Thinnable Ideals and Invariance of Cluster Points

Abstract: We define a class of so-called thinnable ideals $\mathcal{I}$ on the positive integers which includes several well-known examples, e.g., the collection of sets with zero asymptotic density, sets with zero logarithmic density, and several summable ideals. Given a sequence $(x_n)$ taking values in a separable metric space and a thinnable ideal $\mathcal{I}$, it is shown that the set of $\mathcal{I}$-cluster points of $(x_n)$ is equal to the set of $\mathcal{I}$-cluster points of almost all its subsequences, in the sense of Lebesgue measure. Lastly, we obtain a characterization of ideal convergence, which improves the main result in [Trans. Amer. Math. Soc. 347 (1995), 1811--1819].

\section{Introduction}\label{sec:intro}

It is well known that the set of ordinary limit points of ``almost every'' subsequence of a real sequence $(x_n)$ coincides with the set of ordinary limit points of the original sequence, in the sense of Lebesgue measure, see Buck \cite{MR0009997}. In the same direction, we prove its analogue for ideal cluster points.

To this aim, let $\mathcal{I}$ be an ideal on the positive integers $\mathbf{N}$, that is, a family of subsets of $\mathbf{N}$ closed under taking finite unions and subsets of its elements. It is assumed that $\mathcal{I}$ contains the collection $\mathrm{Fin}$ of finite subsets of $\mathbf{N}$ and it is different from the whole power set of $\mathbf{N}$. Note that the collection of subsets with zero asymptotic density, i.e.,
$$
\mathcal{I}_{0}:=\left\{S\subseteq \mathbf{N}: \lim_{n\to \infty}\frac{|S\cap [1,n]|}{n}=0\right\},
$$
is an ideal.
Let also $x=(x_n)$ be a sequence taking values in a topological space $X$. We denote by $\Gamma_x(\mathcal{I})$ the set of $\mathcal{I}$-cluster points of $x$, that is, the set of all $\ell \in X$ such that
$$
\{n: x_n \in U\} \notin \mathcal{I}
$$
for all neighborhoods $U$ of $\ell$. Statistical cluster points (that is, $\mathcal{I}_{0}$-cluster points) of real sequences were introduced by Fridy \cite{MR1181163}, cf. also \cite{MR2463821, MR1416085, LMxyz}.
However, it is worth noting that ideal cluster points have been studied much before under a different name. Indeed, as it follows by \cite[Theorem 4.2]{LMxyz}, they correspond to classical ``cluster points'' of a filter $\mathscr{F}$ on $\mathbf{R}$ (depending on $x$), cf. \cite[Definition 2, p.69]{MR1726779}.

As anticipated, the main question addressed here is
to find suitable conditions on $X$ and $\mathcal{I}$ such that
the set of $\mathcal{I}$-cluster points of a sequence $(x_n)$ is equal to the set of $\mathcal{I}$-cluster points of ``almost all'' its subsequences. Finally, we obtain a characterization of ideal convergence. Related results were obtained in \cite{MR0010616, MR0316930, MR1260176,
Miller18, MR3469337,
MR1924673}.

\section{Thinnability}\label{sec:thinnable}

Given $k \in \mathbf{N}$ and \emph{infinite} sets $A,B\subseteq \mathbf{N}$ with canonical enumeration $\{a_n: n \in \mathbf{N}\}$ and $\{b_n: n \in \mathbf{N}\}$, respectively, we write $A\le B$ if $a_n\le b_n$ for all $n \in \mathbf{N}$ and define
$$
A_B:=\{a_b: b \in B\} \,\,\text{ and }\,\,kA:=\{ka: a \in A\}.
$$

\begin{defi}\label{def:thinn}
An ideal $\mathcal{I}$ is said to be \emph{weakly thinnable} if $A_B \notin \mathcal{I}$ whenever $A\subseteq \mathbf{N}$ admits non-zero asymptotic density and $B\notin \mathcal{I}$.

If, in addition, also $B_A\notin \mathcal{I}$ and $X\notin \mathcal{I}$ whenever $X \le Y$ and $Y\notin \mathcal{I}$, then $\mathcal{I}$ is said to be \emph{thinnable}.

\end{defi}
\begin{defi}\label{def:thinn}
An ideal $\mathcal{I}$ is said to be \emph{strechable} if $kA \notin \mathcal{I}$ for all $k \in \mathbf{N}$ and $A\notin \mathcal{I}$.
\end{defi}
The terminology has been suggested from the related properties of finitely additive measures on $\mathbf{N}$ studied in \cite{MR1192311}.
In this regard, $\mathrm{Fin}$ is thinnable and strechable.

This is the case of several other ideals:
\begin{prop}\label{thm:thinnable}
Let $f: \mathbf{N} \to (0,\infty)$ be a definitively non-increasing function such that $\sum_{n\ge 1}f(n)=\infty$. Define the summable ideal
$$
\mathcal{I}_f:=\left\{S\subseteq \mathbf{N}: \sum_{n \in S}f(n)<\infty\right\}.
$$
Then $\mathcal{I}_f$ is thinnable provided $\mathcal{I}_f$ is strechable.

In addition, suppose that
\begin{equation}\label{eq:addlimit}
\liminf_{n\to \infty}\frac{\sum_{i \in [1,n]}f(i)}{\sum_{i \in [1,kn]}f(i)}\neq 0\,\,\,\text{ for all }k \in \mathbf{N}
\end{equation}
and define the Erd{\H o}s--Ulam ideal
$$
\mathscr{E}_f:=\left\{S\subseteq \mathbf{N}: \lim_{n\to \infty}\frac{\sum_{i \in S\cap [1,n]}f(i)}{\sum_{i \in [1,n]}f(i)}=0\right\}.
$$
Then $\mathscr{E}_f$ is thinnable provided $\mathscr{E}_f$ is strechable.
\end{prop}
\begin{proof}
Let us suppose that $A=\{a_n: n\in \mathbf{N}\}$ admits asymptotic density $c>0$ and $B=\{b_n: n\in \mathbf{N}\}\notin \mathcal{I}_f$, that is, $\sum_{n\ge 1}f(b_n)=\infty$. Define the integer $k:=\lfloor 1/c\rfloor+1 \ge 2$ and note that $\sum_{n\ge 1}f(kb_n)=\infty$ by the fact that $\mathcal{I}_f$ is strechable. Then $a_n=\frac{1}{c}n(1+o(1))$ as $n\to \infty$, which implies
\begin{equation}\label{eq:eq1}
\textstyle \sum_{n\ge 1}f(a_{b_n})\ge O(1)+\sum_{n\ge 1}f(kb_{n})=\infty,
\end{equation}
i.e., $A_B \notin \mathcal{I}_f$, hence $\mathcal{I}_f$ is weakly thinnable.
Moreover, observe that
\begin{equation}\label{eq:ineqprop}
\sum_{n\equiv 1\bmod{k}}f(b_n) \ge \sum_{n\equiv 2\bmod{k}}f(b_n)\ge \cdots \ge \sum_{n\equiv 0\bmod{k}}f(b_n) \ge \sum_{\substack{n\equiv 1\bmod{k}, \\  n\neq 1}}f(b_n)
\end{equation}
and note that the first sum is finite if and only if the last sum is finite. Since $I\notin \mathcal{I}_f$, then all the above sums are infinite, which implies that
$$
\sum_{n\ge 1}f(b_{a_n})\ge O(1)+\sum_{n\ge 1}f(b_{kn})=\infty,
$$
i.e., $B_A \notin \mathcal{I}_f$. Lastly, given infinite sets $X,Y \subseteq \mathbf{N}$ with $X\le Y$ and $X \in \mathcal{I}_f$, we have $\sum_{y \in Y}f(y)\le \sum_{x \in X}f(x)<\infty$. Therefore $\mathcal{I}_f$ is thinnable.

The proof of the second part is similar, where \eqref{eq:eq1} is replaced by
$$
\textstyle \sum_{a_{b_n} \le x}f(a_{b_n}) \ge O(1)+\sum_{{b_n} \le x/k}f(k{b_n}).
$$
Moreover, $B\notin \mathscr{E}_f$ implies $kB \notin \mathscr{E}_f$ by the hypothesis of strechability, i.e.,
$$
\textstyle \sum_{{b_n} \le x/k}f(k{b_n}) \neq o\left(\sum_{i \le x/k}f(i)\right);
$$
thanks to \eqref{eq:addlimit}, we conclude that
$$
\textstyle \sum_{{b_n} \le x/k}f(k{b_n}) \neq o\left(\sum_{i \le x}f(i)\right),
$$
hence $A_B \notin \mathscr{E}_f$, which shows that $\mathscr{E}_f$ is weakly thinnable. In addition, we get
\begin{displaymath}
\frac{f(b_{a_1})+\cdots+f(b_{a_n})}{f(1)+\cdots+f(b_{a_n})}\ge \frac{O(1)+f(b_{k})+\cdots+f(b_{kn})}{f(1)+\cdots+f(b_{kn})} \not\to 0,
\end{displaymath}
so that $B_A \notin \mathscr{E}_f$, where the last $\not\to$ comes from a reasoning similar to \eqref{eq:ineqprop}.
Finally, given infinite subsets $X,Y\subseteq \mathbf{N}$ with canonical enumeration $\{x_n:n \in \mathbf{N}\}$ and $\{y_n: n \in \mathbf{N}\}$, respectively, such that $X\le Y$ and $X \in \mathscr{E}_f$, it holds
$$
\frac{f(x_1)+\cdots+f(x_n)}{f(1)+\cdots+f(x_n)}\ge
\frac{f(y_1)+\cdots+f(y_n)}{f(1)+\cdots+f(y_n)}
$$
for all $n \in \mathbf{N}$ therefore $Y \in \mathscr{E}_f$.
\end{proof}

