✝.checkSupportedCore = false

theorem LeanCert.Core.Expr.checkSupportedCore_correct {e : Expr} (h : e.checkSupportedCore = true) : ExprSupportedCore e

A successful computable core-support check produces the corresponding proof object required by the tight Rational evaluator theorem.

Generic Taylor Series Abstractions

This file provides generic Taylor series machinery for verified numerics. We wrap Mathlib's Taylor expansion theorems in forms convenient for our interval arithmetic framework.

Phase Status

This module is now Phase 3 complete. The main Taylor remainder bound theorem taylor_remainder_bound is fully proved with no sorry markers.

The theorem provides rigorous bounds on Taylor polynomial approximation errors using Lagrange's form of the remainder.

Main definitions

• TaylorApprox - A Taylor approximation with explicit remainder bounds
• Generic theorems for composing Taylor approximations

Design notes

This file provides the abstract theory. Specific Taylor expansions for exp, sin, cos, etc. are built using this machinery in conjunction with Mathlib's calculus lemmas.

Taylor approximation structure

structure LeanCert.Core.TaylorApprox : Type

A Taylor approximation of a function on an interval.

Given a function f, center c, and radius r, this represents:

• A polynomial approximation poly of degree n
• A remainder bound R such that for all x with |x - c| ≤ r: |f(x) - poly(x - c)| ≤ R

• degree : ℕ

  Degree of the polynomial

• coeffs : Fin (self.degree + 1) → ℚ

  Polynomial coefficients (Taylor coefficients at center)

• remainder : ℚ

  Remainder bound

• remainder_nonneg : 0 ≤ self.remainder

  The remainder is non-negative

noncomputable def LeanCert.Core.TaylorApprox.evalPoly (ta : TaylorApprox) (x : ℝ) : ℝ

Evaluate the polynomial part at a point

Equations

• ta.evalPoly x = ∑ i : Fin (ta.degree + 1), ↑(ta.coeffs i) * x ^ ↑i

Derivative bounds

structure LeanCert.Core.DerivBound : Type

A bound on the n-th derivative of a function on an interval

• order : ℕ

  The derivative order

• bound : ℚ

  Upper bound on |f^(n)(x)| for x in the interval

• bound_nonneg : 0 ≤ self.bound

  The bound is non-negative

Taylor remainder bounds

Helper lemmas for iteratedDerivWithin conversion

theorem LeanCert.Core.uniqueDiffWithinAt_Icc_left {c x : ℝ} (hcx : c < x) : UniqueDiffWithinAt ℝ (Set.Icc c x) c

Unique differentiability at the left endpoint of a closed interval.

theorem LeanCert.Core.uniqueDiffWithinAt_Icc_right {c x : ℝ} (hcx : c < x) : UniqueDiffWithinAt ℝ (Set.Icc c x) x

Unique differentiability at the right endpoint of a closed interval.

theorem LeanCert.Core.derivWithin_Icc_left_eq_deriv {f : ℝ → ℝ} {c x : ℝ} (hcx : c < x) (hf : DifferentiableAt ℝ f c) : derivWithin f (Set.Icc c x) c = deriv f c

At the left endpoint of [c, x], derivWithin equals deriv for differentiable functions.

theorem LeanCert.Core.derivWithin_Icc_right_eq_deriv {f : ℝ → ℝ} {c x : ℝ} (hcx : c < x) (hf : DifferentiableAt ℝ f x) : derivWithin f (Set.Icc c x) x = deriv f x

At the right endpoint of [c, x], derivWithin equals deriv for differentiable functions.

theorem LeanCert.Core.iteratedDerivWithin_Icc_interior_eq {f : ℝ → ℝ} {a b x : ℝ} {n : ℕ} (_hab : a < b) (hx : x ∈ Set.Ioo a b) : iteratedDerivWithin n f (Set.Icc a b) x = iteratedDeriv n f x

Helper lemma: iteratedDerivWithin on Icc a b equals iteratedDeriv at interior points.

This bridges Mathlib's iteratedDerivWithin-based Taylor theorems with global iteratedDeriv.

theorem LeanCert.Core.iteratedDerivWithin_Icc_left_eq_iteratedDeriv {f : ℝ → ℝ} {c x : ℝ} {n : ℕ} (hcx : c < x) (hf : ContDiff ℝ (↑n) f) : iteratedDerivWithin n f (Set.Icc c x) c = iteratedDeriv n f c

At the left endpoint of [c, x], iteratedDerivWithin equals iteratedDeriv for ContDiff functions.

theorem LeanCert.Core.iteratedDerivWithin_Icc_left_eq_iteratedDeriv_of_isOpen {f : ℝ → ℝ} {c x : ℝ} {n : ℕ} {U : Set ℝ} (hU_open : IsOpen U) (hcU : c ∈ U) (hcx : c < x) (hI_sub : Set.Icc c x ⊆ U) (hf : ContDiffOn ℝ (↑n) f U) : iteratedDerivWithin n f (Set.Icc c x) c = iteratedDeriv n f c

At the left endpoint of [c, x], iteratedDerivWithin equals iteratedDeriv for functions that are ContDiffOn on an open set containing c.

This is useful for functions like log that are only smooth on (0, ∞).

theorem LeanCert.Core.taylor_remainder_bound_on_c_lt_x {f : ℝ → ℝ} {a b c : ℝ} {m : ℕ} {M : ℝ} {U : Set ℝ} (hU_open : IsOpen U) (hI_sub : Set.Icc a b ⊆ U) (hca : a ≤ c) (hf : ContDiffOn ℝ (↑m + 1) f U) (hM : ∀ y ∈ Set.Icc a b, ‖iteratedDeriv (m + 1) f y‖ ≤ M) (x : ℝ) (hx : x ∈ Set.Icc a b) (hcx : c < x) : ‖f x - ∑ i ∈ Finset.range (m + 1), iteratedDeriv i f c / ↑i.factorial * (x - c) ^ i‖ ≤ M * |x - c| ^ (m + 1) / ↑(m + 1).factorial

Taylor remainder bound for c < x case with ContDiffOn hypothesis.

For functions that are ContDiffOn on an open set containing [a, b], this provides the same Lagrange remainder bound as the global ContDiff version.

theorem LeanCert.Core.iteratedDeriv_reflect_of_contDiffOn {f : ℝ → ℝ} {c : ℝ} {n : ℕ} {U : Set ℝ} (hU_open : IsOpen U) (hf : ContDiffOn ℝ (↑n) f U) (t : ℝ) (ht : 2 * c - t ∈ U) : iteratedDeriv n (fun (s : ℝ) => f (2 * c - s)) t = (-1) ^ n * iteratedDeriv n f (2 * c - t)

Key lemma for reflection: derivatives of g(t) = f(2c - t) when f is smooth on an open set.

This is a local version of iteratedDeriv_reflect that works with ContDiffOn on an open set rather than global ContDiff.

theorem LeanCert.Core.taylor_remainder_bound_on_x_lt_c {f : ℝ → ℝ} {a b c : ℝ} {m : ℕ} {M : ℝ} {U : Set ℝ} (hU_open : IsOpen U) (hI_sub : Set.Icc a b ⊆ U) (hcb : c ≤ b) (hf : ContDiffOn ℝ (↑m + 1) f U) (hM : ∀ y ∈ Set.Icc a b, ‖iteratedDeriv (m + 1) f y‖ ≤ M) (x : ℝ) (hx : x ∈ Set.Icc a b) (hxc : x < c) : ‖f x - ∑ i ∈ Finset.range (m + 1), iteratedDeriv i f c / ↑i.factorial * (x - c) ^ i‖ ≤ M * |x - c| ^ (m + 1) / ↑(m + 1).factorial

Taylor remainder bound for x < c case with ContDiffOn hypothesis.

For functions that are ContDiffOn on an open set containing [a, b], this provides the same Lagrange remainder bound as the global ContDiff version.

The proof uses reflection: define g(t) = f(2c - t), apply Lagrange to g on [c, 2c-x], then convert back.

theorem LeanCert.Core.taylor_remainder_bound_on {f : ℝ → ℝ} {a b c : ℝ} {n : ℕ} {M : ℝ} {U : Set ℝ} (hU_open : IsOpen U) (hI_sub : Set.Icc a b ⊆ U) (hca : a ≤ c) (hcb : c ≤ b) (hf : ContDiffOn ℝ (↑n) f U) (hM : ∀ x ∈ Set.Icc a b, ‖iteratedDeriv n f x‖ ≤ M) (_hMnonneg : 0 ≤ M) (x : ℝ) : x ∈ Set.Icc a b → ‖f x - ∑ i ∈ Finset.range n, iteratedDeriv i f c / ↑i.factorial * (x - c) ^ i‖ ≤ M * |x - c| ^ n / ↑n.factorial

Combined Taylor remainder bound with ContDiffOn hypothesis.

For functions that are ContDiffOn on an open set containing [a, b], this provides the Lagrange remainder bound for any x ∈ [a, b] and center c ∈ [a, b].

theorem LeanCert.Core.iteratedDeriv_reflect {f : ℝ → ℝ} {c : ℝ} {n : ℕ} (hf : ContDiff ℝ (↑n) f) (t : ℝ) : iteratedDeriv n (fun (s : ℝ) => f (2 * c - s)) t = (-1) ^ n * iteratedDeriv n f (2 * c - t)

Key lemma: derivatives of reflected function g(t) = f(2c - t).

For the x < c case, we use reflection: define g(t) = f(2c - t), apply Lagrange to g on [c, 2c-x], then convert back. This lemma shows how g's derivatives relate to f's derivatives.

theorem LeanCert.Core.neg_one_pow_mul_self (n : ℕ) : (-1) ^ n * (-1) ^ n = 1

Auxiliary lemma: (-1)^n * (-1)^n = 1 for any natural n.

theorem LeanCert.Core.taylor_remainder_bound_c_lt_x {f : ℝ → ℝ} {a b c : ℝ} {m : ℕ} {M : ℝ} (hca : a ≤ c) (hf : ContDiff ℝ (↑m + 1) f) (hM : ∀ y ∈ Set.Icc a b, ‖iteratedDeriv (m + 1) f y‖ ≤ M) (x : ℝ) (hx : x ∈ Set.Icc a b) (hcx : c < x) : ‖f x - ∑ i ∈ Finset.range (m + 1), iteratedDeriv i f c / ↑i.factorial * (x - c) ^ i‖ ≤ M * |x - c| ^ (m + 1) / ↑(m + 1).factorial

Taylor remainder bound for c < x case (Lagrange form).

For c < x, we apply taylor_mean_remainder_lagrange on [c, x] and convert iteratedDerivWithin to iteratedDeriv using the helper lemmas above.

theorem LeanCert.Core.taylor_remainder_bound_x_lt_c {f : ℝ → ℝ} {a b c : ℝ} {m : ℕ} {M : ℝ} (hcb : c ≤ b) (hf : ContDiff ℝ (↑m + 1) f) (hM : ∀ y ∈ Set.Icc a b, ‖iteratedDeriv (m + 1) f y‖ ≤ M) (x : ℝ) (hx : x ∈ Set.Icc a b) (hxc : x < c) : ‖f x - ∑ i ∈ Finset.range (m + 1), iteratedDeriv i f c / ↑i.factorial * (x - c) ^ i‖ ≤ M * |x - c| ^ (m + 1) / ↑(m + 1).factorial

Taylor remainder bound for x < c case (Lagrange form via reflection).

For x < c, we define g(t) = f(2c - t), apply taylor_mean_remainder_lagrange on [c, 2c-x], then use iteratedDeriv_reflect to convert back to f's derivatives. The key insight is that g's Taylor expansion at c, evaluated at 2c-x, equals f's Taylor expansion at c, evaluated at x, because the (-1)^i factors from the derivatives cancel with the (-1)^i factors from the powers.

theorem LeanCert.Core.taylor_remainder_bound {f : ℝ → ℝ} {a b c : ℝ} {n : ℕ} {M : ℝ} (_hab : a ≤ b) (hca : a ≤ c) (hcb : c ≤ b) (hf : ContDiff ℝ (↑n) f) (hM : ∀ x ∈ Set.Icc a b, ‖iteratedDeriv n f x‖ ≤ M) (_hMnonneg : 0 ≤ M) (x : ℝ) : x ∈ Set.Icc a b → ‖f x - ∑ i ∈ Finset.range n, iteratedDeriv i f c / ↑i.factorial * (x - c) ^ i‖ ≤ M * |x - c| ^ n / ↑n.factorial

Lagrange form remainder bound for Taylor approximation.

If |f^(n)(x)| ≤ M for all x in [a, b], and c ∈ [a, b], then the Taylor polynomial of degree n-1 (sum over range n) satisfies: for any x ∈ [a, b]: |f(x) - T_{n-1}(x; c)| ≤ M * |x - c|^n / n!

Note: The sum ∑ i ∈ Finset.range n gives terms 0..n-1 (degree n-1 polynomial). The remainder involves the n-th derivative, matching our bound on iteratedDeriv n f.

All cases are fully proved:

• Case n = 0: Direct bound. ✓
• Case n > 0, x = c: Trivial (both sides zero). ✓
• Case n > 0, c < x: Via taylor_remainder_bound_c_lt_x. ✓
• Case n > 0, x < c: Via taylor_remainder_bound_x_lt_c (reflection). ✓

Common Taylor expansions

def LeanCert.Core.expTaylorCoeff (n : ℕ) : ℚ

Taylor coefficients for exp at 0: 1/n!

Equations

• LeanCert.Core.expTaylorCoeff n = 1 / ↑n.factorial

def LeanCert.Core.sinTaylorCoeff (n : ℕ) : ℚ

Taylor coefficients for sin at 0

Equations

• LeanCert.Core.sinTaylorCoeff n = if n % 2 = 0 then 0 else if n / 2 % 2 = 0 then 1 / ↑n.factorial else -1 / ↑n.factorial

def LeanCert.Core.cosTaylorCoeff (n : ℕ) : ℚ

Taylor coefficients for cos at 0

Equations

• LeanCert.Core.cosTaylorCoeff n = if n % 2 = 1 then 0 else if n / 2 % 2 = 0 then 1 / ↑n.factorial else -1 / ↑n.factorial

Derivative bounds for common functions

theorem LeanCert.Core.exp_deriv_bound {a b : ℝ} (_hab : a ≤ b) (n : ℕ) (x : ℝ) : x ∈ Set.Icc a b → ‖iteratedDeriv n Real.exp x‖ ≤ Real.exp b

All derivatives of exp are bounded by exp on any bounded interval

theorem LeanCert.Core.sin_cos_deriv_bound (n : ℕ) (x : ℝ) : ‖iteratedDeriv n Real.sin x‖ ≤ 1 ∧ ‖iteratedDeriv n Real.cos x‖ ≤ 1

All derivatives of sin and cos are bounded by 1. The derivatives cycle: sin → cos → -sin → -cos → sin → ...

theorem LeanCert.Core.cosh_le_exp_abs (x : ℝ) : Real.cosh x ≤ Real.exp |x|

cosh x ≤ exp |x| for all x

theorem LeanCert.Core.abs_sinh_le_cosh (x : ℝ) : |Real.sinh x| ≤ Real.cosh x

|sinh x| ≤ cosh x for all x

theorem LeanCert.Core.sinh_cosh_deriv_bound {a b : ℝ} (_hab : a ≤ b) (n : ℕ) (x : ℝ) : x ∈ Set.Icc a b → ‖iteratedDeriv n Real.sinh x‖ ≤ Real.exp (max |a| |b|) ∧ ‖iteratedDeriv n Real.cosh x‖ ≤ Real.exp (max |a| |b|)

All derivatives of sinh and cosh are bounded by exp(max(|a|, |b|)) on [a, b]. The derivatives cycle: sinh → cosh → sinh → cosh → ...

theorem LeanCert.Core.iteratedDeriv_log {n : ℕ} (hn : n ≠ 0) {x : ℝ} (hx : 0 < x) : iteratedDeriv n Real.log x = (-1) ^ (n - 1) * ↑(n - 1).factorial * x ^ (-↑n)

Rational Endpoint Intervals - Computable Taylor Series

This file provides computable interval enclosures for transcendental functions using Taylor series with rational coefficients and rigorous remainder bounds.

Main definitions

• ratFactorial - Compute n! as a rational
• pow - Compute interval power
• absInterval, maxAbs - Absolute value helpers
• evalTaylorSeries - Evaluate Taylor polynomial on an interval
• expComputable, sinComputable, cosComputable - Computable transcendental functions
• sinhComputable, coshComputable - Computable hyperbolic functions

Main theorems

• mem_pow - FTIA for interval power
• mem_evalTaylorSeries - General FTIA for Taylor series
• mem_expComputable, mem_sinComputable, mem_cosComputable - FTIA for computable functions

Design notes

All definitions in this file use only rational arithmetic and are fully computable. The proofs connect these to the real-valued functions via Taylor's theorem.

Computable Taylor series helpers

def LeanCert.Core.IntervalRat.ratFactorial (n : ℕ) : ℚ

Compute n! as a Rational

Equations

• LeanCert.Core.IntervalRat.ratFactorial n = ↑n.factorial

@[irreducible]

def LeanCert.Core.IntervalRat.pow (I : IntervalRat) : ℕ → IntervalRat

Compute the integer power of an interval using exponentiation by squaring. O(log n) interval multiplications instead of O(n).

Equations

• I.pow 0 = LeanCert.Core.IntervalRat.singleton 1
• I.pow 1 = I
• I.pow n.succ.succ = if ((n + 2) % 2 == 0) = true then (I.pow ((n + 2) / 2)).mul (I.pow ((n + 2) / 2)) else I.mul ((I.pow ((n + 2) / 2)).mul (I.pow ((n + 2) / 2)))

def LeanCert.Core.IntervalRat.absInterval (I : IntervalRat) : IntervalRat

Compute the absolute value interval: |I| = [0, max(|lo|, |hi|)] if 0 ∈ I, or [min(|lo|,|hi|), max(|lo|,|hi|)] otherwise

Equations

• I.absInterval = if h1 : I.lo ≥ 0 then I else if h2 : I.hi ≤ 0 then I.neg else { lo := 0, hi := max (-I.lo) I.hi, le := ⋯ }

def LeanCert.Core.IntervalRat.maxAbs (I : IntervalRat) : ℚ

Maximum absolute value of an interval

Equations

• I.maxAbs = max |I.lo| |I.hi|

def LeanCert.Core.IntervalRat.evalTaylorSeries (coeffs : List ℚ) (I : IntervalRat) : IntervalRat

Evaluate Taylor series ∑_{i=0}^{n} c_i * x^i at interval I using Horner's method. Computes c₀ + I * (c₁ + I * (c₂ + ... + I * cₙ)), which is mathematically equivalent to the direct sum but uses fewer operations and often gives tighter bounds by reducing the dependency problem in interval arithmetic.

Equations

• One or more equations did not get rendered due to their size.

Computable exp via Taylor series

def LeanCert.Core.IntervalRat.expTaylorCoeffsAux : ℕ → ℕ → ℚ → List ℚ

Tail-recursive exp coefficient generator. expTaylorCoeffsAux n k c produces n+1 coefficients starting at index k, assuming c = 1 / k!.

Equations

• LeanCert.Core.IntervalRat.expTaylorCoeffsAux 0 x✝¹ x✝ = [x✝]
• LeanCert.Core.IntervalRat.expTaylorCoeffsAux n.succ x✝¹ x✝ = x✝ :: LeanCert.Core.IntervalRat.expTaylorCoeffsAux n (x✝¹ + 1) (x✝ / (↑x✝¹ + 1))

def LeanCert.Core.IntervalRat.expTaylorCoeffs (n : ℕ) : List ℚ

Taylor coefficients for exp: 1/i! for i = 0, 1, ..., n. Implemented iteratively to avoid repeated factorial recomputation.

Equations

• LeanCert.Core.IntervalRat.expTaylorCoeffs n = LeanCert.Core.IntervalRat.expTaylorCoeffsAux n 0 1

def LeanCert.Core.IntervalRat.expRemainderBoundComputable (I : IntervalRat) (n : ℕ) : IntervalRat

Computable exp remainder bound using rational arithmetic. The Lagrange remainder is exp(ξ) * x^{n+1} / (n+1)! where ξ is between 0 and x. We use e < 3, so e^r ≤ 3^(⌈r⌉+1) as a conservative bound.

Returns an interval [-R, R] where R bounds the remainder.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.expPointComputableRaw (q : ℚ) (n : ℕ := 10) : IntervalRat

The raw rational Taylor enclosure of the exponential at a point.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.expReduceK (q : ℚ) : ℕ

Heuristic reduction factor for exp evaluation. We choose k = log2(ceil(|q|) + 1), so 2^k grows roughly with |q|. No correctness depends on the specific choice; it only affects performance.

Equations

• LeanCert.Core.IntervalRat.expReduceK q = (⌈|q|⌉₊ + 1).log2

def LeanCert.Core.IntervalRat.expPointComputable (q : ℚ) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for exp at a single rational point. Uses argument reduction: exp(q) = exp(q/2^k)^(2^k).

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.expPointComputableWithCoeffs (q : ℚ) (n : ℕ) (coeffs : List ℚ) : IntervalRat

Point exponential using Taylor coefficients prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.expPointComputableWithCoeffs_eq (q : ℚ) (n : ℕ) : expPointComputableWithCoeffs q n (expTaylorCoeffs n) = expPointComputable q n

def LeanCert.Core.IntervalRat.hull (I J : IntervalRat) : IntervalRat

Hull of two intervals: smallest interval containing both.

Equations

• I.hull J = { lo := min I.lo J.lo, hi := max I.hi J.hi, le := ⋯ }

theorem LeanCert.Core.IntervalRat.mem_hull_left {x : ℝ} {I J : IntervalRat} (hx : x ∈ I) : x ∈ I.hull J

Membership in hull

theorem LeanCert.Core.IntervalRat.mem_hull_right {x : ℝ} {I J : IntervalRat} (hx : x ∈ J) : x ∈ I.hull J

def LeanCert.Core.IntervalRat.expComputable (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for exp using Taylor series with monotonicity optimization.

exp(x) = ∑_{i=0}^{n} x^i/i! + R where |R| ≤ exp(|x|) * |x|^{n+1} / (n+1)!

For intervals not crossing 0, we use endpoint evaluation and take the hull, which is tighter than direct Taylor evaluation due to interval widening.

This is fully computable using only rational arithmetic.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.expComputableWithCoeffs (I : IntervalRat) (n : ℕ) (coeffs : List ℚ) : IntervalRat

Interval exponential using Taylor coefficients prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.expComputableWithCoeffs_eq (I : IntervalRat) (n : ℕ) : I.expComputableWithCoeffs n (expTaylorCoeffs n) = I.expComputable n

Computable sin via Taylor series

def LeanCert.Core.IntervalRat.sinTaylorCoeffs (n : ℕ) : List ℚ

Taylor coefficients for sin: 0, 1, 0, -1/6, 0, 1/120, ...

Equations

• LeanCert.Core.IntervalRat.sinTaylorCoeffs n = List.map (fun (i : ℕ) => if i % 2 = 1 then (-1) ^ ((i - 1) / 2) / LeanCert.Core.IntervalRat.ratFactorial i else 0) (List.range (n + 1))

def LeanCert.Core.IntervalRat.sinRemainderBoundComputable (I : IntervalRat) (n : ℕ) : IntervalRat

Computable sin remainder bound. Since |sin^{(k)}(x)| ≤ 1 for all k, x, the remainder is bounded by |x|^{n+1}/(n+1)!

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.sinComputable (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for sin using Taylor series.

sin(x) = ∑_{k=0}^{n/2} (-1)^k x^{2k+1}/(2k+1)! + R where |R| ≤ |x|^{n+1}/(n+1)! since all derivatives of sin are bounded by 1.

We intersect with [-1, 1] for tighter bounds on small intervals.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.sinComputableWithCoeffs (I : IntervalRat) (n : ℕ) (coeffs : List ℚ) : IntervalRat

Interval sine using Taylor coefficients prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.sinComputableWithCoeffs_eq (I : IntervalRat) (n : ℕ) : I.sinComputableWithCoeffs n (sinTaylorCoeffs n) = I.sinComputable n

Computable cos via Taylor series

def LeanCert.Core.IntervalRat.cosTaylorCoeffs (n : ℕ) : List ℚ

Taylor coefficients for cos: 1, 0, -1/2, 0, 1/24, 0, ...

