Abstract: Padovan sequence is a ternary recurrent sequence defined by the recurrence relation $P_{n+3}=P_{n+1}+P_{n}$ with initial terms $P_{0}=P_{1}=P_{2}=1.$ In this study it is shown that $114,151,200,265,351,465,616,816,3329,4410,7739,922111$ are the only Padovan numbers which are concatenations of three repdigits.

\section{Introduction}
A natural number $N$ is called a repdigit if it has only one distict digit in its decimal expansion. That is, $N$ is of the form $N=a\left(\frac{10^{m}-1}{9}\right)=\overline{\underbrace{ a \ldots a}_{m~ \text{times}}}$ for $0\leq a\leq 9$ and $m\geq1.$ A natural number of the form
\begin{equation*}
  N=\overline{\underbrace{a\ldots a}_{l~\text{times}}\underbrace{b\ldots b}_{m~\text{times}}\underbrace{c\ldots c}_{k~\text{times}}}
\end{equation*} can be viewed as concatenation of three repdigits where $a,l,m,k\geq1$ and $0\leq a,b,c\leq 9.$
Let $\{P_{n}\}_{n\geq0}$ be the Padovan sequence given by
\begin{equation*}
P_{n+3}=P_{n+1}+P_{n} ~\text{for all}~ n\geq1,
\end{equation*}
with $P_{0}=P_{1}=P_{2}=1.$ The first few terms of this sequence are
\begin{equation*}
  1, 1, 1, 2, 2, 3, 4, 5, 7, 9, 12, 16, 21, 28, 37, 49, 65, 86, 114, 151, 200, 265, 351,\ldots.
\end{equation*}
In recent times, concatenation of repdigits in different linear recurrence sequences has been studied by many researchers. For example, Alahmadi et al. \cite{ALAHMADI} studied the problem of finding all Fibonacci numbers which are concatenations of two repdigits. They examined the same problem for $k$-generalised Fibonacci sequence in \cite{ALAHMADI1}. Ddamulira searched all Padovan and Tribonacci numbers which are concatenations of two repdigits in \cite{Ddmulir}, \cite{Ddamulira}, respectively. Batte et al. \cite{Batte} proved that the only Perrin numbers which are concatenations of two repdigits are $\{10, 12, 17, 22, 29, 39, 51, 68, 90, 119, 277, 644\}$. In \cite{RAYGURU}, Rayguru and Panda showed that $35$ is the only balancing number which is concatenation
of two repdigits. Recently, Siar and Keskin \cite{Siar} found that $12, 13, 29, 33, 34, 70, 84, 88, 89, 228$, and $233$
are the only $k$-generalized Pell numbers, which are concatenations of two repdigits with at least two digits. Erduvan and Keskin \cite{Erduvan}, in their work obtained Lucas numbers which are concatenations of two repdigits. In \cite{Keskin}, the same authors looked into Lucas numbers which are concatenations of three repdigits. They proved that the only Lucas numbers which are concatenations of three repdigits are $123, 199, 322, 521, 843, 2207, 5778$. For the proof, they used lower bounds for linear forms in logarithms and Baker-Davenport reduction method due to Dujella and Peth\H o \cite{Dujella}.
In this paper, we find all Padovan numbers that are concatenations of three repdigits. More precisely, we completely solve the Diophantine equation
\begin{eqnarray*}
  P_{n}&=&\overline{\underbrace{a\ldots a}_{l~\text{times}}\underbrace{b\ldots b}_{m~\text{times}} \underbrace{c\ldots c}_{k~\text{times}}}\\
   &=&\overline{\underbrace{a\ldots a}_{l~\text{times}}}\cdot 10^{m+k}+\overline{\underbrace{b\ldots b}_{m~\text{times}}}\cdot 10^{k}+\overline{\underbrace{c\ldots c}_{k~\text{times}}} \\
   &=&a\left(\frac{10^{l}-1}{9}\right)10^{m+k}+b\left(\frac{10^{m}-1}{9}\right)10^{k}+c\left(\frac{10^{k}-1}{9}\right),
\end{eqnarray*} that is,
\begin{equation}\label{eq:1}
P_{n}=\frac{1}{9}\left(a 10^{l+m+k}-(a-b)10^{m+k}-(b-c)10^{k}-c\right).
\end{equation}
Our main result is the following.
\begin{theorem}\label{Th:1.}
  The only Padovan numbers that are concatenations of three repdigits are $114,151,200,265,351,465,616,816,3329,4410,7739,922111.$
\end{theorem}
For the proof of Theorem \ref{Th:1.}, we run a program in \textit{Mathemtica} and search all solutions of \eqref{eq:1} with $n\leq560$. Then, we take $n>560$ and write \eqref{eq:1} in three different ways to get three linear forms in logarithms. We apply lower bounds for linear forms in logarithms to obtain an upper bound on $n.$ To reduce the bound, we use Baker-Davenport reduction method de Weger \cite{Weger}. As a result, we get $n\leq 546,$ a contradiction. In this way, we complete the proof of our main result.