Given a real $\alpha \ge -1$, let $\mathcal{I}_\alpha$ be the collection of subsets with zero $\alpha$-density, that is,
\begin{equation}\label{eq:defalpha}
\mathcal{I}_\alpha:=\left\{S\subseteq \mathbf{N}: \mathrm{d}_\alpha^\star(S)=0\right\}, \,\,\text{ where }\,\,\mathrm{d}_\alpha^\star(S)=\limsup_{n\to \infty}\frac{\sum_{i \in S\cap [1,n]} i^\alpha}{\sum_{i \in [1,n]} i^\alpha}.
\end{equation}

\begin{prop}\label{prop:ialphaideals}
All ideals $\mathcal{I}_\alpha$ are thinnable.
\end{prop}
\begin{proof}
If $\alpha \in [-1,0]$, the claim follows by Proposition \ref{thm:thinnable} (we omit details). Hence, let us suppose hereafter than $\alpha>0$.
Fix infinite sets $X,Y \subseteq \mathbf{N}$ with canonical enumerations $\{x_n: n \in \mathbf{N}\}$ and $\{y_n: n \in \mathbf{N}\}$, respectively, such that $Y \notin \mathcal{I}_\alpha$. Then, there exist an infinite set $S$ such that $|Y \cap [1,y_n]|\ge \lambda y_n$ for all $n \in S$, where $\lambda:=1-\left(1-\frac{1}{2}\mathrm{d}_\alpha^\star(Y)\right)^{\frac{1}{\alpha+1}}>0$. Indeed, in the opposite case, we would have that
$$
\frac{\alpha+1}{y_n^{\alpha+1}}\sum_{i\le n}y_i^\alpha \le \frac{\alpha+1}{y_n^{\alpha+1}}\sum_{i \in ((1-\lambda)y_n,y_n]}i^\alpha \le \left(1-(1-\lambda)^{\alpha+1}\right))(1+o(1))<\frac{2}{3}\mathrm{d}_\alpha^\star(Y)
$$
for all sufficiently large $n$. Since $|Y \cap [1,n]| \le |X \cap [1,n]|$ for all $n$, we conclude that
$$
\frac{1}{x_n^{\alpha+1}}\sum_{i\le n}x_i^\alpha \ge \frac{1}{x_n^{\alpha+1}}\sum_{i\le \lambda y_n}i^\alpha \ge \frac{1}{x_n^{\alpha+1}}\sum_{i\le \lambda x_n}i^\alpha \ge \frac{\lambda^{\alpha+1}}{2}
$$
for all large $n \in S$, so that $X \notin \mathcal{I}_\alpha$.

At this point, fix sets $A,B \subseteq \mathbf{N}$
with canonical enumerations $\{a_n: n \in \mathbf{N}\}$ and $\{b_n: n \in \mathbf{N}\}$, respectively,
such that $A$ admits asymptotic density $c>0$ and $B \notin \mathcal{I}_\alpha$.
Fix also $\varepsilon>0$ sufficiently small and note that there exists $n_0=n_0(\varepsilon) \in \mathbf{N}$ such that $(\nicefrac{1}{c}-\varepsilon)n \le a_n \le (\nicefrac{1}{c}+\varepsilon)n$ for all $n\ge n_0$. In particular, it follows that
$$
\frac{1}{a_{b_n}^{\alpha+1}}\sum_{k\le n}\left(a_{b_k}\right)^\alpha \ge \frac{1}{\left(\frac{1}{c}+\varepsilon\right)^{\alpha+1}{b_n}^{\alpha+1}}\left(O(1)+\sum_{n_0\le k\le n}\left(\frac{1}{c}-\varepsilon\right)^{\alpha}{b_k}^{\alpha}\right).
$$
Therefore, setting $\kappa:=\min\left\{\left(\frac{1}{c}+\varepsilon\right)^{-\alpha-1}, \left(\frac{1}{c}-\varepsilon\right)^{\alpha}\right\}>0$, we obtain
\begin{displaymath}
\begin{split}
\frac{\mathrm{d}_\alpha^\star(A_B)}{\alpha+1}&=\limsup_{n\to \infty}\frac{1}{a_{b_n}^{\alpha+1}}\sum_{k\le n}\left(a_{b_k}\right)^\alpha \ge \limsup_{n\to \infty}\frac{\kappa}{{b_n}^{\alpha+1}}\left(O(1)+\sum_{n_0\le k\le n}\kappa{b_k}^{\alpha}\right) \\
&= \kappa^2\limsup_{n\to \infty}\frac{1}{{b_n}^{\alpha+1}}\sum_{n_0\le k\le n}{b_k}^{\alpha}= \kappa^2 \,\frac{\mathrm{d}_\alpha^\star(B)}{\alpha+1}>0.
\end{split}
\end{displaymath}
This proves that $A_B \notin \mathcal{I}_\alpha$. Finally, let $k$ be an integer greater than $\nicefrac{1}{c}$ and note that $B_A \le B_{k\mathbf{N}}\setminus S$, for some finite set $S$. By the previous observation, it is sufficient to show that $B_{k\mathbf{N}} \notin \mathcal{I}_\alpha$ and this is straightforward by an analogous argument of \eqref{eq:ineqprop}.
\end{proof}

To mention another example, let $\mathcal{I}_{\mathfrak{p}}$ be the \emph{P\'olya ideal}, i.e.,
$$
\mathcal{I}_{\mathfrak{p}}:=\left\{S\subseteq \mathbf{N}: \mathfrak{p}^\star(S)=0\right\}, \,\,\text{ where }\,\,\mathfrak{p}^\star(S)=\lim_{s \to 1^-} \limsup_{n \to \infty} \frac{|S \cap [ns,n]|}{(1-s)n}.
$$
Among other things, the upper P\'olya density $\mathfrak p^\ast$ has found a number of remarkable applications in analysis and economic theory, see e.g. \cite{MR1545027}, \cite{MR0003208} and \cite{MR1656470}.

\begin{cor}\label{cor:polya}
The P\'olya ideal $\mathcal{I}_{\mathfrak{p}}$ is thinnable.
\end{cor}
\begin{proof}
The upper P\'olya density $\mathfrak p^\ast$ is the pointwise limit of the real net of the upper $\alpha$-densities $\mathrm{d}_\alpha^\star$ defined in \eqref{eq:defalpha}, see \cite[Theorem 4.3]{MR3278191}.

Fix infinite sets $X,Y \subseteq \mathbf{N}$ with canonical enumerations $\{x_n: n \in \mathbf{N}\}$ and $\{y_n: n \in \mathbf{N}\}$, respectively, such that $Y \notin \mathcal{I}_\mathfrak{p}$. Then, there exists $\alpha>0$ such that $\mathrm{d}_\alpha^\star(Y)>0$ and, thanks to Proposition \ref{prop:ialphaideals}, we get $\mathrm{d}_\alpha^\star(X)>0$ as well. This implies that $X\notin \mathcal{I}_\mathfrak{p}$. Other properties can be shown similarly.
\end{proof}

Lastly, it is worth noting that there exist summable ideals which are not weakly thinnable: for instance, let $\mathcal{I}_f$ be the ideal defined by $f(2n)=1$ and $f(2n-1)=0$ for all $n \in \mathbf{N}$, so that
$$
\mathcal{I}_f=\{I\subseteq \mathbf{N}: I \cap 2\mathbf{N} \in \mathrm{Fin}\}.
$$
Set $A:=\mathbf{N}\setminus \{1\}$ and $B:=2\mathbf{N}$. Then, $A$ has asymptotic density $1$, $B\notin \mathcal{I}_f$, and $A_B=2\mathbf{N}+1 \in \mathcal{I}_f$. Therefore $\mathcal{I}_f$ is not weakly thinnable.

\section{Main Results}\label{sec:mainresult}

Consider the natural bijection between the collection of all subsequences $(x_{n_k})$ of $(x_n)$ and real numbers $\omega \in (0,1]$ with non-terminating dyadic expansion
$$
\sum_{i\ge 1}d_i(\omega)2^{-i},
$$
where $d_i(\omega)=1$ if $i=n_k$, for some integer $k$, and $d_i(\omega)=0$ otherwise, cf. \cite[Appendix A31]{MR1324786} and \cite{MR1260176}. Accordingly, for each $\omega \in (0,1]$, denote by $x \upharpoonright \omega$ the subsequence of $(x_n)$ obtained by omitting $x_i$ if and only if $d_i(\omega)=0$.

Moreover, let $\lambda: \mathscr{M}\to \mathbf{R}$ denote the Lebesgue measure, where $\mathscr{M}$ stands for the completion of the Borel $\sigma$-algebra on $(0,1]$. Our main result follows:
\begin{thm}\label{thm:main}
Let $\mathcal{I}$ be a thinnable ideal and $(x_n)$ be a sequence taking values in a first countable space $X$ where all closed sets are separable. Then
$$
\lambda\left(\left\{\omega \in (0,1]: \Gamma_x(\mathcal{I})=\Gamma_{x\upharpoonright \omega}(\mathcal{I})\right\}\right)=1.
$$
\end{thm}
\begin{proof}
Let $\Omega$ be the set of normal numbers, that is,
\begin{equation}\label{eq:normal}
\Omega:=\left\{\omega \in (0,1]: \lim_{n\to \infty}\frac{1}{n}\sum_{i=1}^n d_i(\omega)=\frac{1}{2}\right\}.
\end{equation}
It follows by Borel's normal number theorem \cite[Theorem 1.2]{MR1324786} that $\Omega \in \mathscr{M}$ and $\lambda(\Omega)=1$. Then, it is claimed tha
\begin{equation}\label{eq:claim1}
\Gamma_{x\upharpoonright \omega}(\mathcal{I})\subseteq \Gamma_x(\mathcal{I})\,\,\,\text{ for all }\omega \in \Omega.
\end{equation}
To this aim, fix $\omega \in \Omega$ and denote by $(x_{n_k})$ the subsequence $x\upharpoonright \omega$. Let us suppose for the sake of contradiction that $\Gamma_{x\upharpoonright \omega}(\mathcal{I})\setminus \Gamma_x(\mathcal{I}) \neq \emptyset$ and fix a point $\ell$ therein. Then, the set of indexes $\{n_k: k\in \mathbf{N}\}$ has asymptotic density $\nicefrac{1}{2}$ and, for each neighborhood $U$ of $\ell$, it holds $\{k: x_{n_k} \in U\} \notin \mathcal{I}$. This implies
$$
\{n: x_n \in U\} \supseteq \{n_k: x_{n_k} \in U\} \notin \mathcal{I}
$$
by the hypothesis that $\mathcal{I}$ is, in particular, weakly thinnable. Therefore $\{n: x_n \in U\} \notin \mathcal{I}$, which is a contradiction since $\ell$ would be also a $\mathcal{I}$-cluster point of $x$. This proves \eqref{eq:claim1}.