Equations

• LeanCert.Core.IntervalRat.cosTaylorCoeffs n = List.map (fun (i : ℕ) => if i % 2 = 0 then (-1) ^ (i / 2) / LeanCert.Core.IntervalRat.ratFactorial i else 0) (List.range (n + 1))

def LeanCert.Core.IntervalRat.cosRemainderBoundComputable (I : IntervalRat) (n : ℕ) : IntervalRat

Computable cos remainder bound. Since |cos^{(k)}(x)| ≤ 1 for all k, x, the remainder is bounded by |x|^{n+1}/(n+1)!

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.cosComputable (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for cos using Taylor series.

cos(x) = ∑_{k=0}^{n/2} (-1)^k x^{2k}/(2k)! + R where |R| ≤ |x|^{n+1}/(n+1)! since all derivatives of cos are bounded by 1.

We intersect with [-1, 1] for tighter bounds on small intervals.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.cosComputableWithCoeffs (I : IntervalRat) (n : ℕ) (coeffs : List ℚ) : IntervalRat

Interval cosine using Taylor coefficients prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.cosComputableWithCoeffs_eq (I : IntervalRat) (n : ℕ) : I.cosComputableWithCoeffs n (cosTaylorCoeffs n) = I.cosComputable n

Computable sinh and cosh via exp

def LeanCert.Core.IntervalRat.sinhPointComputable (q : ℚ) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for sinh at a single rational point. Uses the definition sinh(q) = (exp(q) - exp(-q)) / 2.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.coshPointComputable (q : ℚ) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for cosh at a single rational point. Uses the definition cosh(q) = (exp(q) + exp(-q)) / 2.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.coshPointComputable_lo_ge_one (q : ℚ) (n : ℕ) : 1 ≤ (coshPointComputable q n).lo

The lower bound of coshPointComputable is always at least 1.

def LeanCert.Core.IntervalRat.sinhComputable (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for sinh using exp with endpoint evaluation.

sinh(x) = (exp(x) - exp(-x)) / 2 Since sinh is strictly monotone increasing, sinh([a,b]) = [sinh(a), sinh(b)]. We use endpoint evaluation for tight bounds.

Equations

• I.sinhComputable n = (LeanCert.Core.IntervalRat.sinhPointComputable I.lo n).hull (LeanCert.Core.IntervalRat.sinhPointComputable I.hi n)

def LeanCert.Core.IntervalRat.coshComputable (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable interval enclosure for cosh using exp with endpoint evaluation.

cosh(x) = (exp(x) + exp(-x)) / 2 cosh has minimum 1 at x = 0, and is symmetric: cosh(-x) = cosh(x).

• cosh is decreasing on (-∞, 0]
• cosh is increasing on [0, ∞)

We use endpoint evaluation with monotonicity for tight bounds.

Equations

• One or more equations did not get rendered due to their size.

FTIA for pow

theorem LeanCert.Core.IntervalRat.mem_pow {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : x ^ n ∈ I.pow n

FTIA for interval power (binary exponentiation version)

Helper lemmas for Taylor series membership

theorem LeanCert.Core.IntervalRat.abs_le_maxAbs {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : |x| ≤ ↑I.maxAbs

Any x in I has |x| ≤ maxAbs I

theorem LeanCert.Core.IntervalRat.abs_le_mem_symmetric_interval {x : ℝ} {R : ℚ} (hR : 0 ≤ R) (h : |x| ≤ ↑R) : x ∈ { lo := -R, hi := R, le := ⋯ }

If |x| ≤ R for nonnegative R, then x ∈ [-R, R]. This is the key micro-lemma for embedding Lagrange remainder bounds into intervals.

theorem LeanCert.Core.IntervalRat.domain_from_abs_bound {x : ℝ} {r : ℚ} (_hr : 0 ≤ r) (habs : |x| ≤ ↑r) : x ∈ Set.Icc ↑(-r) ↑r

Domain setup for Taylor theorem: if |x| ≤ r for nonnegative r, then x ∈ [-r, r] as an Icc with the required inequalities.

theorem LeanCert.Core.IntervalRat.domain_from_mem {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : have r := I.maxAbs; 0 ≤ ↑r ∧ |x| ≤ ↑r ∧ x ∈ Set.Icc ↑(-r) ↑r ∧ ↑(-r) ≤ 0 ∧ 0 ≤ ↑r ∧ ↑(-r) ≤ ↑r

Combined domain setup from interval membership.

theorem LeanCert.Core.IntervalRat.remainder_to_interval {v : ℝ} {R : ℚ} (hbound : |v| ≤ ↑R) : v ∈ { lo := -R, hi := R, le := ⋯ }

Convert an absolute value bound |v| ≤ R to interval membership v ∈ [-R, R]. This is the key micro-lemma for the final step of Taylor remainder bounds.

theorem LeanCert.Core.IntervalRat.exp_bound_by_pow3 {r : ℚ} (_hr : 0 ≤ r) {ξ : ℝ} (hξ : |ξ| ≤ ↑r) : Real.exp ξ ≤ 3 ^ (⌈r⌉₊ + 1)

Key lemma: exp(ξ) ≤ 3^(⌈r⌉+1) for |ξ| ≤ r

Coefficient matching lemmas

theorem LeanCert.Core.IntervalRat.iteratedDeriv_exp_zero (i : ℕ) : iteratedDeriv i Real.exp 0 = 1

For exp, all iterated derivatives at 0 equal 1.

Helper lemmas for Taylor series membership

theorem LeanCert.Core.IntervalRat.mem_evalTaylorSeries {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (coeffs : List ℚ) : (List.map (fun (x_1 : ℚ × ℕ) => match x_1 with | (c, i) => ↑c * x ^ i) coeffs.zipIdx).sum ∈ evalTaylorSeries coeffs I

General FTIA for evalTaylorSeries (Horner version): if coeffs has length n+1, then ∑_{i=0}^{n} coeffs[i] * x^i ∈ evalTaylorSeries coeffs I for x ∈ I.

theorem LeanCert.Core.IntervalRat.mem_evalTaylorSeries_exp {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : ∑ i ∈ Finset.range (n + 1), 1 / ↑i.factorial * x ^ i ∈ evalTaylorSeries (expTaylorCoeffs n) I

The exp Taylor polynomial value matches our evalTaylorSeries. The proof shows that our list-based polynomial evaluation produces the same sum as the Finset.sum form used in Mathlib's Taylor theorem.

theorem LeanCert.Core.IntervalRat.mem_evalTaylorSeries_sin {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : ∑ i ∈ Finset.range (n + 1), iteratedDeriv i Real.sin 0 / ↑i.factorial * x ^ i ∈ evalTaylorSeries (sinTaylorCoeffs n) I

The sin Taylor polynomial value matches our evalTaylorSeries. Key: iteratedDeriv i sin 0 = 0, 1, 0, -1, 0, 1, ... matches sinTaylorCoeffs.

theorem LeanCert.Core.IntervalRat.mem_evalTaylorSeries_cos {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : ∑ i ∈ Finset.range (n + 1), iteratedDeriv i Real.cos 0 / ↑i.factorial * x ^ i ∈ evalTaylorSeries (cosTaylorCoeffs n) I

The cos Taylor polynomial value matches our evalTaylorSeries. Key: iteratedDeriv i cos 0 = 1, 0, -1, 0, 1, 0, ... matches cosTaylorCoeffs.

Taylor remainder micro-lemmas

theorem LeanCert.Core.IntervalRat.exp_taylor_remainder_in_interval {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.exp x - ∑ i ∈ Finset.range (n + 1), iteratedDeriv i Real.exp 0 / ↑i.factorial * x ^ i ∈ I.expRemainderBoundComputable n

Unified Taylor remainder bound for exp: given x ∈ I with r = maxAbs I, the Taylor remainder |exp x - poly(x)| ≤ 3^(⌈r⌉+1) * r^(n+1) / (n+1)!. This encapsulates the domain setup and remainder calculation.

theorem LeanCert.Core.IntervalRat.sin_taylor_remainder_in_interval {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.sin x - ∑ i ∈ Finset.range (n + 1), iteratedDeriv i Real.sin 0 / ↑i.factorial * x ^ i ∈ I.sinRemainderBoundComputable n

Unified Taylor remainder bound for sin: given x ∈ I with r = maxAbs I, the Taylor remainder |sin x - poly(x)| ≤ r^(n+1) / (n+1)!. Uses the fact that |sin^(k)(x)| ≤ 1 for all k, x.

theorem LeanCert.Core.IntervalRat.cos_taylor_remainder_in_interval {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.cos x - ∑ i ∈ Finset.range (n + 1), iteratedDeriv i Real.cos 0 / ↑i.factorial * x ^ i ∈ I.cosRemainderBoundComputable n

Unified Taylor remainder bound for cos: given x ∈ I with r = maxAbs I, the Taylor remainder |cos x - poly(x)| ≤ r^(n+1) / (n+1)!. Uses the fact that |cos^(k)(x)| ≤ 1 for all k, x.

FTIA for computable functions

theorem LeanCert.Core.IntervalRat.mem_expPointComputable (q : ℚ) (n : ℕ) : Real.exp ↑q ∈ expPointComputable q n

FTIA for single-point exp: Real.exp q ∈ expPointComputable q n

theorem LeanCert.Core.IntervalRat.mem_expComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.exp x ∈ I.expComputable n

theorem LeanCert.Core.IntervalRat.mem_sinComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.sin x ∈ I.sinComputable n

FTIA for sinComputable: Real.sin x ∈ sinComputable I n for any x ∈ I.

The proof uses the Taylor remainder micro-lemma and the global bound sin ∈ [-1, 1].

theorem LeanCert.Core.IntervalRat.mem_cosComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.cos x ∈ I.cosComputable n

FTIA for cosComputable: Real.cos x ∈ cosComputable I n for any x ∈ I.

The proof uses the Taylor remainder micro-lemma and the global bound cos ∈ [-1, 1].

theorem LeanCert.Core.IntervalRat.mem_sinhPointComputable (q : ℚ) (n : ℕ) : Real.sinh ↑q ∈ sinhPointComputable q n

FTIA for sinhPointComputable: Real.sinh q ∈ sinhPointComputable q n

theorem LeanCert.Core.IntervalRat.mem_coshPointComputable (q : ℚ) (n : ℕ) : Real.cosh ↑q ∈ coshPointComputable q n

FTIA for coshPointComputable: Real.cosh q ∈ coshPointComputable q n

theorem LeanCert.Core.IntervalRat.mem_sinhComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.sinh x ∈ I.sinhComputable n

FTIA for sinhComputable: Real.sinh x ∈ sinhComputable I n for any x ∈ I.

Uses endpoint evaluation and monotonicity of sinh.

theorem LeanCert.Core.IntervalRat.mem_coshComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ) : Real.cosh x ∈ I.coshComputable n

FTIA for coshComputable: Real.cosh x ∈ coshComputable I n for any x ∈ I.

Uses endpoint evaluation and monotonicity properties of cosh.

Computable atanh via Taylor series

For |y| < 1, atanh(y) = y + y³/3 + y⁵/5 + ... We compute this series for y ∈ [-1/3, 1/3] where it converges rapidly.

def LeanCert.Core.IntervalRat.atanhTaylorCoeffs (n : ℕ) : List ℚ

Taylor coefficients for atanh: 0, 1, 0, 1/3, 0, 1/5, ... atanh(y) = Σ y^(2k+1)/(2k+1) = y + y³/3 + y⁵/5 + ...

Equations

• LeanCert.Core.IntervalRat.atanhTaylorCoeffs n = List.map (fun (i : ℕ) => if i % 2 = 1 then 1 / ↑i else 0) (List.range (n + 1))

def LeanCert.Core.IntervalRat.atanhRemainderBoundComputable (r : ℚ) (n : ℕ) : IntervalRat

Computable atanh remainder bound. For |y| ≤ r < 1, the remainder after n terms is bounded by r^(n+1)/(1 - r²). We use a conservative bound: r^(n+1) / ((n+1) * (1 - r)) for simplicity.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.atanhPointComputable (q : ℚ) (n : ℕ := 15) : IntervalRat

Computable interval enclosure for atanh at a single rational point. Requires |q| < 1 for convergence. For |q| ≤ 1/3, this is very accurate.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.atanhPointComputableWithCoeffs (q : ℚ) (n : ℕ) (coeffs : List ℚ) : IntervalRat

Point atanh using Taylor coefficients prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.atanhPointComputableWithCoeffs_eq (q : ℚ) (n : ℕ) : atanhPointComputableWithCoeffs q n (atanhTaylorCoeffs n) = atanhPointComputable q n

theorem LeanCert.Core.IntervalRat.Real.atanh_hasSum' {x : ℝ} (hx : |x| < 1) : HasSum (fun (k : ℕ) => x ^ (2 * k + 1) / (2 * ↑k + 1)) (Real.atanh x)

The atanh series: atanh(x) = Σ_{k=0}^∞ x^(2k+1)/(2k+1) for |x| < 1. Derived from Mathlib's hasSum_log_sub_log_of_abs_lt_one.

theorem LeanCert.Core.IntervalRat.mem_evalTaylorSeries_atanh {q : ℚ} (n : ℕ) : (List.map (fun (x : ℚ × ℕ) => match x with | (c, i) => ↑c * ↑q ^ i) (atanhTaylorCoeffs n).zipIdx).sum ∈ evalTaylorSeries (atanhTaylorCoeffs n) (singleton q)

The atanh Taylor polynomial membership: the partial sum of atanh coefficients at q is in evalTaylorSeries (atanhTaylorCoeffs n) (singleton q).

theorem LeanCert.Core.IntervalRat.atanh_taylor_remainder_in_interval {q : ℚ} (hq : |↑q| < 1) (n : ℕ) : Real.atanh ↑q - (List.map (fun (x : ℚ × ℕ) => match x with | (c, i) => ↑c * ↑q ^ i) (atanhTaylorCoeffs n).zipIdx).sum ∈ atanhRemainderBoundComputable |q| n

theorem LeanCert.Core.IntervalRat.mem_atanhPointComputable (q : ℚ) (n : ℕ) (hq : |↑q| < 1) : Real.atanh ↑q ∈ atanhPointComputable q n

FTIA for atanhPointComputable: Real.atanh q ∈ atanhPointComputable q n for |q| < 1.

Computable ln(2) via atanh

ln(2) = 2 * atanh(1/3), since: 2 = (1 + 1/3) / (1 - 1/3) = (4/3) / (2/3) So atanh(1/3) = (1/2) * ln(2), giving ln(2) = 2 * atanh(1/3)

def LeanCert.Core.IntervalRat.ln2Computable (n : ℕ := 20) : IntervalRat

Compute ln(2) as an interval using 2 * atanh(1/3). This converges rapidly since atanh series at 1/3 has |y| = 1/3.

Equations

• LeanCert.Core.IntervalRat.ln2Computable n = LeanCert.Core.IntervalRat.scale 2 (LeanCert.Core.IntervalRat.atanhPointComputable (1 / 3) n)

theorem LeanCert.Core.IntervalRat.mem_ln2Computable (n : ℕ) : Real.log 2 ∈ ln2Computable n

FTIA for ln2Computable: Real.log 2 ∈ ln2Computable n. Uses the identity log(2) = 2 * atanh(1/3) from log_via_atanh.

Computable log via argument reduction

For q > 0, we compute:

1. Reduce q to m * 2^k where m ∈ [1/2, 2]
2. Compute log(m) = 2 * atanh((m-1)/(m+1)), which has |arg| ≤ 1/3
3. Result = log(m) + k * ln(2)

def LeanCert.Core.IntervalRat.logReductionExponent (q : ℚ) : ℤ

Reduction exponent k such that q * 2^(-k) ≈ 1

Equations

• LeanCert.Core.IntervalRat.logReductionExponent q = if q ≤ 0 then 0 else have n_log := q.num.natAbs.log2; have d_log := q.den.log2; ↑n_log - ↑d_log

def LeanCert.Core.IntervalRat.logReduceMantissa (q : ℚ) : ℚ

Reduced mantissa m = q * 2^(-k)

Equations

• LeanCert.Core.IntervalRat.logReduceMantissa q = if q ≤ 0 then 1 else q * 2 ^ (-LeanCert.Core.IntervalRat.logReductionExponent q)

def LeanCert.Core.IntervalRat.logPointComputable (q : ℚ) (n : ℕ := 20) : IntervalRat

Computable log at a single rational point q > 0. Returns log(q) = log(m) + k * ln(2) where m = q * 2^(-k).

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.logPointComputablePrepared (q : ℚ) (n : ℕ) (ln2 : IntervalRat) (atanhCoeffs : List ℚ) : IntervalRat

Logarithm evaluation using all configuration-dependent data prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.logPointComputablePrepared_eq (q : ℚ) (n : ℕ) : logPointComputablePrepared q n (ln2Computable n) (atanhTaylorCoeffs n) = logPointComputable q n

def LeanCert.Core.IntervalRat.logComputable (I : IntervalRat) (n : ℕ := 20) : IntervalRat

Computable interval enclosure for log using endpoint evaluation. Since log is strictly increasing on (0, ∞), we evaluate at endpoints.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.logComputablePrepared (I : IntervalRat) (n : ℕ) (ln2 : IntervalRat) (atanhCoeffs : List ℚ) : IntervalRat

Interval logarithm using all data prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.logComputablePrepared_eq (I : IntervalRat) (n : ℕ) : I.logComputablePrepared n (ln2Computable n) (atanhTaylorCoeffs n) = I.logComputable n

theorem LeanCert.Core.IntervalRat.mem_logPointComputable {q : ℚ} (hq : 0 < q) (n : ℕ) : Real.log ↑q ∈ logPointComputable q n

FTIA for logPointComputable

theorem LeanCert.Core.IntervalRat.mem_logComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hpos : 0 < I.lo) (n : ℕ) : Real.log x ∈ I.logComputable n

FTIA for logComputable: if x ∈ I and I.lo > 0, then log(x) ∈ logComputable I n

theorem LeanCert.Core.IntervalRat.mem_logComputable' {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hpos : 0 < I.lo) (n : ℕ) : Real.log x ∈ I.logComputable n

Conditional version of mem_logComputable for use in correctness proofs. Requires I.lo > 0 so the log interval is well-defined and monotone.

Computable erf via Taylor series

def LeanCert.Core.IntervalRat.twoDivSqrtPi : IntervalRat

Interval containing 2/√π ≈ 1.128379... Used for erf calculations. 2/√π is in (1.128, 1.129).

Equations

• LeanCert.Core.IntervalRat.twoDivSqrtPi = { lo := 1128 / 1000, hi := 1129 / 1000, le := LeanCert.Core.IntervalRat.twoDivSqrtPi._proof_1 }

def LeanCert.Core.IntervalRat.erfTaylorCoeffs (n : ℕ) : List ℚ

Taylor coefficients for erf (without the 2/√π factor): erf(x) = (2/√π) * Σ_{n=0}^∞ (-1)^n * x^(2n+1) / (n! * (2n+1))

So the coefficient of x^k is:

• 0 if k is even
• (-1)^((k-1)/2) / (((k-1)/2)! * k) if k is odd

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.erfRemainderBoundComputable (I : IntervalRat) (n : ℕ) : IntervalRat

Computable erf remainder bound. Since |erf^{(k)}(x)| ≤ (2/√π) * 2^k for all x (rough bound), and erf is bounded by 1, we use a combination.

For the Taylor remainder centered at 0, we use: |R_n(x)| ≤ sup|f^{(n+1)}(ξ)| * |x|^{n+1} / (n+1)!

A conservative bound: |erf^{(k)}(x)| ≤ (2/√π) * k! / (k/2)! ≤ 2 * k^{k/2} But since |erf| ≤ 1, we can intersect with [-1, 1].

We use: remainder ≤ 2 * |x|^{n+1} / (n+1)! (very conservative).

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.erfPointComputable (q : ℚ) (n : ℕ := 15) : IntervalRat

Computable interval enclosure for erf at a single rational point. Uses sign-aware clipped linear bounds: |erf(q)| ≤ min(1, (2257/2000)*|q|).

Cases:

• q < 0 => erf(q) ∈ [-1, 0]
• q = 0 => erf(q) = 0
• q > 0 => erf(q) ∈ [0, 1]

with tighter near-zero magnitude via (2257/2000)*|q|.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.erfComputable (I : IntervalRat) (n : ℕ := 15) : IntervalRat

Computable interval enclosure for erf using Taylor series with monotonicity.

erf(x) = (2/√π) * Σ_{n=0}^∞ (-1)^n * x^(2n+1) / (n! * (2n+1))

Since erf is strictly monotone increasing (erf'(x) = (2/√π)e^{-x²} > 0), we use endpoint evaluation: erf([a,b]) ⊆ [erf(a), erf(b)].

We intersect with [-1, 1] for safety.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.two_div_sqrt_pi_mem : 2 / √Real.pi ∈ twoDivSqrtPi

2/√π is in the interval twoDivSqrtPi. 2/√π ≈ 1.1283791670955126, which is in (1.128, 1.129).

This is a helper theorem for correctness proofs. The computation of erfComputable is independent of this theorem.

noncomputable def LeanCert.Core.IntervalRat.erfInner (x : ℝ) : ℝ

The "inner" erf function without the 2/√π factor: erfInner(x) = ∫₀ˣ exp(-t²) dt = (√π/2) * erf(x)

This is the function whose Taylor series coefficients are erfTaylorCoeffs.

Equations

• LeanCert.Core.IntervalRat.erfInner x = ∫ (t : ℝ) in 0..x, Real.exp (-t ^ 2)

theorem LeanCert.Core.IntervalRat.erf_eq_factor_mul_inner (x : ℝ) : Real.erf x = 2 / √Real.pi * erfInner x

erf(x) = (2/√π) * erfInner(x)

theorem LeanCert.Core.IntervalRat.erfInner_deriv : deriv erfInner = fun (x : ℝ) => Real.exp (-x ^ 2)

The derivatives of erfInner(x) = ∫₀ˣ exp(-t²) dt. erfInner'(x) = exp(-x²) erfInner''(x) = -2x * exp(-x²) etc.

theorem LeanCert.Core.IntervalRat.contDiff_exp_neg_sq : ContDiff ℝ ⊤ fun (x : ℝ) => Real.exp (-x ^ 2)

exp(-x²) is smooth.

theorem LeanCert.Core.IntervalRat.analyticAt_exp_neg_sq (x : ℝ) : AnalyticAt ℝ (fun (t : ℝ) => Real.exp (-t ^ 2)) x

exp(-x²) is analytic everywhere.

theorem LeanCert.Core.IntervalRat.analyticOnNhd_exp_neg_sq : AnalyticOnNhd ℝ (fun (t : ℝ) => Real.exp (-t ^ 2)) Set.univ

exp(-x²) is analytic on ℝ.

Computable atanh interval via endpoint evaluation

def LeanCert.Core.IntervalRat.atanhComputable (I : IntervalRat) (n : ℕ := 15) : IntervalRat

Computable interval enclosure for atanh using endpoint evaluation. Since atanh is strictly increasing on (-1, 1), we evaluate at endpoints. Requires the interval to be strictly inside (-1, 1); returns a wide fallback otherwise.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.atanhComputableWithCoeffs (I : IntervalRat) (n : ℕ) (coeffs : List ℚ) : IntervalRat

Interval atanh using Taylor coefficients prepared for depth n.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.atanhComputableWithCoeffs_eq (I : IntervalRat) (n : ℕ) : I.atanhComputableWithCoeffs n (atanhTaylorCoeffs n) = I.atanhComputable n

theorem LeanCert.Core.IntervalRat.mem_atanhComputable {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (hlo : -1 < I.lo) (hhi : I.hi < 1) (n : ℕ) : Real.atanh x ∈ I.atanhComputable n

FTIA for atanhComputable: if x ∈ I and I ⊂ (-1, 1), then atanh(x) ∈ atanhComputable I n.