We need some preliminary results which are discussed in the following section.
\section{Preliminary Results}
\subsection{Some properties of Padovan sequence}
The characteristic equation of $\{P_{n}\}_{n\geq0}$ is $f(x)=x^{3}-x-1=0$ which has one real root $\alpha$ and two complex conjugate roots $\beta$ and $\gamma$ given by
\begin{equation*}
\alpha=\frac{r_{1}+r_{2}}{6},~~\beta=\bar{\gamma}=\frac{-r_{1}-r_{2}+i\sqrt{3}(r_{1}-r_{2})} {12},
\end{equation*} where
$r_{1}=\sqrt[3]{108+12\sqrt{69}}$ and $r_{2}=\sqrt[3]{108-12\sqrt{69}}$. Binet's formula for Padovan sequence is given by
\begin{equation}\label{eq:3}
  P_{n}=C_{\alpha}\alpha^{n}+C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n},
\end{equation}
where
\begin{align*}
    &C_{\alpha}=\frac{(1-\beta)(1-\gamma)}{(\alpha-\beta)(\alpha-\gamma)}=\frac{\alpha+1}{-\alpha^2+3\alpha+1},\\
    &C_{\beta}=\frac{(1-\alpha)(1-\gamma)}{(\beta-\alpha)(\beta-\gamma)}=\frac{\beta+1}{-\beta^2+3\beta+1},\\ &C_{\gamma}=\frac{(1-\alpha)(1-\beta)}{(\gamma-\alpha)(\gamma-\beta)}=\frac{\gamma+1}{-\gamma^2+3\gamma+1}.
\end{align*}
The minimal polynomial of $C_{\alpha}$ over $\mathbb{Z}$ is $23x^{3}-23x^{2}+6x-1$ with all its zeros of unit modulus.
Numerically, we have the following estimates:
\begin{align*}
 1.32<\alpha<1.33,\\
 0.86<\vert\beta\rvert=\vert\gamma\vert =\alpha^{-1/2}<0.87,\\
 0.72<C_{\alpha}<0.73,\\
 0.24<\vert C_{\beta}\vert=\vert C_{\gamma}\vert<0.25.
 \end{align*}
 Let $e(n):=P_{n}-C_{\alpha}\alpha^{n}=C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n}.$ Then $\vert e(n)\vert<\frac{1}{\alpha^{n/2}}$ for all $n\geq1.$
 Using induction, one can prove that
 \begin{equation}\label{eq:2}
 \alpha^{n-3}\leq P_{n}\leq \alpha^{n-1} ~\text{holds for all}~ n\geq 1.
 \end{equation}
\subsection{Linear forms in Logarithms}
Baker's theory plays an important role in reducing the bounds concerning linear forms in logarithms of algebraic numbers.
Let $\eta$ be an algebraic number with minimal primitive polynomial
\begin{align*}
     f\left(X\right) =a_{0}x^{d}+a_{1}x^{d-1}+\ldots+a_{d}= a_{0}\prod_{i=1}^{d}(X-\eta^{(i)})\in {\mathbb{Z}\left[X\right]},
\end{align*}
where  the leading coefficient $a_{0}>0$, and $\eta^{(i)}$'s are conjugates of $\eta$. Then, the \textit{logarithmic height} of $\eta$ is given by
\begin{align*}
    h(\eta)=\frac{1}{d}\left(\log a_{0}+\sum_{j=1}^{d}\text{max}\{0,\log\vert\eta^{(j)}\vert\}\right).
\end{align*}
The following are some properties of the logarithmic height function (see \cite[Property 3.3]{W}), which will be used to calculate the heights of the algebraic integers
\begin{gather*}
       h(\eta+\gamma)\leq h(\eta)+h(\gamma)+\log2,\\
    h(\eta\gamma^{\pm1})\leq h(\eta)+h(\gamma),\\
     h(\eta^{k})=|k|h(\eta), k\in \mathbb{Z}.
\end{gather*}
With these notations, Matveev (see \cite{Matveev} or \cite[Theorem 9.4]{Bugeaud1}) proved the following result.
 \begin{theorem}\label{th:2}
 Let $\eta_{1},\eta_{2},\ldots , \eta_{l}$ be positive real algebraic integers in a real algebraic number field $\mathbb{L}$  of degree $d_{\mathbb{L}}$ and $b_{1},b_{2},\ldots, b_{l}$ be non zero  integers. If
 $\Gamma=\prod_{i=1}^{l}\eta_{i}^{b_{i}}-1
$ is not zero, then
\begin{align*}
    \log \vert\Gamma\vert>-1.4\cdot30^{l+3}l^{4.5}d_{\mathbb{L}}^{2}(1+\log d_{\mathbb{L}})(1+\log D)A_{1}A_{2}\ldots A_{l},
    \end{align*} where $D=\text{max}\{\vert b_{1} \vert,\vert b_{2} \vert,\ldots, \vert b_{l} \vert\}$ and
$A_{1},A_{2},\ldots, A_{l}$ are positive real numbers such that
\begin{align*}
    A_{j}\geq \text{max}\{d_{\mathbb{L}}h\left( \eta_{j}\right),\vert\log\eta_{j}\vert, 0.16\}  ~~ \text{for}~   j=1,\ldots,l.
\end{align*}
\end{theorem}
\subsection{Reduction method}
The following Baker-Davenport reduction method due to de Weger \cite{Weger} is used to reduce the bounds of the variables which are too large.
Let $\vartheta_{1}, \vartheta_{2}, \beta \in \mathbb{R}$ be given and $ x_{1},x_{2} \in \mathbb{Z}$ be unknowns.
Suppose
\begin{align}\label{eq:T}
    \Lambda=\beta+x_{1}\vartheta_{1}+x_{2}\vartheta_{2}.
\end{align}
Set
$X=\max\{\vert x_{1} \vert, \vert x_{2} \vert\}$ and $ X_{0}, Y $ be positive.
Assume that
\begin{align}\label{eq:V}
    X\leq X_{0},
\end{align}
and
\begin{align}\label{eq:U}
    \vert\Lambda\vert < c \cdot\exp(-\delta\cdot Y),
\end{align}
where $c, \delta$ be positive constants.
When $\beta\neq0$ in \eqref{eq:T}, put $\vartheta=-\vartheta_{1}/\vartheta_{2}$ and $\psi=\beta/\vartheta_{2}$.
Then we have
\begin{align*}
    \frac{\Lambda}{\vartheta_{2}}=\psi-x_{1}\vartheta+x_{2}.
\end{align*}
Let $p/q$ be a convergent of $\vartheta$ with $q>X_{0}.$ For a real number $x,$ we let
$
\|x\|=\min\{\vert x-n \vert, n \in \mathbb{Z} \}$ be the distance from $x$ to the nearest integer. We have the following result.
\begin{lemma}(\cite[Lemma 3.3]{Weger})\label{le:2.3}
Suppose that
\begin{align*}
    \|q\psi\|>\frac{2X_{0}}{q}.
\end{align*}
Then, the solutions of \eqref{eq:U} and \eqref{eq:V} satisfy
\begin{align*}
     Y<\frac{1}{\delta}\log\left(\frac{q^{2}c}{\vert
     \vartheta_{2}\vert X_{0}}\right).
\end{align*}
\end{lemma}
We state and prove the following lemma which gives a relation between $n$ amd $l+m+k$ of \eqref{eq:1}.
\begin{lemma}
All solutions to the Diophantine equation \eqref{eq:1} satisfy
\begin{equation*}
  (l+m+k)\log10-3<n\log\alpha<(l+m+k)\log10+1.
\end{equation*}
\end{lemma}
\begin{proof}
From \eqref{eq:1} and \eqref{eq:2} we get
\begin{equation*}
   \alpha^{n-3}\leq P_{n}<10^{l+m+k}.
\end{equation*}
Taking logarithm on both sides, we have
\begin{equation*}
  (n-3)\log\alpha<(l+m+k)\log10,
\end{equation*}
which leads to
\begin{equation*}
  n\log\alpha<(l+m+k)\log10+3\log\alpha<(l+m+k)\log10+1.
\end{equation*}
On the other hand, for the lower bound, \eqref{eq:1} implies that
\begin{equation*}
  10^{l+m+k-1}<P_{n}\leq\alpha^{n-1}.
\end{equation*}
Taking logarithm on both sides, we get
\begin{equation*}
  (l+m+k-1)\log10<(n-1)\log\alpha,
\end{equation*} which leads to
\begin{equation*}
  (l+m+k-1)\log10-3<(l+m+k-1)\log10+\log\alpha<n\log\alpha.
\end{equation*}
\end{proof}
The following result will also be used in our proof.
\begin{lemma}\label{le:*}
If $\lvert e^{z}-1\rvert<y<\frac{1}{2}$ for real values of $z$ and $y$, then $\lvert z\rvert<2y$.
\end{lemma}
\begin{proof}
   If $z\geq0,$ we have $0\leq z\leq e^{z}-1=\lvert e^{z}-1\rvert<y.$ If $z<0,$ then $\lvert e^{z}-1\rvert <\frac{1}{2}.$ From this, we get $e^{\lvert z\rvert}<2,$ and therefore $0<\lvert z \rvert<e^{\lvert z\rvert}-1=e^{\lvert z \rvert} \lvert e^{z}-1\rvert<2y$. so, in both cases, we get $\lvert z\rvert<2y.$
\end{proof}
The following lemma will be used in our proof. It is seen in \cite[Lemma 7]{GUZMAN}.
\begin{lemma}\label{le:q}
Let $r\geq 1$ and $H>0$ be such that $H>(4r^{2})^r$ and $H>L/(\log L)^r$. Then
\begin{align*}
L<2^{r}H(\log H)^r.
\end{align*}
\end{lemma}
\section{Proof of the main result}
Using \textit{Mathematica}, we find all solutions to the Diophantine equation \eqref{eq:1} for $a\geq1$, $0\leq a,b,c\leq9$ and $1\leq n\leq 560$ that are listed in Theorem \ref{Th:1.}. Now, assume that $n>560.$ We ignore the cases $a=b\neq c$ and $a\neq b=c$ since these cases have been treated in \cite{Ddmulir}. We also ignore the case $a=b=c$ as it has been studied in \cite{Ddamulira*}.
Using \eqref{eq:1} and \eqref{eq:3}, we have
\begin{equation}\label{eq:4}
C_{\alpha}\alpha^{n}+C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n}=\frac{1}{9}\left(a 10^{l+m+k}-(a-b)10^{m+k}-(b-c)10^{k}-c\right).
\end{equation}
We can write \eqref{eq:4}as
\begin{equation}\label{eq:5}
9C_{\alpha}\alpha^{n}-a 10^{l+m+k}=-9(C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n})-(a-b)10^{m+k}-(b-c)10^{k}-c.
\end{equation}
Taking absolute values on both sides of \eqref{eq:5}, we have that
\begin{align*}
  \left\vert9C_{\alpha}\alpha^{n}-a 10^{l+m+k}\right \vert & \leq 9\left\vert ( C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n})\right\vert+\lvert(a-b)\rvert10^{m+k}+\lvert(b-c)\rvert10^{k}+\lvert c\rvert\\
  &\leq9\alpha^{-n/2}+9\cdot10^{m+k}+9\cdot10^{k}+9\\
  &<11\cdot10^{m+k}
\end{align*}
Dividing both sides of the above inequality by $a10^{l+m+k}$ gives
\begin{equation}\label{eq:6}
  \left\vert \left(\frac{9C_{\alpha}}{a}\right)\alpha^{n}10^{-(l+m+k)}-1\right\vert<\frac{11\cdot10^{m+k}}{a10^{l+m+k}}<\frac{11}{10^{l}}.
\end{equation}
Let
\begin{equation*}
  \Gamma_{1}=\left(\frac{9C_{\alpha}}{a}\right)\alpha^{n}10^{-(l+m+k)}-1.
 \end{equation*}
 Note that $  \Gamma_{1}\neq 0.$ If $  \Gamma_{1}=0,$ then
 \begin{equation}\label{e:*}
   C_{\alpha}\alpha^{n}=\frac{a}{9}10^{l+m+k}.
 \end{equation}
Let $\sigma$ be the automorphism of the Galois group of the splitting field of $f(x)$ over $\mathbb{Q}$ defined by $\sigma(\alpha)=\beta,$ where $f(x)=x^{3}-x-1$ is the minimal polynomial of $\alpha$.
Applying $\sigma$ on both sides of \eqref{e:*}, and taking absolute values, we get
\begin{align*}
  \lvert C_{\beta}\beta^{n}\rvert= \left\vert\left(\frac{a}{9}10^{l+m+k}\right)\right\vert,
\end{align*} which is not possible since $\lvert C_{\beta}\beta^{n}\rvert <1$, whereas $\left\vert\left(\frac{a}{9}10^{l+m+k}\right)\right\vert>1.$
Therefore, $ \Gamma_{1}\neq 0.$
 Now, we are ready to apply Theorem \ref{th:2} with the following data:
\begin{align*}
    \eta_{1}= \frac{9C_{\alpha}}{a},~ \eta_{2}=\alpha,~  \eta_{3}=10,~ b_{1}=1,~ b_{2}=n,~ b_{3}=-(l+m+k),~ l=3,
\end{align*} with $d_{\mathbb{L}}=[\mathbb{Q}(\alpha):\mathbb Q] = 3.$ Since $l+m+k<n,$ take $D =n$. The heights of $\eta_{1}, \eta_{2}, \eta_{3}$ are calculated as follows:
\begin{equation*}
   h(\eta_{1})=h(9C_{\alpha}/a)\leq h(9)+h(C_{\alpha})+h(a)\leq 2\log9+\frac{\log23}{3}<5.44,
\end{equation*}
\begin{equation*}
h(\eta_{2})=h(\alpha)=\frac{\log\alpha}{3},~h(\eta_{3})=h(10)=\log 10.
\end{equation*}
Thus, we take
\begin{equation*}
 A _{1}=16.32,~~~A_{2}=\log\alpha,~~~~A_{3}=3\log 10.
\end{equation*}
Applying Theorem \ref{th:2} we find
\begin{align*}
 \log \vert\Gamma_{1}\vert &>-1.4\cdot30^{6}3^{4.5}3^2(1+\log3)(1+\log n)(16.32)(\log\alpha)(3\log 10)\\
 &>-8.58\cdot10^{13}\log(1+\log n).
\end{align*}
Comparing the above inequality with \eqref{eq:6} gives
\begin{align*}
l\log 10-\log 11<8.58\cdot10^{13}(1+\log n),
\end{align*}
which leads to
\begin{equation}\label{eq:14}
 l\log 10<8.59\cdot10^{13}(1+\log n).
\end{equation}
Rewriting \eqref{eq:4} in another way, we have
\begin{equation}\label{eq:7}
     9C_{\alpha}\alpha^{n}-(a 10^{l}-(a-b))10^{m+k}=-9(C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n})-(b-c)10^{k}-c.
\end{equation}
Taking absolute values on both sides of \eqref{eq:7}, we obtain
 \begin{align*}
 \left\vert9C_{\alpha}\alpha^{n}-(a 10^{l}-(a-b))10^{m+k}\right\vert & \leq9\vert(C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n})\vert+\lvert(b-c)\rvert10^{k}+\lvert c\rvert\\
 & \leq 9\alpha^{-n/2}+9\cdot10^{k}+9\\
 &<11\cdot10^{k}
 \end{align*}
  Dividing both sides by $(a 10^{l}-(a-b))10^{m+k}$, we obtain
 \begin{equation}\label{eq:8}
   \left\vert 1-\left(\frac{9C_{\alpha}}{a10^{l}-(a-b)}\right)\alpha^{n}10^{-(m+k)} \right\vert<\frac{11\cdot10^{k}}{(a 10^{l}-(a-b))10^{m+k}}<\frac{11}{10^{m}}.
 \end{equation}
 Put
 \begin{equation*}
    \Gamma_{2}= 1-\left(\frac{9C_{\alpha}}{a10^{l}-(a-b)}\right)\alpha^{n}10^{-(m+k)}.
 \end{equation*}
 By using similar reason as above we can show that $ \Gamma_{2}\neq0$.
 Now, we apply Theorem \ref{th:2} with the following parameters:
\begin{align*}
    \eta_{1}= \frac{9C_{\alpha}}{a10^{l}-(a-b)},~ \eta_{2}=\alpha,~  \eta_{3}=10,~ b_{1}=1,~ b_{2}=n,~ b_{3}=-(m+k),~ l=3,
\end{align*} with $d_{\mathbb{L}}=[\mathbb{Q}(\alpha):\mathbb Q] = 3.$ Since $m+k<n,$ take $D =n$.
 Using the properties of logarithmic height, we estimate $h(\eta_{1})$ as follows:
  \begin{align*}
h(\eta_{1}) & =h\left(\frac{9C_{\alpha}}{a10^{l}-(a-b)}\right) \leq h(9C_{\alpha})+h\left(a10^{l}-(a-b)\right)\\
 & \leq h(9)+h(C_{\alpha})+h(a10^{l})+h(a-b)+\log2\\
 &\leq  h(9)+h(C_{\alpha})+h(a)+lh(10)+h(a)+h(b)+2\log2\\
 &\leq 4\log9+l\log10+\frac{\log23}{3}+2\log2\\
 &<11.23+l\log10.
 \end{align*}
Hence from \eqref{eq:14}, we get
\begin{equation*}
 h(\eta_{1})<11.23+8.59\cdot10^{13}(1+\log n)<8.6\cdot10^{13}(1+\log n).
  \end{equation*}
Furthermore, $h(\eta_{2})=h(\alpha)=\frac{\log\alpha}{3}$ and $h(\eta_{3})=h(10)=\log 10.$
Thus, we take
\begin{equation*}
 A _{1}=25.8\cdot10^{13}(1+\log n),~~~A_{2}=\log\alpha,~~~~A_{3}=3\log 10.
\end{equation*}
By virtue of Theorem \ref{th:2} we have
\begin{align*}
 \log \vert\Gamma_{2}\vert &>-1.4\cdot30^{6}3^{4.5}3^2(1+\log3)(1+\log n)(25.8\cdot10^{13}(1+\log n))(\log\alpha)(3\log 10)\\
 &>-1.36\cdot10^{27}(1+\log n)^{2}.
\end{align*}
Comparing the above inequality with \eqref{eq:8} gives
\begin{align*}
m\log 10-\log 11<1.36\cdot10^{27}(1+\log n)^{2},
\end{align*}
which leads to
\begin{equation}\label{eq:15}
 m\log 10<1.37\cdot10^{27}(1+\log n)^{2}.
\end{equation}
Again, rearranging \eqref{eq:4}, we have
 \begin{equation}\label{eq:9}
  9C_{\alpha}\alpha^{n}-(a 10^{l+m}-(a-b)10^{m}-(b-c))10^{k}=-9(C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n})-c.
 \end{equation}
 Taking absolute values on both sides of \eqref{eq:9}, we obtain
  \begin{align*}
 \left \lvert 9C_{\alpha}\alpha^{n}-(a10^{l+m}-(a-b)10^{m}-(b-c))10^{k}\right\rvert&\leq9\vert(C_{\beta}\beta^{n}+C_{\gamma}\gamma^{n})\vert+\lvert c\rvert\\
 &\leq9\alpha^{n/2}+9<10.
 \end{align*}
 Dividing both sides by $9C_{\alpha}\alpha^{n}$, we obtain
 \begin{equation}\label{eq:10}
   \left\lvert 1-\left(\frac{a10^{l+m}-(a-b)10^{m}-(b-c)}{9C_{\alpha}}\right)\alpha^{-n}10^{k}\right\rvert<\frac{10}{9C_{\alpha}\alpha^{n}}<\frac{2.5}{\alpha^{n}} .
 \end{equation}
 Let
 \begin{equation*}
     \Gamma_{3}= 1-\left(\frac{a10^{l+m}-(a-b)10^{m}-(b-c)}{9C_{\alpha}}\right)\alpha^{-n}10^{k}.
 \end{equation*}
 By using similar arguments as before it is seen that $ \Gamma_{3}\neq0$.
 Now, we apply Theorem \ref{th:2} with the following parameters:
\begin{align*}
    \eta_{1}= \frac{a10^{l+m}-(a-b)10^{m}-(b-c)}{9C_{\alpha}},~ \eta_{2}=\alpha,~  \eta_{3}=10,~ b_{1}=1,~ b_{2}=-n,~ b_{3}=k,~ l=3,
\end{align*} with $d_{\mathbb{L}}=[\mathbb{Q}(\alpha):\mathbb Q] = 3.$ Since $k<n,$ take $D =n$.
 Using the properties of logarithmic height, we estimate $h(\eta_{1})$ as follows:
  \begin{align*}
h(\eta_{1}) & =h\left(\frac{a10^{l+m}-(a-b)10^{m}-(b-c)}{9C_{\alpha}}\right)\\
 &\leq h(a10^{l+m})+h((a-b)10^{m})+h(b-c)+h(9C_{\alpha})+2\log2\\
 & \leq h(a)+h(10^{l+m})+h(a-b)+h(10^{m})+h(b-c)+h(9)+h(C_{\alpha})+2\log2\\
 &\leq  h(9)+(l+m)h(10)+h(a)+h(b)+mh(10)+h(b)+h(c)+h(9)+h(C_{\alpha})+4\log2\\
 &\leq 6\log9+(l+m)\log10+m\log10+\frac{\log23}{3}+4\log2\\
 &<17.1+ l\log10+2m\log10.
 \end{align*}
Hence from \eqref{eq:14} and \eqref{eq:15}, we get
\begin{equation*}
 h(\eta_{1})<17.1+8.59\cdot10^{13}(1+\log n)+2.74\cdot10^{27}(1+\log n)^{2}<2.76\cdot10^{27}(1+\log n)^{2}.
  \end{equation*}
Furthermore, $h(\eta_{2})=h(\alpha)=\frac{\log\alpha}{3}$ and $h(\eta_{3})=h(10)=\log 10.$
Thus, we take
\begin{equation*}
 A _{1}=8.28\cdot10^{27}(1+\log n)^{2},~~~A_{2}=\log\alpha,~~~~A_{3}=3\log 10.
\end{equation*}
Using Theorem \ref{th:2} we have
\begin{align*}
 \log \vert\Gamma_{3}\vert &>-1.4\cdot30^{6}3^{4.5}3^2(1+\log3)(1+\log n)\left(8.28\cdot10^{27}(1+\log n)^{2}\right)(\log\alpha)(3\log 10)\\
 &>-4.35\cdot10^{48}(1+\log n)^{3}.
\end{align*}
Comparing the above inequality with \eqref{eq:10} gives
\begin{align*}
n\log \alpha-\log 2.5<4.35\cdot10^{48}(1+\log n)^{3},
\end{align*}
which further implies
\begin{equation*}
 n<15.6\cdot10^{48}(1+\log n)^{3}.
\end{equation*}
With the notation of Lemma \ref{le:q}, we take $r=3$, $L=n$ and $H=15.6\cdot10^{48}$. Applying Lemma \ref{le:q}, we have
\begin{align*}
n&<2^{3}(15.6\cdot10^{48})(\log(15.6\cdot10^{48})^{3}\\
&<2\cdot10^{56}.
\end{align*}
Now, to reduce the bounds, let
\begin{equation*}
  \Lambda_{1}=(l+m+k)\log 10- n\log\alpha-\log\left(\frac{9C_{\alpha}}{a}\right) .
\end{equation*}
The inequality \eqref{eq:6} can be written as
    \begin{equation*}
     \lvert e^{-\Lambda_{1}}-1\rvert<\frac{11}{10^{l}}.
 \end{equation*}
  Notice that $-\Lambda_{1}\neq0$ as $e^{-\Lambda_{1}}-1=\Gamma_{1}\neq0.$  Assuming $l\geq 2$, the right-hand side in the above inequality is at most $\frac{1}{2}.$
  Using Lemma \ref{le:*} we obtain
\begin{equation*}
 0<\lvert \Lambda_{1}\rvert<\frac{22}{10^l},
\end{equation*}
 which implies that
 \begin{equation*}
    \left\lvert (l+m+k)\log 10- n\log\alpha-\log\left(\frac{9C_{\alpha}}{a}\right)\right\rvert<22\exp(-l\log10) .
 \end{equation*}
 We also have
\begin{align*}
     \frac{\Lambda_{1}}{\log10}=(l+m+k)-n\left(\frac{\log\alpha}{\log10}\right)-\frac{\log(9C_{\alpha}/a)}{\log10}.
\end{align*}
Thus, we take
\begin{align*}
     &c=22,~ \delta=\log10,~ X_{0}=2\cdot10^{56},~ \psi=-\frac{\log(9C_{\alpha}/a)}{\log10}\\
     &\vartheta=\frac{\log\alpha}{\log10},~\vartheta_{1}=-\log\alpha,~\vartheta_{2}=\log10,~\beta=-\log\left(\frac{9C_{\alpha}}{a}\right).
\end{align*}
We find that $\frac{p_{121}}{q_{121}}= \frac{17548495448098062534665425097069587403994668418373610729747}{143694755301644024543505669827725455817494147218758974051600}$ is the $121$th convergent of $\vartheta$ such that $q_{121}>X_{0}$ and it satisfies  $\|q\psi\|>\frac{2X_{0}}{q}$. Applying Lemma \ref{le:2.3}, we get $l<\frac{1}{\log10}\log\left(\frac{ 143694755301644024543505669827725455817494147218758974051600^{2}\cdot 22}{\log10\cdot2\cdot10^{56}}\right)\leq62$.
Now, let
\begin{equation*}
  \Lambda_{2}=(m+k)\log 10- n\log\alpha-\log\left(\frac{9C_{\alpha}}{a10^{l}-(a-b)}\right) .
\end{equation*}
From \eqref{eq:8}, it is seen that
\begin{equation*}
     \lvert e^{-\Lambda_{2}}-1\rvert<\frac{11}{10^{m}}.
\end{equation*}
Notice that $\Lambda_{2}\neq0$ as $e^{-\Lambda_{2}}-1=\Gamma_{2}\neq0.$  Assuming $m\geq 2$, the right-hand side in the above inequality is at most $\frac{1}{2}.$
  Using Lemma \ref{le:*} we obtain
\begin{equation*}
 0<\lvert \Lambda_{2}\rvert<\frac{22}{10^m},
\end{equation*}
 which implies that
 \begin{equation*}
    \left\lvert (m+k)\log 10- n\log\alpha-\log\left(\frac{9C_{\alpha}}{a10^{l}-(a-b)}\right)\right\rvert<22\exp(-m\log10) .
 \end{equation*}
  We also have
\begin{align*}
     \frac{\Lambda_{2}}{\log10}=(m+k)-n\left(\frac{\log\alpha}{\log10}\right)-\frac{\log(9C_{\alpha}/(a10^{l}-(a-b)))}{\log10}.
\end{align*}
We choose
\begin{align*}
     &c=22,~ \delta=\log10,~ X_{0}=2\cdot10^{56},~ \psi=-\frac{\log(9C_{\alpha}/(a10^{l}-(a-b)))}{\log10}\\
     &\vartheta=\frac{\log\alpha}{\log10},~\vartheta_{1}=-\log\alpha,~\vartheta_{2}=\log10,~\beta=-\log\left(\frac{9C_{\alpha}}{a10^{l}-(a-b)}\right).
\end{align*}
We find that $\frac{p_{124}}{q_{124}}= \frac{627183116477915636965979019027840650348169004436382793310275}{5135649646898035023105055510310316619786462973990152740408498}$ is the $124$th convergent of $\vartheta$ such that $q_{124}>X_{0}$ and it satisfies  $\|q\psi\|>\frac{2X_{0}}{q}$. Using Lemma \ref{le:2.3}, we get $m\leq66$.
Now, let
\begin{equation*}
  \Lambda_{3}=k\log 10- n\log\alpha+\log\left(\frac{a10^{l+m}-(a-b)10^{m}-(b-c)}{9C_{\alpha}}\right).
\end{equation*}
From \eqref{eq:10}, it is seen that
\begin{equation*}
     \lvert e^{\Lambda_{3}}-1\rvert<\frac{2.5}{\alpha^{n}}.
\end{equation*}