To complete the proof, it is sufficient to show that
\begin{equation}\label{eq:claim2}
\lambda\left(\left\{\omega \in (0,1]: \Gamma_x(\mathcal{I}) \subseteq \Gamma_{x\upharpoonright \omega}(\mathcal{I})\right\}\right)=1.
\end{equation}
This is clear if $\Gamma_x(\mathcal{I})$ is empty. Otherwise, note that $\Gamma_x(\mathcal{I})$ is closed by \cite[Lemma 3.1(iv)]{LMxyz}, hence there exists a non-empty countable dense subset $L$.
Fix $\ell \in L$ and let $(U_m)$ be a decreasing local base of neighborhoods at $\ell$. Fix also $m \in \mathbf{N}$ and define $I:=\{n: x_n \in U_m\}$ which does not belong to $\mathcal{I}$; in particular, $I$ is infinite and we let $\{i_n: n\in \mathbf{N}\}$ be its enumeration. Again by Borel's normal number theorem,
$$
\Theta(\ell,U_m):=\left\{\omega \in (0,1]: \lim_{n\to \infty}\frac{1}{n}\sum_{j=1}^n d_{i_j}(\omega)=\frac{1}{2}\right\}
$$
belongs to $\mathscr{M}$ and has Lebesgue measure $1$. Fix $\omega$ in the above set and denote by $(x_{n_k})$ the subsequence $x\upharpoonright \omega$. Hence, the set
$
J:=\{n: i_n \in \{n_k: k \in \mathbf{N}\}\}
$
admits asymptotic density $\nicefrac{1}{2}$ and, by the thinnability of $\mathcal{I}$, we get $I_J \notin \mathcal{I}$. Lastly, note that
$$
\{k: x_{n_k} \in U_m\} = \{k: n_k \in I\} \le \{n_k: n_k \in I\}=I_J.
$$
Therefore $\{k: x_{n_k} \in U_m\} \notin \mathcal{I}$. In addition, $\Theta(\ell):=\bigcap_{m\ge 1}\Theta(\ell,U_m)$ belongs to $\mathscr{M}$ and has Lebesgue measure $1$. This implies that
$
\lambda\left(\left\{\omega \in (0,1]: \ell \in \Gamma_{x\upharpoonright \omega}(\mathcal{I})\right\}\right)=1.
$
(See also \cite[Theorem 1]{MR0493027} for the case $\mathcal{I}=\mathrm{Fin}$.) At this point, since $L$ is countable, we get
$
\lambda\left(\left\{\omega \in (0,1]: L\subseteq \Gamma_{x\upharpoonright \omega}(\mathcal{I})\right\}\right)=1.
$
Claim \eqref{eq:claim2} follows by the fact that also $\Gamma_{x\upharpoonright \omega}(\mathcal{I})$ is closed by \cite[Lemma 3.1(iv)]{LMxyz}, so that each of these $\Gamma_{x\upharpoonright \omega}(\mathcal{I})$ contains the closure of $L$, i.e., $\Gamma_x(\mathcal{I})$.
\end{proof}

\begin{rmk}\label{rmk:separablemetric}
Separable metric spaces $X$ satisfy the hypotheses of Theorem \ref{thm:main}. Indeed, $X$ is first countable and every closed subset $F$ of $X$ is separable. To prove the latter, let $A$ be a countable dense subset of $X$ and note that
$$
\mathscr{F}:=\{B(a,r) \cap F: a \in A, 0<r \in \mathbf{Q}\}\setminus \{\emptyset\}
$$
is a base for $F$, where $B(a,r)$ is the open ball with center $a$ and radious $r$. Then, a set which picks one point for every set in $\mathscr{F}$ is a countable dense subset of $F$.
\end{rmk}

As a consequence of Proposition \ref{prop:ialphaideals},
Theorem \ref{thm:main}, and Remark \ref{rmk:separablemetric}, we obtain:
\begin{cor}\label{cor:alphadensity}
Let $x$ be a sequence taking values in a separable metric space. Then the set of statistical cluster points of $x$ is equal to the set of statistical cluster points of almost all its subsequences \textup{(}in the sense of Lebesgue measure\textup{)}.
\end{cor}

Similarly, setting $\mathcal{I}=\mathrm{Fin}$, we recover Buck's result \cite{MR0009997}:
\begin{cor}\label{cor:buck}
Let $x$ be a sequence taking values in a separable metric space. Then the set of ordinary limit points of $x$ is equal to the set of ordinary limit points of almost all its subsequences \textup{(}in the sense of Lebesgue measure\textup{)}.
\end{cor}

\begin{comment}
At this point, given a sequence $x=(x_n)$ with values in topological space $X$, we denote by $\Lambda_x(\mathcal{I})$ the set of $\mathcal{I}$-limit points, that is, the set of all $\ell \in X$ such that $x_{n_k} \to \ell$ for some subsequence $(x_{n_k})$ such that $\{n_k: k \in \mathbf{N}\} \notin \mathcal{I}$. With a proof similar to Theorem \ref{thm:main}, the following can be shown (we omit details):
\begin{thm}\label{thm:main2}
Let $\mathcal{I}$ be a thinnable ideal and $(x_n)$ be a sequence taking values in a topological space $X$. Then
$$
\lambda\left(\left\{\omega \in (0,1]: \Lambda_x(\mathcal{I})=\Lambda_{x\upharpoonright \omega}(\mathcal{I})\right\}\right)=1
$$
\end{thm}
\end{comment}

Lastly, we recall that a sequence $x=(x_n)$ taking values in topological space $X$ converges (with respect to an ideal $\mathcal{I}$) to $\ell \in X$, shortened as $x \to_{\mathcal{I}} \ell$, if
$$
\{n: x_n \notin U\} \in \mathcal{I}
$$
for all neighborhoods $U$ of $\ell$.
In this regard, Miller \cite[Theorem 3]{MR1260176} proved that a real sequence $x$ converges statistically to $\ell$, i.e., $x \to_{\mathcal{I}_0}\ell$, if and only if almost all its sequences converge statistically to $\ell$.

This is extended in the following result. Here, we say that an ideal $\mathcal{I}$ is \emph{invariant} if, for each $A\subseteq \mathbf{N}$ with positive asymptotic density, it holds $A_B \notin \mathcal{I}$ if and only if $B\notin \mathcal{I}$ (in particular, $\mathcal{I}$ is weakly thinnable). This condition is strictly related with the so-called ``property (G)'' defined in \cite{MR3568092}.
\begin{thm}\label{thm:oldmiller}
Let $\mathcal{I}$ be an invariant ideal and $x$ be a sequence taking values in a topological space. Then $x \to_\mathcal{I} \ell$ if and only if
$$
\lambda\left(\left\{\,\omega \in (0,1]: x\upharpoonright \omega \to_\mathcal{I} \ell \,\right\}\right)=1.
$$
\end{thm}
\begin{proof}
First, let us suppose that $x \to_\mathcal{I} \ell$ and let $U$ be a neighborhood of $\ell$.
Let $\Omega$ be set of normal numbers defined in \eqref{eq:normal}, fix $\omega \in \Omega$, and denote by $(x_{n_k})$ the subsequence $x\upharpoonright \omega$. Then $I:=\{n:x_n \notin U\} \in \mathcal{I}$ and $A:=\{n_k:k \in \mathbf{N}\}$ has asymptotic density $\nicefrac{1}{2}$. Define $B:=\{k: x_{n_k}\notin U\}=\{k: n_k \in I\}$. Since $\mathcal{I}$ is, in particular, weakly thinnable and $A_B=\{n_k: x_{n_k} \notin U\} \in \mathcal{I}$, it follows that $B \in \mathcal{I}$, i.e., $x\upharpoonright \omega \to_{\mathcal{I}} \ell$.

Conversely,
note that $\lambda(\Omega \cap (1-\Omega))=1$. Hence, there exists $\omega \in \Omega$ such that $x\upharpoonright \omega \to_\mathcal{I} \ell$ and $x\upharpoonright (1-\omega) \to_\mathcal{I} \ell$. It easily follows that $x \to_\mathcal{I} \ell$. Indeed, denoting by $(x_{n_k})$ and $(x_{m_r})$ the subsequences $x\upharpoonright \omega$ and $x\upharpoonright (1-\omega)$, respectively, we have that, for each neighborhood $U$ of $\ell$, it holds $\{k: x_{n_k} \notin U\} \in \mathcal{I}$ and $\{r: x_{m_r} \notin U\} \in \mathcal{I}$.
Since $\{n_k: k \in \mathbf{N}\}$ and $\{m_r: r \in \mathbf{N}\}$ form a partition of $\mathbf{N}$, then
$$
\{n: x_n \notin U\}=\{n_k: x_{n_k} \notin U\} \cup \{m_r: x_{m_r} \notin U\}.
$$
The claim follows by the hypothesis that $\mathcal{I}$ is invariant.
\end{proof}

It is not possible to extend Theorem \ref{thm:oldmiller} on the class of all ideals:
indeed, it has been shown in \cite[Example 2]{MR3568092} that there exists an ideal $\mathcal{I}$ and a real sequence $x$ such that $x \to_{\mathcal{I}} \ell$ and, on the other hand, $\lambda\left(\left\{\,\omega \in (0,1]: x\upharpoonright \omega \to_\mathcal{I} \ell \,\right\}\right)=0$.

\subsection*{Acknowledgments}
The author is grateful to Piotr Miska (Jagiellonian University, PL) and Marek Balcerzak (\L{}\'{o}d\'{z} University of Technology, PL) for several useful comments.

\subsection*{Note added in proof} It turns out that the topological analogue of Theorem \ref{thm:main} is quite different, providing a non-analogue between measure and category. Indeed, it has been shown in \cite{Leo17c} that, if $x$ is a sequence in a separable metric space, then $\{\omega \in (0,1]: \Gamma_x(\mathcal{I}_0)=\Gamma_{x \upharpoonright \omega}(\mathcal{I}_0)\}$ is not a first Baire category set if and only if every ordinary limit point of $x$ is also a statistical cluster point of $x$, that is, $\Gamma_x(\mathrm{Fin})=\Gamma_x(\mathcal{I}_0)$.

\bibliographystyle{amsplain}

Classical Analysis and ODEs (math.CA); Functional Analysis (math.FA); General Topology (math.GN); Number Theory (math.NT); Probability (math.PR)


Lebesgue Induction and Tonelli's Theorem in Coq

Abstract: Lebesgue integration is a well-known mathematical tool, used for instance in probability theory, real analysis, and numerical mathematics. Thus its formalization in a proof assistant is to be designed to fit different goals and projects. Once Lebesgue integral is formally defined and the first lemmas are proved, the question of the convenience of the formalization naturally arises. To check it, a useful extension is the Tonelli theorem, stating that the (double) integral of a nonnegative measurable function of two variables can be computed by iterated integrals, and allowing to switch the order of integration. Therefore, we need to define and prove results on product spaces, hoping that they can easily derive from the existing ones on a single space. This article describes the formal definition and proof in Coq of product $\sigma$-algebras, product measures and their uniqueness, the construction of iterated integrals, up to the Tonelli theorem. We also advertise the \emph{Lebesgue induction principle} provided by an inductive type for {\nonnegative} measurable functions.