Rational Endpoint Intervals

This file defines IntervalRat, a concrete interval type with rational endpoints suitable for computation. We prove the Fundamental Theorem of Interval Arithmetic (FTIA) for each operation.

Module Structure

• IntervalRat.Basic - Core types: IntervalRat, membership, basic operations
• IntervalRat.Transcendental - Noncomputable transcendental bounds (exp, log, sqrt, atanh)
• IntervalRat.Taylor - Computable Taylor series evaluators

Main definitions

• LeanCert.Core.IntervalRat - Intervals with rational endpoints
• LeanCert.Core.IntervalRat.toSet - Semantic interpretation as a subset of ℝ
• Operations: add, neg, sub, mul, inv, div
• Computable: expComputable, sinComputable, cosComputable

Main theorems

• mem_add - FTIA for addition
• mem_neg - FTIA for negation
• mem_sub - FTIA for subtraction
• mem_mul - FTIA for multiplication
• mem_expComputable, mem_sinComputable, mem_cosComputable - FTIA for computable functions

Design notes

All operations maintain the invariant lo ≤ hi. Domain restrictions for partial operations (like inv) are encoded via separate types or explicit hypotheses.

Dyadic Intervals

Intervals with Dyadic endpoints. These support "Outward Rounding", ensuring mathematical soundness even when we limit numerical precision.

Main definitions

• IntervalDyadic - Interval with Dyadic endpoints
• IntervalDyadic.add, mul, neg - Interval arithmetic operations
• IntervalDyadic.roundOut - Outward rounding to control precision
• IntervalDyadic.toIntervalRat - Convert to rational interval for verification

Design notes

The key feature is roundOut: after each operation, we can enforce a minimum exponent to prevent precision explosion. When rounding:

• Lower bounds are shifted down (toward -∞)
• Upper bounds are shifted up (toward +∞)

This maintains the containment invariant: the rounded interval always contains the original interval, which contains the true mathematical value.

Performance

In v1.0, Rat multiplication of 1/3 * 1/3 * ... * 1/3 (10 times) creates a denominator of 3^10 = 59049. Each operation requires GCD computation.

In v1.1, with precision = -10, the denominator stays fixed at 2^10 = 1024. The result is slightly less tight but computed significantly faster.

structure LeanCert.Core.IntervalDyadic : Type

An interval with Dyadic endpoints.

Maintains invariant: lo.toRat ≤ hi.toRat

• lo : Dyadic

  Lower bound

• hi : Dyadic

  Upper bound

• le : self.lo.toRat ≤ self.hi.toRat

  Invariant: lower bound ≤ upper bound

@[instance_reducible]

instance LeanCert.Core.instReprIntervalDyadic : Repr IntervalDyadic

Equations

• LeanCert.Core.instReprIntervalDyadic = { reprPrec := LeanCert.Core.instReprIntervalDyadic.repr }

def LeanCert.Core.instReprIntervalDyadic.repr : IntervalDyadic → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

Membership and Sets

def LeanCert.Core.IntervalDyadic.toSet (I : IntervalDyadic) : Set ℝ

The set of reals contained in this interval

Equations

• I.toSet = Set.Icc I.lo.toReal I.hi.toReal

@[instance_reducible]

instance LeanCert.Core.IntervalDyadic.instMembershipReal : Membership ℝ IntervalDyadic

Membership in a Dyadic interval

Equations

• LeanCert.Core.IntervalDyadic.instMembershipReal = { mem := fun (I : LeanCert.Core.IntervalDyadic) (x : ℝ) => ↑I.lo.toRat ≤ x ∧ x ≤ ↑I.hi.toRat }

@[simp]

theorem LeanCert.Core.IntervalDyadic.mem_def (x : ℝ) (I : IntervalDyadic) : x ∈ I ↔ ↑I.lo.toRat ≤ x ∧ x ≤ ↑I.hi.toRat

Conversion to IntervalRat

def LeanCert.Core.IntervalDyadic.toIntervalRat (I : IntervalDyadic) : IntervalRat

Convert to IntervalRat for verification with existing theorems

Equations

• I.toIntervalRat = { lo := I.lo.toRat, hi := I.hi.toRat, le := ⋯ }

theorem LeanCert.Core.IntervalDyadic.mem_toIntervalRat {x : ℝ} {I : IntervalDyadic} : x ∈ I ↔ x ∈ I.toIntervalRat

Membership is preserved by conversion to IntervalRat

Construction

def LeanCert.Core.IntervalDyadic.singleton (d : Dyadic) : IntervalDyadic

Create a singleton interval from a Dyadic

Equations

• LeanCert.Core.IntervalDyadic.singleton d = { lo := d, hi := d, le := ⋯ }

theorem LeanCert.Core.IntervalDyadic.mem_singleton (d : Dyadic) : ↑d.toRat ∈ singleton d

A Dyadic value is in its singleton interval

@[instance_reducible]

instance LeanCert.Core.IntervalDyadic.instInhabited : Inhabited IntervalDyadic

Default interval [0, 0]

Equations

• LeanCert.Core.IntervalDyadic.instInhabited = { default := LeanCert.Core.IntervalDyadic.singleton LeanCert.Core.Dyadic.zero }

def LeanCert.Core.IntervalDyadic.mk? (lo hi : Dyadic) : Option IntervalDyadic

Create an interval, checking the invariant

Equations

• LeanCert.Core.IntervalDyadic.mk? lo hi = if h : lo.toRat ≤ hi.toRat then some { lo := lo, hi := hi, le := h } else none

def LeanCert.Core.IntervalDyadic.width (I : IntervalDyadic) : Dyadic

The width of an interval

Equations

• I.width = I.hi.sub I.lo

@[simp]

theorem LeanCert.Core.IntervalDyadic.width_toRat (I : IntervalDyadic) : I.width.toRat = I.hi.toRat - I.lo.toRat

The dyadic width denotes endpoint subtraction exactly.

def LeanCert.Core.IntervalDyadic.midpoint (I : IntervalDyadic) : Dyadic

Exact midpoint of a dyadic interval.

Dyadics are closed under division by two, so midpoint construction must lower the exponent rather than shift (and potentially round) the mantissa.

Equations

• I.midpoint = (I.lo.add I.hi).scale2 (-1)

@[simp]

theorem LeanCert.Core.IntervalDyadic.midpoint_toRat (I : IntervalDyadic) : I.midpoint.toRat = (I.lo.toRat + I.hi.toRat) / 2

The dyadic midpoint denotes the ordinary rational midpoint exactly.

theorem LeanCert.Core.IntervalDyadic.lo_le_midpoint (I : IntervalDyadic) : I.lo.toRat ≤ I.midpoint.toRat

The lower endpoint is at most the exact midpoint.

theorem LeanCert.Core.IntervalDyadic.midpoint_le_hi (I : IntervalDyadic) : I.midpoint.toRat ≤ I.hi.toRat

The exact midpoint is at most the upper endpoint.

def LeanCert.Core.IntervalDyadic.bisect (I : IntervalDyadic) : IntervalDyadic × IntervalDyadic

Split a dyadic interval into two exact closed halves.

Equations

• I.bisect = ({ lo := I.lo, hi := I.midpoint, le := ⋯ }, { lo := I.midpoint, hi := I.hi, le := ⋯ })

theorem LeanCert.Core.IntervalDyadic.mem_bisect_left {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) (hm : x ≤ ↑I.midpoint.toRat) : x ∈ I.bisect.1

A point in the original interval and left of the midpoint is in the left half.

theorem LeanCert.Core.IntervalDyadic.mem_bisect_right {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) (hm : ↑I.midpoint.toRat ≤ x) : x ∈ I.bisect.2

A point in the original interval and right of the midpoint is in the right half.

theorem LeanCert.Core.IntervalDyadic.mem_of_mem_bisect_left {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I.bisect.1) : x ∈ I

Membership in the left half implies membership in the original interval.

theorem LeanCert.Core.IntervalDyadic.mem_of_mem_bisect_right {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I.bisect.2) : x ∈ I

Membership in the right half implies membership in the original interval.

theorem LeanCert.Core.IntervalDyadic.mem_bisect_or {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) : x ∈ I.bisect.1 ∨ x ∈ I.bisect.2

The two closed halves cover the original interval, including their shared seam.

theorem LeanCert.Core.IntervalDyadic.midpoint_mem_bisect_both (I : IntervalDyadic) : ↑I.midpoint.toRat ∈ I.bisect.1 ∧ ↑I.midpoint.toRat ∈ I.bisect.2

Both closed halves contain the midpoint seam.

theorem LeanCert.Core.IntervalDyadic.bisect_intersection (I : IntervalDyadic) : I.bisect.1.toSet ∩ I.bisect.2.toSet = {I.midpoint.toReal}

The overlap of the two closed children is exactly their midpoint seam.

theorem LeanCert.Core.IntervalDyadic.bisect_left_width_toRat (I : IntervalDyadic) : I.bisect.1.width.toRat = I.width.toRat / 2

The left child has exactly half the semantic width of its parent.

theorem LeanCert.Core.IntervalDyadic.bisect_right_width_toRat (I : IntervalDyadic) : I.bisect.2.width.toRat = I.width.toRat / 2

The right child has exactly half the semantic width of its parent.

Outward Rounding

def LeanCert.Core.IntervalDyadic.roundOut (I : IntervalDyadic) (minExp : ℤ) : IntervalDyadic

Outward rounding: enforces a maximum precision (minimum exponent).

This is the key operation for preventing precision explosion. minExp is the minimum allowed exponent (higher = coarser precision).

For example, minExp = -10 ensures all values are multiples of 2^(-10) ≈ 0.001.

Equations

• I.roundOut minExp = { lo := I.lo.shiftDown minExp, hi := I.hi.shiftUp minExp, le := ⋯ }

theorem LeanCert.Core.IntervalDyadic.roundOut_contains {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) (minExp : ℤ) : x ∈ I.roundOut minExp

roundOut produces an interval containing the original

Interval Negation

def LeanCert.Core.IntervalDyadic.neg (I : IntervalDyadic) : IntervalDyadic

Negate an interval

Equations

• I.neg = { lo := I.hi.neg, hi := I.lo.neg, le := ⋯ }

theorem LeanCert.Core.IntervalDyadic.mem_neg {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) : -x ∈ I.neg

FTIA for negation

Interval Addition

def LeanCert.Core.IntervalDyadic.add (I J : IntervalDyadic) : IntervalDyadic

Add two intervals

Equations

• I.add J = { lo := I.lo.add J.lo, hi := I.hi.add J.hi, le := ⋯ }

theorem LeanCert.Core.IntervalDyadic.mem_add {x y : ℝ} {I J : IntervalDyadic} (hx : x ∈ I) (hy : y ∈ J) : x + y ∈ I.add J

FTIA for addition

def LeanCert.Core.IntervalDyadic.addRounded (I J : IntervalDyadic) (prec : ℤ := -53) : IntervalDyadic

Add with precision control

Equations

• I.addRounded J prec = (I.add J).roundOut prec

Interval Subtraction

def LeanCert.Core.IntervalDyadic.sub (I J : IntervalDyadic) : IntervalDyadic

Subtract two intervals

Equations

• I.sub J = I.add J.neg

theorem LeanCert.Core.IntervalDyadic.mem_sub {x y : ℝ} {I J : IntervalDyadic} (hx : x ∈ I) (hy : y ∈ J) : x - y ∈ I.sub J

FTIA for subtraction

Interval Multiplication

def LeanCert.Core.IntervalDyadic.mul (I J : IntervalDyadic) : IntervalDyadic

Multiply two intervals.

Uses min/max of all four endpoint products to handle signs correctly. This is the exact multiplication - mantissas may grow. Use mulRounded or mulNormalized for controlled precision.

Correctness: For x ∈ [a,b] and y ∈ [c,d], the product x*y lies in the interval [min(ac,ad,bc,bd), max(ac,ad,bc,bd)].

Equations

• I.mul J = { lo := (I.lo.mul J.lo).min4 (I.lo.mul J.hi) (I.hi.mul J.lo) (I.hi.mul J.hi), hi := (I.lo.mul J.lo).max4 (I.lo.mul J.hi) (I.hi.mul J.lo) (I.hi.mul J.hi), le := ⋯ }

def LeanCert.Core.IntervalDyadic.mulFast (I J : IntervalDyadic) : IntervalDyadic

Fast interval multiplication using sign-based case splitting. Reduces from 4 multiplications + 12 comparisons to 2 multiplications in the common case (both intervals positive or both negative). Falls back to the full 4-way product for mixed-sign intervals.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalDyadic.mem_mul {x y : ℝ} {I J : IntervalDyadic} (hx : x ∈ I) (hy : y ∈ J) : x * y ∈ I.mul J

FTIA for multiplication

theorem LeanCert.Core.IntervalDyadic.mem_mulFast {x y : ℝ} {I J : IntervalDyadic} (hx : x ∈ I) (hy : y ∈ J) : x * y ∈ I.mulFast J

mulFast preserves the containment property of mul. This is retained as documentation and a future audited optimization hook; production certificate checking currently uses mul directly.

def LeanCert.Core.IntervalDyadic.mulRounded (I J : IntervalDyadic) (prec : ℤ := -53) : IntervalDyadic

Multiply with precision control (outward rounding)

Equations

• I.mulRounded J prec = (I.mul J).roundOut prec

def LeanCert.Core.IntervalDyadic.mulNormalized (I J : IntervalDyadic) (maxBits : ℕ := 256) : IntervalDyadic

Multiply with mantissa normalization (prevents bit explosion)

Equations

• I.mulNormalized J maxBits = { lo := (I.mul J).lo.normalizeDown maxBits, hi := (I.mul J).hi.normalizeUp maxBits, le := ⋯ }

Interval Scaling

def LeanCert.Core.IntervalDyadic.scale (I : IntervalDyadic) (c : Dyadic) : IntervalDyadic

Scale an interval by a constant Dyadic

Equations

• I.scale c = if hc : LeanCert.Core.Dyadic.zero.le c = true then { lo := I.lo.mul c, hi := I.hi.mul c, le := ⋯ } else { lo := I.hi.mul c, hi := I.lo.mul c, le := ⋯ }

def LeanCert.Core.IntervalDyadic.scale2 (I : IntervalDyadic) (n : ℤ) : IntervalDyadic

Scale by a power of 2 (very efficient: just adjusts exponents)

Equations

• I.scale2 n = { lo := I.lo.scale2 n, hi := I.hi.scale2 n, le := ⋯ }

Square Root

def LeanCert.Core.IntervalDyadic.sqrt (I : IntervalDyadic) (_prec : ℤ := -53) : IntervalDyadic

Square root of an interval. Returns a conservative bound [0, max(hi, 1)]. This is sound because:

• sqrt(x) = 0 for x < 0 (by definition in Mathlib)
• sqrt(x) ≥ 0 for all x
• sqrt(x) ≤ max(x, 1) for x ≥ 0 Therefore for any x ∈ [lo, hi], sqrt(x) ∈ [0, max(hi, 1)].

Equations

• I.sqrt _prec = { lo := LeanCert.Core.Dyadic.zero, hi := I.hi.max (LeanCert.Core.Dyadic.ofInt 1), le := ⋯ }

theorem LeanCert.Core.IntervalDyadic.mem_sqrt {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) (hx_nn : 0 ≤ x) (prec : ℤ) : √x ∈ I.sqrt prec

Soundness of interval sqrt: if x ∈ I, x ≥ 0, then Real.sqrt x ∈ sqrt I

theorem LeanCert.Core.IntervalDyadic.mem_sqrt' {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) (prec : ℤ) : √x ∈ I.sqrt prec

General soundness of interval sqrt for any real input. Handles both non-negative inputs and negative inputs (where Real.sqrt returns 0).

Comparison and Containment

def LeanCert.Core.IntervalDyadic.containsZero (I : IntervalDyadic) : Bool

Check if interval contains zero

Equations

• I.containsZero = (I.lo.le LeanCert.Core.Dyadic.zero && LeanCert.Core.Dyadic.zero.le I.hi)

def LeanCert.Core.IntervalDyadic.isPositive (I : IntervalDyadic) : Bool

Check if entire interval is positive

Equations

• I.isPositive = LeanCert.Core.Dyadic.zero.lt I.lo

def LeanCert.Core.IntervalDyadic.isNegative (I : IntervalDyadic) : Bool

Check if entire interval is negative

Equations

• I.isNegative = I.hi.lt LeanCert.Core.Dyadic.zero

def LeanCert.Core.IntervalDyadic.subset (I J : IntervalDyadic) : Bool

Check if I ⊆ J

Equations

• I.subset J = (J.lo.le I.lo && I.hi.le J.hi)

def LeanCert.Core.IntervalDyadic.upperBoundedBy (I : IntervalDyadic) (q : ℚ) : Bool

Check if the upper bound is ≤ a rational

Equations

• I.upperBoundedBy q = decide (I.hi.toRat ≤ q)

def LeanCert.Core.IntervalDyadic.lowerBoundedBy (I : IntervalDyadic) (q : ℚ) : Bool

Check if a rational is ≤ the lower bound

Equations

• I.lowerBoundedBy q = decide (q ≤ I.lo.toRat)

theorem LeanCert.Core.IntervalDyadic.le_hi_of_mem {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) : x ≤ ↑I.hi.toRat

Upper bound extraction from membership

theorem LeanCert.Core.IntervalDyadic.lo_le_of_mem {x : ℝ} {I : IntervalDyadic} (hx : x ∈ I) : ↑I.lo.toRat ≤ x

Lower bound extraction from membership

theorem LeanCert.Core.IntervalDyadic.upperBoundedBy_spec {I : IntervalDyadic} {q : ℚ} (h : I.upperBoundedBy q = true) : ↑I.hi.toRat ≤ ↑q

What upperBoundedBy means: the interval's hi endpoint is ≤ q

theorem LeanCert.Core.IntervalDyadic.lowerBoundedBy_spec {I : IntervalDyadic} {q : ℚ} (h : I.lowerBoundedBy q = true) : ↑q ≤ ↑I.lo.toRat

What lowerBoundedBy means: q is ≤ the interval's lo endpoint

Helper for Transcendentals

def LeanCert.Core.IntervalDyadic.ofIntervalRat (I : IntervalRat) (prec : ℤ := -53) : IntervalDyadic

Convert from IntervalRat (for transcendental results)

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalDyadic.mem_ofIntervalRat {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (prec : ℤ) (hprec : prec ≤ 0 := by norm_num) : x ∈ ofIntervalRat I prec

If x ∈ IntervalRat I, then x ∈ ofIntervalRat I prec (outward rounding preserves membership). Requires precision ≤ 0 (e.g. -53).

Intervals with Real Endpoints

This file defines IntervalReal, an interval type with real (ℝ) endpoints. Unlike IntervalRat (which has rational endpoints and is suitable for computation), IntervalReal allows us to represent intervals involving transcendental values like [1, Real.exp 1] or [Real.log 2, π].

Main definitions

• IntervalReal - Intervals with real endpoints
• expInterval - Interval bound for exp
• logInterval - Interval bound for log (on positive intervals)

Main theorems

• mem_expInterval - FTIA for exp: if x ∈ I, then exp(x) ∈ expInterval(I)

Design notes

This type complements IntervalRat for proving facts about transcendental functions. While IntervalRat is used for numerical computation (since rationals are computable), IntervalReal is used for correctness proofs involving exp, log, etc.

Typical workflow:

1. Use IntervalRat for actual interval arithmetic computations
2. Convert to IntervalReal when proving facts about transcendental functions
3. Use mathlib's analysis lemmas directly on real intervals

structure LeanCert.Core.IntervalReal : Type

An interval with real endpoints

• lo : ℝ

  Lower endpoint of the interval.

• hi : ℝ

  Upper endpoint of the interval.

• le : self.lo ≤ self.hi

def LeanCert.Core.IntervalReal.toSet (I : IntervalReal) : Set ℝ

The set of reals contained in this interval

Equations

• I.toSet = Set.Icc I.lo I.hi

@[instance_reducible]

instance LeanCert.Core.IntervalReal.instMembershipReal : Membership ℝ IntervalReal

Membership in an interval

Equations

• LeanCert.Core.IntervalReal.instMembershipReal = { mem := fun (I : LeanCert.Core.IntervalReal) (x : ℝ) => I.lo ≤ x ∧ x ≤ I.hi }

@[simp]

theorem LeanCert.Core.IntervalReal.mem_def (x : ℝ) (I : IntervalReal) : x ∈ I ↔ I.lo ≤ x ∧ x ≤ I.hi

theorem LeanCert.Core.IntervalReal.mem_toSet_iff (x : ℝ) (I : IntervalReal) : x ∈ I.toSet ↔ x ∈ I

def LeanCert.Core.IntervalReal.singleton (r : ℝ) : IntervalReal

Create an interval from a single real

Equations

• LeanCert.Core.IntervalReal.singleton r = { lo := r, hi := r, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_singleton (r : ℝ) : r ∈ singleton r

def LeanCert.Core.IntervalReal.ofRat (I : IntervalRat) : IntervalReal

Convert from IntervalRat to IntervalReal

Equations

• LeanCert.Core.IntervalReal.ofRat I = { lo := ↑I.lo, hi := ↑I.hi, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_ofRat {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : x ∈ ofRat I

Interval addition

def LeanCert.Core.IntervalReal.add (I J : IntervalReal) : IntervalReal

Add two intervals

Equations

• I.add J = { lo := I.lo + J.lo, hi := I.hi + J.hi, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_add {x y : ℝ} {I J : IntervalReal} (hx : x ∈ I) (hy : y ∈ J) : x + y ∈ I.add J

FTIA for addition

Interval negation

def LeanCert.Core.IntervalReal.neg (I : IntervalReal) : IntervalReal

Negate an interval

Equations

• I.neg = { lo := -I.hi, hi := -I.lo, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_neg {x : ℝ} {I : IntervalReal} (hx : x ∈ I) : -x ∈ I.neg

FTIA for negation

Interval multiplication

def LeanCert.Core.IntervalReal.min4 (a b c d : ℝ) : ℝ

The minimum of four real endpoints, used for interval multiplication.

Equations

• LeanCert.Core.IntervalReal.min4 a b c d = min (min a b) (min c d)

def LeanCert.Core.IntervalReal.max4 (a b c d : ℝ) : ℝ

The maximum of four real endpoints, used for interval multiplication.

Equations

• LeanCert.Core.IntervalReal.max4 a b c d = max (max a b) (max c d)

def LeanCert.Core.IntervalReal.mul (I J : IntervalReal) : IntervalReal

Multiply two intervals

Equations

• One or more equations did not get rendered due to their size.

Exponential interval

noncomputable def LeanCert.Core.IntervalReal.expInterval (I : IntervalReal) : IntervalReal

Interval bound for exp. Since exp is strictly increasing, exp([a,b]) = [exp(a), exp(b)].

Equations

• I.expInterval = { lo := Real.exp I.lo, hi := Real.exp I.hi, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_expInterval {x : ℝ} {I : IntervalReal} (hx : x ∈ I) : Real.exp x ∈ I.expInterval

FTIA for exp: if x ∈ [a,b], then exp(x) ∈ [exp(a), exp(b)]. This is FULLY PROVED - no sorry, no axioms.

Logarithm interval (for positive intervals)

structure LeanCert.Core.IntervalReal.IntervalRealPosextends LeanCert.Core.IntervalReal : Type

An interval that is strictly positive

• lo : ℝ
• hi : ℝ
• le : self.lo ≤ self.hi
• lo_pos : 0 < self.lo

noncomputable def LeanCert.Core.IntervalReal.logInterval (I : IntervalRealPos) : IntervalReal

Interval bound for log on positive intervals. Since log is strictly increasing on (0, ∞), log([a,b]) = [log(a), log(b)] for a > 0.

Equations

• LeanCert.Core.IntervalReal.logInterval I = { lo := Real.log I.lo, hi := Real.log I.hi, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_logInterval {x : ℝ} {I : IntervalRealPos} (hx : x ∈ I.toIntervalReal) : Real.log x ∈ logInterval I

FTIA for log: if x ∈ [a,b] with a > 0, then log(x) ∈ [log(a), log(b)]. This is FULLY PROVED - no sorry, no axioms.

Trigonometric intervals (global bounds)

def LeanCert.Core.IntervalReal.sinInterval (_I : IntervalReal) : IntervalReal

Interval bound for sin. Since |sin x| ≤ 1 for all x, we use [-1, 1].