 Notice that $\Lambda_{3}\neq0$ as $e^{\Lambda_{3}}-1=\Gamma_{3}\neq0.$  Since $n>560$, the right-hand side in the above inequality is at most $\frac{1}{2}.$
Using Lemma \ref{le:*} we obtain
\begin{equation*}
 0<\lvert \Lambda_{3}\rvert<\frac{5}{\alpha^{n}},
\end{equation*}
 which implies that
 \begin{equation*}
    \left\lvert k\log 10- n\log\alpha+\log\left(\frac{a10^{l+m}-(a-b)10^{m}+(b-c)}{9C_{\alpha}}\right)\right\rvert<5\exp(-n\log\alpha) .
 \end{equation*}
  We also have
\begin{align*}
     \frac{\Lambda_{3}}{\log10}=k-n\left(\frac{\log\alpha}{\log10}\right)+\frac{\log((a10^{l+m}-(a-b)10^{m}+(b-c))/9C_{\alpha})}{\log10}.
\end{align*}
Thus, we take
\begin{align*}
     &c=5,~ \delta=\log\alpha,~ X_{0}=2\cdot10^{56},~ \psi=\frac{\log((a10^{l+m}-(a-b)10^{m}+(b-c))/9C_{\alpha})}{\log10}\\
     &\vartheta=\frac{\log\alpha}{\log10},~\vartheta_{1}=-\log\alpha,~\vartheta_{2}=\log10,~\beta=\log\left(\frac{a10^{l+m}-(a-b)10^{m}+(b-c)}{9C_{\alpha}}\right).
\end{align*}
We find that $\frac{p_{125}}{q_{125}}= \frac{2616187734565998164447356816798847641018036629887990573914437}{21422489321292086600361648904597606825079844749495429580710675}$ is the $125$th convergent of $\vartheta$ such that $q_{125}>X_{0}$ and it satisfies  $\|q\psi\|>\frac{2X_{0}}{q}$. Applying Lemma \ref{le:2.3}, we get $n\leq546$, which is a contradiction to our assumption that $n>560$. Hence, the theorem is proved.