\section{Conclusion and perspectives}
\label{sec:Concl}

In this paper, we present the formalization and the construction of the full
formal proof of the {\Tont}.
We have constructed the product measure of two $\sigma$-finite measures, built
the two iterated integrals, and proved they are equal to the double integral on
the product measure space.
A key point is the definition of {{\nonnegativ}e} measurable functions as an
inductive type.
It has been proved equivalent to the common mathematical definition and has led
to a very useful induction scheme.
Although the induction principle is present in some formalizations, building it
from an inductive type is an original point of view we have not seen in the
literature.

To achieve the proof of the {\Tont}, we have also formalized in {\soft{Coq}}
common generic results and constructions such as the {\mct}, the
restricted measure, the image measure, and a change-of-measure formula for the
integral.
The latter, combined with a swap of variables, has prevented redundancies in
our proofs.

This work confirms the fact that the library we are developing, in line with
the choices of the {\soft{Coquelicot}} library, is rather comprehensive and
usable.
First, this work has led to few additions in the core of the library, except
for the inductive definition for~$\calM_+$ that is related to the needed
{Lebesgue induction principle}.
Second, the library seems easy to learn.
One co-author of this article and this {\soft{Coq}} development was a novice who did
not actually participate in the previous developments.

\myskip

The natural extension after the {\Tont} on {{\nonnegativ}e} measurable
functions is the {\Ft} that provides the same formulas for integrable
functions with arbitrary sign.
But we would rather directly consider the version using the Bochner
integral~\cite{BCL22} that applies to functions taking their values in a Banach
space, such as the Euclidean spaces~$\mathbb{R}^n$ and the Hermitian spaces~$\mathbb{C}^n$.
For that, we can take inspiration from the work by van~Doorn in
{\soft{Lean}}~\cite{VanDoo21}, and in particular with the concept of ``marginal
integral'' that seems to be an elegant way to handle integrals on a finitary
Cartesian product.

Our long-term purpose is to formally prove the correctness of parts of a
library implementing the Finite Element Method (FEM), which is used to compute
approximated solutions of Partial Differential Equations (PDEs).
We already formalized the {\LMt}~\cite{BCF21}, one of the key
ingredient to numerically solve PDEs, and we need to build suitable Hilbert
functional spaces on which to apply it.
The target candidates are the Sobolev spaces such as~$H^1$, that represents
square integrable functions with square integrable first derivatives.
Of course, this will involve the formalization of the~$L^p$ Lebesgue spaces as
complete normed vector spaces, and parts of the distribution
theory~\cite{sch:td:66}.

\section{Introduction}
\label{sec:Introd}

This work deals with the {\soft{Coq}}\footnote{\url{https://coq.inria.fr/}}
formalization of the {\LIP} and the {\Tont} as a
direct continuation of a previous work~\cite{BCF21}.
Our long term objective is to formally prove in {\soft{Coq}} scientific computing
programs and the correctness of parts of a {\soft{C++}} library, such as
{\soft{FreeFEM++}}\footnote{\url{https://freefem.org/}} or
{\soft{XLiFE++}},\footnote{\url{https://uma.ensta-paris.fr/soft/XLiFE++/}} that
implements the Finite Element Method (FEM), a widely used method for
numerically solving Partial Differential Equations (PDEs) arising in different
domains like engineering and mathematical modeling.
With this work, we carry on with our goal: to provide a {\soft{Coq}} library usable
by numerician people.
It started with the first development of a real numbers library~\cite{May01},
and then by the first complete experimentation of the formalization and proof
of a numerical program, a small {\soft{C}} program for the approximated
resolution of the wave equation~\cite{BCF13}.
More recently, the {\LMt}~\cite{BCF17} (for the resolution of a class
of PDEs), then Lebesgue integration of {{\nonnegativ}e} measurable functions, the
{\BLmct} and {\Fl}~\cite{BCF21}, Bochner
integration~\cite{BCL22} (a generalization of Lebesgue integration for
functions taking their values in a Banach space), and the construction of the
Lebesgue measure%
\footnote{\url{https://lipn.univ-paris13.fr/coq-num-analysis/tree/Tonelli.1.0/Lebesgue/measure_R.v}}
(yet unpublished) have also been formalized.

The proof of the {\Tont} is the next step.
But, as a side result, it also allows us to validate our previous developments
and in particular our definitions and results about the Lebesgue integral.
The validation of a usable development is indeed important.
It should allow us to carry on by confirming or not the choices of
formalization.
For example, as we work in {\soft{Coq}}, the question of using classical or
intuitionistic real analysis is a valid question.
As explained in~\cite{BCF17} and~\cite{BCF21}, our view on the question
has evolved.
In this work, we make the same choices as in the latter, namely we are
completely classical.

\myskip

The {\LIP} is a proof technique for properties about
{{\nonnegativ}e} measurable functions, and usually involving the integral.
It reflects the three construction steps followed by Henri Lebesgue to build
his integral~\cite{leb:lir:04}.
The property is first established for indicator functions, then for
{{\nonnegativ}e} simple functions by checking that the property is compatible
with positive linear operations, and finally for all {{\nonnegativ}e} measurable
functions by checking that it is compatible with the supremum.
This technique is an important asset for the proof of the {\Tont}, and we
provide it as a {by\-product} of an inductive type.

The {\Tont} provides a convenient way to ease the computation of
multiple integrals by stating their equality with iterated integrals, each in
a single dimension.
The {\Tont} applies to {{\nonnegativ}e} measurable functions.
A similar result, the {\Ft}, applies to integrable functions with
arbitrary sign, or even taking their values in a Banach space when using the
Bochner integral.
Both theorems can be combined to ease the proof of integrability of the
multi-variable function to integrate.
This article focuses on the case of {{\nonnegativ}e} functions, and as usual
in mathematics, we are only interested in the case of two variables.

We aim to the construction of the full formal proof in {\soft{Coq}} of the
{\Tont}, stating that the (double) integral of a {{\nonnegativ}e} measurable
function of two variables can be computed by iterated integrals, and allowing
to switch the order of integration.
It can be expressed in a mathematical setting as follows.
\pagebreak
\begin{Theorem}[{Tonelli}]
  \label{th:tonelli}
  Let $(X_1,\Sigma_1,\mu_1)$ and~$(X_2,\Sigma_2,\mu_2)$ be measure spaces.
  Assume that~$\mu_1$ and~$\mu_2$ are $\sigma$-finite.
  Let $f\in\calM_+(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$.
  Then, we have
  \begin{gather}
    \label{eq:tonelli1}
    \big( \forall x_1 \in X_1,\;
    f_{x_1} \in \calM_+ (X_2, \Sigma_2) \big)
    \quad\land\quad
    \int_{X_2} f_{x_1} \, d\mu_2 \in \calM_+ (X_1, \Sigma_1),\\
    \label{eq:tonelli2}
    \big( \forall x_2 \in X_2,\;
    f^{x_2} \in \calM_+ (X_1, \Sigma_1) \big)
    \quad\land\quad
    \int_{X_1} f^{x_2} \, d\mu_1 \in \calM_+ (X_2, \Sigma_2),\\
    \label{eq:tonelli3}
    \int_{X_1\times X_2} f \, d(\mu_1 \otimes \mu_2)
    = \int_{X_1} \left( \int_{X_2} f_{x_1} \, d\mu_2 \right) \, d\mu_1
    = \int_{X_2} \left( \int_{X_1} f^{x_2} \, d\mu_1 \right) \, d\mu_2.
  \end{gather}
\end{Theorem}
The notations in this statement are specified in the remainder of this paper.
Just note that many measures, including the Lebesgue measure, are
$\sigma$-finite (defined in Section~\ref{sec:Prod}), ${\calM_+}$~denotes the
set of {{\nonnegativ}e} measurable functions (see Section~\ref{sec:MeasFun}),
and~$f_{x_1}$ and~$f^{x_2}$ are partial applications of~$f$ (see
Section~\ref{sec:SecFun}).
Notice also that the properties~\eqref{eq:tonelli1} and~\eqref{eq:tonelli2}
ensure the existence of all simple integrals, while the existence of the double
integral is granted by the assumption on the function~$f$.

The mathematical definitions and proofs are taken from
textbooks~\cite{mai:m2:14,gh:mip:13,cm:li:21}, and the {\soft{Coq}} code is available
at (mainly in files \texttt{Tonelli.v}, \texttt{LInt\_p.v} and \texttt{Mp.v}):
\begin{center}
  {\small \url{https://lipn.univ-paris13.fr/coq-num-analysis/tree/Tonelli.1.0/Lebesgue}\\
  where the tag \texttt{Tonelli.1.0} corresponds to the code of this article
  from {\soft{Coq}} $\geq$ 8.12.2.}
\end{center}

\myskip

The {\Tont} is known enough and useful enough to have been formalized
before our work in several proof assistants.
It has been done in {\soft{PVS}} in the {\soft{PVS-NASA}} library%
\footnote{\url{https://github.com/nasa/pvslib/blob/master/measure_integration/fubini_tonelli.pvs}}
by Lester, probably as a follow-up of~\cite{Les07}.
Some Fubini-like results are available in {\soft{HOL Light}}~\cite{Har13}.
More recently, the {\Tont} was formalized in {\soft{Mizar}} by
Endou~\cite{Endou2019}.

The formalizations nearest to ours are in {\soft{Isabelle/HOL}} and {\soft{Lean}}.
In {\soft{Isabelle/HOL}}, Hölzl and Heller defined binary and iterated product measure
before the {\Ft}~\cite{HolHel11}.
It cleverly relies on {\soft{Isabelle}} type classes and locales.
A more recent work%
\footnote{\url{https://isabelle.in.tum.de/library/HOL/HOL-Analysis/Bochner_Integration.html}}
extends it to the Bochner integral.
In {\soft{Lean}}, van Doorn defines products of measures and properties of the
product space towards the {\thms{{\Ton} and {\Fub}}} in a way very similar to
ours~\cite{VanDoo21} with the same inductive definitions and the same proof
path.
Instead of Lebesgue integral, the {\Ft} is proved with the more generic
Bochner integral.