Equations

• _I.sinInterval = { lo := -1, hi := 1, le := LeanCert.Core.IntervalReal.sinInterval._proof_1 }

theorem LeanCert.Core.IntervalReal.mem_sinInterval {x : ℝ} {I : IntervalReal} (_hx : x ∈ I) : Real.sin x ∈ I.sinInterval

FTIA for sin

def LeanCert.Core.IntervalReal.cosInterval (_I : IntervalReal) : IntervalReal

Interval bound for cos. Since |cos x| ≤ 1 for all x, we use [-1, 1].

Equations

• _I.cosInterval = { lo := -1, hi := 1, le := LeanCert.Core.IntervalReal.sinInterval._proof_1 }

theorem LeanCert.Core.IntervalReal.mem_cosInterval {x : ℝ} {I : IntervalReal} (_hx : x ∈ I) : Real.cos x ∈ I.cosInterval

FTIA for cos

def LeanCert.Core.IntervalReal.atanInterval (_I : IntervalReal) : IntervalReal

Interval bound for atan. Since arctan x ∈ (-π/2, π/2) ⊂ [-2, 2] for all x.

Equations

• _I.atanInterval = { lo := -2, hi := 2, le := LeanCert.Core.IntervalReal.atanInterval._proof_1 }

theorem LeanCert.Core.IntervalReal.mem_atanInterval {x : ℝ} {I : IntervalReal} (_hx : x ∈ I) : Real.arctan x ∈ I.atanInterval

FTIA for atan

theorem LeanCert.Core.IntervalReal.abs_arsinh_le_abs (x : ℝ) : |Real.arsinh x| ≤ |x|

|arsinh x| ≤ |x| for all x. This follows from MVT and |arsinh'| ≤ 1.

def LeanCert.Core.IntervalReal.arsinhInterval (I : IntervalReal) : IntervalReal

Interval bound for arsinh. Uses a conservative bound based on input interval.

Equations

• I.arsinhInterval = { lo := -(max |I.lo| |I.hi| + 1), hi := max |I.lo| |I.hi| + 1, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_arsinhInterval {x : ℝ} {I : IntervalReal} (hx : x ∈ I) : Real.arsinh x ∈ I.arsinhInterval

FTIA for arsinh

Hyperbolic function intervals

noncomputable def LeanCert.Core.IntervalReal.sinhInterval (I : IntervalReal) : IntervalReal

Interval bound for sinh. Since sinh is strictly monotonic increasing, sinh([a,b]) = [sinh(a), sinh(b)].

Equations

• I.sinhInterval = { lo := Real.sinh I.lo, hi := Real.sinh I.hi, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_sinhInterval {x : ℝ} {I : IntervalReal} (hx : x ∈ I) : Real.sinh x ∈ I.sinhInterval

FTIA for sinh: if x ∈ [a,b], then sinh(x) ∈ [sinh(a), sinh(b)]. This is FULLY PROVED - no sorry, no axioms.

noncomputable def LeanCert.Core.IntervalReal.coshInterval (I : IntervalReal) : IntervalReal

Interval bound for cosh. cosh is convex with minimum at 0:

• If interval is all non-negative: cosh is increasing
• If interval is all non-positive: cosh is decreasing
• If interval contains 0: minimum is cosh(0) = 1, max is at endpoints

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalReal.mem_coshInterval {x : ℝ} {I : IntervalReal} (hx : x ∈ I) : Real.cosh x ∈ I.coshInterval

FTIA for cosh: if x ∈ [a,b], then cosh(x) ∈ coshInterval([a,b]). This is FULLY PROVED - no sorry, no axioms.

Square root interval

noncomputable def LeanCert.Core.IntervalReal.sqrtInterval (I : IntervalReal) : IntervalReal

Interval bound for sqrt. For any interval I, sqrt(x) ∈ [0, max(hi, 1)] for x ∈ I. This is always sound because:

• sqrt(x) ≥ 0 for all x (Mathlib convention: sqrt(negative) = 0)
• sqrt(x) ≤ max(x, 1) for x ≥ 0, so sqrt(x) ≤ max(hi, 1)

Equations

• I.sqrtInterval = { lo := 0, hi := max I.hi 1, le := ⋯ }

theorem LeanCert.Core.IntervalReal.mem_sqrtInterval {x : ℝ} {I : IntervalReal} (hx : x ∈ I) : √x ∈ I.sqrtInterval

FTIA for sqrt: if x ∈ I, then sqrt(x) ∈ sqrtInterval(I). Works for all x including negative (where sqrt returns 0 by Mathlib convention).

Shared Trigonometric Range Reduction

Common rational π bounds and interval-shifting proofs used by IntervalRat and Taylor-model trigonometric evaluators.

Rational approximations of π and 2π

def LeanCert.Core.TrigReduction.piRatLo : ℚ

Lower bound for π: 314159265/100000000 < π

Equations

• LeanCert.Core.TrigReduction.piRatLo = 314159265 / 100000000

def LeanCert.Core.TrigReduction.piRatHi : ℚ

Upper bound for π: π < 355/113

Equations

• LeanCert.Core.TrigReduction.piRatHi = 355 / 113

def LeanCert.Core.TrigReduction.twoPiRatLo : ℚ

Lower bound for 2π

Equations

• LeanCert.Core.TrigReduction.twoPiRatLo = 2 * LeanCert.Core.TrigReduction.piRatLo

def LeanCert.Core.TrigReduction.twoPiRatHi : ℚ

Upper bound for 2π

Equations

• LeanCert.Core.TrigReduction.twoPiRatHi = 2 * LeanCert.Core.TrigReduction.piRatHi

theorem LeanCert.Core.TrigReduction.piRatLo_lt_pi : ↑piRatLo < Real.pi

piRatLo < π, proved from Mathlib's decimal π bounds.

theorem LeanCert.Core.TrigReduction.pi_lt_piRatHi : Real.pi < ↑piRatHi

π < piRatHi, proved from Mathlib's decimal π bounds.

theorem LeanCert.Core.TrigReduction.twoPiRatLo_lt_two_pi : ↑twoPiRatLo < 2 * Real.pi

twoPiRatLo < 2π

theorem LeanCert.Core.TrigReduction.two_pi_lt_twoPiRatHi : 2 * Real.pi < ↑twoPiRatHi

2π < twoPiRatHi

theorem LeanCert.Core.TrigReduction.twoPiRatLo_le_twoPiRatHi : twoPiRatLo ≤ twoPiRatHi

twoPiRatLo ≤ twoPiRatHi

Range reduction

def LeanCert.Core.TrigReduction.computeShiftK (I : IntervalRat) : ℤ

Compute the shift amount k such that I.midpoint - k * 2π is approximately in [-π, π].

Equations

• LeanCert.Core.TrigReduction.computeShiftK I = (I.midpoint / LeanCert.Core.TrigReduction.twoPiRatHi).floor

def LeanCert.Core.TrigReduction.shiftInterval (I : IntervalRat) (k : ℤ) : IntervalRat

Shift an interval by subtracting k * 2π using rational bounds.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.TrigReduction.reduceToMainPeriod (I : IntervalRat) : IntervalRat × ℤ

Reduce interval to be approximately in [-π, π] by subtracting multiples of 2π.

Equations

• LeanCert.Core.TrigReduction.reduceToMainPeriod I = (LeanCert.Core.TrigReduction.shiftInterval I (LeanCert.Core.TrigReduction.computeShiftK I), LeanCert.Core.TrigReduction.computeShiftK I)

Correctness of range reduction

theorem LeanCert.Core.TrigReduction.mem_shiftInterval_of_mem {x : ℝ} {I : IntervalRat} {k : ℤ} (hx : x ∈ I) : x - 2 * Real.pi * ↑k ∈ shiftInterval I k

If x ∈ I, then x - 2πk ∈ shiftInterval I k.

theorem LeanCert.Core.TrigReduction.mem_reduceToMainPeriod_of_mem {x : ℝ} {I : IntervalRat} (hx : x ∈ I) : x - 2 * Real.pi * ↑(reduceToMainPeriod I).2 ∈ (reduceToMainPeriod I).1

Convenience form: if x ∈ I, then x - 2πk ∈ (reduceToMainPeriod I).1.

Computable Range Reduction for Trigonometric Functions

This file implements range reduction for sin and cos to improve Taylor series convergence for intervals far from 0.

Problem

Standard Taylor series for sin/cos centered at 0 have remainder bounds of |x|^{n+1} / (n+1)!. For intervals far from 0 (e.g., [10, 11]), this remainder is huge even for moderate n.

Solution: Range Reduction

Use the periodicity of sin/cos:

• sin(x) = sin(x - 2πk) for any integer k
• cos(x) = cos(x - 2πk) for any integer k

By choosing k to bring x - 2πk into [-π, π], the Taylor series converges much faster since |x - 2πk| ≤ π ≈ 3.14.

Main definitions

• twoPiRatLo, twoPiRatHi - Rational bounds for 2π
• reduceToMainPeriod - Shift interval to be near 0
• sinComputableReduced, cosComputableReduced - Computable evaluation with range reduction

Shared range-reduction API

def LeanCert.Core.IntervalRat.piRatLo : ℚ

The rational lower π bound from the trigonometric reduction implementation.

Equations

• LeanCert.Core.IntervalRat.piRatLo = LeanCert.Core.TrigReduction.piRatLo

def LeanCert.Core.IntervalRat.piRatHi : ℚ

The rational upper π bound from the trigonometric reduction implementation.

Equations

• LeanCert.Core.IntervalRat.piRatHi = LeanCert.Core.TrigReduction.piRatHi

def LeanCert.Core.IntervalRat.twoPiRatLo : ℚ

The rational lower bound for twice π used in argument reduction.

Equations

• LeanCert.Core.IntervalRat.twoPiRatLo = LeanCert.Core.TrigReduction.twoPiRatLo

def LeanCert.Core.IntervalRat.twoPiRatHi : ℚ

The rational upper bound for twice π used in argument reduction.

Equations

• LeanCert.Core.IntervalRat.twoPiRatHi = LeanCert.Core.TrigReduction.twoPiRatHi

def LeanCert.Core.IntervalRat.computeShiftK : IntervalRat → ℤ

Choose the integer number of periods used to reduce an input interval.

Equations

• LeanCert.Core.IntervalRat.computeShiftK = LeanCert.Core.TrigReduction.computeShiftK

def LeanCert.Core.IntervalRat.shiftInterval : IntervalRat → ℤ → IntervalRat

Shift an interval by the selected integer multiple of the period enclosure.

Equations

• LeanCert.Core.IntervalRat.shiftInterval = LeanCert.Core.TrigReduction.shiftInterval

def LeanCert.Core.IntervalRat.reduceToMainPeriod : IntervalRat → IntervalRat × ℤ

Return the reduced interval and its integer period shift.

Equations

• LeanCert.Core.IntervalRat.reduceToMainPeriod = LeanCert.Core.TrigReduction.reduceToMainPeriod

theorem LeanCert.Core.IntervalRat.piRatLo_lt_pi : ↑piRatLo < Real.pi

theorem LeanCert.Core.IntervalRat.pi_lt_piRatHi : Real.pi < ↑piRatHi

theorem LeanCert.Core.IntervalRat.twoPiRatLo_lt_two_pi : ↑twoPiRatLo < 2 * Real.pi

theorem LeanCert.Core.IntervalRat.two_pi_lt_twoPiRatHi : 2 * Real.pi < ↑twoPiRatHi

theorem LeanCert.Core.IntervalRat.twoPiRatLo_le_twoPiRatHi : twoPiRatLo ≤ twoPiRatHi

theorem LeanCert.Core.IntervalRat.mem_shiftInterval_of_mem {x : ℝ} {I : IntervalRat} {k : ℤ} (hx : x ∈ I) : x - 2 * Real.pi * ↑k ∈ I.shiftInterval k

Computable reduced evaluation

def LeanCert.Core.IntervalRat.sinComputableReduced (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable sin evaluation with range reduction.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Core.IntervalRat.cosComputableReduced (I : IntervalRat) (n : ℕ := 10) : IntervalRat

Computable cos evaluation with range reduction.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Core.IntervalRat.mem_sinComputableReduced {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ := 10) : Real.sin x ∈ I.sinComputableReduced n

sin x ∈ sinComputableReduced I for all x ∈ I

theorem LeanCert.Core.IntervalRat.mem_cosComputableReduced {x : ℝ} {I : IntervalRat} (hx : x ∈ I) (n : ℕ := 10) : Real.cos x ∈ I.cosComputableReduced n

cos x ∈ cosComputableReduced I for all x ∈ I

Computable Interval Evaluation

This file implements the computable interval evaluator for LeanCert.Core.Expr. Given an expression and intervals for its variables, we compute an interval guaranteed to contain all possible values.

Main definitions

• IntervalEnv - Variable assignment as intervals
• EvalConfig - Configuration for evaluation parameters (Taylor depth)
• LeanCert.Internal.Rational.evalTotalCore - Computable interval evaluator for core expressions
• evalIntervalCore_correct - Correctness theorem for core evaluation

Design notes

This evaluator is COMPUTABLE, allowing use of native_decide for bound checking in tactics. The transcendental functions (exp, sin, cos) use Taylor series with configurable depth for precision control.

For inv: computes bounds using invInterval, but correctness is not covered by evalIntervalCore_correct. Use evalIntervalOption for inv.

Interval bounds for transcendental functions

def LeanCert.Engine.sinInterval (_I : Core.IntervalRat) : Core.IntervalRat

Simple interval bound for sin. Since |sin x| ≤ 1 for all x, we use the global bound [-1, 1]. This is sound but not tight.

Equations

• LeanCert.Engine.sinInterval _I = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }

theorem LeanCert.Engine.mem_sinInterval {x : ℝ} {I : Core.IntervalRat} (_hx : x ∈ I) : Real.sin x ∈ sinInterval I

Correctness of sin interval: sin x ∈ [-1, 1] for all x

def LeanCert.Engine.cosInterval (_I : Core.IntervalRat) : Core.IntervalRat

Simple interval bound for cos. Since |cos x| ≤ 1 for all x, we use the global bound [-1, 1]. This is sound but not tight.

Equations

• LeanCert.Engine.cosInterval _I = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }

theorem LeanCert.Engine.mem_cosInterval {x : ℝ} {I : Core.IntervalRat} (_hx : x ∈ I) : Real.cos x ∈ cosInterval I

Correctness of cos interval: cos x ∈ [-1, 1] for all x

def LeanCert.Engine.atanInterval (_I : Core.IntervalRat) : Core.IntervalRat

Simple interval bound for atan. Since atan x ∈ (-π/2, π/2) for all x, we use the global bound [-2, 2]. This is sound but not tight (π/2 ≈ 1.57).

Equations

• LeanCert.Engine.atanInterval _I = { lo := -2, hi := 2, le := LeanCert.Engine.atanInterval._proof_1 }

theorem LeanCert.Engine.mem_atanInterval {x : ℝ} {I : Core.IntervalRat} (_hx : x ∈ I) : Real.arctan x ∈ atanInterval I

Correctness of atan interval: arctan x ∈ [-2, 2] for all x

def LeanCert.Engine.erfInterval (I : Core.IntervalRat) (taylorDepth : ℕ := 15) : Core.IntervalRat

Interval bound for erf using computable Taylor series. erf(x) = (2/√π) * ∫₀ˣ exp(-t²) dt, strictly monotone increasing. This computes tight bounds using verified Taylor series.

Equations

• LeanCert.Engine.erfInterval I taylorDepth = I.erfComputable taylorDepth

theorem LeanCert.Engine.Real.strictMono_erf : StrictMono Core.Real.erf

erf is strictly monotone increasing. Proof: erf'(x) = (2/√π) * exp(-x²) > 0 for all x.

We use that for a < b, the integral ∫_{a}^{b} exp(-t²) dt > 0 since the integrand is strictly positive.

theorem LeanCert.Engine.mem_erfPointComputable (q : ℚ) (n : ℕ) : Core.Real.erf ↑q ∈ Core.IntervalRat.erfPointComputable q n

Correctness of erfPointComputable. The enclosure is sign-aware and uses monotonicity of erf with erf(0)=0.

theorem LeanCert.Engine.mem_erfInterval {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) (n : ℕ := 15) : Core.Real.erf x ∈ erfInterval I n

Correctness of erf interval using monotonicity and endpoint evaluation.

Since erf is strictly monotone increasing:

• For x ∈ [I.lo, I.hi], we have erf(I.lo) ≤ erf(x) ≤ erf(I.hi)
• erfPointComputable(I.lo) contains erf(I.lo)
• erfPointComputable(I.hi) contains erf(I.hi)
• hull of these intervals contains [erf(I.lo), erf(I.hi)]
• Therefore erf(x) ∈ hull(...) ∩ [-1, 1]

def LeanCert.Engine.arsinhInterval (I : Core.IntervalRat) : Core.IntervalRat

Simple interval bound for arsinh. arsinh is unbounded, so we use a very rough linear bound. We use max(|lo|, |hi|) + 1 as a safe bound that always works.

Equations

• LeanCert.Engine.arsinhInterval I = { lo := -(max |I.lo| |I.hi| + 1), hi := max |I.lo| |I.hi| + 1, le := ⋯ }

theorem LeanCert.Engine.mem_arsinhInterval {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) : Real.arsinh x ∈ arsinhInterval I

Correctness of arsinh interval. Uses the bound |arsinh x| ≤ |x| for all x (from IntervalRealEndpoints).

noncomputable def LeanCert.Engine.atanhInterval (I : Core.IntervalRat) : Core.IntervalRat

Interval bound for atanh. atanh is defined for (-1, 1). If interval is within this range, we compute tight bounds using monotonicity. Otherwise returns default.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Engine.mem_atanhInterval {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) (hlo : -1 < I.lo) (hhi : I.hi < 1) : Core.Real.atanh x ∈ atanhInterval I

Correctness of atanh interval: when x ∈ I and I ⊂ (-1, 1), atanh(x) ∈ atanhInterval I.

def LeanCert.Engine.tanhInterval (_I : Core.IntervalRat) : Core.IntervalRat

Tight interval bound for tanh. Since tanh(x) ∈ (-1, 1) for all x ∈ ℝ, we use the global bound [-1, 1]. This avoids the interval explosion that occurs when desugaring to exp.

Equations

• LeanCert.Engine.tanhInterval _I = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }

theorem LeanCert.Engine.mem_tanhInterval {x : ℝ} {I : Core.IntervalRat} (_hx : x ∈ I) : Real.tanh x ∈ tanhInterval I

Correctness of tanh interval: tanh x ∈ [-1, 1] for all x

def LeanCert.Engine.piInterval : Core.IntervalRat

Interval enclosure for π. Uses tight bounds from Mathlib's pi_gt_d20 and pi_lt_d20 which give 20 decimal digits. 3.14159265358979323846 < π < 3.14159265358979323847

Equations

• LeanCert.Engine.piInterval = { lo := 31415926535897932 / 10000000000000000, hi := 31415926535897933 / 10000000000000000, le := LeanCert.Engine.piInterval._proof_1 }

theorem LeanCert.Engine.mem_piInterval : Real.pi ∈ piInterval

Correctness of pi interval: Real.pi ∈ piInterval

def LeanCert.Engine.eulerMascheroniInterval : Core.IntervalRat

Interval enclosure for the Euler–Mascheroni constant γ. Tight bounds derived from eulerMascheroniSeq 100 < γ < eulerMascheroniSeq' 100 combined with explicit Taylor partial sums for log. The proofs below are axiom-free (no native_decide): all rational arithmetic is certified by norm_num, and the only analytic inputs are Mathlib's abs_log_sub_add_sum_range_le and the d9 bounds on log 2.

Equations

• LeanCert.Engine.eulerMascheroniInterval = { lo := 5722 / 10000, hi := 5823 / 10000, le := LeanCert.Engine.eulerMascheroniInterval._proof_1 }

theorem LeanCert.Engine.mem_eulerMascheroniInterval : Real.eulerMascheroniConstant ∈ eulerMascheroniInterval

Correctness of Euler–Mascheroni interval: γ ∈ eulerMascheroniInterval

def LeanCert.Core.MathConst.interval : MathConst → IntervalRat

Centralized interval lookup for named mathematical constants. Extending this table is the ONLY change needed to add a new constant.

Equations

• LeanCert.Core.MathConst.pi.interval = LeanCert.Engine.piInterval
• LeanCert.Core.MathConst.eulerMascheroni.interval = LeanCert.Engine.eulerMascheroniInterval

theorem LeanCert.Core.MathConst.mem_interval (c : MathConst) : c.toReal ∈ c.interval

Correctness: the real value of every named constant is in its interval.

def LeanCert.Engine.sinhInterval (I : Core.IntervalRat) (taylorDepth : ℕ := 10) : Core.IntervalRat

Interval bound for sinh using computable Taylor series for exp. sinh(x) = (exp(x) - exp(-x)) / 2, and sinh is strictly monotonic. This computes tight bounds using the verified exp implementation.

Equations

• LeanCert.Engine.sinhInterval I taylorDepth = I.sinhComputable taylorDepth

def LeanCert.Engine.coshInterval (I : Core.IntervalRat) (taylorDepth : ℕ := 10) : Core.IntervalRat

Interval bound for cosh using computable Taylor series for exp. cosh(x) = (exp(x) + exp(-x)) / 2, with minimum 1 at x = 0. This computes tight bounds using the verified exp implementation.

Equations

• LeanCert.Engine.coshInterval I taylorDepth = I.coshComputable taylorDepth

Interval inverse

def LeanCert.Engine.invWideBound : ℚ

Wide bound constant for when inverse is undefined (denominator contains 0)

Equations

• LeanCert.Engine.invWideBound = 10 ^ 30

def LeanCert.Engine.invInterval (I : Core.IntervalRat) : Core.IntervalRat

Computable interval inverse. For [a,b] with a > 0: returns [1/b, 1/a] (1/x is decreasing on positive reals) For [a,b] with b < 0: returns [1/b, 1/a] (1/x is decreasing on negative reals) For intervals containing 0: returns wide bounds [-M, M]. NOTE: this branch is NOT a sound enclosure of x⁻¹ in general (1/x is unbounded near 0); the correctness theorem mem_invInterval therefore requires the extra hypothesis |x⁻¹| ≤ invWideBound in that case.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Engine.mem_invInterval_pos {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) (hpos : I.lo > 0) : x⁻¹ ∈ invInterval I

Correctness of invInterval when denominator interval is positive. For x ∈ [a,b] with a > 0, we have 1/x ∈ [1/b, 1/a]

theorem LeanCert.Engine.mem_invInterval_neg {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) (hneg : I.hi < 0) : x⁻¹ ∈ invInterval I

Correctness of invInterval when denominator interval is negative. For x ∈ [a,b] with b < 0, we have 1/x ∈ [1/b, 1/a]

theorem LeanCert.Engine.mem_invInterval_wide {x : ℝ} {I : Core.IntervalRat} (_hx : x ∈ I) (hlo : ¬I.lo > 0) (hhi : ¬I.hi < 0) (hbnd : |x⁻¹| ≤ ↑invWideBound) : x⁻¹ ∈ invInterval I

Correctness of invInterval when denominator interval contains zero. Requires a bound on |x⁻¹| to be provable, since x can be arbitrarily close to 0.

theorem LeanCert.Engine.mem_invInterval {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) (hbnd : |x⁻¹| ≤ ↑invWideBound) : x⁻¹ ∈ invInterval I

Main correctness theorem for invInterval. Fully proved for intervals bounded away from zero. For intervals containing zero, requires a bound on |x⁻¹|.

theorem LeanCert.Engine.mem_invInterval_nonzero {x : ℝ} {I : Core.IntervalRat} (hx : x ∈ I) (hnonzero : I.lo > 0 ∨ I.hi < 0) : x⁻¹ ∈ invInterval I

Correctness of invInterval for intervals bounded away from zero (no extra hypothesis needed)

Core interval evaluation (computable)

@[reducible, inline]

abbrev LeanCert.Engine.IntervalEnv : Type

Variable assignment as intervals

Equations

• LeanCert.Engine.IntervalEnv = (ℕ → LeanCert.Core.IntervalRat)

structure LeanCert.Engine.EvalConfig : Type

Configuration for interval evaluation parameters. This allows certificates to specify the required precision.