Defining Functions on Equivalence Classes

Abstract: A quotient construction defines an abstract type from a concrete type, using an equivalence relation to identify elements of the concrete type that are to be regarded as indistinguishable. The elements of a quotient type are \emph{equivalence classes}: sets of equivalent concrete values. Simple techniques are presented for defining and reasoning about quotient constructions, based on a general lemma library concerning functions that operate on equivalence classes. The techniques are applied to a definition of the integers from the natural numbers, and then to the definition of a recursive datatype satisfying equational constraints.

\section{Introduction}

Equivalence classes and quotient constructions are familiar to every
student of discrete mathematics. They are frequently used for defining
abstract objects. A typical example from the $\lambda$-calculus is
$\alpha$-equivalence, which identifies terms that differ only by the
names of bound variables. Strictly speaking, we represent a term by the set
of all terms that can be obtained from it by renaming variables. In order
to define a function on terms, we must show that the result is independent
of the choice of variable names. Here we see the drawbacks of
using equivalence classes: individuals are represented by sets and function
definitions carry a proof obligation.

Users of theorem proving tools are naturally inclined to prefer concrete
methods whenever possible. With their backgrounds in computer science, they
will see functions as algorithms and seek to find canonical representations
of elements. We can replace $\alpha$-equivalence by de Bruijn
variables~\cite{debruijn72}. Other common applications of equivalence
classes can similarly be replaced by
clever data structures. However, such methods can make proofs
unnecessarily difficult.

The automated reasoning community already uses equivalence classes. I
conducted an informal e-mail survey and learned of applications using
ACL2, Coq, HOL, Mizar and PVS\@. There must be other applications.
However,
ACL2~\cite{acl2} does not use equivalence classes; it obtains a
similar effect through its ability to rewrite a term with respect to
any equivalence relation
\footnote{Documentation is on the Internet at
\url{http://www.cs.utexas.edu/users/moore/acl2/v2-7/EQUIVALENCE.html}}
The work in Coq is specific to constructive type theory and
uses the concept of setoid~\cite{geuvers-constructive}. The work using HOL requires the use of special purpose
code~\cite{harrison94,homeier-quotient}. If we consider the huge
amount of mathematics that has been formalised, it seems that uses of
equivalence classes are rare.

The object of this paper is to show that with the right definitions,
working with equivalence classes is easy. The approach will work in any
theorem prover that admits the formalisation of basic set theory. Function
definitions are made in a stylised but readable form. Once a function is
shown to respect the equivalence relation, further proofs can be undertaken
as they would be in a mathematics textbook: by assuming as given an
arbitrary representative of the equivalence class. Higher-order logic is
sufficient, by the obvious representation of typed sets by predicates;
untyped axiomatic set theory is also sufficient. The axiom of choice is
not required. The tool does not need to be programmable. The examples
in this paper have been done using Isabelle/HOL~\cite{isa-tutorial}.

The paper provides a brief review of equivalence classes
(\S\ref{sec:background}). It then outlines a formal lemma library for
equivalence classes (\S\ref{sec:Equiv}), which it demonstrates using
a construction of the integers (\S\ref{sec:IntDef}). It then
demonstrates how equational constraints can be imposed on a recursive
datatype (\S\ref{sec:quodatatype}). Finally, the paper
presents brief conclusions (\S\ref{sec:concl}).

\section{Equivalence Classes and Quotient Sets}\label{sec:background}

This section is a brief review of the mathematics required for this paper.
Thorough descriptions of the concepts appear in standard
textbooks~\cite[p.\ts128]{kolman-discrete}.

An \emph{equivalence relation} over a set is any relation that
is reflexive, symmetric and transitive. Each of the following examples
is easily shown to be an equivalence relation.

\begin{itemize}
\item $\alpha$-equivalence has already been mentioned in the introduction.

\item The integers can be defined as equivalence classes
on pairs of natural numbers related by
$(x,y)\sim(u,v)$ if and only if $x+v=u+y$.

\item The rational numbers can be defined as equivalence classes on pairs
of integers related by $(x,y)\sim(u,v)$ if and only if $xv=uy$, where $y$,
$v\not=0$. Since $y$ and $v$ must be non-zero, it is an equivalence
relation on the set $\mathbb Z\times (\mathbb Z\setminus\{0\})$.
\end{itemize}

We can often do without equivalence classes.
The integers can be defined using a signed magnitude representation. The
rational numbers can be defined as fractions in reduced form. The drawbacks
of both representations become clear when we try to prove that addition is
associative. A signed magnitude representation requires case analysis on
the sign and the consideration of eight cases; proving the
associative law for reduced fractions will require a body of theory about
greatest common divisors~\cite[\S3]{harrison94}.

If ${\sim}$ is an equivalence relation over a set~$A$, and $x\in A$, then
$[x]_{\sim}$ denotes $\{y\mid y\sim x\}$ and is called an \emph{equivalence class}. The notation simplifies to $[x]$ when ${\sim}$ is fixed in advance.
Because ${\sim}$ is reflexive, an equivalence
class is always non-empty. Because $\sim$ is symmetric and transitive,
equivalence classes are disjoint: if two equivalence classes
have an element in common, then they are equal. The equivalence
relation therefore partitions the set~$A$. The quotient set $A/{\sim}$ is defined to be the set of equivalence classes generated by~${\sim}$.

Let us examine the construction of the integers. Here $A$ is the set of
pairs of natural numbers. As mentioned above, the equivalence relation
is $(x,y)\sim(u,v)$ if and only if $x+v=u+y$. The
integer 0 and functions for negation, addition and multiplication are
defined in terms of equivalence classes.
\begin{align*}
    0  &= [(0,0)] \\
    {}-[(x,y)] &= [(y,x)] \\
    [(x,y)] + [(u,v)] &= [(x+u,y+v)] \\
    [(x,y)] \times [(u,v)] &= [(xu+yv,xv+vu)]
\end{align*}
The intuition is that $[(x,y)]$ represents
the integer $x-y$, so clearly the negation of  $[(x,y)]$ must be $[(y,x)]$.
The definition of multiplication is obtained by evaluating the product
$(x-y)(u-v)$.

Such definitions are only legitimate if they are independent
of the particular elements chosen from the equivalence classes. For example, negation is well-defined
because $[(x,y)]=[(x',y')]$ implies $-[(x,y)]=-[(x',y')]$. The statement that a function respects an equivalence relation is called a
\emph{congruence property}. For negation, it is easily verified: if
$(x,y)\sim(x',y')$, then $x+y'=x'+y$, so $y+x'=y'+x$ and thus
$(y,x)\sim(y',x')$. The congruence property for addition is harder  to
verify and that for multiplication is harder still. These proof obligations
are the chief drawback of using equivalence classes. Once we have verified
the congruence properties, developing the theory of the integers is easy.

To prove $-(-z)=z$, write the integer $z$ as $[(x,y)]$. (We have just
proved that the choice of $x$ and $y$ is irrelevant.) Now trivially
\[ -(-[(x,y)]) = -[(y,x)] = [(x,y)].\]
The proof that addition is associative appeals to the corresponding
property for the natural numbers:
\begin{align*}
 \bigl([(x_1,y_1)] + [(x_2,y_2)]\bigr) + [(x_3,y_3)]
   &=[(x_1+x_2+x_3,y_1+y_2+y_3]) \\
   &= [(x_1,y_1)] + \bigl([(x_2,y_2)] + [(x_3,y_3)]\bigr).
\end{align*}

All of these proofs work in the same way. We write the given integers as
pairs of natural numbers. We simplify the expression using function
definitions that have already been shown to be legitimate. We are left with
elementary reasoning about the natural numbers. If we formalise equivalence
relations appropriately, the formal proofs will be as natural as those
shown above.

\section{A Formalization of Equivalence Classes}\label{sec:Equiv}

The key to effective use of equivalence classes is to give definitions in a
particular form and to simplify them using particular lemmas. The
formalization is designed to make
the machine proofs as simple as possible, for any verifier. Unions capture
the possible ambiguity in a function defined on equivalence classes. For a
well-defined function, there will be no ambiguity.

This section
presents the most important components of the formalisation, omitting
obvious definitions and routine proofs. The approach should work with tools
such as HOL~\cite{mgordon-hol} and PVS~\cite{pvs-long-tutorial}. Isabelle
output is shown, using mathematical symbols that are largely
self-explanatory. Note that the Isabelle statement
$\lbrakk P_1; \ldots; P_n\rbrakk \Rightarrow Q$
is equivalent to $P_1\Rightarrow \ldots\Rightarrow P_n \Rightarrow Q$
and denotes the inference rule $\frac{P_1\;\ldots\; P_n}{Q.}$

Another notation in need of explanation is the image operator. A relation in
Isabelle/HOL is a set of ordered pairs. The notation $R``A$ denotes
the image of the set ~$A$ under the relation~$R$, namely $\{y\mid \exists x\in A\;(x,y)\in R\}$. In particular, $R``\{x\}$ denotes $\{y\mid (x,y)\in R\}$,
which is the equivalence class $[x]_R$ when $R$ is an equivalence
relation. (HOL users traditionally represent the relation~$R$ as a
function of type
$\alpha\to\alpha\to\isa{bool}$. They can express the equivalence class
$[x]_R$ by currying: $R\,x$. Either approach is acceptable.)

The predicate \isa{equiv\ A\ r} denotes that \isa{r} is an equivalence
relation on the set~\isa{A}\@. This concept is easily defined and its basic
properties proved. Let us therefore focus on the theorems that are directly
relevant to working with quotient types. This theorem, concerning equality
between equivalence classes, is useful in congruence proofs.
\begin{isabelle}
\isacommand{theorem}\ eq\_equiv\_class\_iff:\isanewline
\ \ "\isasymlbrakk equiv\ A\ r; \ x\ \isasymin \ A; \ y\ \isasymin \ A\isasymrbrakk\isanewline
\ \ \ \isasymLongrightarrow \ (r``\isacharbraceleft x\isacharbraceright \ =\ r``\isacharbraceleft y\isacharbraceright )\ =\
((x,y)\ \isasymin \ r)"
\end{isabelle}
The quotient set \isa{A//r} is defined to be the set of equivalence
classes.
\begin{isabelle}
\ \ "A//r\ \isasymequiv \ \isasymUnion x\ \isasymin \ A.\ \isacharbraceleft r``\isacharbraceleft x\isacharbraceright \isacharbraceright "\ \ \end{isabelle}
The combination of unions and singleton sets in this definition captures
the concept of a set comprehension. I have formalized
$\{f(x)\mid x\in A\}$ by $\bigcup_{x\in A}\{f(x)\}$. This technique
generalizes nicely:
\[ \{f(x_1, \ldots, x_n)\mid x_1\in A_1, \ldots, x_n\in A_n\} =
   \bigcup_{x_1\in A_1}\ldots\bigcup_{x_n\in A_n}\{f(x_1, \ldots, x_n)\}. \]
I use the same technique below when defining functions over equivalence
classes. Nested unions of singleton sets work well. If an alternative
formalization is chosen, then the lemmas proved below about unions
must be reformulated accordingly.

Crucial to the method is the
treatment of congruence properties.  The formula \isa{f\ respects\ r} expresses%
\footnote{Suggested by Rob Arthan. Previously, I used a less intuitive notation, \isa{\footnotesize congruent\ r\ f}.}
that the function \isa{f} respects the
relation~\isa{r}. That is, \isa{f} returns equal results for arguments
that are related by~\isa{r}.
\begin{isabelle}
f\ respects\ r\ \isasymequiv \ \isasymforall y\ z.\ (y,z)\ \isasymin \ r\ \isasymlongrightarrow \ f\ y\ =\ f\ z
\end{isabelle}
This definition does not constrain the domain and range of~\isa{f},
but in the lemmas involving unions, this function must range over
sets. In practice, these sets will either be singletons or
equivalence classes. In untyped set theory, where everything is a set,
they could be anything.