A very recent (unpublished to our knowledge) work in {\soft{Coq}} has been developed
for probability theory.%
\footnote{\url{https://github.com/jtassarotti/coq-proba}}
Many definitions are similar to ours~\cite{BCF21}.
The {\thms{{\Ton} and {\Fub}}} are proved, but in a quite simpler setting than
ours, as their goal is probability, where the measures are finite.
The $\sigma$-finiteness as above is skipped, and this corresponds in the sequel
to the first parts in proofs of Sections~\ref{sec:MeasSect}
and~\ref{sec:ProdMeas}.

The {\LIP} is formalized in {\soft{Lean}}~\cite{VanDoo21}.
To our knowledge, no formalization is achieved starting from an inductive type.

For a comparison of Lebesgue integral in various proof assistants, we refer the
reader to~\cite{BCF21,VanDoo21}, and we refer to~\cite{BLM16} for a
wider comparison of real analysis in proof assistants.

\myskip

This paper is organized as follows.
Section~\ref{sec:Prereq} gives a brief summary of prerequisites and the main
concepts of measure and integration theories developed in previous works.
The formalization of the {\LIP} is detailed in
Section~\ref{sec:LIP}.
Section~\ref{sec:Prod} describes the construction of the product measure, while
Section~\ref{sec:Ton} is devoted to the construction of the iterated integrals
and the full proof of the {\Tont}.
Finally, Section~\ref{sec:Concl} concludes and provides hints to future work.

\section{Lebesgue Induction Principle}
\label{sec:LIP}

Let~$(X,\Sigma)$ be a measurable space.
The properties of the function spaces~$\calM_+$, $\calSF_+$ and~$\mathcal{IF}$
recalled in Section~\ref{sec:MeasFun} suggest we may represent {{\nonnegativ}e}
measurable functions by an inductive type.
Indeed, functions in~$\calM_+$ are the supremum of adapted sequences of
{{\nonnegativ}e} measurable simple functions, and functions in~$\calSF_+$ are
positive linear combinations of measurable indicator functions in~$\mathcal{IF}$.
Moreover, the construction of the Lebesgue integral in Section~\ref{sec:LInt_p}
mimics the associated structural induction principle, and the same principle is
a common proof technique for several results in Lebesgue integration theory,
among which the {\Tont} as noted in~\cite{VanDoo21}.

\myskip

In addition to~\coqe{Mplus} recalled in Section~\ref{sec:MeasFun}, we now
define an inductive type:
\begin{lstlisting}
Inductive Mp : (X -> Rbar) -> Prop :=
  | Mp_charac : \forall A, measurable genX A -> Mp (charac A)
  | Mp_scal : \forall a f, 0 <== a -> Mp f -> Mp (fun x => Rbar_mult a (f x))
  | Mp_plus : \forall f g, Mp f -> Mp g -> Mp (fun x => Rbar_plus (f x) (g x))
  | Mp_sup : \forall f, incr_fun_seq f -> (\forall n, Mp (f n)) -> Mp (fun x => Sup_seq (fun n => f n x)).
\end{lstlisting}
where \coqe{incr_fun_seq f} stands for
\coqe{\forall x n, Rbar_le (f n x) (f (S n) x)}.

We also have an inductive type for~$\calSF_+$ denoted by~\coqe{SFp}, whose
constructors are essentially the same as the first three of~\coqe{Mp}.
Several inductive types equivalent to~\coqe{Mp} are defined in order to split
the proof steps, for instance one is built over~\coqe{SFp}.
They are not given here for the sake of simplicity and brevity.

\myskip

The important point is then the correctness of this definition, compared to the
existing one.
The only delicate part is to obtain that simple functions in~$\calSF_+$ can
actually be represented by such an inductive construction, stated in
\coqe{Lemma SFp_correct : \forall f, SFp f <-> SFplus gen f}.

For that, from a simple function represented by a list of values of size~$n+1$,
we need to construct a smaller simple function associated to a sublist of
size~$n$.
The tricky needed result is the following:
\begin{lstlisting}
Lemma SF_aux_cons :
  \forall (f : X -> R) v1 v2 l, nonneg f -> SF_aux genX f (v1 :: v2 :: l) ->
    let g := fun x => f x + (v1 - v2) * charac (fun t => f t = v2) x in
    nonneg g /\ SF_aux genX g (v1 :: l).
\end{lstlisting}
Given~$f\in\calSF_+$ and its associated canonical list~$\ell$, the lemma
builds a new~$g\in\calSF_+$ canonically associated with the list~$\ell$
deprived from some item~$v_2$.
This means that on the {non\-empty} subset~$\preimage{f}{v_2}$, $g$~must take
one of the remaining values, $v_1$~as shown in Figure~\ref{fig:SFauxcons},
which also provides the property~$g\leq f$.

\begin{figure}[bht]
\begin{center}
\begin{tikzpicture}
\draw[very thick,-latex] (0,0) -- (5.5,0) node[below]{$x$};
\draw[very thick,-latex] (0,0) -- (0,3.5) node[left]{$f(x)$};
\draw[help lines,dashed] (0,.6) -- (5,.6);
\node[left] at (0,.6) {$v_1$};
\draw[help lines,dashed] (0,1.5) -- (5,1.5);
\node[left] at (0,1.5) {$v_2$};
\draw[help lines,dashed] (0,1.9) -- (5,1.9);
\node[left] at (0,1.9) {$v_3$};
\node[left] at (-.1,2.4) {$\vdots$};
\draw[help lines,dashed] (0,2.7) -- (5,2.7);
\node[left] at (0,2.7) {$v_7$};
\draw[thick,blue] (0,1.9) -- (1,1.9);
\draw[thick,blue] (1,.6) -- (1.5,.6);
\draw[thick,blue] (1.5,1.5) -- (2.2,1.5);
\draw[thick,blue] (2.2,2.7) -- (2.6,2.7);
\draw[thick,blue] (2.6,1.5) -- (3,1.5);
\draw[thick,blue] (3,1.9) -- (3.2,1.9);
\draw[thick,blue] (3.2,.6) -- (4,.6);
\end{tikzpicture}
\hfill
\begin{tikzpicture}
\draw[very thick,-latex] (0,0) -- (5.5,0) node[below]{$x$};
\draw[very thick,-latex] (0,0) -- (0,3.5) node[left]{$g(x)$};
\draw[help lines,dashed] (0,.6) -- (5,.6);
\node[left] at (0,.6) {$v_1$};
\draw[help lines,dashed] (0,1.5) -- (5,1.5);
\node[left] at (0,1.5) {$v_2$};
\draw[help lines,dashed] (0,1.9) -- (5,1.9);
\node[left] at (0,1.9) {$v_3$};
\node[left] at (-.1,2.4) {$\vdots$};
\draw[help lines,dashed] (0,2.7) -- (5,2.7);
\node[left] at (0,2.7) {$v_7$};
\draw[thick,blue] (0,1.9) -- (1,1.9);
\draw[thick,blue] (1,.6) -- (1.5,.6);
\draw[thick,red] (1.5,.6) -- (2.2,.6);
\draw[thick,blue] (2.2,2.7) -- (2.6,2.7);
\draw[thick,red] (2.6,.6) -- (3,.6);
\draw[thick,blue] (3,1.9) -- (3.2,1.9);
\draw[thick,blue] (3.2,.6) -- (4,.6);
\end{tikzpicture}
\end{center}
\caption{%
  Illustration of Lemma \coqe{SF_aux_cons}.
  The value~$v_2$ taken by the simple function~$f$ (on the left) is replaced
  in~$g$ (on the right) by the value~$v_1$ (in red).}
\label{fig:SFauxcons}
\end{figure}

More precisely, let us assume that
$f(x)=\sum_{v\in\{v_1,v_2\}\cup\ell}v\times\charac{\preimage{f}{v}}$.
Then, by setting $g(x):=f(x)+(v_1-v_2)\times\charac{\preimage{f}{v_2}}$, one
has $g(x)=\sum_{v \in\{v_1\}\cup\ell}v\times\charac{\preimage{f}{v}}$.
Thus, $g\in\calSF_+$ with a smaller list of values, and
$f(x)=g(x)+(v_2-v_1)\times\charac{\preimage{f}{v_2}}$ with $v_2-v_1\ge0$.
This is tricky for two reasons.
First, we cannot set~$g$ to zero on~$\preimage{f}{v_2}$ (as it may be a new
value, defeating the point of reducing the size of the value list); thus, the
initial list must contain at least two values.
Second, by proceeding the other way around and setting~$g$ to~$v_2$
on~$\preimage{f}{v_1}$, we cannot write~$f$ as the sum of~$g$ and a
\emph{{\nonnegativ}e} value times an indicator function, as needed by the
constructor~\coqe{SFp_scal}, similar to~\coqe{Mp_scal}.

\myskip

Now, we have all the ingredients to check that the definition of~\coqe{Mp} is
satisfactory, that is to say that~\coqe{Mp} represents~$\calM_+$
as~\coqe{Mplus} already does.
This correctness lemma is stated as
\begin{lstlisting}
Lemma Mp_correct : \forall f, Mp genX f <-> Mplus genX f.
\end{lstlisting}
The proof is mainly based on inductions, the construction of adapted sequences
\coqe{mk_adapted_seq} (see Section~\ref{sec:MeasFun}), and the previous lemma.