• taylorDepth : ℕ

  Number of Taylor series terms for transcendental functions

@[instance_reducible]

instance LeanCert.Engine.instReprEvalConfig : Repr EvalConfig

Equations

• LeanCert.Engine.instReprEvalConfig = { reprPrec := LeanCert.Engine.instReprEvalConfig.repr }

def LeanCert.Engine.instReprEvalConfig.repr : EvalConfig → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Engine.instDecidableEqEvalConfig : DecidableEq EvalConfig

Equations

• LeanCert.Engine.instDecidableEqEvalConfig = LeanCert.Engine.instDecidableEqEvalConfig.decEq

def LeanCert.Engine.instDecidableEqEvalConfig.decEq (x✝ x✝¹ : EvalConfig) : Decidable (x✝ = x✝¹)

Equations

• LeanCert.Engine.instDecidableEqEvalConfig.decEq { taylorDepth := a } { taylorDepth := b } = if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯

@[instance_reducible]

instance LeanCert.Engine.instInhabitedEvalConfig : Inhabited EvalConfig

Default evaluation configuration with 10 Taylor terms

Equations

• LeanCert.Engine.instInhabitedEvalConfig = { default := { } }

def LeanCert.Internal.Rational.evalTotalCore (e : Core.Expr) (ρ : Engine.IntervalEnv) (cfg : Engine.EvalConfig := { }) : Core.IntervalRat

Internal total evaluator for the theorem-restricted core expression fragment.

For expressions in ExprSupportedCore, this computes correct interval bounds with a fully-verified proof (given domain validity conditions).

For inv: computes bounds using invInterval, but correctness is not covered by evalIntervalCore_correct. Use evalIntervalOption for inv.

For log: uses logComputable with Taylor series. Correctness requires that the argument interval is positive (see evalDomainValid).

This evaluator is COMPUTABLE, allowing use of native_decide for bound checking in tactics. The transcendental functions (exp, sin, cos, log) use Taylor series with configurable depth for precision control.

Equations

• LeanCert.Internal.Rational.evalTotalCore (LeanCert.Core.Expr.const q) ρ cfg = LeanCert.Core.IntervalRat.singleton q
• LeanCert.Internal.Rational.evalTotalCore (LeanCert.Core.Expr.var idx) ρ cfg = ρ idx
• LeanCert.Internal.Rational.evalTotalCore (e₁.add e₂) ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e₁ ρ cfg).add (LeanCert.Internal.Rational.evalTotalCore e₂ ρ cfg)
• LeanCert.Internal.Rational.evalTotalCore (e₁.mul e₂) ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e₁ ρ cfg).mul (LeanCert.Internal.Rational.evalTotalCore e₂ ρ cfg)
• LeanCert.Internal.Rational.evalTotalCore e_1.neg ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).neg
• LeanCert.Internal.Rational.evalTotalCore e_1.inv ρ cfg = LeanCert.Engine.invInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg)
• LeanCert.Internal.Rational.evalTotalCore e_1.exp ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).expComputable cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.sin ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).sinComputableReduced cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.cos ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).cosComputableReduced cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.log ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).logComputable cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.atan ρ cfg = LeanCert.Engine.atanInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg)
• LeanCert.Internal.Rational.evalTotalCore e_1.arsinh ρ cfg = LeanCert.Engine.arsinhInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg)
• LeanCert.Internal.Rational.evalTotalCore e_1.atanh ρ cfg = default
• LeanCert.Internal.Rational.evalTotalCore e_1.sinc ρ cfg = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }
• LeanCert.Internal.Rational.evalTotalCore e_1.erf ρ cfg = LeanCert.Engine.erfInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg) cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.sinh ρ cfg = LeanCert.Engine.sinhInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg) cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.cosh ρ cfg = LeanCert.Engine.coshInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg) cfg.taylorDepth
• LeanCert.Internal.Rational.evalTotalCore e_1.tanh ρ cfg = LeanCert.Engine.tanhInterval (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg)
• LeanCert.Internal.Rational.evalTotalCore e_1.sqrt ρ cfg = (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).sqrtIntervalTightPrec
• LeanCert.Internal.Rational.evalTotalCore (LeanCert.Core.Expr.namedConst c) ρ cfg = c.interval

def LeanCert.Engine.envMem (ρ_real : ℕ → ℝ) (ρ_int : IntervalEnv) : Prop

A real environment is contained in an interval environment

Equations

• LeanCert.Engine.envMem ρ_real ρ_int = ∀ (i : ℕ), ρ_real i ∈ ρ_int i

def LeanCert.Engine.evalDomainValid (e : Core.Expr) (ρ : IntervalEnv) (cfg : EvalConfig := { }) : Prop

Domain validity predicate for expressions with domain restrictions.

For log: requires the argument interval to be strictly positive. This ensures that logComputable returns correct bounds.

For other expressions: always true (no domain restrictions).

Equations

• LeanCert.Engine.evalDomainValid (LeanCert.Core.Expr.const q) ρ cfg = True
• LeanCert.Engine.evalDomainValid (LeanCert.Core.Expr.var idx) ρ cfg = True
• LeanCert.Engine.evalDomainValid (e₁.add e₂) ρ cfg = (LeanCert.Engine.evalDomainValid e₁ ρ cfg ∧ LeanCert.Engine.evalDomainValid e₂ ρ cfg)
• LeanCert.Engine.evalDomainValid (e₁.mul e₂) ρ cfg = (LeanCert.Engine.evalDomainValid e₁ ρ cfg ∧ LeanCert.Engine.evalDomainValid e₂ ρ cfg)
• LeanCert.Engine.evalDomainValid e_1.neg ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.inv ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.exp ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.sin ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.cos ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.log ρ cfg = (LeanCert.Engine.evalDomainValid e_1 ρ cfg ∧ (LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).lo > 0)
• LeanCert.Engine.evalDomainValid e_1.atan ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.arsinh ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.atanh ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.sinc ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.erf ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.sinh ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.cosh ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.tanh ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid e_1.sqrt ρ cfg = LeanCert.Engine.evalDomainValid e_1 ρ cfg
• LeanCert.Engine.evalDomainValid (LeanCert.Core.Expr.namedConst c) ρ cfg = True

def LeanCert.Engine.evalDomainValid1 (e : Core.Expr) (I : Core.IntervalRat) (cfg : EvalConfig := { }) : Prop

Single-variable domain validity

Equations

• LeanCert.Engine.evalDomainValid1 e I cfg = LeanCert.Engine.evalDomainValid e (fun (x : ℕ) => I) cfg

def LeanCert.Engine.checkDomainValid (e : Core.Expr) (ρ : IntervalEnv) (cfg : EvalConfig := { }) : Bool

Computable (decidable) check for domain validity

Equations

• LeanCert.Engine.checkDomainValid (LeanCert.Core.Expr.const q) ρ cfg = true
• LeanCert.Engine.checkDomainValid (LeanCert.Core.Expr.var idx) ρ cfg = true
• LeanCert.Engine.checkDomainValid (e₁.add e₂) ρ cfg = (LeanCert.Engine.checkDomainValid e₁ ρ cfg && LeanCert.Engine.checkDomainValid e₂ ρ cfg)
• LeanCert.Engine.checkDomainValid (e₁.mul e₂) ρ cfg = (LeanCert.Engine.checkDomainValid e₁ ρ cfg && LeanCert.Engine.checkDomainValid e₂ ρ cfg)
• LeanCert.Engine.checkDomainValid e_1.neg ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.inv ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.exp ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.sin ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.cos ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.log ρ cfg = (LeanCert.Engine.checkDomainValid e_1 ρ cfg && decide ((LeanCert.Internal.Rational.evalTotalCore e_1 ρ cfg).lo > 0))
• LeanCert.Engine.checkDomainValid e_1.atan ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.arsinh ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.atanh ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.sinc ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.erf ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.sinh ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.cosh ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.tanh ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid e_1.sqrt ρ cfg = LeanCert.Engine.checkDomainValid e_1 ρ cfg
• LeanCert.Engine.checkDomainValid (LeanCert.Core.Expr.namedConst c) ρ cfg = true

def LeanCert.Engine.checkDomainValid1 (e : Core.Expr) (I : Core.IntervalRat) (cfg : EvalConfig := { }) : Bool

Single-variable domain check

Equations

• LeanCert.Engine.checkDomainValid1 e I cfg = LeanCert.Engine.checkDomainValid e (fun (x : ℕ) => I) cfg

theorem LeanCert.Engine.checkDomainValid_correct (e : Core.Expr) (ρ : IntervalEnv) (cfg : EvalConfig) (h : checkDomainValid e ρ cfg = true) : evalDomainValid e ρ cfg

checkDomainValid = true implies evalDomainValid

theorem LeanCert.Engine.checkDomainValid1_correct (e : Core.Expr) (I : Core.IntervalRat) (cfg : EvalConfig) (h : checkDomainValid1 e I cfg = true) : evalDomainValid1 e I cfg

checkDomainValid1 = true implies evalDomainValid1

theorem LeanCert.Engine.evalDomainValid_iff_checkDomainValid (e : Core.Expr) (ρ : IntervalEnv) (cfg : EvalConfig) : evalDomainValid e ρ cfg ↔ checkDomainValid e ρ cfg = true

evalDomainValid is equivalent to checkDomainValid = true

@[instance_reducible]

instance LeanCert.Engine.decidableEvalDomainValid (e : Core.Expr) (ρ : IntervalEnv) (cfg : EvalConfig) : Decidable (evalDomainValid e ρ cfg)

Decidability instance for domain validity

Equations

• LeanCert.Engine.decidableEvalDomainValid e ρ cfg = decidable_of_iff' (LeanCert.Engine.checkDomainValid e ρ cfg = true) ⋯

@[instance_reducible]

instance LeanCert.Engine.decidableEvalDomainValid1 (e : Core.Expr) (I : Core.IntervalRat) (cfg : EvalConfig) : Decidable (evalDomainValid1 e I cfg)

Decidability instance for single-variable domain validity

Equations

• LeanCert.Engine.decidableEvalDomainValid1 e I cfg = LeanCert.Engine.decidableEvalDomainValid e (fun (x : ℕ) => I) cfg

theorem LeanCert.Engine.ADSupported.domainValid {e : Core.Expr} (hsupp : ADSupported e) (ρ : IntervalEnv) (cfg : EvalConfig) : evalDomainValid e ρ cfg

ADSupported expressions (which don't include log) always have valid domains. This is because only log has domain restrictions (positive argument).

theorem LeanCert.Engine.exprSupported_domainValid1 {e : Core.Expr} (hsupp : ADSupported e) (I : Core.IntervalRat) (cfg : EvalConfig) : evalDomainValid1 e I cfg

Single-variable version of domainValid for ADSupported

theorem LeanCert.Engine.evalIntervalCore_correct (e : Core.Expr) (hsupp : ExprSupportedCore e) (ρ_real : ℕ → ℝ) (ρ_int : IntervalEnv) (hρ : envMem ρ_real ρ_int) (cfg : EvalConfig := { }) (hdom : evalDomainValid e ρ_int cfg) : Core.Expr.eval ρ_real e ∈ Internal.Rational.evalTotalCore e ρ_int cfg

Fundamental correctness theorem for core evaluation.

This theorem is FULLY PROVED for core expressions (no sorry, no axioms). The hsupp hypothesis ensures we only consider expressions in the computable verified subset. The hdom hypothesis ensures domain validity (e.g., log arguments are positive). Works for any Taylor depth.

Convenience functions

def LeanCert.Internal.Rational.evalTotalCore1 (e : Core.Expr) (I : Core.IntervalRat) (cfg : Engine.EvalConfig := { }) : Core.IntervalRat

Computable single-variable evaluation for core expressions

Equations

• LeanCert.Internal.Rational.evalTotalCore1 e I cfg = LeanCert.Internal.Rational.evalTotalCore e (fun (x : ℕ) => I) cfg

theorem LeanCert.Engine.evalIntervalCore1_correct (e : Core.Expr) (hsupp : ExprSupportedCore e) (x : ℝ) (I : Core.IntervalRat) (hx : x ∈ I) (cfg : EvalConfig := { }) (hdom : evalDomainValid1 e I cfg) : Core.Expr.eval (fun (x_1 : ℕ) => x) e ∈ Internal.Rational.evalTotalCore1 e I cfg

Correctness for single-variable core evaluation

Smart constructors for supported expressions

def LeanCert.Engine.mkConst (q : ℚ) : { e : Core.Expr // ADSupported e }

Build a constant expression (always supported)

Equations

• LeanCert.Engine.mkConst q = ⟨LeanCert.Core.Expr.const q, ⋯⟩

def LeanCert.Engine.mkVar (idx : ℕ) : { e : Core.Expr // ADSupported e }

Build a variable expression (always supported)

Equations

• LeanCert.Engine.mkVar idx = ⟨LeanCert.Core.Expr.var idx, ⋯⟩

def LeanCert.Engine.mkAdd (e₁ e₂ : { e : Core.Expr // ADSupported e }) : { e : Core.Expr // ADSupported e }

Build an addition (supported if both operands are supported)

Equations

• LeanCert.Engine.mkAdd e₁ e₂ = ⟨(↑e₁).add ↑e₂, ⋯⟩

def LeanCert.Engine.mkMul (e₁ e₂ : { e : Core.Expr // ADSupported e }) : { e : Core.Expr // ADSupported e }

Build a multiplication (supported if both operands are supported)

Equations

• LeanCert.Engine.mkMul e₁ e₂ = ⟨(↑e₁).mul ↑e₂, ⋯⟩

def LeanCert.Engine.mkNeg (e : { e : Core.Expr // ADSupported e }) : { e : Core.Expr // ADSupported e }

Build a negation (supported if operand is supported)

Equations

• LeanCert.Engine.mkNeg e = ⟨(↑e).neg, ⋯⟩

def LeanCert.Engine.mkSin (e : { e : Core.Expr // ADSupported e }) : { e : Core.Expr // ADSupported e }

Build a sin (supported if operand is supported)

Equations

• LeanCert.Engine.mkSin e = ⟨(↑e).sin, ⋯⟩

def LeanCert.Engine.mkCos (e : { e : Core.Expr // ADSupported e }) : { e : Core.Expr // ADSupported e }

Build a cos (supported if operand is supported)

Equations

• LeanCert.Engine.mkCos e = ⟨(↑e).cos, ⋯⟩

def LeanCert.Engine.mkExp (e : { e : Core.Expr // ADSupported e }) : { e : Core.Expr // ADSupported e }

Build an exp (supported if operand is supported)

Equations

• LeanCert.Engine.mkExp e = ⟨(↑e).exp, ⋯⟩

Checked evaluation results

Certified evaluators return a finite enclosure only after all partial-domain conditions have been checked. Failures are data: callers must propagate them instead of substituting a finite sentinel that could be mistaken for an enclosure.

inductive LeanCert.Engine.EvalError : Type

Why a checked evaluator could not produce a finite certified enclosure.

• reciprocalContainsZero (interval : Core.IntervalRat) : EvalError
• logNonpositive (interval : Core.IntervalRat) : EvalError
• atanhOutsideUnitBall (interval : Core.IntervalRat) : EvalError
• unsupportedBackend (operation : String) : EvalError
• unsupportedFeature (feature : String) : EvalError
• invalidConfiguration (message : String) : EvalError
• nestedFailure (operation : String) (cause : EvalError) : EvalError

@[instance_reducible]

instance LeanCert.Engine.instReprEvalError : Repr EvalError

Equations

• LeanCert.Engine.instReprEvalError = { reprPrec := LeanCert.Engine.instReprEvalError.repr }

def LeanCert.Engine.instReprEvalError.repr : EvalError → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Engine.instDecidableEqEvalError : DecidableEq EvalError

Equations

• LeanCert.Engine.instDecidableEqEvalError = LeanCert.Engine.instDecidableEqEvalError.decEq

def LeanCert.Engine.instDecidableEqEvalError.decEq (x✝ x✝¹ : EvalError) : Decidable (x✝ = x✝¹)

Equations

• One or more equations did not get rendered due to their size.
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.reciprocalContainsZero interval) (LeanCert.Engine.EvalError.logNonpositive interval_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.reciprocalContainsZero interval) (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.reciprocalContainsZero interval) (LeanCert.Engine.EvalError.unsupportedBackend operation) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.reciprocalContainsZero interval) (LeanCert.Engine.EvalError.unsupportedFeature feature) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.reciprocalContainsZero interval) (LeanCert.Engine.EvalError.invalidConfiguration message) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.reciprocalContainsZero interval) (LeanCert.Engine.EvalError.nestedFailure operation cause) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive interval) (LeanCert.Engine.EvalError.reciprocalContainsZero interval_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive a) (LeanCert.Engine.EvalError.logNonpositive b) = if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive interval) (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive interval) (LeanCert.Engine.EvalError.unsupportedBackend operation) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive interval) (LeanCert.Engine.EvalError.unsupportedFeature feature) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive interval) (LeanCert.Engine.EvalError.invalidConfiguration message) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.logNonpositive interval) (LeanCert.Engine.EvalError.nestedFailure operation cause) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) (LeanCert.Engine.EvalError.reciprocalContainsZero interval_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) (LeanCert.Engine.EvalError.logNonpositive interval_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) (LeanCert.Engine.EvalError.unsupportedBackend operation) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) (LeanCert.Engine.EvalError.unsupportedFeature feature) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) (LeanCert.Engine.EvalError.invalidConfiguration message) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) (LeanCert.Engine.EvalError.nestedFailure operation cause) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend operation) (LeanCert.Engine.EvalError.reciprocalContainsZero interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend operation) (LeanCert.Engine.EvalError.logNonpositive interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend operation) (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend a) (LeanCert.Engine.EvalError.unsupportedBackend b) = if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend operation) (LeanCert.Engine.EvalError.unsupportedFeature feature) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend operation) (LeanCert.Engine.EvalError.invalidConfiguration message) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedBackend operation) (LeanCert.Engine.EvalError.nestedFailure operation_1 cause) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature feature) (LeanCert.Engine.EvalError.reciprocalContainsZero interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature feature) (LeanCert.Engine.EvalError.logNonpositive interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature feature) (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature feature) (LeanCert.Engine.EvalError.unsupportedBackend operation) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature a) (LeanCert.Engine.EvalError.unsupportedFeature b) = if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature feature) (LeanCert.Engine.EvalError.invalidConfiguration message) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.unsupportedFeature feature) (LeanCert.Engine.EvalError.nestedFailure operation cause) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.invalidConfiguration message) (LeanCert.Engine.EvalError.reciprocalContainsZero interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.invalidConfiguration message) (LeanCert.Engine.EvalError.logNonpositive interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.invalidConfiguration message) (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.invalidConfiguration message) (LeanCert.Engine.EvalError.unsupportedBackend operation) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.invalidConfiguration message) (LeanCert.Engine.EvalError.unsupportedFeature feature) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.invalidConfiguration message) (LeanCert.Engine.EvalError.nestedFailure operation cause) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.nestedFailure operation cause) (LeanCert.Engine.EvalError.reciprocalContainsZero interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.nestedFailure operation cause) (LeanCert.Engine.EvalError.logNonpositive interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.nestedFailure operation cause) (LeanCert.Engine.EvalError.atanhOutsideUnitBall interval) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.nestedFailure operation cause) (LeanCert.Engine.EvalError.unsupportedBackend operation_1) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.nestedFailure operation cause) (LeanCert.Engine.EvalError.unsupportedFeature feature) = isFalse ⋯
• LeanCert.Engine.instDecidableEqEvalError.decEq (LeanCert.Engine.EvalError.nestedFailure operation cause) (LeanCert.Engine.EvalError.invalidConfiguration message) = isFalse ⋯

@[reducible, inline]

abbrev LeanCert.Engine.EvalResult (α : Type) : Type

Result type used by checked evaluators and public computation APIs.

Equations

• LeanCert.Engine.EvalResult α = Except LeanCert.Engine.EvalError α

Extended (Noncomputable) Interval Evaluation

This file implements the noncomputable interval evaluator for LeanCert.Core.Expr, supporting exp with floor/ceil bounds and partial evaluation for inv/log.

Main definitions

• evalInterval - Noncomputable interval evaluator supporting exp
• evalInterval_correct - Correctness theorem for extended evaluation
• evalIntervalOption - Partial (Option-returning) evaluator with inv/log support
• evalIntervalOption_correct - Correctness theorem for partial evaluation

Design notes

The extended evaluator uses Real.exp with floor/ceil bounds, which requires noncomputability. For computability, use LeanCert.Internal.Rational.evalTotalCore instead.

The partial evaluator evalIntervalOption returns none when:

• The denominator interval for inv contains zero
• The argument interval for log is not strictly positive
• The argument for atanh is not in (-1, 1)

When it returns some I, correctness is guaranteed.

Extended interval evaluation (noncomputable, supports exp)

noncomputable def LeanCert.Internal.Rational.evalUnchecked (e : Core.Expr) (ρ : Engine.IntervalEnv) : Core.IntervalRat

Noncomputable interval evaluator supporting exp.

For supported expressions (const, var, add, mul, neg, sin, cos, exp), this computes correct interval bounds with a fully-verified proof.

For unsupported expressions (inv, log), returns a default interval. Do not rely on results for expressions containing inv or log. Use evalIntervalOption for partial functions like inv and log.

This evaluator is NONCOMPUTABLE due to exp using Real.exp with floor/ceil.

Equations

• LeanCert.Internal.Rational.evalUnchecked (LeanCert.Core.Expr.const q) ρ = LeanCert.Core.IntervalRat.singleton q
• LeanCert.Internal.Rational.evalUnchecked (LeanCert.Core.Expr.var idx) ρ = ρ idx
• LeanCert.Internal.Rational.evalUnchecked (e₁.add e₂) ρ = (LeanCert.Internal.Rational.evalUnchecked e₁ ρ).add (LeanCert.Internal.Rational.evalUnchecked e₂ ρ)
• LeanCert.Internal.Rational.evalUnchecked (e₁.mul e₂) ρ = (LeanCert.Internal.Rational.evalUnchecked e₁ ρ).mul (LeanCert.Internal.Rational.evalUnchecked e₂ ρ)
• LeanCert.Internal.Rational.evalUnchecked e_1.neg ρ = (LeanCert.Internal.Rational.evalUnchecked e_1 ρ).neg
• LeanCert.Internal.Rational.evalUnchecked e_1.inv ρ = default
• LeanCert.Internal.Rational.evalUnchecked e_1.exp ρ = (LeanCert.Internal.Rational.evalUnchecked e_1 ρ).expInterval
• LeanCert.Internal.Rational.evalUnchecked e_1.sin ρ = LeanCert.Engine.sinInterval (LeanCert.Internal.Rational.evalUnchecked e_1 ρ)
• LeanCert.Internal.Rational.evalUnchecked e_1.cos ρ = LeanCert.Engine.cosInterval (LeanCert.Internal.Rational.evalUnchecked e_1 ρ)
• LeanCert.Internal.Rational.evalUnchecked e_1.log ρ = default
• LeanCert.Internal.Rational.evalUnchecked e_1.atan ρ = LeanCert.Engine.atanInterval (LeanCert.Internal.Rational.evalUnchecked e_1 ρ)
• LeanCert.Internal.Rational.evalUnchecked e_1.arsinh ρ = LeanCert.Engine.arsinhInterval (LeanCert.Internal.Rational.evalUnchecked e_1 ρ)
• LeanCert.Internal.Rational.evalUnchecked e_1.atanh ρ = default
• LeanCert.Internal.Rational.evalUnchecked e_1.sinc ρ = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }
• LeanCert.Internal.Rational.evalUnchecked e_1.erf ρ = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }
• LeanCert.Internal.Rational.evalUnchecked e_1.sinh ρ = default
• LeanCert.Internal.Rational.evalUnchecked e_1.cosh ρ = default
• LeanCert.Internal.Rational.evalUnchecked e_1.tanh ρ = default
• LeanCert.Internal.Rational.evalUnchecked e_1.sqrt ρ = (LeanCert.Internal.Rational.evalUnchecked e_1 ρ).sqrtInterval
• LeanCert.Internal.Rational.evalUnchecked (LeanCert.Core.Expr.namedConst c) ρ = c.interval

theorem LeanCert.Engine.evalInterval_correct (e : Core.Expr) (hsupp : ADSupported e) (ρ_real : ℕ → ℝ) (ρ_int : IntervalEnv) (hρ : envMem ρ_real ρ_int) : Core.Expr.eval ρ_real e ∈ Internal.Rational.evalUnchecked e ρ_int

Fundamental correctness theorem for extended evaluation.