The next lemma expresses the central idea of the approach, although
users do not invoke it directly. It eliminates unions over constant
functions. For all values in its domain (namely~\isa{A}),
the function~\isa{f} returns the set~\isa{c}.
\begin{isabelle}
\isacommand{lemma}\ "\isasymlbrakk a\ \isasymin \ A; \ \isasymforall y\ \isasymin
\ A.\ f\ y\ =\ c\isasymrbrakk\ \isasymLongrightarrow \ (\isasymUnion y\ \isasymin \
A.\ f\ y)\ =\ c"
\end{isabelle}

The following lemma is again crucial. It eliminates a union over the
elements of an equivalence class provided the function respects the
equivalence relation. Such
unions will appear in the definitions of functions over quotient types. The
removal of the union is precisely the simplification we need to obtain
natural reasoning.
\begin{isabelle}
\isacommand{lemma}\ UN\_equiv\_class:\isanewline
\ \ \ \ \ "\isasymlbrakk equiv\ A\ r;\ f\ respects\ r;\ a\ \isasymin \ A\isasymrbrakk\isanewline
\ \ \ \ \ \ \isasymLongrightarrow \ (\isasymUnion x\ \isasymin \
r``\isacharbraceleft a\isacharbraceright .\ f\ x)\ =\ f\ a"
\end{isabelle}

For two-argument functions, we have the predicate \isa{congruent2}, where
\isa{congruent2\ r1\ r2\ f} means the function
\isa{f} respects the relations~\isa{r1} and~\isa{r2}.
\begin{isabelle}
\ \ \ \isasymforall x\ y\ u\ v.\ (x,y)\ \isasymin \ r1\ \isasymlongrightarrow\ (u,v)\ \isasymin \ r2\ \isasymlongrightarrow \ f\ x\ u\ =\ f\ y\ v
\end{isabelle}
The intuitive syntax \isa{f\ respects2\ r} abbreviates the common situation
when the two relations are identical, \isa{congruent2\ r\ r\ f}.

The congruence property for a two-argument function can be shown directly
from the definition. Occasionally, it is easier to show \isa{congruent2\
r1\ r2\ f} by showing that \isa{f} respects each relation separately.
It also suffices to show that \isa{f} is commutative and respects a
relation in one argument. These straightforward lemmas, based on
Harrison's HOL formalization, are omitted.

Here is a lemma to eliminate unions over the elements
of equivalence classes, this time for two arguments.
\begin{isabelle}
\isacommand{lemma}\ UN\_equiv\_class2:\isanewline
\ \ "\isasymlbrakk equiv\ A\ r1;\ equiv\ A\ r2;\ congruent2\ r1\ r2\ f;\ a1\ \isasymin \ A;\ a2\ \isasymin \ A\isasymrbrakk \isanewline
\ \ \ \isasymLongrightarrow \ (\isasymUnion x1\ \isasymin \ r1``\isacharbraceleft a1\isacharbraceright .\
\isasymUnion x2\ \isasymin \ r2``\isacharbraceleft a2\isacharbraceright .\ f\ x1\
x2)\ =\ f\ a1\ a2"
\end{isabelle}
It follows from the one argument case. The proof uses two lemmas
concerning functions that satisfy \isa{congruent2\ r1\ r2\ f}. The first
lemma asserts that the one-argument function \isa{f\ a}
obtained by currying, where \isa{a\ \isasymin \ A},  respects~\isa{r2}.
The second lemma
asserts that \isa{\isasymUnion x2\ \isasymin \ r2``\isacharbraceleft
a2\isacharbraceright .\ f\ x1\ x2} respects~\isa{r1} when viewed as a
function of~\isa{x1}.

One further lemma is helpful. Isabelle~\cite[\S8.2.1]{isa-tutorial} and HOL
both allow a tuple of bound variables to appear wherever a bound variable
is expected. They are translated into a primitive un-curry operator. For
example, $\bigcup_{(x,y)\in A}\,B x y$ abbreviates $\bigcup_{z\in
A}\,(\lambda(x,y).\,B x y) z$, where $\lambda(x,y).\,B x y$ satisfies the
equation
\[ (\lambda(x,y).\,B x y)(X,Y) = B X Y. \]
The lemma rewrites the
left-hand side (which users may employ in definitions) into nested unions,
a form that allows the application of the union lemma.
\begin{isabelle}
\isacommand{lemma}\ UN\_UN\_split\_split\_eq:\isanewline
\ \ \ "(\isasymUnion (x1,x2)\ \isasymin \ X.\ \isasymUnion (y1,y2)\ \isasymin \ Y.\ A\ x1\ x2\ y1\ y2)\ =\isanewline
\ \ \ \ (\isasymUnion x\isasymin X.\ \isasymUnion y\isasymin Y.\ (\isasymlambda (x1,x2).\ (\isasymlambda (y1,y2).\ A\ x1\ x2\ y1\ y2)\ y)\ x)"
\end{isabelle}
The lemma is unnecessary for people who are willing to use the projection
functions \isa{fst} and \isa{snd} (\isa{PROJ.1} and \isa{PROJ.2} in PVS)\@.
It is specific to the common case where the representing set~\isa{A}
consists of ordered pairs.

\section{Example: Defining the Integers Formally} \label{sec:IntDef}

This section applies the lemma library to a formal development of the
integers. The technique is independent of particular theorem provers.
Isabelle's approach to type definition (which resembles HOL's)
clutters some of the formulae with abstraction and representation
functions. These will be absent in PVS or in any untyped formalism.

We also need a function \isa{contents} that returns the sole element of a
singleton set. It must satisfy the equation
\isa{contents\ \isacharbraceleft x\isacharbraceright\ = x}. In higher-order logic, defining such a function
requires a definite description (the $\iota$-operator). It does not require
an indefinite description (Hilbert's $\epsilon$-operator) because we are
only interested in singleton sets
\footnote{The Isabelle tutorial
discusses description operators \cite[\S5.10]{isa-tutorial}.}

Standard set theories---untyped and without atoms---satisfy
$\bigcup(\{x\})=x$. We could therefore use $\bigcup$ for \isa{contents},
but we can do better still. Both \isa{contents} and singletons (the
inner
$\{\cdots\}$) can be eliminated from function definitions by virtue of
the equation
\[ \bigcup\left(\bigcup_{x\in A}\,\{f(x)\}\right)=\bigcup_{x\in A}\,f(x). \]
Even in higher-order logic, this simplification can be used to define
some functions whose result involves a set construction. Indeed,
\isa{contents} and singletons can be removed from most of the
definitions below. This section uses the general form in order to
demonstrate the general technique; the next section will use
simplified definitions.

\subsection{Defining the Integers in Isabelle/HOL}

We begin by defining the equivalence relation.
\begin{isabelle}
\ \ \ \ "intrel\ \isasymequiv \ \isacharbraceleft ((x,y),(u,v))\ |\ x\ y\ u\ v.\ x+v\ =\ u+y\isacharbraceright "
\end{isabelle}
Next, we introduce the type int.
\begin{isabelle}
\isacommand{typedef}\ (Integ)\ \ int\ =\ "UNIV//intrel"\isanewline
\ \ \isacommand{by}\ (auto\ simp\ add:\ quotient\_def)
\end{isabelle}
An Isabelle type definition equates a new type to a set.
The command \isa{\isacommand{by}\ (auto\ ...)} proves the set to be non-empty by appealing to the definition of quotients.
The set is given the name \isa{Integ} and is defined to be the set of pairs
of natural numbers quotiented by \isa{intrel}. The polymorphic constant
\isa{UNIV} denotes the universal set, here of type \isa{nat*nat}. The
representation function maps elements of type \isa{int} to elements of type
\isa{nat*nat} belonging to the set \isa{Integ}; the abstraction function
maps in the opposite direction.

Now we can define the integer constants 0 and~1.
\begin{isabelle}
\ \ "0\ \isasymequiv \ Abs\_Integ(intrel\ ``\ \isacharbraceleft (0,0)\isacharbraceright)"\isanewline
\ \ "1\ \isasymequiv \ Abs\_Integ(intrel\ ``\ \isacharbraceleft (1,0)\isacharbraceright)"
\end{isabelle}
Here \isa{intrel\ ``\ \isacharbraceleft (0,0)\isacharbraceright}
denotes the equivalence class $[(0,0)]$, which \isa{Abs\_Integ} coerces to
the new type~\isa{int}.

Now, we can do some preliminary proofs. A trivial equivalence is proved and
given to the simplifier (through the \isa{[simp]} annotation). It unfolds
membership assertions concerning the equivalence relation without unfolding
the definition in other contexts.
\begin{isabelle}
\isacommand{lemma}\ intrel\_iff[simp]:\ "(((x,y),(u,v))\ \isasymin \ intrel)\ =\ (x+v\ =\ u+y)"\isanewline
\isacommand{by}\ (simp\ add:\ intrel\_def)
\end{isabelle}

Proving that \isa{intrel} is an equivalence relation requires a one-line
simplifier call. (\isa{UNIV} again denotes the universal set of type
\isa{nat*nat}.)
\begin{isabelle}
\isacommand{lemma}\ equiv\_intrel:\ "equiv\ UNIV\ intrel"\isanewline
\isacommand{by}\ (simp\ add:\ intrel\_def\ equiv\_def\ refl\_def\ sym\_def\ trans\_def)
\end{isabelle}
A few other routine declarations (omitted) complete the setup of
type~\isa{int}.

Reasoning about the integers requires a theorem
stating that every integer is
represented by a pair of natural numbers. This theorem is trivially
expressed in first-order logic by $\forall z\;\exists x y\;z = [(x,y)]$. In
proofs, this theorem replaces given integer variables by equivalence
classes involving arbitrary natural numbers. Isabelle's natural deduction
framework can express this reasoning step directly as an inference rule.
\begin{isabelle}
\isacommand{lemma}\ eq\_Abs\_Integ\ [cases\ type:\ int]:\isanewline
\ \ \ \ \ "(\isasymAnd x\ y.\ z\ =\ Abs\_Integ(intrel``\isacharbraceleft (x,y)\isacharbraceright )\ \isasymLongrightarrow \ P)\ \isasymLongrightarrow \ P"
\end{isabelle}
The annotation \isa{cases type:\ int} informs Isabelle that case
analysis  on an integer variable---through the \isa{cases}
command---refers to this rule implicitly. This Isabelle-specific
feature should  not be difficult to imitate using other tools. In HOL,
it is easy to write a tactic that takes an integer variable, creates
a suitable instance of the theorem, and eliminates the  existential
quantifiers.

\subsection{A One-Argument Function on Equivalence Classes}

Unary minus illustrates the definition of functions on quotient types.
The idea is simple. We cannot pick an arbitrary element of an equivalence
class, but if the function respects the equivalence relation,
then the choice of element does not
matter. Therefore, we form a set consisting of all values generated by all
elements of the equivalence class. This set will simplify to a singleton,
whose value will be returned via the equation
\isa{contents\ \isacharbraceleft x\isacharbraceright\ = x}.
\begin{isabelle}
\ "-z\ \isasymequiv \ contents\isanewline
\ \ \ \ \ \ \ \ (\isasymUnion (x,y)\isasymin Rep\_Integ z.\ \isacharbraceleft \ Abs\_Integ(intrel``\isacharbraceleft (y,x)\isacharbraceright )\ \isacharbraceright)"
\end{isabelle}
Here \isa{intrel\ ``\ \isacharbraceleft (y,x)\isacharbraceright} denotes
the equivalence class $[(y,x)]$. The argument of \isa{contents} is
the collection of all integers
$[(y,x)]$ such that $(x,y)$ belongs to the equivalence class for~$z$. This
collection will turn out to be a singleton.