\myskip

This gives us for free an induction lemma corresponding to the~\coqe{Mp}
inductive:
\begin{lstlisting}
Mp_ind : \forall P : (E -> Rbar) -> Prop,
  (\forall A, measurable gen A -> P (charac A)) ->
  (\forall a f, 0 <== a -> Mp f -> P f -> P (fun x => Rbar_mult a (f x))) ->
  (\forall f g, Mp f -> P f -> Mp g -> P g -> P (fun x => Rbar_plus (f x) (g x))) ->
  (\forall f, incr_fun_seq f -> (\forall n, Mp (f n)) -> (\forall n, P (f n)) -> P (fun x => Sup_seq (fun n => f n x))) ->
  \forall f, Mp f -> P f.
\end{lstlisting}
The corresponding mathematical statement is the following
\begin{Lemma}[Lebesgue induction principle]
Let~$(X,\Sigma)$ be a measurable space.
Let~$P$ be a predicate on functions from~$X$ to~$\overline{\R}$.
Assume that~$P$ holds on~$\mathcal{IF}$, and that it is compatible on~$\calM_+$
with positive linear operations and with the supremum of {non\-decreasing}
sequences:
\begin{align}
  \label{eq:LIP1}
  \forall A,\quad &A \in \Sigma \Rightarrow P (\charac{A}),\\
  \label{eq:LIP2}
  \forall a \in \R_+,\;
  \forall f \in \calM_+,\quad
  &P (f) \Rightarrow P (a f),\\
  \label{eq:LIP3}
  \forall f, g \in \calM_+,\quad
  &P (f) \land P (g) \Rightarrow P (f + g),\\
  \label{eq:LIP4}
  \forall (f_n)_{n \in {\mathbb{N}}} \in \calM_+,\quad
  &(\forall n \in \mathbb{N},\; f_n \leq f_{n + 1} \land P (f_n)) \Rightarrow
  P \left( \sup_{n \in \mathbb{N}} f_n \right).
\end{align}
Then, $P$~holds on~$\calM_+$.
\end{Lemma}

There are a few alternative statements of the {Lebesgue induction principle}.
For instance, we choose to have~$a$ in~$\mathbb{R}$ and not in~$\overline{\R}$ in
Equation~\eqref{eq:LIP2}, as it makes an equivalent, but simpler to use lemma.
Moreover, as noted in the {\soft{Lean}} source code,%
\footnote{\url{https://leanprover-community.github.io/mathlib_docs/measure_theory/integral/lebesgue.html\#measurable.ennreal_induction}.}
it is possible to sharpen the premises of the constructors.
For instance, it may be sufficient to have in~\eqref{eq:LIP3} simple functions
that do not share the same image value, except~0, or with disjoint supports.

\section{Prerequisites}
\label{sec:Prereq}

Our formalizations and proofs are conducted in {\soft{Coq}}.
In this section, we present the necessary prerequisites and libraries for our
developments, from external packages to our own previous work.

\subsection{The {\soft{Coquelicot}} Library, $\overline{\R}$ and Logic}
\label{sec:coquelicot}

The {\soft{Coquelicot}}\footnote{\url{http://coquelicot.saclay.inria.fr/}}
library~\cite{BLM15} is a conservative extension of the standard {\soft{Coq}} library
of real numbers~\cite{Link_Coq_Ref,May01}.
It provides the formalization of basic results in real analysis for {\soft{Coq}}
developments.
Besides the fact that it is a classical library, a salient feature is that it
provides total functions, {e.g.} for limit, derivative, and (Rieman) integral.
This is consistent with classical logic, and it means a much simpler and
natural way to write mathematical formulas and theorem statements.
The library also provides a formalization of the extended real numbers
$\overline{\R}:=\mathbb{R}\cup\{-\infty,+\infty\}$ equipped, among other operations, with
\coqe{Rbar_lub : (Rbar -> Prop) -> Rbar} for the least-upper bound of subsets
of~$\overline{\R}$, and \coqe{Sup_seq : (nat -> Rbar) -> Rbar} for the supremum of
sequences.

As in the {\soft{Coquelicot}} library, we use the full classical logic: total order
on real numbers, propositional and functional extensionality axioms, excluded
middle and choice axioms.

A more detailed description of what we need can be found
in~\cite[Section~2]{BCF21}.

\subsection{Lebesgue Integration Theory}
\label{sec:Lebesgue}

The theory of integration is commonly built upon the measure theory.
The first step defines the measurability of subsets, and then the measure
associates a (possibly infinite) {{\nonnegativ}e} number to each measurable
subset.
The second step defines the measurability of functions, and then the integral
associates a (possibly infinite) {{\nonnegativ}e} number to each {{\nonnegativ}e}
measurable function.
The integral for functions with arbitrary sign is not relevant to the present
work.

This section briefly reviews the main concepts of measure and integration
theories that were presented in~\cite{BCF21} and are needed here.
It includes the notion of generators of $\sigma$-algebra for measurability, and
of adapted sequences to approximate from below measurable functions by simple
functions.

\subsubsection{Measurable Subsets}
\label{sec:MeasSub}

A measurable space~$(X,\Sigma)$ is made of a set~$X$, and the
collection~$\Sigma$ of all its measurable subsets.
The collection~$\Sigma$ is a subset of the power set of~$X$ called
\emph{$\sigma$-algebra}.
It is closed under most subset operations, such as complement, countable union
and countable intersection.
A $\sigma$-algebra can be \emph{generated} as the closure of a smaller
collection of subsets with respect to some of the subset operations.
In our {\soft{Coq}} developments, the generators on~\coqe{X : Type} are typically
denoted~\coqe{genX}, and a subset~\coqe{A : X -> Prop} belongs to the
$\sigma$-algebra generated by~\coqe{genX} when the inductive property
\coqe{measurable genX A} holds.

When the set~$X$ has a topological structure, it is convenient to consider its
\emph{Borel $\sigma$-algebra} that is generated by all the open subsets.
The Borel $\sigma$-algebra of~$\overline{\R}$ can also be generated by the smaller
collection of right closed rays of the form $[a,\infty]$, denoted in {\soft{Coq}}
by~\coqe{gen_Rbar}.

Given two measurable spaces~$(X_1,\Sigma_1)$ and~$(X_2,\Sigma_2)$, the
\emph{product $\sigma$-algebra on~$X_1\times X_2$} is the one generated by the
products of measurable subsets of~$X_1$ and~$X_2$.
Some details are provided in Section~\ref{sec:Prod} where it is a major
ingredient.

\subsubsection{Measure}
\label{sec:Meas}

In a measure space~$(X,\Sigma,\mu)$, there is in addition a
\emph{measure}~$\mu$: a function $\Sigma\to\overline{\R}$ that is {{\nonnegativ}e},
homogeneous ($\mu(\emptyset)=0$), and $\sigma$-additive.
This is represented in {\soft{Coq}} by a record collecting the support function and
the three constitutive properties.

The properties of \emph{continuity from below} and \emph{from above} are useful
in Section~\ref{sec:Prod}.
For any measure~$\mu$, and for any sequence~$(A_n)_{n\in\mathbb{N}}\in\Sigma$, they
respectively state
\begin{gather}
  \label{eq:cont-below}
  (\forall n \in \mathbb{N},\; A_n \subset A_{n + 1})
  \Rightarrow
  \mu \left( \bigcup_{n \in \mathbb{N}} A_n \right)
    = \lim_{n \to \infty} \mu (A_n)
    = \sup_{n \in \mathbb{N}} \mu (A_n),\\
  \label{eq:cont-above}
  (\forall n \in \mathbb{N},\; A_{n + 1} \subset A_n)
  \land
  (\exists n_0 \in \mathbb{N},\; \mu (A_{n_0}) < \infty)
  \Rightarrow
  \mu \left( \bigcap_{n \in \mathbb{N}} A_n \right)
    = \inf_{n \in \mathbb{N}} \mu (A_n)
\end{gather}
Note that {\monotony} of measures allows to replace the limit of a
{non\-decreasing} sequence by its supremum.
This property of real numbers is repeatedly used in the sequel.

\subsubsection{Measurable Functions}
\label{sec:MeasFun}

Given two measurable spaces~$(X,\Sigma)$ and~$(Y,\mathcal{T})$, a function~$f:X\to Y$
is said \emph{measurable} when the preimage of every measurable subset is
measurable:
\begin{lstlisting}
Definition measurable_fun : (X -> Y) -> Prop :=
  fun f => \forall B, measurable genY B -> measurable genX (fun x => B (f x)).
\end{lstlisting}

When $Y:=\overline{\R}$, and usually~$\mathcal{T}$ is its Borel $\sigma$-algebra, we may
simply say that the function is \emph{$\Sigma$-measurable}, and we use the
predicate \coqe{measurable_fun_Rbar} corresponding to \coqe{genY := gen_Rbar}.
We denote the \emph{set of {{\nonnegativ}e} measurable functions}
by~$\calM_+(X,\Sigma)$.
When there is no possible confusion in the context, we may drop the
``$(X,\Sigma)$'' annotation.
Among other operations, $\calM_+$~is closed under {{\nonnegativ}e} scalar
multiplication, addition, and supremum.
In {\soft{Coq}}, we use the predicate \coqe{Mplus genX : (X -> Rbar) -> Prop} that
encompasses {{\nonnegativ}ity} and measurability, and
\coqe{Mplus_seq genX : (nat -> X -> Rbar) -> Prop} means that all the elements
of a sequence of functions belong to~$\calM_+$.

Two subsets of functions are of major interest for the construction of Lebesgue
integration.
\emph{Simple functions} are functions with range of finite cardinal, and the
\emph{set of {{\nonnegativ}e} measurable simple functions} is
denoted~$\calSF_+(X,\Sigma)$.
In {\soft{Coq}}, we use the predicate
\coqe{SFplus genX : (X -> Rbar) ->}\linebreak[0]\coqe{Prop},
and any simple function~$f$ is canonically represented by the strictly sorted
list~$\ell$ of its values, $f=\sum_{v\in\ell}v\times\charac{\preimage{f}{v}}$.
Given any function~$f\in\calM_+$, a simple algorithm allows to build an
\emph{adapted sequence for~$f$}, {i.e.} a {non\-decreasing} sequence of simple
functions $(\varphi_n)_{n\in\mathbb{N}}\in\calSF_+$ such that
$f=\lim_{n\to\infty}\varphi_n=\sup_{n\in\mathbb{N}}\varphi_n$.
In~\cite{BCF21}, the process, denoted \coqe{mk_adapted_seq}, is obtained
via a fixed-point rounding downwards with a least significant bit of~$-n$
relying on the Flocq library~\cite{BolMel11}.

The \emph{set of measurable indicator functions} is denoted~$\mathcal{IF}(X,\Sigma)$.
Note that an indicator function~$\charac{A}$ is measurable whenever its support
subset~$A$ belongs to~$\Sigma$.
Simple functions in~$\calSF_+$ are positive linear combinations of indicator
functions in~$\mathcal{IF}$.

\subsubsection{Lebesgue Integral}
\label{sec:LInt_p}

The construction of the Lebesgue integral in~$\calM_+$ operates in three
steps.
The first stage is to integrate indicator functions in~$\mathcal{IF}$ by taking the
measure of their support.
Then, the second stage extends the integral to simple functions in~$\calSF_+$
by positive linearity.
And finally, the third stage extends it again to measurable functions
in~$\calM_+$ by taking the supremum.