This theorem is FULLY PROVED (no sorry, no axioms) for supported expressions. The hsupp hypothesis ensures we only consider expressions in the verified subset.

Convenience functions

Note: LeanCert.Internal.Rational.evalTotalCore now uses Taylor series for exp/sin/cos, which gives different (often tighter) intervals than evalInterval's floor/ceil bounds. Both are correct, but they are not necessarily equal.

For purely algebraic expressions (const, var, add, mul, neg), both evaluators give identical results.

noncomputable def LeanCert.Internal.Rational.evalUnchecked1 (e : Core.Expr) (I : Core.IntervalRat) : Core.IntervalRat

Internal single-variable wrapper around evalUnchecked.

Equations

• LeanCert.Internal.Rational.evalUnchecked1 e I = LeanCert.Internal.Rational.evalUnchecked e fun (x : ℕ) => I

theorem LeanCert.Engine.evalInterval1_correct (e : Core.Expr) (hsupp : ADSupported e) (x : ℝ) (I : Core.IntervalRat) (hx : x ∈ I) : Core.Expr.eval (fun (x_1 : ℕ) => x) e ∈ Internal.Rational.evalUnchecked1 e I

Correctness for single-variable extended evaluation

Partial interval evaluation with inv support

def LeanCert.Engine.evalIntervalLogDepth : ℕ

Partial (Option-returning) interval evaluator supporting inv.

For expressions with inv, this evaluator returns none if the denominator interval contains zero, and some I with a correct enclosure otherwise.

This allows safe interval evaluation of expressions like 1/x when we can verify the denominator is bounded away from zero.

For expressions without inv, this always returns some with the same result as evalInterval.

Equations

• LeanCert.Engine.evalIntervalLogDepth = 60

def LeanCert.Engine.evalIntervalExpDepth : ℕ

The Taylor truncation depth used by the checked exponential evaluator.

Equations

• LeanCert.Engine.evalIntervalExpDepth = 30

def LeanCert.Engine.evalIntervalAtanhDepth : ℕ

Taylor depth used by the strict atanh evaluator.

Equations

• LeanCert.Engine.evalIntervalAtanhDepth = 30

def LeanCert.Engine.evalIntervalOption (e : Core.Expr) (ρ : IntervalEnv) : Option Core.IntervalRat

Evaluate an expression by rational intervals, failing when a domain check fails.

Equations

• One or more equations did not get rendered due to their size.
• LeanCert.Engine.evalIntervalOption (LeanCert.Core.Expr.const q) ρ = some (LeanCert.Core.IntervalRat.singleton q)
• LeanCert.Engine.evalIntervalOption (LeanCert.Core.Expr.var idx) ρ = some (ρ idx)
• LeanCert.Engine.evalIntervalOption e_1.neg ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some I.neg | none => none
• LeanCert.Engine.evalIntervalOption e_1.exp ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (I.expComputable LeanCert.Engine.evalIntervalExpDepth) | none => none
• LeanCert.Engine.evalIntervalOption e_1.sin ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.sinInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.cos ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.cosInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.atan ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.atanInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.arsinh ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.arsinhInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.sinh ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.sinhInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.cosh ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.coshInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.tanh ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some (LeanCert.Engine.tanhInterval I) | none => none
• LeanCert.Engine.evalIntervalOption e_1.sqrt ρ = match LeanCert.Engine.evalIntervalOption e_1 ρ with | some I => some I.sqrtInterval | none => none
• LeanCert.Engine.evalIntervalOption (LeanCert.Core.Expr.namedConst c) ρ = some c.interval

theorem LeanCert.Engine.evalIntervalOption_correct (e : Core.Expr) (ρ_int : IntervalEnv) (I : Core.IntervalRat) (hsome : evalIntervalOption e ρ_int = some I) (ρ_real : ℕ → ℝ) (hρ : envMem ρ_real ρ_int) : Core.Expr.eval ρ_real e ∈ I

Main correctness theorem for evalIntervalOption (approach 1 from plan).

When evalIntervalOption returns some I:

1. The expression evaluates to a value in I for all ρ_real ∈ ρ_int
2. All inv denominators along the evaluation are guaranteed nonzero (because their intervals don't contain zero)

This follows your suggestion to keep ADSupported syntactic and add separate semantic hypotheses. The key insight is that if evalIntervalOption succeeds (returns Some), the interval arithmetic has already verified that no denominator interval contains zero.

Checked API with diagnostics

@[irreducible]

def LeanCert.Engine.diagnoseEvalIntervalFailure (e : Core.Expr) (ρ : IntervalEnv) : EvalError

Diagnose the first partial-domain failure after evalIntervalOption returned none. This function is deliberately separate from the trusted computation: soundness depends only on successful evalIntervalOption, while diagnostics may be refined without changing the correctness theorem.

Equations

• One or more equations did not get rendered due to their size.
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.neg ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.exp ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.sin ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.cos ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.atan ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.arsinh ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.sinc ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.erf ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.sinh ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.cosh ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.tanh ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure e_2.sqrt ρ = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseEvalIntervalFailure e_2 ρ)
• LeanCert.Engine.diagnoseEvalIntervalFailure (LeanCert.Core.Expr.const q) ρ = LeanCert.Engine.EvalError.unsupportedBackend "internal: total expression unexpectedly failed"
• LeanCert.Engine.diagnoseEvalIntervalFailure (LeanCert.Core.Expr.var idx) ρ = LeanCert.Engine.EvalError.unsupportedBackend "internal: total expression unexpectedly failed"
• LeanCert.Engine.diagnoseEvalIntervalFailure (LeanCert.Core.Expr.namedConst c) ρ = LeanCert.Engine.EvalError.unsupportedBackend "internal: total expression unexpectedly failed"

def LeanCert.Engine.evalIntervalChecked (e : Core.Expr) (ρ : IntervalEnv) : EvalResult Core.IntervalRat

Checked rational evaluator. Every successful result is a certified finite enclosure; domain-invalid expressions return a structured error.

Equations

• LeanCert.Engine.evalIntervalChecked e ρ = match LeanCert.Engine.evalIntervalOption e ρ with | some I => Except.ok I | none => Except.error (LeanCert.Engine.diagnoseEvalIntervalFailure e ρ)

theorem LeanCert.Engine.evalIntervalChecked_correct (e : Core.Expr) (ρ_int : IntervalEnv) (I : Core.IntervalRat) (hsuccess : evalIntervalChecked e ρ_int = Except.ok I) (ρ_real : ℕ → ℝ) (hρ : envMem ρ_real ρ_int) : Core.Expr.eval ρ_real e ∈ I

Success of evalIntervalChecked is sufficient for enclosure correctness for every expression constructor.

def LeanCert.Engine.evalIntervalTightChecked (e : Core.Expr) (ρ : IntervalEnv) (cfg : EvalConfig := { }) : EvalResult Core.IntervalRat

Checked Rational evaluation with a tight path for the verified computable core. Unsupported syntax or a failed core-domain check falls back to the general checked evaluator, preserving its structured domain errors.

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Engine.evalIntervalTightChecked_correct (e : Core.Expr) (ρ_int : IntervalEnv) (cfg : EvalConfig) (I : Core.IntervalRat) (hsuccess : evalIntervalTightChecked e ρ_int cfg = Except.ok I) (ρ_real : ℕ → ℝ) (hρ : envMem ρ_real ρ_int) : Core.Expr.eval ρ_real e ∈ I

Every successful tight checked Rational evaluation encloses the expression value. The core branch uses the core correctness theorem; the fallback uses the general checked evaluator theorem.

def LeanCert.Engine.evalIntervalOption1 (e : Core.Expr) (I : Core.IntervalRat) : Option Core.IntervalRat

Single-variable version of evalIntervalOption

Equations

• LeanCert.Engine.evalIntervalOption1 e I = LeanCert.Engine.evalIntervalOption e fun (x : ℕ) => I

theorem LeanCert.Engine.evalIntervalOption1_correct (e : Core.Expr) (I J : Core.IntervalRat) (hsome : evalIntervalOption1 e I = some J) (x : ℝ) (hx : x ∈ I) : Core.Expr.eval (fun (x_1 : ℕ) => x) e ∈ J

Correctness for single-variable partial evaluation

theorem LeanCert.Engine.evalIntervalOption_le_of_hi (e : Core.Expr) (I J : Core.IntervalRat) (c : ℚ) (hsome : evalIntervalOption1 e I = some J) (hhi : J.hi ≤ c) (x : ℝ) : x ∈ I → Core.Expr.eval (fun (x_1 : ℕ) => x) e ≤ ↑c

When evalIntervalOption succeeds, we get bounds

theorem LeanCert.Engine.evalIntervalOption_ge_of_lo (e : Core.Expr) (I J : Core.IntervalRat) (c : ℚ) (hsome : evalIntervalOption1 e I = some J) (hlo : c ≤ J.lo) (x : ℝ) : x ∈ I → ↑c ≤ Core.Expr.eval (fun (x_1 : ℕ) => x) e

When evalIntervalOption succeeds, we get lower bounds

Semantic Lemmas for Interval Bounds

This file provides semantic lemmas for deriving real bounds from certified interval enclosures. Tactics consume these lemmas, but the definitions belong to the engine layer so checked programmatic APIs do not depend on tactic modules.

Main theorems

Core (computable) lemmas

• exprCore_le_of_interval_hi - Upper bound from interval high endpoint
• exprCore_ge_of_interval_lo - Lower bound from interval low endpoint
• exprCore_lt_of_interval_hi_lt - Strict upper bound
• exprCore_gt_of_interval_lo_gt - Strict lower bound

Extended (noncomputable) lemmas

• expr_le_of_interval_hi - Upper bound from interval high endpoint
• expr_ge_of_interval_lo - Lower bound from interval low endpoint
• expr_lt_of_interval_hi_lt - Strict upper bound
• expr_gt_of_interval_lo_gt - Strict lower bound
• expr_le_of_mem_interval - Single-point variant
• expr_ge_of_mem_interval - Single-point variant

Usage

These lemmas are intended to be used by tactics like certify_bound and interval_decide to close goals of the form ∀ x ∈ I, f(x) ≤ c or similar.

The core lemmas use the computable evaluator and can work with native_decide. The extended lemmas use the noncomputable evaluator with floor/ceil bounds.

Tactic-facing lemmas for interval bounds (core, computable)

theorem LeanCert.Engine.exprCore_le_of_interval_hi (e : Core.Expr) (hsupp : ExprSupportedCore e) (I : Core.IntervalRat) (c : ℚ) (cfg : EvalConfig := { }) (hdom : evalDomainValid1 e I cfg) (hhi : (Internal.Rational.evalTotalCore1 e I cfg).hi ≤ c) (x : ℝ) : x ∈ I → Core.Expr.eval (fun (x_1 : ℕ) => x) e ≤ ↑c

Upper bound lemma for core expressions (computable). FULLY PROVED - no sorry, no axioms. Accepts configurable Taylor depth. Requires domain validity (e.g., log arguments must be positive).

theorem LeanCert.Engine.exprCore_ge_of_interval_lo (e : Core.Expr) (hsupp : ExprSupportedCore e) (I : Core.IntervalRat) (c : ℚ) (cfg : EvalConfig := { }) (hdom : evalDomainValid1 e I cfg) (hlo : c ≤ (Internal.Rational.evalTotalCore1 e I cfg).lo) (x : ℝ) : x ∈ I → ↑c ≤ Core.Expr.eval (fun (x_1 : ℕ) => x) e

Lower bound lemma for core expressions (computable). FULLY PROVED - no sorry, no axioms. Accepts configurable Taylor depth. Requires domain validity (e.g., log arguments must be positive).

theorem LeanCert.Engine.exprCore_lt_of_interval_hi_lt (e : Core.Expr) (hsupp : ExprSupportedCore e) (I : Core.IntervalRat) (c : ℚ) (cfg : EvalConfig := { }) (hdom : evalDomainValid1 e I cfg) (hhi : (Internal.Rational.evalTotalCore1 e I cfg).hi < c) (x : ℝ) : x ∈ I → Core.Expr.eval (fun (x_1 : ℕ) => x) e < ↑c

Strict upper bound for core expressions (computable). FULLY PROVED - no sorry, no axioms. Accepts configurable Taylor depth. Requires domain validity (e.g., log arguments must be positive).

theorem LeanCert.Engine.exprCore_gt_of_interval_lo_gt (e : Core.Expr) (hsupp : ExprSupportedCore e) (I : Core.IntervalRat) (c : ℚ) (cfg : EvalConfig := { }) (hdom : evalDomainValid1 e I cfg) (hlo : c < (Internal.Rational.evalTotalCore1 e I cfg).lo) (x : ℝ) : x ∈ I → ↑c < Core.Expr.eval (fun (x_1 : ℕ) => x) e

Strict lower bound for core expressions (computable). FULLY PROVED - no sorry, no axioms. Accepts configurable Taylor depth. Requires domain validity (e.g., log arguments must be positive).

Tactic-facing lemmas for interval bounds (extended, noncomputable)

theorem LeanCert.Engine.expr_le_of_interval_hi (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (c : ℚ) (hhi : (Internal.Rational.evalUnchecked1 e I).hi ≤ c) (x : ℝ) : x ∈ I → Core.Expr.eval (fun (x_1 : ℕ) => x) e ≤ ↑c

Upper bound lemma for extended expressions. FULLY PROVED - no sorry, no axioms.

theorem LeanCert.Engine.expr_ge_of_interval_lo (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (c : ℚ) (hlo : c ≤ (Internal.Rational.evalUnchecked1 e I).lo) (x : ℝ) : x ∈ I → ↑c ≤ Core.Expr.eval (fun (x_1 : ℕ) => x) e

Lower bound lemma for extended expressions. FULLY PROVED - no sorry, no axioms.

theorem LeanCert.Engine.expr_lt_of_interval_hi_lt (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (c : ℚ) (hhi : (Internal.Rational.evalUnchecked1 e I).hi < c) (x : ℝ) : x ∈ I → Core.Expr.eval (fun (x_1 : ℕ) => x) e < ↑c

Strict upper bound for extended expressions. FULLY PROVED - no sorry, no axioms.

theorem LeanCert.Engine.expr_gt_of_interval_lo_gt (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (c : ℚ) (hlo : c < (Internal.Rational.evalUnchecked1 e I).lo) (x : ℝ) : x ∈ I → ↑c < Core.Expr.eval (fun (x_1 : ℕ) => x) e

Strict lower bound for extended expressions. FULLY PROVED - no sorry, no axioms.

theorem LeanCert.Engine.expr_le_of_mem_interval (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (c : ℚ) (x : ℝ) (hx : x ∈ I) (hhi : (Internal.Rational.evalUnchecked1 e I).hi ≤ c) : Core.Expr.eval (fun (x_1 : ℕ) => x) e ≤ ↑c

Variant for single point (extended).

theorem LeanCert.Engine.expr_ge_of_mem_interval (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (c : ℚ) (x : ℝ) (hx : x ∈ I) (hlo : c ≤ (Internal.Rational.evalUnchecked1 e I).lo) : ↑c ≤ Core.Expr.eval (fun (x_1 : ℕ) => x) e

Variant for single point (extended).

Interval Evaluation of Expressions

This file re-exports the interval evaluation infrastructure for LeanCert.Core.Expr.

Module structure

The implementation is split across several files:

• LeanCert.Core.Support - Expression support predicates for total core evaluation and automatic differentiation

• LeanCert.Engine.Eval.Core - Computable interval evaluator (LeanCert.Internal.Rational.evalTotalCore) and transcendental interval bounds

• LeanCert.Engine.Eval.Extended - Internal noncomputable evaluator and the partial evaluator with inv/log support (evalIntervalOption)

• LeanCert.Engine.Bounds.Lemmas - Semantic lemmas for deriving real bounds

Main definitions (re-exported)

Expression support predicates

• ExprSupportedCore - Computable subset (const, var, add, mul, neg, sin, cos, exp, sqrt, sinh, cosh, tanh, pi)
• ADSupported - Noncomputable AD subset (const, var, add, mul, neg, sin, cos, exp)

Evaluators

• LeanCert.Internal.Rational.evalTotalCore - Computable interval evaluator (uses Taylor series)
• LeanCert.Internal.Rational.evalUnchecked - Internal noncomputable evaluator
• evalIntervalOption - Partial evaluator with inv/log support

Correctness theorems

• evalIntervalCore_correct - Core evaluator correctness
• evalInterval_correct - Extended evaluator correctness
• evalIntervalOption_correct - Partial evaluator correctness

Tactic lemmas

• exprCore_le_of_interval_hi / exprCore_ge_of_interval_lo - Core bounds
• expr_le_of_interval_hi / expr_ge_of_interval_lo - Extended bounds

Design notes

The evaluators are split by computability:

• LeanCert.Internal.Rational.evalTotalCore is COMPUTABLE, enabling native_decide in tactics
• evalInterval is NONCOMPUTABLE, using Real.exp with floor/ceil bounds
• Both are fully verified (no sorry, no axioms)

Automatic Differentiation - Basic Definitions

This file provides the core types and algebraic operations for forward-mode automatic differentiation using interval arithmetic.

Main definitions

• DualInterval - A pair of intervals representing (value, derivative)
• DualInterval.const - Constant dual (derivative is zero)
• DualInterval.varActive - Active variable (derivative is 1)
• DualInterval.varPassive - Passive variable (derivative is 0)
• DualInterval.add - Addition with sum rule
• DualInterval.mul - Multiplication with product rule
• DualInterval.neg - Negation

structure LeanCert.Engine.DualInterval : Type

Dual number with interval components: represents (value, derivative)

• val : Core.IntervalRat

  The interval enclosing the function value.

• der : Core.IntervalRat

  The interval enclosing the derivative.

def LeanCert.Engine.instReprDualInterval.repr : DualInterval → ℕ → Std.Format

Equations

• One or more equations did not get rendered due to their size.

@[instance_reducible]

instance LeanCert.Engine.instReprDualInterval : Repr DualInterval

Equations

• LeanCert.Engine.instReprDualInterval = { reprPrec := LeanCert.Engine.instReprDualInterval.repr }

@[instance_reducible]

instance LeanCert.Engine.instInhabitedDualInterval : Inhabited DualInterval

Default DualInterval for unsupported expression branches

Equations

• LeanCert.Engine.instInhabitedDualInterval = { default := { val := default, der := default } }

def LeanCert.Engine.DualInterval.const (q : ℚ) : DualInterval

Dual interval for a constant (derivative is zero)

Equations

• LeanCert.Engine.DualInterval.const q = { val := LeanCert.Core.IntervalRat.singleton q, der := LeanCert.Core.IntervalRat.singleton 0 }

def LeanCert.Engine.DualInterval.piConst : DualInterval

Dual interval for the constant π (derivative is zero)

Equations

• LeanCert.Engine.DualInterval.piConst = { val := LeanCert.Engine.piInterval, der := LeanCert.Core.IntervalRat.singleton 0 }

def LeanCert.Engine.DualInterval.eulerMascheroniConst : DualInterval

Dual interval for the Euler–Mascheroni constant γ (derivative is zero)

Equations

• LeanCert.Engine.DualInterval.eulerMascheroniConst = { val := LeanCert.Engine.eulerMascheroniInterval, der := LeanCert.Core.IntervalRat.singleton 0 }

def LeanCert.Engine.DualInterval.ofMathConst (c : Core.MathConst) : DualInterval

Dual interval for a named mathematical constant (derivative is zero)

Equations

• LeanCert.Engine.DualInterval.ofMathConst c = { val := c.interval, der := LeanCert.Core.IntervalRat.singleton 0 }

def LeanCert.Engine.DualInterval.varActive (I : Core.IntervalRat) : DualInterval

Dual interval for the variable we're differentiating with respect to

Equations

• LeanCert.Engine.DualInterval.varActive I = { val := I, der := LeanCert.Core.IntervalRat.singleton 1 }

def LeanCert.Engine.DualInterval.varPassive (I : Core.IntervalRat) : DualInterval

Dual interval for a passive variable

Equations

• LeanCert.Engine.DualInterval.varPassive I = { val := I, der := LeanCert.Core.IntervalRat.singleton 0 }

def LeanCert.Engine.DualInterval.add (d₁ d₂ : DualInterval) : DualInterval

Add two dual intervals

Equations

• d₁.add d₂ = { val := d₁.val.add d₂.val, der := d₁.der.add d₂.der }

def LeanCert.Engine.DualInterval.mul (d₁ d₂ : DualInterval) : DualInterval

Multiply two dual intervals (product rule)

Equations

• d₁.mul d₂ = { val := d₁.val.mul d₂.val, der := (d₁.der.mul d₂.val).add (d₁.val.mul d₂.der) }

def LeanCert.Engine.DualInterval.neg (d : DualInterval) : DualInterval

Negate a dual interval

Equations

• d.neg = { val := d.val.neg, der := d.der.neg }

def LeanCert.Engine.DualInterval.inv (d : DualInterval) : DualInterval

Inverse of a dual interval (quotient rule: d(1/f) = -f'/f²) Uses invInterval for the value component. For intervals containing zero, returns wide bounds.

Equations

• d.inv = { val := LeanCert.Engine.invInterval d.val, der := (d.der.mul ((LeanCert.Engine.invInterval d.val).mul (LeanCert.Engine.invInterval d.val))).neg }

Automatic Differentiation - Transcendental Functions

This file provides dual interval implementations for transcendental functions, implementing the chain rule for each.

Main definitions

Total functions (always succeed)

• DualInterval.sin - Sine with chain rule
• DualInterval.cos - Cosine with chain rule
• DualInterval.exp - Exponential with chain rule
• DualInterval.atan - Arctangent with chain rule
• DualInterval.arsinh - Inverse hyperbolic sine
• DualInterval.sinh, cosh, tanh - Hyperbolic functions
• DualInterval.erf - Error function
• DualInterval.sqrt - Square root (conservative derivative bound)
• DualInterval.sinc - sinc function

Partial functions (return Option)

• DualInterval.atanhOption - Inverse hyperbolic tangent (requires |x| < 1)
• DualInterval.inv? - Inverse (requires nonzero)
• DualInterval.logOption - Logarithm (requires positive)
• DualInterval.sqrt? - Square root with tight bounds (requires positive)

def LeanCert.Engine.DualInterval.sin (d : DualInterval) : DualInterval

Dual for sin (chain rule: d(sin f) = cos(f) * f')

Equations

• d.sin = { val := LeanCert.Engine.sinInterval d.val, der := (LeanCert.Engine.cosInterval d.val).mul d.der }

def LeanCert.Engine.DualInterval.cos (d : DualInterval) : DualInterval

Dual for cos (chain rule: d(cos f) = -sin(f) * f')

Equations

• d.cos = { val := LeanCert.Engine.cosInterval d.val, der := (LeanCert.Engine.sinInterval d.val).neg.mul d.der }

noncomputable def LeanCert.Engine.DualInterval.exp (d : DualInterval) : DualInterval

Dual for exp (chain rule: d(exp f) = exp(f) * f')

Equations

• d.exp = { val := d.val.expInterval, der := d.val.expInterval.mul d.der }

def LeanCert.Engine.DualInterval.unitInterval : Core.IntervalRat

The interval [0, 1] used to bound derivative factors in (0, 1]

Equations

• LeanCert.Engine.DualInterval.unitInterval = { lo := 0, hi := 1, le := LeanCert.Engine.DualInterval.unitInterval._proof_1 }

theorem LeanCert.Engine.DualInterval.arctan_deriv_factor_mem_unitInterval (y : ℝ) : 1 / (1 + y ^ 2) ∈ unitInterval

The derivative factor for arctan: 1/(1+x²) is in [0, 1]

theorem LeanCert.Engine.DualInterval.arsinh_deriv_factor_mem_unitInterval (y : ℝ) : (√(1 + y ^ 2))⁻¹ ∈ unitInterval

The derivative factor for arsinh: 1/√(1+x²) is in [0, 1]

def LeanCert.Engine.DualInterval.atan (d : DualInterval) : DualInterval

Dual for atan (chain rule: d(atan f) = f' / (1 + f²))

Equations

• d.atan = { val := LeanCert.Engine.atanInterval d.val, der := d.der.mul LeanCert.Engine.DualInterval.unitInterval }

def LeanCert.Engine.DualInterval.arsinh (d : DualInterval) : DualInterval

Dual for arsinh (chain rule: d(arsinh f) = f' / √(1 + f²))

Equations

• d.arsinh = { val := LeanCert.Engine.arsinhInterval d.val, der := d.der.mul LeanCert.Engine.DualInterval.unitInterval }

def LeanCert.Engine.DualInterval.sinh (d : DualInterval) : DualInterval

Dual for sinh (chain rule: d(sinh f) = cosh(f) * f')

Equations

• d.sinh = { val := LeanCert.Engine.sinhInterval d.val, der := (LeanCert.Engine.coshInterval d.val).mul d.der }

def LeanCert.Engine.DualInterval.cosh (d : DualInterval) : DualInterval

Dual for cosh (chain rule: d(cosh f) = sinh(f) * f')

Equations

• d.cosh = { val := LeanCert.Engine.coshInterval d.val, der := (LeanCert.Engine.sinhInterval d.val).mul d.der }

def LeanCert.Engine.DualInterval.tanh (d : DualInterval) : DualInterval

Dual for tanh (chain rule: d(tanh f) = sech²(f) * f' = (1 - tanh²(f)) * f') Since sech²(x) = 1 - tanh²(x) ∈ (0, 1] for all x, we use [0, 1] as bound.