\subsubsection{Proving the Characteristic Equation}

Let us apply these ideas to integer negation. We can prove its
\emph{characteristic equation} ${}-[(x,y)] = [(y,x)]$, describing its behaviour on equivalence classes.
\begin{isabelle}
\isacommand{lemma}\ minus:\isanewline
\ \ "-\ Abs\_Integ(intrel``\isacharbraceleft (x,y)\isacharbraceright )\ =\ Abs\_Integ(intrel\ ``\ \isacharbraceleft (y,x)\isacharbraceright )"\isanewline
\isacommand{proof}\ -\isanewline
\ \ \isacommand{have}\ "(\isasymlambda (x,y).\ \isacharbraceleft Abs\_Integ\ (intrel``\isacharbraceleft (y,x)\isacharbraceright )\isacharbraceright )\ respects\ intrel"\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ congruent\_def)\ \isanewline
\ \ \isacommand{thus}\ ?thesis\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ minus\_int\_def\ UN\_equiv\_class\ [OF\ equiv\_intrel])\isanewline
\isacommand{qed}
\end{isabelle}
The first part of the proof concerns congruence: that of
the body of the union in the definition of negation. The
simplifier, given the definition of congruence (\isa{congruent\_def}),
immediately establishes that claim. In general, congruence properties
can be difficult to prove.

The second part of the proof
establishes the desired equation using the definition of negation
(\isa{minus\_int\_def}) and our theorem about unions over equivalence
classes. This part of the proof is always easy. Above,
\isa{UN\_equiv\_class\ [OF\ equiv\_intrel]}  denotes the instance of
\isa{UN\_equiv\_class} for the relation \isa{intrel}; since we have just
proved the necessary congruence property, it is in effect the following
rewrite rule:
\begin{isabelle}
\ \ \ \ \ "(\isasymUnion x\ \isasymin \
intrel``\isacharbraceleft a\isacharbraceright .\ f\ x)\ =\ f\ a"
\end{isabelle}
Using this rule, the left-hand side of the desired equation simplifies
immediately to
\begin{isabelle}
\ "contents\ (\isacharbraceleft \ Abs\_Integ(intrel``\isacharbraceleft (y,x)\isacharbraceright )\ \isacharbraceright)"
\end{isabelle}
Then, because \isa{contents} is applied to a singleton, this simplifies in one step to the desired right-hand side. Even the most basic rewriting
engine can perform the reasoning outlined above.

\subsubsection{An Alternative: the Axiom of Choice}

The obvious way to formalize equivalence classes, used by virtually all
other researchers, employs Hilbert's $\epsilon$-operator to choose a
representative of each equivalence class. In that approach,
negation might be defined as follows:
\begin{isabelle}
\ "-z\ \isasymequiv \ (let\ (x,y) = choose (Rep\_Integ z)\ in\ Abs\_Integ(intrel``\isacharbraceleft (y,x)\isacharbraceright))"
\end{isabelle}
Here, \isa{choose} is a function that returns an arbitrary element of a
given set. This reliance on the axiom of choice does not lessen the proof
obligation: we must still show that the function respects the equivalence
relation. Reasoning about the axiom of choice will be difficult unless
we can find lemmas resembling \isa{UN\_equiv\_class} to eliminate the
operator \isa{choose}. Even if we can, the formalization involving unions
is preferable because it avoids a needless dependence on the axiom of
choice.

\subsubsection{Reasoning about the Newly Defined Function}

Given the characteristic equation, proving properties of unary negation is
trivial. The approach is always the same. First, let the \isa{cases}
command replace integer variables by equivalence classes. Then,
call the simplifier to replace integer constants (such as 0) by their
definitions and to apply the characteristic equation and other
simplification rules. At this point, the formal proof steps duplicate those
of textbook proofs.

Consider the proof that negation is self-cancelling.
\begin{isabelle}
\isacommand{lemma}\ zminus\_zminus:\ "-\ (-\ z)\ =\ (z::int)"\isanewline
\isacommand{apply}\ (cases\ z)\isanewline
\isacommand{apply}\ (simp\ add:\ minus)\isanewline
\isacommand{done}
\end{isabelle}
The \isa{cases} command leaves the following proof state:
\begin{isabelle}
\ 1.\ \isasymAnd x\ y.\ z\ =\ Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (x,\ y)\isacharbraceright )\ \isasymLongrightarrow \ -\ (-\ z)\ =\ z%
\end{isabelle}
The simplifier uses the characteristic equation (\isa{minus}) twice,
each time exchanging the two variables. The machine proof follows the
informal one presented in \S\ref{sec:background} above.
\begin{isabelle}
\ \ -\ (-\ (Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (x,\ y)\isacharbraceright)))\isanewline
\ \ \ \ =\ -\ (Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (y,\ x)\isacharbraceright))\isanewline
\ \ \ \ =\ Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (x,\ y)\isacharbraceright)
\end{isabelle}

\subsection{Two-Argument Functions on Equivalence Classes}

Addition and multiplication illustrate the
treatment of two-argument functions. There are simply two unions
instead of one.
\begin{isabelle}
\ "z\ +\ w\ \isasymequiv \isanewline
\ \ \ \ \ contents\ (\isasymUnion (x,y)\isasymin Rep\_Integ z.\ \isasymUnion (u,v)\isasymin Rep\_Integ w.\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \isacharbraceleft \ Abs\_Integ(intrel``\isacharbraceleft (x+u,\ y+v)\isacharbraceright )\ \isacharbraceright )"\isanewline
\isanewline
\ "z\ *\ w\ \isasymequiv \isanewline
\ \ \ \ \ contents\ (\isasymUnion (x,y)\isasymin Rep\_Integ z.\ \isasymUnion (u,v)\isasymin Rep\_Integ w.\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \isacharbraceleft \ Abs\_Integ(intrel``\isacharbraceleft (x*u\ +\ y*v,\ x*v\ +\ y*u)\isacharbraceright )\ \isacharbraceright )"
\end{isabelle}

The characteristic equation for addition describes its effect
on equivalence classes: $[(x,y)] + [(u,v)] = [(x+u,y+v)]$.
The proof again begins by establishing congruence.
Then the main theorem is established using the definition of addition
and our union theorems for two-argument functions. As with unary negation
above, the proof is a short and simple equational argument.
\begin{isabelle}
\isacommand{lemma}\ add:\isanewline
\ \ \ "Abs\_Integ\ (intrel``\isacharbraceleft (x,y)\isacharbraceright )\ +\ Abs\_Integ\ (intrel``\isacharbraceleft (u,v)\isacharbraceright )\ =\isanewline
\ \ \ \ Abs\_Integ\ (intrel``\isacharbraceleft (x+u,\ y+v)\isacharbraceright )"\isanewline
\isacommand{proof}\ -\isanewline
\ \ \isacommand{have}\ "(\isasymlambda z\ w.\ (\isasymlambda (x,y).\ (\isasymlambda (u,v).\isanewline
\ \ \ \ \ \ \ \ \ \isacharbraceleft Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (x+u,\ y+v)\isacharbraceright )\isacharbraceright )\ w)\ z)\isanewline
\ \ \ \ \ \ \ \ respects2\ intrel"\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ congruent2\_def)\isanewline
\ \ \isacommand{thus}\ ?thesis\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ add\_int\_def\ UN\_UN\_split\_split\_eq\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ UN\_equiv\_class2\ [OF\ equiv\_intrel])\isanewline
\isacommand{qed}
\end{isabelle}
The congruence property, \isa{...\ respects2\ intrel}, looks formidable.
However, manually applying the theorem \isa{UN\_equiv\_class2} displays the
required claim, which we can then paste into the proof script. The
arithmetic decision procedure for the natural numbers makes the proof
trivial.

Consider the proof that unary minus distributes over
addition.
\begin{isabelle}
\isacommand{lemma}\ zminus\_zadd\_distrib:\ "-\ (z\ +\ w)\ =\ (-\ z)\ +\ (-\ w::int)"\isanewline
\isacommand{apply}\ (cases\ z,\ cases\ w)\isanewline
\isacommand{apply}\ (simp\ add:\ minus\ add)\isanewline
\isacommand{done}\end{isabelle}

Here is the proof state after both applications of the \isa{cases} method.
\begin{isabelle}
\ 1.\ \isasymAnd x\ y\ xa\ ya.\isanewline
\isaindent{\ 1.\ \ \ \ }\isasymlbrakk z\ =\ Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (x,\ y)\isacharbraceright );\isanewline
\isaindent{\ 1.\ \ \ \ \ }w\ =\ Abs\_Integ\ (intrel\ ``\ \isacharbraceleft (xa,\ ya)\isacharbraceright )\isasymrbrakk \isanewline
\isaindent{\ 1.\ \ \ \ }\isasymLongrightarrow \ -\ (z\ +\ w)\ =\ -\ z\ +\ -\ w
\end{isabelle}
This subgoal is proved by rewriting using the characteristic equations
for negation and addition. The formal reasoning is essentially
the same as the textbook proof.

The treatment of multiplication is similar. The proof of congruence
(omitted) requires some work because it lies outside the scope
of linear arithmetic. Given that lemma, simple equational reasoning
(as always) establishes the characteristic equation:
\begin{isabelle}
\isacommand{lemma}\ mult:\isanewline
\ \ "Abs\_Integ((intrel``\isacharbraceleft (x,y)\isacharbraceright ))\ *\ Abs\_Integ((intrel``\isacharbraceleft (u,v)\isacharbraceright ))\ =\isanewline
\ \ \ Abs\_Integ(intrel\ ``\ \isacharbraceleft (x*u\ +\ y*v,\ x*v\ +\ y*u)\isacharbraceright )"\isanewline
\isacommand{by}\ (simp\ add:\ mult\_int\_def\ UN\_UN\_split\_split\_eq\ mult\_congruent2\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ \ UN\_equiv\_class2\ [OF\ equiv\_intrel\ equiv\_intrel])
\end{isabelle}

We can now prove the standard theorems relating negation, addition and
multiplication. Each proof consists of \isa{cases} followed by
simplification with characteristic equations and the corresponding
properties of the natural numbers. Other proofs, not shown, are equally
trivial.
\begin{isabelle}
\isacommand{lemma}\ zmult\_zminus:\ "(-\ z)\ *\ w\ =\ -\ (z\ *\ (w::int))"\isanewline
\isacommand{by}\ (cases\ z,\ cases\ w,\ simp\ add:\ minus\ mult\ add\_ac)
\end{isabelle}

\begin{isabelle}
\isacommand{lemma}\ zmult\_assoc:\ "((z1::int)\ *\ z2)\ *\ z3\ =\ z1\ *\ (z2\ *\ z3)"\isanewline
\isacommand{by}\ (cases\ z1,\ cases\ z2,\ cases\ z3,\isanewline
\ \ \ \ simp\ add:\ mult\ add\_mult\_distrib2\ mult\_ac)
\end{isabelle}

\begin{isabelle}
\isacommand{lemma}\ zmult\_commute:\ "(z::int)\ *\ w\ =\ w\ *\ z"\isanewline
\isacommand{by}\ (cases\ z,\ cases\ w,\ simp\ add:\ mult\ add\_ac\ mult\_ac)\
\end{isabelle}

\begin{isabelle}
\isacommand{lemma}\ zadd\_zmult\_distrib:\ "((z1::int)+z2)\ *\ w\ =\ (z1*w)\ +\ (z2*w)"\isanewline
\isacommand{by}\ (cases\ z1,\ cases\ z2,\ cases\ w,\isanewline
\ \ \ \ simp\ add:\ add\ mult\ add\_mult\_distrib2\ mult\_ac)
\end{isabelle}

\subsection{Further Operations on the Integers}

The treatment of the ordering (${\le}$) illustrates
an advantage of this approach. A relation in higher-order logic
is a Boolean-valued function, so we could have used nested unions
as we did for addition and multiplication. However, because we are using
native logic rather than a package, we are not
forced to formalise this relation as a function.
\begin{isabelle}
\ \ \ "z\ \isasymle \ (w::int)\ \isanewline
\ \ \ \ \isasymequiv \ \isasymexists x\ y\ u\ v.\ x+v\ \isasymle \ u+y\ \&\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ (x,y)\ \isasymin\ Rep\_Integ\ z\ \&\ (u,v)\ \isasymin \ Rep\_Integ\ w"
\end{isabelle}

We can prove the characteristic equation directly, without proving
congruence. The proof is trivial. Informally, the equation is $[(x,y)]\le[(u,v)]\iff x+v \le u+y$.
\begin{isabelle}
\isacommand{lemma}\ le:\isanewline
\ \ "(Abs\_Integ(intrel``\isacharbraceleft (x,y)\isacharbraceright )\ \isasymle \ Abs\_Integ(intrel``\isacharbraceleft (u,v)\isacharbraceright ))\isanewline
\ \ \ =\ (x+v\ \isasymle \ u+y)"\isanewline
\isacommand{by}\ (force\ simp\ add:\ le\_int\_def)
\end{isabelle}

The proofs about the ordering are largely straightforward, and
are therefore omitted. The only difficult one is the monotonicity of multiplication, and it would be no easier using other treatments of
quotient types.