In the end, the \emph{integral of a function~$f\in\calM_+$} is defined as the
supremum of the integrals of all simple functions in~$\calSF_+$ smaller
than~$f$.
It is formalized in~\cite{BCF21} as
\begin{lstlisting}
Definition LInt_p : (X -> Rbar) -> Rbar :=
  fun f => Rbar_lub (fun z => \exists (phi : X -> R) (Hphi : SF genX phi),
    nonneg phi /\ (\forall x, Rbar_le (phi x) (f x)) /\ LInt_SFp mu phi Hphi = z).
\end{lstlisting}

The proof of the {\Tont} relies on several properties of the integral
in~$\calM_+$, such as {\monotony}, positive linearity, $\sigma$-additivity,
and the {\BLmct}.
The latter states the compatibility with the supremum: for any {non\-decreasing}
sequence~$(f_n)_{n\in\mathbb{N}}\in\calM_+$, the limit $\lim_{n\to\infty}f_n$ (which
actually equals $\sup_{n\in\mathbb{N}}f_n$) is also in~$\calM_+$, and the
integral-limit exchange formula holds,
$\int\sup_{n\in\mathbb{N}}f_n\,d\mu=\sup_{n\in\mathbb{N}}\int f_n\,d\mu$.

\section{Product Measure on a Product Space}
\label{sec:Prod}

In this section, we build the product measure for the measurable subsets of a
product space.
This allows to integrate numeric functions defined on such a product space in
Section~\ref{sec:Ton}.

Given two measure spaces~$(X_1,\Sigma_1,\mu_1)$ and~$(X_2,\Sigma_2,\mu_2)$, a
\emph{product measure on the measurable space
  $(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$ induced by~$\mu_1$ and~$\mu_2$} is
a measure~$\mu$ defined on the product
$\sigma$-algebra $\Sigma_1\otimes\Sigma_2$ (defined in
Section~\ref{sec:ProdSigAlg}) satisfying the \emph{box property}:
\begin{equation}
  \label{eq:ProdMeasBox}
  \forall A_1 \in \Sigma_1,\;
  \forall A_2 \in \Sigma_2,\quad
  \mu (A_1 \times A_2) = \mu_1 (A_1) \, \mu_2 (A_2).
\end{equation}
To ensure existence and uniqueness of such a product measure, we assume
that~$\mu_1$ and~$\mu_2$ are \emph{$\sigma$-finite} measures, {i.e.} that the
full sets~$X_1$ and~$X_2$ are (possibly {non\-decreasing}) unions of subsets of
finite measure (see a detailed definition in Section~\ref{sec:MeasSect}).

A candidate product measure is first built in three steps, see
Figure~\ref{fig:prod-meas}.
Firstly, \emph{$X_1$-sections} (or \emph{``vertical'' cuttings}) of subsets are
proved to be $\Sigma_2$-measurable.
Then, the measure of sections is proved to be $\Sigma_1$-measurable.
The candidate is the integral of the measure of sections.
Then, this candidate is proved to be a product measure, and the product measure
is guaranteed to be unique.
The main argument for this construction is the {\mct}, whose quite
heavy proof is not detailed here.
It is used twice: for the measurability of the measure of sections, and for the
uniqueness of the product measure.

The definition of the product $\sigma$-algebra is first reviewed in
Section~\ref{sec:ProdSigAlg}.
Then, Section~\ref{sec:Sect} is dedicated to sections, and
Section~\ref{sec:MeasSect} to the measure of sections.
Finally, existence and uniqueness of the product measure is obtained in
Section~\ref{sec:ProdMeas}.

\begin{figure}[htb]
\begin{center}
\begin{tikzpicture}
\node[draw,rounded corners=3pt,fill=darkgray] (S1S2) at (3.5,4.5)
     {$A\in\Sigma_1\otimes\Sigma_2$};
\node[draw,rounded corners=3pt,fill=gray] (Sec) at (3.5,3.5)
  {$s_{x_1}(A)\in\Sigma_2$};
\node[draw,rounded corners=3pt,fill=lightgray] (MeasSec) at (3.5,2.5)
  {$\left(x_1\longmapsto\mu_2(s_{x_1}(A))\right)\in\calM_+(X_1,\Sigma_1)$};
\node[draw,rounded corners=3pt,fill=lightlightgray] (CandProdMeas) at (3.5,1)
  {$\begin{array}{c}
      \mu_1\otimes\mu_2:=
      \left(A\longmapsto\int_{X_1}\mu_2(s_{x_1}(A))\,d\mu_1\right)\\
      \mbox{is a product measure}
    \end{array}$};
\node[draw,rounded corners=3pt,fill=lightlightgray] (Uniq) at (10,1)
  {product measure is unique};
\draw[->,>=latex,thick] (S1S2) to (Sec);
\draw[->,>=latex,thick] (Sec) to (MeasSec);
\draw[->,>=latex,thick] (MeasSec) to (CandProdMeas);
\node[draw] (MCTh) at (10,4)
  {$\begin{array}{c}
      \mbox{Monotone Class Thm}\\
      \mbox{Restricted measure}
    \end{array}$};
\draw[->,>=latex,dashed] (MCTh) to (MeasSec.north east);
\draw[->,>=latex,dashed] (MCTh) to (Uniq);
\end{tikzpicture}
\end{center}
\caption{%
  Flowchart illustrating the construction of the product measure.\protect\\
  The fill colors refer to sections:
  \ref{sec:ProdSigAlg} in {\colorbox{\colorA}{dark gray}},
  \ref{sec:Sect} in {\colorbox{\colorB}{gray}},
  \ref{sec:MeasSect} in {\colorbox{\colorC}{light gray}},
  and \ref{sec:ProdMeas} in {\colorbox{\colorD}{lighter gray}}.\protect\\
  Dashed lines denote the use of the listed proof arguments, that were
  developed for the present work.
}
\label{fig:prod-meas}
\end{figure}

\subsection{Product $\sigma$-algebra}
\label{sec:ProdSigAlg}

Let us detail the notion of product $\sigma$-algebra that was introduced
in~\cite{BCF21}.
Given two measurable spaces~$(X_1,\Sigma_1)$ and~$(X_2,\Sigma_2)$, the
\emph{product $\sigma$-algebra on~$X_1\times X_2$} is the
$\sigma$-algebra~$\Sigma_1\otimes\Sigma_2$ generated by the products of
measurable subsets:
\begin{equation*}
  \Sigma_1 \otimes \Sigma_2 := \mbox{ $\sigma$-algebra generated by }
  \Sigma_1 \overline{\times} \Sigma_2 :=
  \{ A_1 \times A_2 \;|\; A_1 \in \Sigma_1 \land A_2 \in \Sigma_2 \}
  \ (\subsetneq \Sigma_1 \otimes \Sigma_2).
\end{equation*}
Given generators~\coqe{genX1} and~\coqe{genX2} for~$\Sigma_1$ and~$\Sigma_2$,
the generator~$\Sigma_1\overline{\times}\Sigma_2$ is denoted in {\soft{Coq}} by
\coqe{Product_Sigma_algebra genX1 genX2}.
It is proven in~\cite[Sec. 4.3]{BCF21} that
$\Sigma_1\otimes\Sigma_2$ is also the $\sigma$-algebra generated by
\begin{equation*}
  \{ A_1 \times A_2 \;|\;
  A_1 \in \mathrm{gen}(\Sigma_1) \cup \{ X_1 \} \land
  A_2 \in \mathrm{gen}(\Sigma_2) \cup \{ X_2 \} \}.
\end{equation*}
This smaller generator is denoted in {\soft{Coq}} by \coqe{Gen_Product genX1 genX2},
and simply denoted in the sequel by \coqe{genX1xX2}.
Symmetrically, \coqe{genX2xX1} represents \coqe{Gen_Product genX2 genX1}.

\subsection{Section of Subset}
\label{sec:Sect}

\begin{figure}[htb]
\begin{center}
\begin{tikzpicture}
\draw[->,thick] (0,0)--(5,0) node[right]{$X_1$};
\draw[->,thick] (0,0)--(0,3) node[above]{$X_2$};

\coordinate (M) at (4,2.5);
\pgfmathsetmacro{\myslope}{atan2(2,-4.5)}
\draw[fill=gray!30] (M) to[out=\myslope,in=0]
    ++ (-1,0.25) to[out=180,in=90] ++ (-.5,-0.25)
 to[out=-90,in=90] ++ (1,-1) to[out=-90,in=90] ++ (-2.5,-.5)
 to[out=-90,in=180] ++(2,-.5) to[out=0,in=\myslope+180] cycle;
\node at (3.9,2.2) {$A$};

\node[below] at (1.75,0) {$x_1$};
\draw[dashed] (1.75,0)--(1.75,3) node[above]{$s_{x_1}(A)$};
\draw[ultra thick] (1.75,0.45)--(1.75,1.35);

\node[below] at (3.25,0) {$y_1$};
\draw[dashed] (3.25,0)--(3.25,3) node[above]{$s_{y_1}(A)$};
\draw[ultra thick] (3.25,0.54)--(3.25,1.17);
\draw[ultra thick] (3.25,1.88)--(3.25,2.73);
\end{tikzpicture}
\end{center}
\caption{%
  $X_1$-sections of a subset~$A$ of~$X_1\times X_2$ at points~$x_1$ and~$y_1$.}
\label{fig:section}
\end{figure}

The notion of \emph{section} consists in keeping one of the variables fixed.
Given{~$A\!\subset\!X_1\times X_2$} and{}~$x_1\in X_1$, the
\emph{$X_1$-section of~$A$ at~$x_1$} is the subset of~$X_2$ defined by
$s_{x_1}(A):=\{x_2\in X_2\;|\;(x_1,x_2)\in A\}$ (see Figure~\ref{fig:section}).
The {\soft{Coq}} translation is straightforward.
\begin{lstlisting}
Definition section : X1 -> (X1 * X2 -> Prop) -> X2 -> Prop := fun x1 A x2 => A (x1, x2).
\end{lstlisting}

Sections commute with most subset operations.
For example, they are compatible with the empty set
($s_{x_1}(\emptyset)=\emptyset$), the complement ($s_{x_1}(A^c)=s_{x_1}(A)^c$),
countable union and intersection, and are monotone.
Sections also satisfy the following box property: for all
subsets~$A_1\subset X_1$, $A_2\subset X_2$, and point~$x_1\in X_1$,
\begin{equation}
  \label{eq:box-section}
  x_1 \in A_1 \Rightarrow s_{x_1} (A_1 \times A_2) = A_2
  \quad\mbox{and}\quad
  x_1 \not\in A_1 \Rightarrow s_{x_1} (A_1 \times A_2) = \emptyset.
\end{equation}

Then, we prove that, if a subset~$A$ is $\Sigma_1\otimes\Sigma_2$-measurable,
then its $X_1$-sections at any point in~$X_1$ are $\Sigma_2$-measurable.
As measurability is an inductive type, the proof is a simple induction on the
hypothesis.
\begin{lstlisting}
Lemma section_measurable : \forall A x1, measurable genX1xX2 A -> measurable genX2 (section x1 A).
\end{lstlisting}

\subsection{Measurability of Measure of Section}
\label{sec:MeasSect}

As sections are measurable (see Section~\ref{sec:Sect}), one can take their
measure.
In Section~\ref{sec:ProdMeas}, the product measure is defined as the integral
of the measure of sections, but before that, we have to prove the and
{{\nonnegativ}ity} and measurability of these functions.
More precisely, that for all $\Sigma_1\otimes\Sigma_2$-measurable subset~$A$,
the function $(x_1\mapsto\mu_2(s_{x_1}(A)))$ belongs to
$\calM_+(X_1,\Sigma_1)$.