Equations

• d.tanh = { val := LeanCert.Engine.tanhInterval d.val, der := d.der.mul LeanCert.Engine.DualInterval.unitInterval }

def LeanCert.Engine.DualInterval.twoDivSqrtPi : Core.IntervalRat

Interval containing 2/√π ≈ 1.128379...

Equations

• LeanCert.Engine.DualInterval.twoDivSqrtPi = { lo := 1128 / 1000, hi := 1129 / 1000, le := LeanCert.Core.IntervalRat.twoDivSqrtPi._proof_1 }

noncomputable def LeanCert.Engine.DualInterval.erf (d : DualInterval) : DualInterval

Dual for erf (chain rule: d(erf f) = (2/√π) * exp(-f²) * f') erf'(x) = (2/√π) * exp(-x²), which is always positive and bounded by 2/√π ≈ 1.13

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Engine.DualInterval.erfCore (d : DualInterval) (n : ℕ := 10) : DualInterval

Computable dual for erf using expComputable

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Engine.DualInterval.sqrt (d : DualInterval) : DualInterval

Dual for sqrt (chain rule: d(sqrt f) = f' / (2 * sqrt(f))) sqrt'(x) = 1/(2*sqrt(x)) for x > 0, undefined at x = 0. We use sqrtInterval for the value and a conservative bound for the derivative. Note: The derivative blows up as x → 0+, so this uses a wide conservative bound.

Equations

• d.sqrt = { val := d.val.sqrtInterval, der := d.der.mul { lo := -100, hi := 100, le := LeanCert.Engine.DualInterval.sqrt._proof_1 } }

def LeanCert.Engine.DualInterval.sincDerivBound : Core.IntervalRat

Conservative derivative bound [-1, 1] for sinc derivative

Equations

• LeanCert.Engine.DualInterval.sincDerivBound = { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }

def LeanCert.Engine.DualInterval.sinc (d : DualInterval) : DualInterval

Dual for sinc (chain rule: d(sinc f) = sinc'(f) * f') sinc'(x) = (x cos x - sin x) / x² for x ≠ 0, limit 0 at x = 0. We use conservative bound: |sinc'(x)| ≤ 1 for all x.

Equations

• d.sinc = { val := { lo := -1, hi := 1, le := LeanCert.Core.IntervalRat.sinComputable._proof_3 }, der := LeanCert.Engine.DualInterval.sincDerivBound.mul d.der }

Partial functions (domain-restricted)

noncomputable def LeanCert.Engine.DualInterval.atanhOption (d : DualInterval) : Option DualInterval

Partial dual for atanh (chain rule: d(atanh f) = f' / (1 - f²)) Returns None if the value interval is not contained in (-1, 1).

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Engine.DualInterval.inv? (d : DualInterval) : Option DualInterval

Partial dual for inv (chain rule: d(1/f) = -f'/f²) Returns None if the value interval contains zero.

Equations

• One or more equations did not get rendered due to their size.

noncomputable def LeanCert.Engine.DualInterval.logOption (d : DualInterval) : Option DualInterval

Partial dual for log (chain rule: d(log f) = f'/f) Returns None if the value interval is not strictly positive.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Engine.DualInterval.sqrtDerivCoefBound (lo : ℚ) (hpos : 0 < lo) : Core.IntervalRat

Compute a conservative upper bound on 1/(2*sqrt(lo)) for lo > 0. Uses the fact that:

• For 0 < lo ≤ 1: sqrt(lo) ≥ lo, so 1/(2sqrt(lo)) ≤ 1/(2lo)
• For lo > 1: sqrt(lo) > 1, so 1/(2*sqrt(lo)) < 1/2

Equations

• One or more equations did not get rendered due to their size.

theorem LeanCert.Engine.DualInterval.sqrtDerivCoef_bound {x lo : ℝ} (hlo_pos : 0 < lo) (hx_ge : lo ≤ x) : 1 / (2 * √x) ≤ max (1 / (2 * lo)) (1 / 2)

For lo > 0, the derivative coefficient 1/(2*sqrt(x)) is bounded above for x ≥ lo.

noncomputable def LeanCert.Engine.DualInterval.sqrt? (d : DualInterval) : Option DualInterval

Partial dual for sqrt (chain rule: d(sqrt f) = f' / (2 * sqrt(f))) Returns None if the value interval is not strictly positive.

Equations

• One or more equations did not get rendered due to their size.

Automatic Differentiation - Evaluators

This file provides the evaluation functions for automatic differentiation, mapping expressions to dual intervals.

Main definitions

• DualEnv - Environment mapping variable indices to dual intervals
• LeanCert.Internal.AD.evalUnchecked - Main evaluator for supported expressions (total)
• evalDualOption - Partial evaluator supporting domain-checked functions (returns Option)
• evalDualOption1 - Single-variable version of evalDualOption
• mkDualEnv - Create a dual environment for differentiation w.r.t. a variable
• evalWithDeriv - Evaluate and differentiate w.r.t. a variable index
• derivInterval - Get just the derivative interval
• evalWithDeriv1 - Single-variable evaluation and differentiation

Dual evaluation

@[reducible, inline]

abbrev LeanCert.Engine.DualEnv : Type

Environment for dual evaluation

Equations

• LeanCert.Engine.DualEnv = (ℕ → LeanCert.Engine.DualInterval)

noncomputable def LeanCert.Internal.AD.evalUnchecked (e : Core.Expr) (ρ : Engine.DualEnv) : Engine.DualInterval

Evaluate expression in dual interval mode.

For supported expressions (const, var, add, mul, neg, sin, cos, exp), this computes correct dual interval bounds with a fully-verified proof.

For unsupported expressions (inv, log), returns a default interval. Do not rely on results for expressions containing inv or log. Use evalDualOption for partial functions like inv and log.

Equations

• LeanCert.Internal.AD.evalUnchecked (LeanCert.Core.Expr.const q) ρ = LeanCert.Engine.DualInterval.const q
• LeanCert.Internal.AD.evalUnchecked (LeanCert.Core.Expr.var idx) ρ = ρ idx
• LeanCert.Internal.AD.evalUnchecked (e₁.add e₂) ρ = (LeanCert.Internal.AD.evalUnchecked e₁ ρ).add (LeanCert.Internal.AD.evalUnchecked e₂ ρ)
• LeanCert.Internal.AD.evalUnchecked (e₁.mul e₂) ρ = (LeanCert.Internal.AD.evalUnchecked e₁ ρ).mul (LeanCert.Internal.AD.evalUnchecked e₂ ρ)
• LeanCert.Internal.AD.evalUnchecked e_1.neg ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).neg
• LeanCert.Internal.AD.evalUnchecked e_1.inv ρ = default
• LeanCert.Internal.AD.evalUnchecked e_1.exp ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).exp
• LeanCert.Internal.AD.evalUnchecked e_1.sin ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).sin
• LeanCert.Internal.AD.evalUnchecked e_1.cos ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).cos
• LeanCert.Internal.AD.evalUnchecked e_1.log ρ = default
• LeanCert.Internal.AD.evalUnchecked e_1.atan ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).atan
• LeanCert.Internal.AD.evalUnchecked e_1.arsinh ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).arsinh
• LeanCert.Internal.AD.evalUnchecked e_1.atanh ρ = default
• LeanCert.Internal.AD.evalUnchecked e_1.sinc ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).sinc
• LeanCert.Internal.AD.evalUnchecked e_1.erf ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).erf
• LeanCert.Internal.AD.evalUnchecked e_1.sinh ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).sinh
• LeanCert.Internal.AD.evalUnchecked e_1.cosh ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).cosh
• LeanCert.Internal.AD.evalUnchecked e_1.tanh ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).tanh
• LeanCert.Internal.AD.evalUnchecked e_1.sqrt ρ = (LeanCert.Internal.AD.evalUnchecked e_1 ρ).sqrt
• LeanCert.Internal.AD.evalUnchecked (LeanCert.Core.Expr.namedConst c) ρ = LeanCert.Engine.DualInterval.ofMathConst c

Partial dual evaluation

noncomputable def LeanCert.Engine.evalDualOption (e : Core.Expr) (ρ : DualEnv) : Option DualInterval

Partial dual evaluator that supports domain-checked functions. Returns none if any domain error would occur:

• inv of an interval containing zero
• log of an interval not strictly positive When it returns some, the result is guaranteed to be correct.

The total and computable dual evaluators support tanh, but this Option-returning evaluator deliberately keeps tanh disabled until the evalDualOption-specific value/differentiability/derivative correctness path is wired for that constructor.

Equations

• LeanCert.Engine.evalDualOption (LeanCert.Core.Expr.const q) ρ = some (LeanCert.Engine.DualInterval.const q)
• LeanCert.Engine.evalDualOption (LeanCert.Core.Expr.var idx) ρ = some (ρ idx)
• LeanCert.Engine.evalDualOption (e₁.add e₂) ρ = match LeanCert.Engine.evalDualOption e₁ ρ, LeanCert.Engine.evalDualOption e₂ ρ with | some d₁, some d₂ => some (d₁.add d₂) | x, x_1 => none
• LeanCert.Engine.evalDualOption (e₁.mul e₂) ρ = match LeanCert.Engine.evalDualOption e₁ ρ, LeanCert.Engine.evalDualOption e₂ ρ with | some d₁, some d₂ => some (d₁.mul d₂) | x, x_1 => none
• LeanCert.Engine.evalDualOption e_1.neg ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.neg | none => none
• LeanCert.Engine.evalDualOption e_1.inv ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | none => none | some d => d.inv?
• LeanCert.Engine.evalDualOption e_1.exp ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.exp | none => none
• LeanCert.Engine.evalDualOption e_1.sin ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.sin | none => none
• LeanCert.Engine.evalDualOption e_1.cos ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.cos | none => none
• LeanCert.Engine.evalDualOption e_1.log ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | none => none | some d => d.logOption
• LeanCert.Engine.evalDualOption e_1.atan ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.atan | none => none
• LeanCert.Engine.evalDualOption e_1.arsinh ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.arsinh | none => none
• LeanCert.Engine.evalDualOption e_1.atanh ρ = none
• LeanCert.Engine.evalDualOption e_1.sinc ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.sinc | none => none
• LeanCert.Engine.evalDualOption e_1.erf ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.erf | none => none
• LeanCert.Engine.evalDualOption e_1.sinh ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.sinh | none => none
• LeanCert.Engine.evalDualOption e_1.cosh ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => some d.cosh | none => none
• LeanCert.Engine.evalDualOption e_1.tanh ρ = none
• LeanCert.Engine.evalDualOption e_1.sqrt ρ = match LeanCert.Engine.evalDualOption e_1 ρ with | some d => d.sqrt? | none => none
• LeanCert.Engine.evalDualOption (LeanCert.Core.Expr.namedConst c) ρ = some (LeanCert.Engine.DualInterval.ofMathConst c)

noncomputable def LeanCert.Engine.evalDualOption1 (e : Core.Expr) (I : Core.IntervalRat) : Option DualInterval

Single-variable version of evalDualOption

Equations

• LeanCert.Engine.evalDualOption1 e I = LeanCert.Engine.evalDualOption e fun (x : ℕ) => LeanCert.Engine.DualInterval.varActive I

Single variable differentiation

def LeanCert.Engine.mkDualEnv (ρ : IntervalEnv) (idx : ℕ) : DualEnv

Create dual environment for differentiating with respect to variable idx

Equations

• LeanCert.Engine.mkDualEnv ρ idx i = if i = idx then LeanCert.Engine.DualInterval.varActive (ρ i) else LeanCert.Engine.DualInterval.varPassive (ρ i)

noncomputable def LeanCert.Engine.evalWithDeriv (e : Core.Expr) (ρ : IntervalEnv) (idx : ℕ) : DualInterval

Evaluate and differentiate with respect to variable idx

Equations

• LeanCert.Engine.evalWithDeriv e ρ idx = LeanCert.Internal.AD.evalUnchecked e (LeanCert.Engine.mkDualEnv ρ idx)

noncomputable def LeanCert.Engine.derivInterval (e : Core.Expr) (ρ : IntervalEnv) (idx : ℕ) : Core.IntervalRat

Get just the derivative interval

Equations

• LeanCert.Engine.derivInterval e ρ idx = (LeanCert.Engine.evalWithDeriv e ρ idx).der

noncomputable def LeanCert.Engine.evalWithDeriv1 (e : Core.Expr) (I : Core.IntervalRat) : DualInterval

Evaluate and differentiate a single-variable expression

Equations

• LeanCert.Engine.evalWithDeriv1 e I = LeanCert.Internal.AD.evalUnchecked e fun (x : ℕ) => LeanCert.Engine.DualInterval.varActive I

Automatic Differentiation - Correctness Theorems

This file proves the correctness of forward-mode automatic differentiation for supported expressions (ADSupported).

Main theorems

• LeanCert.Engine.evalDualUnchecked_val_correct - Value component is correct
• LeanCert.Engine.evalDualUnchecked_der_correct - Derivative component is correct
• evalFunc1_differentiable - Supported expressions are differentiable
• deriv_mem_dualDer - Key theorem: computed derivative contains true derivative
• LeanCert.Engine.evalDualUnchecked_der_correct_idx - n-variable derivative correctness
• evalWithDeriv1_correct - Single-variable correctness

Design notes

All theorems in this file are FULLY PROVED with no sorry or axioms. The correctness relies on the chain rule for each supported operation.

Correctness

theorem LeanCert.Engine.evalDualUnchecked_val_correct (e : Core.Expr) (hsupp : ADSupported e) (ρ_real : ℕ → ℝ) (ρ_dual : DualEnv) (hρ : ∀ (i : ℕ), ρ_real i ∈ (ρ_dual i).val) : Core.Expr.eval ρ_real e ∈ (Internal.AD.evalUnchecked e ρ_dual).val

The value component is correct for supported expressions.

This theorem is FULLY PROVED (no sorry, no axioms) for supported expressions. The hsupp hypothesis ensures we only consider expressions in the verified subset.

Single-variable evaluation for derivative proofs

@[reducible, inline]

noncomputable abbrev LeanCert.Engine.evalFunc1 (e : Core.Expr) : ℝ → ℝ

The function t ↦ Expr.eval (fun _ => t) e for single-variable expressions

Equations

• LeanCert.Engine.evalFunc1 e t = LeanCert.Core.Expr.eval (fun (x : ℕ) => t) e

Differentiability of supported expressions

theorem LeanCert.Engine.evalFunc1_differentiable (e : Core.Expr) (hsupp : ADSupported e) : Differentiable ℝ (evalFunc1 e)

Supported expressions are differentiable as single-variable functions. This theorem shows that for any supported expression, the function evalFunc1 e is differentiable.

FULLY PROVED - no sorry, no axioms.

Core derivative correctness micro-lemmas

theorem LeanCert.Engine.cos_mem_cosInterval_of_any (y : ℝ) (I : Core.IntervalRat) : Real.cos y ∈ cosInterval I

Real.cos y is always in cosInterval I (which is [-1, 1]). This micro-lemma encapsulates the fact that cosInterval uses the global bound.

theorem LeanCert.Engine.sin_mem_sinInterval_of_any (y : ℝ) (I : Core.IntervalRat) : Real.sin y ∈ sinInterval I

Real.sin y is always in sinInterval I (which is [-1, 1]). This micro-lemma encapsulates the fact that sinInterval uses the global bound.

theorem LeanCert.Engine.neg_sin_mem_neg_sinInterval (y : ℝ) (I : Core.IntervalRat) : -Real.sin y ∈ (sinInterval I).neg

-Real.sin y is always in IntervalRat.neg (sinInterval I). This combines the sin global bound with negation for the cos derivative rule.

theorem LeanCert.Engine.updateVar_mem_mkDualEnv_val (ρ_real : ℕ → ℝ) (ρ_int : IntervalEnv) (idx : ℕ) (x : ℝ) (hx : x ∈ ρ_int idx) (hρ : ∀ (i : ℕ), ρ_real i ∈ ρ_int i) (i : ℕ) : (ρ_real[idx ↦ x]) i ∈ (mkDualEnv ρ_int idx i).val

The key lemma for n-variable AD: updateVar ρ_real idx x respects mkDualEnv ρ_int idx. This encapsulates the repeated proof that appears in mul/exp cases.

evalFunc1 unfolding lemmas

theorem LeanCert.Engine.evalFunc1_add (e₁ e₂ : Core.Expr) : evalFunc1 (e₁.add e₂) = fun (t : ℝ) => evalFunc1 e₁ t + evalFunc1 e₂ t

Helper lemma: evalFunc1 for addition unfolds correctly

theorem LeanCert.Engine.evalFunc1_add_pi (e₁ e₂ : Core.Expr) : evalFunc1 (e₁.add e₂) = evalFunc1 e₁ + evalFunc1 e₂

Helper lemma: evalFunc1 for addition in Pi form

theorem LeanCert.Engine.evalFunc1_mul (e₁ e₂ : Core.Expr) : evalFunc1 (e₁.mul e₂) = fun (t : ℝ) => evalFunc1 e₁ t * evalFunc1 e₂ t

Helper lemma: evalFunc1 for multiplication unfolds correctly

theorem LeanCert.Engine.evalFunc1_mul_pi (e₁ e₂ : Core.Expr) : evalFunc1 (e₁.mul e₂) = evalFunc1 e₁ * evalFunc1 e₂

Helper lemma: evalFunc1 for multiplication in Pi form

theorem LeanCert.Engine.evalFunc1_neg (e : Core.Expr) : evalFunc1 e.neg = fun (t : ℝ) => -evalFunc1 e t

Helper lemma: evalFunc1 for negation unfolds correctly

theorem LeanCert.Engine.evalFunc1_neg_pi (e : Core.Expr) : evalFunc1 e.neg = -evalFunc1 e

Helper lemma: evalFunc1 for negation in Pi form

theorem LeanCert.Engine.evalFunc1_sin (e : Core.Expr) : evalFunc1 e.sin = fun (t : ℝ) => Real.sin (evalFunc1 e t)

Helper lemma: evalFunc1 for sin unfolds correctly

theorem LeanCert.Engine.evalFunc1_cos (e : Core.Expr) : evalFunc1 e.cos = fun (t : ℝ) => Real.cos (evalFunc1 e t)

Helper lemma: evalFunc1 for cos unfolds correctly

theorem LeanCert.Engine.evalFunc1_exp (e : Core.Expr) : evalFunc1 e.exp = fun (t : ℝ) => Real.exp (evalFunc1 e t)

Helper lemma: evalFunc1 for exp unfolds correctly

theorem LeanCert.Engine.evalFunc1_log (e : Core.Expr) : evalFunc1 e.log = fun (t : ℝ) => Real.log (evalFunc1 e t)

Helper lemma: evalFunc1 for log unfolds correctly

theorem LeanCert.Engine.evalFunc1_atan (e : Core.Expr) : evalFunc1 e.atan = fun (t : ℝ) => Real.arctan (evalFunc1 e t)

Helper lemma: evalFunc1 for atan unfolds correctly

theorem LeanCert.Engine.evalFunc1_arsinh (e : Core.Expr) : evalFunc1 e.arsinh = fun (t : ℝ) => Real.arsinh (evalFunc1 e t)

Helper lemma: evalFunc1 for arsinh unfolds correctly

theorem LeanCert.Engine.evalFunc1_atanh (e : Core.Expr) : evalFunc1 e.atanh = fun (t : ℝ) => Core.Real.atanh (evalFunc1 e t)

Helper lemma: evalFunc1 for atanh unfolds correctly

theorem LeanCert.Engine.evalFunc1_sinc (e : Core.Expr) : evalFunc1 e.sinc = fun (t : ℝ) => Real.sinc (evalFunc1 e t)

Helper lemma: evalFunc1 for sinc unfolds correctly

theorem LeanCert.Engine.evalFunc1_erf (e : Core.Expr) : evalFunc1 e.erf = fun (t : ℝ) => Core.Real.erf (evalFunc1 e t)

Helper lemma: evalFunc1 for erf unfolds correctly

theorem LeanCert.Engine.evalFunc1_sqrt (e : Core.Expr) : evalFunc1 e.sqrt = fun (t : ℝ) => √(evalFunc1 e t)

Helper lemma: evalFunc1 for sqrt unfolds correctly

@[simp]

theorem LeanCert.Engine.evalFunc1_const (q : ℚ) : evalFunc1 (Core.Expr.const q) = fun (x : ℝ) => ↑q

Helper lemma: evalFunc1 for const

@[simp]

theorem LeanCert.Engine.evalFunc1_var (i : ℕ) : evalFunc1 (Core.Expr.var i) = id

Helper lemma: evalFunc1 for var

@[simp]

theorem LeanCert.Engine.evalFunc1_namedConst (c : Core.MathConst) : evalFunc1 (Core.Expr.namedConst c) = fun (x : ℝ) => c.toReal

Helper lemma: evalFunc1 for namedConst (constant function)

theorem LeanCert.Engine.evalFunc1_pi : evalFunc1 (Core.Expr.namedConst Core.MathConst.pi) = fun (x : ℝ) => Real.pi

Helper lemma: evalFunc1 for pi (constant function)

theorem LeanCert.Engine.evalFunc1_eulerMascheroni : evalFunc1 (Core.Expr.namedConst Core.MathConst.eulerMascheroni) = fun (x : ℝ) => Real.eulerMascheroniConstant

Helper lemma: evalFunc1 for eulerMascheroni (constant function)

theorem LeanCert.Engine.deriv_mem_dualDer (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (x : ℝ) (hx : x ∈ I) : deriv (evalFunc1 e) x ∈ (Internal.AD.evalUnchecked e fun (x : ℕ) => DualInterval.varActive I).der

Helper: the dual environment evaluation gives correct derivative. This connects the interval-based AD to actual calculus derivatives.

FULLY PROVED - no sorry, no axioms.

theorem LeanCert.Engine.evalDualUnchecked_der_correct (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (x : ℝ) (hx : x ∈ I) : deriv (fun (t : ℝ) => Core.Expr.eval (fun (x : ℕ) => t) e) x ∈ (Internal.AD.evalUnchecked e fun (x : ℕ) => DualInterval.varActive I).der

The derivative component of dual interval evaluation is correct. For a supported expression evaluated at a point x in the interval I, the derivative of the expression (as a function of x) lies in the computed derivative interval.