A final example is the coercion from integers to natural numbers.
It illustrates a function that leaves the integers.
\begin{isabelle}
\ \ \ \ "nat\ z\ \isasymequiv \ contents\ (\isasymUnion (x,y)\ \isasymin \ Rep\_Integ z.\ \isacharbraceleft \ x-y\ \isacharbraceright )"
\end{isabelle}
This function respects the equivalence relation, and its characteristic
equation is $\mathrm{nat}[(x,y)] = x-y$.  Note that
$x-y$ is natural number subtraction and that $x-y=0$ if $x\le y$.
\begin{isabelle}
\isacommand{lemma}\ nat:\ "nat\ (Abs\_Integ\ (intrel``\isacharbraceleft (x,y)\isacharbraceright ))\ =\ x-y"\isanewline
\isacommand{proof}\ -\isanewline
\ \ \isacommand{have}\ "(\isasymlambda (x,y).\ \isacharbraceleft x-y\isacharbraceright)\ respects\ intrel"\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ congruent\_def,\ arith)\ \isanewline
\ \ \isacommand{thus}\ ?thesis\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ nat\_def\ UN\_equiv\_class\ [OF\ equiv\_intrel])\isanewline
\isacommand{qed}
\end{isabelle}
Using this characteristic equation, theorems relating the function \isa{nat}
to the other integer operations are trivial to prove.

\section{Quotienting a Recursive Data type}\label{sec:quodatatype}

Another application of equivalence relations is to impose equations on recursive
datatypes. The necessary declarations are voluminous, but they are not
complicated and can be produced with the assistance of cut-and-paste. This section
presents an example inspired by cryptographic protocols. Many symmetric-key
cryptosystems provide separate decryption and encryption operations, which are
inverses of each other. Writing decryption of message~$X$ using key~$K$ as $D_K(X)$
and the corresponding encryption as $E_K(X)$, we have the equations
$D_K(E_K(X))=X$ and $E_K(D_K(X))=X$. Decryption can be applied to any
message, not just to the result of an encryption.

To define a datatype with equational constraints, first define an ordinary
datatype (which will be a free algebra). Then, define an equivalence
relation expressing the desired equations; the precise form is illustrated
below. Finally, quotient the datatype. The free datatype constructors are
easily lifted to the new recursive datatype, using the techniques of
function definition described above.  To define other functions on the new
datatype, first define a concrete version on the free datatype and then
lift it.

\subsection{The Concrete Datatype and the Equivalence Relation}

This simple datatype has four constructors: a message can be a nonce (a number),
the concatenation of two messages, an encryption or a decryption.
\begin{isabelle}
\isacommand{datatype}\isanewline
\ \ \ \ \ freemsg\ =\ NONCE\ \ nat\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ |\ MPAIR\ \ freemsg\ freemsg\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ |\ CRYPT\ \ nat\ freemsg\ \ \isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ |\ DECRYPT\ \ nat\ freemsg
\end{isabelle}

The equivalence relation, \isa{msgrel}, is defined inductively. The first
two rules (\isa{CD} and \isa{DC}) express the desired equations between
encryption and decryption. The next
four rules (\isa{NONCE} to \isa{DECRYPT}) have many purposes. They make the
equations hold for sub-messages; they allow the abstract constructors to
respect \isa{msgrel}; they ensure that \isa{msgrel} is reflexive. The last
two rules (\isa{SYM} and \isa{TRANS}) ensure that \isa{msgrel} is
symmetric and transitive.
\begin{isabelle}
\isacommand{inductive}\ "msgrel"\isanewline
\ \ \isakeyword{intros}\ \isanewline
\ \ \ \ CD:\ \ \ \ "CRYPT\ K\ (DECRYPT\ K\ X)\ \isasymsim \ X"\isanewline
\ \ \ \ DC:\ \ \ \ "DECRYPT\ K\ (CRYPT\ K\ X)\ \isasymsim \ X"\isanewline
\ \ \ \ NONCE:\ "NONCE\ N\ \isasymsim \ NONCE\ N"\isanewline
\ \ \ \ MPAIR:\ "\isasymlbrakk X\ \isasymsim \ X';\ Y\ \isasymsim \ Y'\isasymrbrakk \ \isasymLongrightarrow \ MPAIR\ X\ Y\ \isasymsim \ MPAIR\ X'\ Y'"\isanewline
\ \ \ \ CRYPT:\ "X\ \isasymsim \ X'\ \isasymLongrightarrow \ CRYPT\ K\ X\ \isasymsim \ CRYPT\ K\ X'"\isanewline
\ \ \ \ DECRYPT:\ "X\ \isasymsim \ X'\ \isasymLongrightarrow \ DECRYPT\ K\ X\ \isasymsim \ DECRYPT\ K\ X'"\isanewline
\ \ \ \ SYM:\ \ \ "X\ \isasymsim \ Y\ \isasymLongrightarrow \ Y\ \isasymsim \ X"\isanewline
\ \ \ \ TRANS:\ "\isasymlbrakk X\ \isasymsim \ Y;\ Y\ \isasymsim \ Z\isasymrbrakk \ \isasymLongrightarrow \ X\ \isasymsim \ Z"
\end{isabelle}
The relation~\isa{\isasymsim} is easily proved to be reflexive, symmetric
and transitive. The proof of \isa{X\isasymsim X} is by structural induction on
the message~\isa{X}\@.

\subsection{Two Functions on the Free Algebra}\label{sec:free-functions}

Two examples will illustrate how functions are lifted to the quotiented abstract datatype. Obviously, we can only consider functions that
respect the equivalence relation. Both of these functions ignore encryption
and decryption altogether, so they are acceptable.

The function \isa{freenonces} returns the set of all nonces present in a message.
It is defined by structural recursion.
\begin{isabelle}
\ \ \ "freenonces\ (NONCE\ N)\ =\ \isacharbraceleft N\isacharbraceright "\isanewline
\ \ \ "freenonces\ (MPAIR\ X\ Y)\ =\ freenonces\ X\ \isasymunion \ freenonces\ Y"\isanewline
\ \ \ "freenonces\ (CRYPT\ K\ X)\ =\ freenonces\ X"\isanewline
\ \ \ "freenonces\ (DECRYPT\ K\ X)\ =\ freenonces\ X"
\end{isabelle}
This function respects the equivalence relation.  The one-line proof
appeals to induction on the definition of~\isa{\isasymsim} followed
by simplification.
\begin{isabelle}
\isacommand{theorem}\ msgrel\_imp\_eq\_freenonces:\ \isanewline
\ \ \ \ "U\ \isasymsim \ V\ \isasymLongrightarrow \ freenonces\ U\ =\ freenonces\ V"\isanewline
\isacommand{by}\ (erule\ msgrel.induct,\ auto)
\end{isabelle}

The function \isa{freeleft} returns the left part of the topmost \isa{MPAIR}
constructor.  (The lifted version, \isa{left}, will be a destructor function for the abstract
\isa{MPair} constructor.) The cases for \isa{CRYPT} and \isa{DECRYPT} make it
respect the equivalence relation. The case for \isa{NONCE} makes the
function total, and will yield the further equation
\isa{left\ (Nonce\ N)\ =\ Nonce\ N}.
\begin{isabelle}
\ \ \ "freeleft\ (NONCE\ N)\ =\ NONCE\ N"\isanewline
\ \ \ "freeleft\ (MPAIR\ X\ Y)\ =\ X"\isanewline
\ \ \ "freeleft\ (CRYPT\ K\ X)\ =\ freeleft\ X"\isanewline
\ \ \ "freeleft\ (DECRYPT\ K\ X)\ =\ freeleft\ X"
\end{isabelle}

The proof that \isa{freeleft} respects the equivalence relation resembles the
previous one, but includes an appeal to \isa{msgrel.intros}: a  list of
theorems for proving membership in~\isa{\isasymsim}.
\begin{isabelle}
\isacommand{theorem}\ "U\ \isasymsim \ V\ \isasymLongrightarrow \ freeleft\ U\ \isasymsim \ freeleft\ V"\isanewline
\isacommand{by}\ (erule\ msgrel.induct,\ auto\ intro:\ msgrel.intros)
\end{isabelle}

\subsection{The Abstract Message Type and its Constructors}

The abstract type of messages is declared by quotienting the universal
set (here of type \isa{freemsg}) with the relation~\isa{\isasymsim}.
\begin{isabelle}
\isacommand{typedef}\ (Msg)\ \ msg\ =\ "UNIV//msgrel"\isanewline
\ \ \isacommand{by}\ (auto\ simp\ add:\ quotient\_def)
\end{isabelle}

The abstract versions of the message constructors are called \isa{Nonce},
\isa{MPair}, \isa{Crypt} and \isa{Decrypt}. They are defined as functions
using unions, as we have already seen for the integer operations. The following
definitions do not use the function \isa{contents}; this simplification is possible
because the results are all derived from a set (namely an equivalence class).

\begin{isabelle}
\ "Nonce\ N\ ==\ Abs\_Msg(msgrel``\isacharbraceleft NONCE\ N\isacharbraceright )"\isanewline
\isanewline
\ "MPair\ X\ Y\ ==\isanewline
\ \ \ Abs\_Msg\ (\isasymUnion U\isasymin Rep\_Msg X.\ \isasymUnion V\isasymin Rep\_Msg Y.\ msgrel``\isacharbraceleft MPAIR\ U\ V\isacharbraceright )"\isanewline
\isanewline
\ "Crypt\ K\ X\ ==\ Abs\_Msg\ (\isasymUnion U\isasymin Rep\_Msg X.\ msgrel``\isacharbraceleft CRYPT\ K\ U\isacharbraceright )"\isanewline
\isanewline
\ "Decrypt\ K\ X\ ==\ Abs\_Msg\ (\isasymUnion U\isasymin Rep\_Msg X.\ msgrel``\isacharbraceleft DECRYPT\ K\ U\isacharbraceright )"
\end{isabelle}

Proving the characteristic equations for these constructors is
straightforward. Each equation relates an abstract constructor to the
corresponding concrete constructor. Each congruence proof is immediate by
the definition of the equivalence relation. Recall that the proof of the
characteristic equation from the congruence property is trivial.
\begin{isabelle}
\ "MPair\ (Abs\_Msg(msgrel``\isacharbraceleft U\isacharbraceright ))\ (Abs\_Msg(msgrel``\isacharbraceleft V\isacharbraceright ))\ =\ \isanewline
\ \ Abs\_Msg\ (msgrel``\isacharbraceleft MPAIR\ U\ V\isacharbraceright )"
\end{isabelle}

\begin{isabelle}
\ "Crypt\ K\ (Abs\_Msg(msgrel``\isacharbraceleft U\isacharbraceright ))\ =\ Abs\_Msg(msgrel``\isacharbraceleft CRYPT\ K\ U\isacharbraceright )"
\end{isabelle}