This is the fundamental correctness theorem for forward-mode AD: the derivative bounds computed by interval arithmetic contain the true derivative at every point in the domain.

FULLY PROVED - no sorry, no axioms.

Generalized n-variable derivative correctness

theorem LeanCert.Engine.evalAlong_differentiable (e : Core.Expr) (hsupp : ADSupported e) (ρ : ℕ → ℝ) (idx : ℕ) : Differentiable ℝ (e.evalAlong ρ idx)

Helper: evalAlong is differentiable for supported expressions

theorem LeanCert.Engine.evalDualUnchecked_der_correct_idx (e : Core.Expr) (hsupp : ADSupported e) (ρ_real : ℕ → ℝ) (ρ_int : IntervalEnv) (idx : ℕ) (hρ : ∀ (i : ℕ), ρ_real i ∈ ρ_int i) (x : ℝ) (hx : x ∈ ρ_int idx) : deriv (e.evalAlong ρ_real idx) x ∈ (Internal.AD.evalUnchecked e (mkDualEnv ρ_int idx)).der

The derivative of evalAlong with respect to coordinate idx lies in the computed derivative interval from mkDualEnv.

This is the fundamental n-variable derivative correctness theorem. It shows that for any expression, if we differentiate along coordinate idx while holding all other coordinates fixed according to ρ, the derivative at any point x in the interval ρ_int idx lies in the computed interval.

FULLY PROVED - no sorry, no axioms.

theorem LeanCert.Engine.derivInterval_correct_idx (e : Core.Expr) (hsupp : ADSupported e) (ρ_real : ℕ → ℝ) (ρ_int : IntervalEnv) (idx : ℕ) (hρ : ∀ (i : ℕ), ρ_real i ∈ ρ_int i) (x : ℝ) (hx : x ∈ ρ_int idx) : deriv (e.evalAlong ρ_real idx) x ∈ derivInterval e ρ_int idx

Convenience theorem: derivInterval correctness for n-variable expressions. The derivative of evalAlong e ρ idx at any point x in the interval lies in derivInterval e ρ_int idx.

Single-variable expressions

inductive LeanCert.Engine.UsesOnlyVar0 : Core.Expr → Prop

Predicate: expression only uses variable index 0. This is useful for proving that different environments give the same result when they agree at index 0.

• const (q : ℚ) : UsesOnlyVar0 (Core.Expr.const q)
• var0 : UsesOnlyVar0 (Core.Expr.var 0)
• add (e₁ e₂ : Core.Expr) (h₁ : UsesOnlyVar0 e₁) (h₂ : UsesOnlyVar0 e₂) : UsesOnlyVar0 (e₁.add e₂)
• mul (e₁ e₂ : Core.Expr) (h₁ : UsesOnlyVar0 e₁) (h₂ : UsesOnlyVar0 e₂) : UsesOnlyVar0 (e₁.mul e₂)
• neg (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.neg
• inv (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.inv
• sin (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.sin
• cos (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.cos
• exp (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.exp
• log (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.log
• atan (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.atan
• arsinh (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.arsinh
• atanh (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.atanh
• sinc (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.sinc
• erf (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.erf
• sinh (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.sinh
• cosh (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.cosh
• tanh (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.tanh
• sqrt (e : Core.Expr) (h : UsesOnlyVar0 e) : UsesOnlyVar0 e.sqrt
• namedConst (c : Core.MathConst) : UsesOnlyVar0 (Core.Expr.namedConst c)

theorem LeanCert.Engine.Expr.usesOnlyVar0_iff_UsesOnlyVar0 {e : Core.Expr} : e.usesOnlyVar0 = true ↔ UsesOnlyVar0 e

Bridge between the canonical boolean predicate and the proof-carrying UsesOnlyVar0 predicate used by AD correctness lemmas.

theorem LeanCert.Engine.evalDualUnchecked_congr_at_0 (e : Core.Expr) (h : UsesOnlyVar0 e) (ρ₁ ρ₂ : DualEnv) (heq : ρ₁ 0 = ρ₂ 0) : Internal.AD.evalUnchecked e ρ₁ = Internal.AD.evalUnchecked e ρ₂

For expressions using only var 0, LeanCert.Internal.AD.evalUnchecked agrees for environments that match at 0

theorem LeanCert.Engine.mkDualEnv_at_0 (I : Core.IntervalRat) : mkDualEnv (fun (x : ℕ) => I) 0 0 = DualInterval.varActive I

mkDualEnv at index 0 equals varActive at 0

theorem LeanCert.Engine.derivInterval_eq_evalWithDeriv1_of_UsesOnlyVar0 (e : Core.Expr) (h : UsesOnlyVar0 e) (I : Core.IntervalRat) : derivInterval e (fun (x : ℕ) => I) 0 = (evalWithDeriv1 e I).der

For expressions using only var 0, derivInterval equals evalWithDeriv1

theorem LeanCert.Engine.evalWithDeriv1_correct (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (x : ℝ) (hx : x ∈ I) : Core.Expr.eval (fun (x_1 : ℕ) => x) e ∈ (evalWithDeriv1 e I).val ∧ deriv (fun (t : ℝ) => Core.Expr.eval (fun (x : ℕ) => t) e) x ∈ (evalWithDeriv1 e I).der

Correctness of single-variable derivative bounds

Automatic Differentiation - Computable Evaluators

This file provides computable dual evaluators using Taylor-based approximations for transcendental functions. This enables native_decide for derivative-based bound checking.

Main definitions

• DualInterval.expCore, sinCore, cosCore - Taylor-based dual functions
• DualInterval.sinhCore, coshCore, tanhCore - Hyperbolic Taylor-based duals
• LeanCert.Internal.AD.evalTotalCore - Computable dual evaluator for ExprSupportedCore
• derivIntervalCore - Computable single-variable derivative interval

Main theorems

• LeanCert.Engine.evalDualTotalCore_val_correct - Value component is correct
• LeanCert.Engine.evalDualTotalCore_der_correct - Derivative component is correct
• derivIntervalCore_correct - Derivative interval correctness
• strictMonoOn_of_derivIntervalCore_pos - Monotonicity from positive derivative
• strictAntiOn_of_derivIntervalCore_neg - Antitonicity from negative derivative

Computable Dual Evaluation for ExprSupportedCore

This section provides a fully computable dual evaluator that uses Taylor-based approximations for transcendental functions. This enables native_decide for derivative-based bound checking.

def LeanCert.Engine.DualInterval.expCore (d : DualInterval) (n : ℕ := 10) : DualInterval

Computable dual for exp using Taylor series (chain rule: d(exp f) = exp(f) * f')

Equations

• d.expCore n = { val := d.val.expComputable n, der := (d.val.expComputable n).mul d.der }

def LeanCert.Engine.DualInterval.sinCore (d : DualInterval) (n : ℕ := 10) : DualInterval

Computable dual for sin using Taylor series

Equations

• d.sinCore n = { val := d.val.sinComputable n, der := (d.val.cosComputable n).mul d.der }

def LeanCert.Engine.DualInterval.cosCore (d : DualInterval) (n : ℕ := 10) : DualInterval

Computable dual for cos using Taylor series

Equations

• d.cosCore n = { val := d.val.cosComputable n, der := (d.val.sinComputable n).neg.mul d.der }

def LeanCert.Engine.DualInterval.logCore (d : DualInterval) (n : ℕ := 20) : DualInterval

Computable dual for log using Taylor series via atanh reduction. Chain rule: d(log f) = f' / f

Equations

• d.logCore n = { val := d.val.logComputable n, der := (LeanCert.Engine.invInterval d.val).mul d.der }

def LeanCert.Engine.DualInterval.sinhCore (d : DualInterval) (n : ℕ := 10) : DualInterval

Computable dual for sinh using Taylor series (chain rule: d(sinh f) = cosh(f) * f')

Equations

• d.sinhCore n = { val := d.val.sinhComputable n, der := (d.val.coshComputable n).mul d.der }

def LeanCert.Engine.DualInterval.coshCore (d : DualInterval) (n : ℕ := 10) : DualInterval

Computable dual for cosh using Taylor series (chain rule: d(cosh f) = sinh(f) * f')

Equations

• d.coshCore n = { val := d.val.coshComputable n, der := (d.val.sinhComputable n).mul d.der }

def LeanCert.Engine.DualInterval.tanhCore (d : DualInterval) (_n : ℕ := 10) : DualInterval

Computable dual for tanh (chain rule: d(tanh f) = sech²(f) * f') Since sech²(x) ∈ (0, 1], we use [0, 1] as a conservative bound.

Equations

• d.tanhCore _n = { val := LeanCert.Engine.tanhInterval d.val, der := d.der.mul { lo := 0, hi := 1, le := LeanCert.Engine.DualInterval.unitInterval._proof_1 } }

def LeanCert.Internal.AD.evalTotalCore (e : Core.Expr) (ρ : Engine.DualEnv) (cfg : Engine.EvalConfig := { }) : Engine.DualInterval

Computable dual interval evaluator for ExprSupportedCore expressions.

This uses Taylor series approximations for transcendental functions, making it fully computable and usable with native_decide.

For inv and log, use evalDualChecked or the bounded-denominator evalDualDyadicChecked; they validate the actual input box before exposing this total kernel's result. Correctness is not claimed for unchecked partial-operation branches here.

Equations

• LeanCert.Internal.AD.evalTotalCore (LeanCert.Core.Expr.const q) ρ cfg = LeanCert.Engine.DualInterval.const q
• LeanCert.Internal.AD.evalTotalCore (LeanCert.Core.Expr.var idx) ρ cfg = ρ idx
• LeanCert.Internal.AD.evalTotalCore (e₁.add e₂) ρ cfg = (LeanCert.Internal.AD.evalTotalCore e₁ ρ cfg).add (LeanCert.Internal.AD.evalTotalCore e₂ ρ cfg)
• LeanCert.Internal.AD.evalTotalCore (e₁.mul e₂) ρ cfg = (LeanCert.Internal.AD.evalTotalCore e₁ ρ cfg).mul (LeanCert.Internal.AD.evalTotalCore e₂ ρ cfg)
• LeanCert.Internal.AD.evalTotalCore e_1.neg ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).neg
• LeanCert.Internal.AD.evalTotalCore e_1.inv ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).inv
• LeanCert.Internal.AD.evalTotalCore e_1.exp ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).expCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.sin ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).sinCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.cos ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).cosCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.log ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).logCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.atan ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).atan
• LeanCert.Internal.AD.evalTotalCore e_1.arsinh ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).arsinh
• LeanCert.Internal.AD.evalTotalCore e_1.atanh ρ cfg = default
• LeanCert.Internal.AD.evalTotalCore e_1.sinc ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).sinc
• LeanCert.Internal.AD.evalTotalCore e_1.erf ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).erfCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.sinh ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).sinhCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.cosh ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).coshCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.tanh ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).tanhCore cfg.taylorDepth
• LeanCert.Internal.AD.evalTotalCore e_1.sqrt ρ cfg = (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).sqrt
• LeanCert.Internal.AD.evalTotalCore (LeanCert.Core.Expr.namedConst c) ρ cfg = LeanCert.Engine.DualInterval.ofMathConst c

def LeanCert.Engine.derivIntervalCore (e : Core.Expr) (I : Core.IntervalRat) (cfg : EvalConfig := { }) : Core.IntervalRat

Computable single-variable derivative interval

Equations

• LeanCert.Engine.derivIntervalCore e I cfg = (LeanCert.Internal.AD.evalTotalCore e (fun (x : ℕ) => LeanCert.Engine.DualInterval.varActive I) cfg).der

def LeanCert.Engine.evalDomainValidDual (e : Core.Expr) (ρ : DualEnv) (cfg : EvalConfig := { }) : Prop

Domain validity for dual evaluation. This is defined directly in terms of LeanCert.Internal.AD.evalTotalCore to ensure compatibility. For log, we require the argument interval to have positive lower bound.

Equations

• LeanCert.Engine.evalDomainValidDual (LeanCert.Core.Expr.const q) ρ cfg = True
• LeanCert.Engine.evalDomainValidDual (LeanCert.Core.Expr.var idx) ρ cfg = True
• LeanCert.Engine.evalDomainValidDual (e₁.add e₂) ρ cfg = (LeanCert.Engine.evalDomainValidDual e₁ ρ cfg ∧ LeanCert.Engine.evalDomainValidDual e₂ ρ cfg)
• LeanCert.Engine.evalDomainValidDual (e₁.mul e₂) ρ cfg = (LeanCert.Engine.evalDomainValidDual e₁ ρ cfg ∧ LeanCert.Engine.evalDomainValidDual e₂ ρ cfg)
• LeanCert.Engine.evalDomainValidDual e_1.neg ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.inv ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.exp ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.sin ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.cos ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.log ρ cfg = (LeanCert.Engine.evalDomainValidDual e_1 ρ cfg ∧ (LeanCert.Internal.AD.evalTotalCore e_1 ρ cfg).val.lo > 0)
• LeanCert.Engine.evalDomainValidDual e_1.atan ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.arsinh ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.atanh ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.sinc ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.erf ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.sinh ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.cosh ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.tanh ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual e_1.sqrt ρ cfg = LeanCert.Engine.evalDomainValidDual e_1 ρ cfg
• LeanCert.Engine.evalDomainValidDual (LeanCert.Core.Expr.namedConst c) ρ cfg = True

theorem LeanCert.Engine.evalDualTotalCore_val_correct (e : Core.Expr) (hsupp : ExprSupportedCore e) (ρ_real : ℕ → ℝ) (ρ_dual : DualEnv) (cfg : EvalConfig) (hρ : ∀ (i : ℕ), ρ_real i ∈ (ρ_dual i).val) (hdom : evalDomainValidDual e ρ_dual cfg) : Core.Expr.eval ρ_real e ∈ (Internal.AD.evalTotalCore e ρ_dual cfg).val

Correctness theorem for computable dual value component.

Note: Requires domain validity for log (positive argument interval).

theorem LeanCert.Engine.evalDomainValidDual_of_ExprSupported (e : Core.Expr) (hsupp : ADSupported e) (ρ : DualEnv) (cfg : EvalConfig) : evalDomainValidDual e ρ cfg

For ADSupported expressions (which exclude log), domain validity is trivially true. This is because ADSupported has no log constructor.

theorem LeanCert.Engine.evalDualTotalCore_der_correct (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (x : ℝ) (hx : x ∈ I) (cfg : EvalConfig) : deriv (evalFunc1 e) x ∈ (Internal.AD.evalTotalCore e (fun (x : ℕ) => DualInterval.varActive I) cfg).der

Correctness theorem for computable dual derivative component. Uses ADSupported since derivative correctness requires differentiability.

theorem LeanCert.Engine.derivIntervalCore_correct (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (x : ℝ) (hx : x ∈ I) (cfg : EvalConfig) : deriv (evalFunc1 e) x ∈ derivIntervalCore e I cfg

Convenience theorem: derivIntervalCore correctness

theorem LeanCert.Engine.derivIntervalCore_nonzero_implies_deriv_nonzero (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (cfg : EvalConfig) (h : ¬(derivIntervalCore e I cfg).containsZero) (x : ℝ) : x ∈ I → deriv (evalFunc1 e) x ≠ 0

If derivIntervalCore doesn't contain zero, the derivative is nonzero everywhere on I. This is a key theorem for Newton contraction analysis.

theorem LeanCert.Engine.derivIntervalCore_pos_implies_deriv_pos (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (cfg : EvalConfig) (h : 0 < (derivIntervalCore e I cfg).lo) (x : ℝ) : x ∈ I → 0 < deriv (evalFunc1 e) x

If derivIntervalCore.lo > 0, then the derivative is positive everywhere on I.

theorem LeanCert.Engine.derivIntervalCore_neg_implies_deriv_neg (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (cfg : EvalConfig) (h : (derivIntervalCore e I cfg).hi < 0) (x : ℝ) : x ∈ I → deriv (evalFunc1 e) x < 0

If derivIntervalCore.hi < 0, then the derivative is negative everywhere on I.

theorem LeanCert.Engine.strictMonoOn_of_derivIntervalCore_pos (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (cfg : EvalConfig) (hpos : 0 < (derivIntervalCore e I cfg).lo) : StrictMonoOn (evalFunc1 e) (Set.Icc ↑I.lo ↑I.hi)

Strictly positive derivative (via Core bounds) implies strict monotonicity

theorem LeanCert.Engine.strictAntiOn_of_derivIntervalCore_neg (e : Core.Expr) (hsupp : ADSupported e) (I : Core.IntervalRat) (cfg : EvalConfig) (hneg : (derivIntervalCore e I cfg).hi < 0) : StrictAntiOn (evalFunc1 e) (Set.Icc ↑I.lo ↑I.hi)

Strictly negative derivative (via Core bounds) implies strict antitonicity

Computable domain-aware automatic differentiation

This module extends LeanCert's computable forward-mode AD path with checked reciprocal and logarithm nodes. The existing ADSupported fragment remains the domain-free fast path. Here, successful evaluation itself certifies both syntactic support and every partial-domain side condition.

def LeanCert.Engine.checkADDomain (e : Core.Expr) (ρ : DualEnv) (cfg : EvalConfig := { }) : Bool

The computable domain-aware AD fragment. Unlike ADSupported, this is a box-dependent check because reciprocal and logarithm have partial domains.

Equations

• LeanCert.Engine.checkADDomain (LeanCert.Core.Expr.const q) ρ cfg = true
• LeanCert.Engine.checkADDomain (LeanCert.Core.Expr.var idx) ρ cfg = true
• LeanCert.Engine.checkADDomain (a.add b) ρ cfg = (LeanCert.Engine.checkADDomain a ρ cfg && LeanCert.Engine.checkADDomain b ρ cfg)
• LeanCert.Engine.checkADDomain (a.mul b) ρ cfg = (LeanCert.Engine.checkADDomain a ρ cfg && LeanCert.Engine.checkADDomain b ρ cfg)
• LeanCert.Engine.checkADDomain a.neg ρ cfg = LeanCert.Engine.checkADDomain a ρ cfg
• LeanCert.Engine.checkADDomain a.exp ρ cfg = LeanCert.Engine.checkADDomain a ρ cfg
• LeanCert.Engine.checkADDomain a.sin ρ cfg = LeanCert.Engine.checkADDomain a ρ cfg
• LeanCert.Engine.checkADDomain a.cos ρ cfg = LeanCert.Engine.checkADDomain a ρ cfg
• LeanCert.Engine.checkADDomain a.inv ρ cfg = (LeanCert.Engine.checkADDomain a ρ cfg && decide ¬(LeanCert.Internal.AD.evalTotalCore a ρ cfg).val.containsZero)
• LeanCert.Engine.checkADDomain a.log ρ cfg = (LeanCert.Engine.checkADDomain a ρ cfg && decide (LeanCert.Internal.AD.evalTotalCore a ρ cfg).val.isPositive)
• LeanCert.Engine.checkADDomain e ρ cfg = false

def LeanCert.Engine.diagnoseADDomainFailure (e : Core.Expr) (ρ : DualEnv) (cfg : EvalConfig := { }) : EvalError

Best-effort structured explanation for a failed domain-aware AD check.

Equations

• One or more equations did not get rendered due to their size.
• LeanCert.Engine.diagnoseADDomainFailure a.neg ρ cfg = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseADDomainFailure a ρ cfg)
• LeanCert.Engine.diagnoseADDomainFailure a.exp ρ cfg = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseADDomainFailure a ρ cfg)
• LeanCert.Engine.diagnoseADDomainFailure a.sin ρ cfg = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseADDomainFailure a ρ cfg)
• LeanCert.Engine.diagnoseADDomainFailure a.cos ρ cfg = LeanCert.Engine.EvalError.nestedFailure "unary operand" (LeanCert.Engine.diagnoseADDomainFailure a ρ cfg)
• LeanCert.Engine.diagnoseADDomainFailure (LeanCert.Core.Expr.const q) ρ cfg = LeanCert.Engine.EvalError.invalidConfiguration "successful AD expression diagnosed as failure"
• LeanCert.Engine.diagnoseADDomainFailure (LeanCert.Core.Expr.var idx) ρ cfg = LeanCert.Engine.EvalError.invalidConfiguration "successful AD expression diagnosed as failure"
• LeanCert.Engine.diagnoseADDomainFailure e ρ cfg = LeanCert.Engine.EvalError.unsupportedFeature "domain-aware automatic differentiation"

def LeanCert.Engine.evalDualChecked (e : Core.Expr) (ρ : DualEnv) (cfg : EvalConfig := { }) : EvalResult DualInterval

Computable checked dual evaluation. No finite derivative enclosure is returned unless every reciprocal denominator excludes zero and every logarithm argument is strictly positive on the input box.

Equations

• One or more equations did not get rendered due to their size.

def LeanCert.Engine.evalWithDerivChecked (e : Core.Expr) (ρ : IntervalEnv) (idx : ℕ) (cfg : EvalConfig := { }) : EvalResult DualInterval

Checked value-and-derivative evaluation along coordinate idx.

Equations

• LeanCert.Engine.evalWithDerivChecked e ρ idx cfg = LeanCert.Engine.evalDualChecked e (LeanCert.Engine.mkDualEnv ρ idx) cfg

def LeanCert.Engine.derivIntervalChecked (e : Core.Expr) (ρ : IntervalEnv) (idx : ℕ) (cfg : EvalConfig := { }) : EvalResult Core.IntervalRat

Checked derivative enclosure along coordinate idx.

Equations

• LeanCert.Engine.derivIntervalChecked e ρ idx cfg = do let __do_lift ← LeanCert.Engine.evalWithDerivChecked e ρ idx cfg pure __do_lift.der

def LeanCert.Engine.derivIntervalChecked1 (e : Core.Expr) (I : Core.IntervalRat) (cfg : EvalConfig := { }) : EvalResult Core.IntervalRat

Checked derivative enclosure for a single-variable expression.

Equations

• LeanCert.Engine.derivIntervalChecked1 e I cfg = LeanCert.Engine.derivIntervalChecked e (fun (x : ℕ) => I) 0 cfg

theorem LeanCert.Engine.evalDualChecked_val_correct (e : Core.Expr) (ρReal : ℕ → ℝ) (ρDual : DualEnv) (cfg : EvalConfig) (D : DualInterval) (hρ : ∀ (i : ℕ), ρReal i ∈ (ρDual i).val) (hok : evalDualChecked e ρDual cfg = Except.ok D) : Core.Expr.eval ρReal e ∈ D.val

Successful checked dual evaluation encloses the expression value for every real environment represented by the dual environment.

theorem LeanCert.Engine.evalWithDerivChecked_differentiableAt (e : Core.Expr) (ρReal : ℕ → ℝ) (ρInt : IntervalEnv) (idx : ℕ) (cfg : EvalConfig) (D : DualInterval) (x : ℝ) (hx : x ∈ ρInt idx) (hρ : ∀ (i : ℕ), ρReal i ∈ ρInt i) (hok : evalWithDerivChecked e ρInt idx cfg = Except.ok D) : DifferentiableAt ℝ (e.evalAlong ρReal idx) x

A successful checked evaluation proves differentiability at every point in the input box along the selected coordinate.

theorem LeanCert.Engine.evalWithDerivChecked_der_correct (e : Core.Expr) (ρReal : ℕ → ℝ) (ρInt : IntervalEnv) (idx : ℕ) (cfg : EvalConfig) (D : DualInterval) (x : ℝ) (hx : x ∈ ρInt idx) (hρ : ∀ (i : ℕ), ρReal i ∈ ρInt i) (hok : evalWithDerivChecked e ρInt idx cfg = Except.ok D) : deriv (e.evalAlong ρReal idx) x ∈ D.der

Successful checked indexed AD encloses the true partial derivative.

theorem LeanCert.Engine.derivIntervalChecked_correct (e : Core.Expr) (ρReal : ℕ → ℝ) (ρInt : IntervalEnv) (idx : ℕ) (cfg : EvalConfig) (dI : Core.IntervalRat) (x : ℝ) (hx : x ∈ ρInt idx) (hρ : ∀ (i : ℕ), ρReal i ∈ ρInt i) (hok : derivIntervalChecked e ρInt idx cfg = Except.ok dI) : deriv (e.evalAlong ρReal idx) x ∈ dI

Golden soundness theorem for the checked derivative-only API.