There is no characteristic equation for \isa{Nonce} because its argument is
not an equivalence class. The characteristic equation for \isa{Decrypt}
appears below, with its proof. As always, congruence is
established first.
\begin{isabelle}
\isacommand{lemma}\ Decrypt:\isanewline
\ \ \ \ \ "Decrypt\ K\ (Abs\_Msg(msgrel``\isacharbraceleft U\isacharbraceright ))\ =\isanewline
\ \ \ \ \ \ Abs\_Msg\ (msgrel``\isacharbraceleft DECRYPT\ K\ U\isacharbraceright )"\isanewline
\isacommand{proof}\ -\isanewline
\ \ \isacommand{have}\ "(\isasymlambda U.\ msgrel\ ``\ \isacharbraceleft DECRYPT\ K\ U\isacharbraceright)\ respects\ msgrel"\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ congruent\_def\ msgrel.DECRYPT)\isanewline
\ \ \isacommand{thus}\ ?thesis\isanewline
\ \ \ \ \isacommand{by}\ (simp\ add:\ Decrypt\_def\ UN\_equiv\_class\ [OF\ equiv\_msgrel])\isanewline
\isacommand{qed}
\end{isabelle}
As with the integers, the \isa{cases} lemma lets us replace an abstract
message by its representation as an equivalence class.
\begin{isabelle}
\isacommand{lemma}\ eq\_Abs\_Msg\ [cases\ type:\ msg]:\isanewline
\ \ \ \ \ "(!!U.\ z\ =\ Abs\_Msg(msgrel``\isacharbraceleft U\isacharbraceright )\ ==>\ P)\ ==>\ P"
\end{isabelle}
We now achieve a key objective: \isa{Crypt} and \isa{Decrypt}
are indeed inverses. Both proofs are one-liners using \isa{cases}, the
characteristic equations and the corresponding rule from the inductive
definition of~\isa{\isasymsim}.
\begin{isabelle}
\isacommand{theorem}\ CD\_eq:\ "Crypt\ K\ (Decrypt\ K\ X)\ =\ X"\isanewline
\isacommand{by}\ (cases\ X,\ simp\ add:\ Crypt\ Decrypt\ CD)\isanewline
\isanewline
\isacommand{theorem}\ DC\_eq:\ "Decrypt\ K\ (Crypt\ K\ X)\ =\ X"\isanewline
\isacommand{by}\ (cases\ X,\ simp\ add:\ Crypt\ Decrypt\ DC)
\end{isabelle}
Both proofs implicitly refer to the theorem \isa{eq\_equiv\_class\_iff},
presented in \S\ref{sec:Equiv} above, which relates equality of equivalence
classes to membership in the equivalence relation.

\subsection{Defining Functions on the Abstract Message Type}

To define a function on the abstract message type, first define an
analogous version on the concrete type and prove that it respects
equivalence relation. Then, define the abstract version as usual using
unions.

Recall that the function \isa{freenonces} returns the set of nonces contained in a
concrete message. We are now ready to declare the corresponding abstract function.
\begin{isabelle}
\ \ \ "nonces\ X\ ==\ \isasymUnion U\isasymin Rep\_Msg X.\ freenonces\ U"
\end{isabelle}
Congruence is immediate since \isa{freenonces} respects the equivalence relation,
as we saw in \S\ref{sec:free-functions} above.
\begin{isabelle}
\isacommand{lemma}\ nonces\_congruent:\ "freenonces\ respects\ msgrel"
\isanewline
\isacommand{by}\ (simp\ add:\ congruent\_def\ msgrel\_imp\_eq\_freenonces)
\end{isabelle}

The recursion equations for \isa{nonces}, the abstract function, are
trivial to prove. Here are the first three.
\begin{isabelle}
\ "nonces\ (Nonce\ N)\ =\ \isacharbraceleft N\isacharbraceright "\isanewline
\ "nonces\ (MPair\ X\ Y)\ =\ nonces\ X\ \isasymunion \ nonces\ Y"\isanewline
\ "nonces\ (Crypt\ K\ X)\ =\ nonces\ X"
\end{isabelle}
Here is the fourth equation, including its proof. Observe its similarity
to proofs about the integer operations.
\begin{isabelle}
\isacommand{lemma}\ nonces\_Decrypt:\ "nonces\ (Decrypt\ K\ X)\ =\ nonces\ X"\isanewline
\isacommand{apply}\ (cases\ X)\ \isanewline
\isacommand{apply}\ (simp\ add:\ nonces\_def\ Decrypt\isanewline
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ UN\_equiv\_class\ [OF\ equiv\_msgrel\
nonces\_congruent])\isanewline
\isacommand{done}
\end{isabelle}

Recall that the function \isa{freeleft} returns returns the left part of the topmost
pair in a concrete message. The abstract version is defined using the techniques
just demonstrated.
\begin{isabelle}
\ \ \ "left\ X\ ==\ Abs\_Msg\ (\isasymUnion U\isasymin Rep\_Msg X.\ msgrel``\isacharbraceleft freeleft\ U\isacharbraceright )"
\end{isabelle}
Here are the recursion equations for this abstract destructor function.
\begin{isabelle}
\ "left\ (Nonce\ N)\ =\ Nonce\ N"\isanewline
\ "left\ (MPair\ X\ Y)\ =\ X"\isanewline
\ "left\ (Crypt\ K\ X)\ =\ left\ X"\isanewline
\ "left\ (Decrypt\ K\ X)\ =\ left\ X"
\end{isabelle}

\subsection{Freeness of the Abstract Constructors}

The abstract datatype satisfies equations between some of its constructors,
but the other constructors are still injective. In my experience, the
easiest way to prove such properties is to define explicit destructor
functions, not by inductive proofs over equivalence relations. We have seen
the function \isa{left} above, and the function \isa{right} can be defined
similarly. These two functions make it easy to prove that abstract message
pairing is injective.
\begin{isabelle}
\ "(MPair\ X\ Y\ =\ MPair\ X'\ Y')\ =\ (X=X'\ \&\ Y=Y')"
\end{isabelle}
The function \isa{nonces} makes it easy to prove that the abstract nonce constructor is injective.
\begin{isabelle}
\ "(Nonce\ m\ =\ Nonce\ n)\ =\ (m\ =\ n)"
\end{isabelle}
Surprising as it may seem, the constructors for encryption and decryption
are also injective in the second argument; the proof is trivial, by the
equations relating them.
\begin{isabelle}
\ "(Crypt\ K\ X\ =\ Crypt\ K\ X')\ =\ (X=X')"\ \isanewline
\ "(Decrypt\ K\ X\ =\ Decrypt\ K\ X')\ =\ (X=X')"
\end{isabelle}
They are not injective in the first argument because any abstract message
can be rewritten to have the form of an encryption or decryption with
any desired key. For the same reason, we do not have the
discrimination property \isa{Nonce\ N\ \isasymnoteq \ Crypt\ K\ X}.
However, many discrimination properties do hold, even for \isa{Crypt} and
\isa{Decrypt}. They can be proved by defining a discriminator function on
the concrete datatype, using the methods demonstrated above.
\begin{isabelle}
\ \ \ "freediscrim\ (NONCE\ N)\ =\ 0"\isanewline
\ \ \ "freediscrim\ (MPAIR\ X\ Y)\ =\ 1"\isanewline
\ \ \ "freediscrim\ (CRYPT\ K\ X)\ =\ freediscrim\ X\ +\ 2"\isanewline
\ \ \ "freediscrim\ (DECRYPT\ K\ X)\ =\ freediscrim\ X\ -\ 2"
\end{isabelle}
Because encryptions and decryptions cancel each other, this function
respects the equivalence relation. Lifting this function to the quotiented
type yields a function \isa{discrim} satisfying the four analogous equations
on the abstract message constructors. Thus we can
prove that no nonce equals a message pair.
\begin{isabelle}
\ "Nonce\ N\ \isasymnoteq \ MPair\ X\ Y"
\end{isabelle}
We can also prove many discrimination results involving encryption, such as
this one.
\begin{isabelle}
\ "Crypt\ K\ (Nonce\ M)\ \isasymnoteq \ Nonce\ N"
\end{isabelle}

We have seen just one example of a quotiented datatype. Imposing
equations on the constructors seems to be straightforward, using the
strategy shown above. Establishing other properties, such as inequations,
requires defining suitable functions on the free datatype.

At a referee's request, I have formalized an example involving nested
recursion: a quotiented datatype of expressions, including a constructor to
apply a function to a list of expressions. This development (available upon
request) uses a function to form a equivalence relation on lists from
an equivalence relation on list elements. It also requires a \isa{cases}
lemma analogous to \isa{eq\_Abs\_Msg}, but for lists of expressions. It is
clear that handling the full range of quotient datatypes requires
considerable ingenuity.

\section{Related work and Conclusions}\label{sec:concl}

The aim of this paper is to demystify the process of defining functions
over equivalence classes. Other authors have worked in this field.

Harrison~\citeyear[\S5]{harrison94} has written
an automated package for HOL that
declares the abstract quotient type and operations, returning theorems
about those operations. Its arguments include the equivalence relation, the
desired characteristic equations for each operation, and proofs of each
theorem expressed at the level of representatives. However, such a package
is not essential. The necessary definitions are straightforward, if they
are written as described above, and the reasoning about equivalence classes
poses no difficulties. Not using a package has its advantages: we
do not have to collect all the theorems we shall ever want into one giant
list; we are not restricted to top-level properties but can reason about
equivalence classes within a larger proof; we do not get stuck because the
package developer failed to anticipate our special requirements.

For defining abstract datatypes, the situation is different. Each
constructor and destructor function requires a separate declaration and
congruence proof. The declarations are uniform and the proofs are trivial,
but there are too many of them. Who would like to see the full treatment of
a 20 constructor abstract datatype? Nested and mutual recursion are also
difficult. If such declarations on needed
frequently, the proof tool should provide automated support.

Homeier~\citeyear{homeier-quotient} has developed an elaborate package for HOL
that offers special support for quotient constructions on recursive data
types. Homeier has used it to define a type of $\lambda$-terms quotiented
under $\alpha$-equivalence. Wenzel's treatment of quotient
types in Isabelle uses axiomatic type classes, which streamlines the notation but
tends to require additional type declarations.%
\footnote{See the theory at
\url{http://isabelle.in.tum.de/library/HOL/Library/Quotient.html}.}
Slotosch~\citeyear{slotosch-quotients} has developed an
Isabelle/HOL theory of higher-order quotients based on  partial equivalence
relations.

PVS supports quotients in its standard prelude, but not with dedicated code.
Jackson has done a few examples, including a construction of the
integers (private communication), while Tews~\citeyear{tews-lifting} has
formalized one of the theorems in a theoretical paper on
coalgebras.

All of these other treatments of quotients use the axiom of choice,
typically via Hilbert's $\epsilon$-operator, to pick arbitrary
elements of equivalence classes. However, using the axiom of choice does
not lessen the proof obligations. Pragmatists  may argue that in
verification nobody cares whether choice is used or not. However,
pragmatists should be concerned that reasoning about $\epsilon$-terms is
tricky, while the unions over equivalence classes are simplified away
automatically.

We have seen, through a series of simple examples, how to define functions
on equivalence classes and how to reason about them. No special tools are
required, only a small lemma library. Each function definition must be
expressed in a particular form. Provided it respects the equivalence
relation, its characteristic equation is easily proved. Properties of the
function can then be reduced to properties of the representing type, with
proofs that resemble textbook presentations.

\begin{acks} Rob Arthan, Francis Flannery, Tom Harke,
Farhad Mehta, Lockwood Morris, Markus Wenzel
and the referees commented on this paper.
Peter Homeier provided extensive information about his tools. The U.K.'s
Engineering and Physical Sciences Research Council (EPSRC) supported the
development of Isabelle.
\end{acks}

\bibliographystyle{acmtrans}\raggedright