The {{\nonnegativ}ity} property directly follows from that of measures.
The proof of measurability goes in two stages.
Firstly when the measure~$\mu_2$ is assumed to be \emph{finite} ({i.e.}
when~$\mu_2(X_2)$ is finite), and then in the more general $\sigma$-finite
case.
The first stage is quite high-level, it relies on the {\mct}.
The second stage extends the first one by means of restricted measures.

\myskip

After having defined the measure of sections, represented in {\soft{Coq}} by the
total function
\begin{lstlisting}
Definition meas_section : (X1 * X2 -> Prop) -> X1 -> Rbar := fun A x1 => muX2 (section x1 A).
\end{lstlisting}
the first stage of the proof is stated in {\soft{Coq}} as
\begin{lstlisting}
Lemma meas_section_Mplus_finite :
  \forall A, is_finite_measure muX2 -> measurable genX1xX2 A -> Mplus genX1 (meas_section A).
\end{lstlisting}

Let~$\mathcal{S}$ be the set of measurable subsets satisfying the property to prove,
\begin{equation*}
  \mathcal{S} :=
  \left\{ A \in \Sigma_1 \otimes \Sigma_2 {\,|\,}
  \big( x_1 \longmapsto \mu_2 (s_{x_1} (A)) \big)
  \in \calM_+ (X_1, \Sigma_1) \right\}.
\end{equation*}
It suffices to show that $\Sigma_1\otimes\Sigma_2\subset\mathcal{S}$.
Firstly, $\mathcal{S}$~is proved to contain the generator
$\overline{\Sigma}:=\Sigma_1\overline{\times}\Sigma_2$ of~$\Sigma_1\otimes\Sigma_2$ (see
Section~\ref{sec:ProdSigAlg}).
Then, it is proved to contain the algebra of sets generated by~$\overline{\Sigma}$
(where an algebra of sets contains the empty set and is closed under complement
and finite union).
Then, $\mathcal{S}$~is also proved to be a monotone class, {i.e.} closed under
monotone countable union and intersection.
This step uses the finiteness assumption on~$\mu_2$, and continuity from below
and from above (see Equations~\eqref{eq:cont-below} and~\eqref{eq:cont-above}).
And finally, we conclude by applying the following {\mct} with
\coqe{X := X1 * X2}, \coqe{P := \mathcal{S}}, and \coqe{genX := \overline{\Sigma}}.
\begin{lstlisting}
Theorem monotone_class_Prop :
  \forall P : (X -> Prop) -> Prop, is_Monotone_class P ->
    Incl (Algebra genX) P -> Incl (Sigma_algebra genX) P.
\end{lstlisting}
Note that \coqe{Incl} denotes the inclusion for subsets of the power set
of~$X$.

\myskip

In the second stage, the measure~$\mu_2$ is supposed to be $\sigma$-finite.
Thus, there exists a {non\-decreasing} sequence $(B_n)_{n\in\mathbb{N}}\in\Sigma_2$ such
that $X_2=\bigcup_{n\in\mathbb{N}}B_n$, and~$\mu_2(B_n)$ is finite for all~$n\in\mathbb{N}$.
Then, for each~$n\in\mathbb{N}$, the \emph{restricted measure}
\begin{equation*}
  \mu_2^n := (A_2 \in \Sigma_2 \longmapsto \mu_2 (A_2 \cap B_n) \in \Rbar_+)
\end{equation*}
is proved to be a finite measure.
Thus, the previous result applies,
\begin{equation*}
  \forall A \in \Sigma_1 \otimes \Sigma_2,\quad
  (x_1 \longmapsto \mu_2^n (s_{x_1} (A))) \in \calM_+ (X_1, \Sigma_1).
\end{equation*}
Moreover, from the properties of sections (see Section~\ref{sec:Sect}) and from
the continuity from below of~$\mu_2$, for all $A\in\Sigma_1\otimes\Sigma_2$
and~$x_1\in X_1$,
\begin{align*}
  \mu_2 (s_{x_1} (A))
  &= \mu_2 \left( s_{x_1} (A) \cap \bigcup_{n \in \mathbb{N}} B_n \right)
  = \mu_2 \left( \bigcup_{n \in \mathbb{N}} s_{x_1} (A) \cap B_n \right)\\
  &= \sup_{n \in \mathbb{N}} \mu_2 \left( s_{x_1} (A) \cap B_n \right)
  = \sup_{n \in \mathbb{N}} \mu_2^n (s_{x_1} (A)).
\end{align*}
Finally, the closedness of~$\calM_+(X_1,\Sigma_1)$ under supremum (see
Section~\ref{sec:MeasFun}) concludes the proof.
Thus, the lemma in the $\sigma$-finite case holds,
\begin{lstlisting}
Lemma meas_section_Mplus_sigma_finite :
  \forall A, is_sigma_finite_measure muX2 -> measurable genX1xX2 A -> Mplus genX1 (meas_section A).
\end{lstlisting}

\myskip

Note that from~\eqref{eq:box-section}, the measure of the section of a box
reads
\begin{equation}
  \label{eq:box-meas-section}
  \forall A_1 \in \Sigma_1,\;
  \forall A_2 \in \Sigma_2,\quad
  (x_1 \longmapsto \mu_2 (s_{x_1} (A_1 \times A_2)))
  = \mu_2 (A_2) \, \charac{A_1}.
\end{equation}

\subsection{Existence and Uniqueness of the Product Measure}
\label{sec:ProdMeas}

As the measures of sections are {{\nonnegativ}e} and measurable (see
Section~\ref{sec:MeasSect}), one can take their integral.
The candidate product measure is the function defined on the product
$\sigma$-algebra~$\Sigma_1\otimes\Sigma_2$ (see Section~\ref{sec:ProdSigAlg})
by
\begin{equation}
  \label{eq:prod-meas}
  (\mu_1 \otimes \mu_2) (A) := \int_{X_1} \mu_2 (s_{x_1} (A)) \, d\mu_1,
\end{equation}
again represented in {\soft{Coq}} by a total function,
\begin{lstlisting}
Definition meas_prod_meas : (X1 * X2 -> Prop) -> Rbar :=
  fun A => LInt_p muX1 (meas_section muX2 A).
\end{lstlisting}

We easily deduce that this candidate function is both {{\nonnegativ}e} and equal
to zero on the empty set.
The $\sigma$-additivity property is obtained by means of $\sigma$-additivity of
the integral (see Section~\ref{sec:LInt_p}), and of the measure~$\mu_2$.
This proves that the candidate is a measure, and that we can instantiate the
record defining the product measure \coqe{meas_prod} as an object of type
measure (see Section~\ref{sec:Meas}), so all the proved results on measures are
available.

Moreover, Equation~\eqref{eq:box-meas-section}, and the positive linearity of
the integral ensure the box property~\eqref{eq:ProdMeasBox}, thus making
\coqe{meas_prod} a product measure.

\myskip

Product measures are proved to keep the finiteness, or $\sigma$-finiteness,
property of the initial measures~$\mu_1$ and~$\mu_2$: for all measure~$\mu$ on
$(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$ satisfying the box
property~\eqref{eq:ProdMeasBox}, we have~$\mu_1$ and~$\mu_2$ finite
$\Rightarrow\mu$ finite, and~$\mu_1$ and~$\mu_2$ $\sigma$-finite $\Rightarrow\mu$
$\sigma$-finite.

Then, the proof of uniqueness of the product measure follows exactly the same
path as the one for the measurability of measure of sections (see
Section~\ref{sec:MeasSect}).
Firstly, when the measures~$\mu_1$ and~$\mu_2$ are finite, we introduce two
(finite) product measures~$m$ and~$\tilde{m}$ induced by~$\mu_1$ and~$\mu_2$ ({i.e.}
both satisfying~\eqref{eq:ProdMeasBox}).
The set $\mathcal{S}\stackrel{\mathrm{def.}}{=}\{A\in\Sigma_1\otimes\Sigma_2{\,|\,} m(A)=\tilde{m}(A)\}$ is proved
to contain~$\Sigma_1\otimes\Sigma_2$ using \coqe{monotone_class_Prop}, which
shows uniqueness.
Then, the result is again extended to $\sigma$-finite measures by means of
restricted measures.

\section{The {Tonelli} Theorem}
\label{sec:Ton}

With the product measure built in Section~\ref{sec:Prod}, we can now consider
the integration of {{\nonnegativ}e} measurable functions on a product space.
As in Section~\ref{sec:Prod}, we assume that the measures are $\sigma$-finite,
which ensures existence and uniqueness of the product measure.

More precisely, this section deals with the proof of the {\Tont} that
allows to compute a double integral on a product space by integrating
successively with respect to each variable, either way.
Besides the following formulas, the theorem also states measurability
properties that ensure legitimacy of all integrals (see
Theorem~\ref{th:tonelli}):
\begin{align}
  \label{eq:tonelli-eq1}
  \int_{X_1 \times X_2} f (x_1, x_2) \, d(\mu_1 \otimes \mu_2) (x_1, x_2)
  &= \int_{X_1} \left(
    \int_{X_2} f (x_1, x_2) \, d\mu_2 (x_2) \right) \, d\mu_1 (x_1)\\
  \label{eq:tonelli-eq2}
  &= \int_{X_2} \left(
    \int_{X_1} f (x_1, x_2) \, d\mu_1 (x_1) \right) \, d\mu_2 (x_2).
\end{align}

Similarly to the process used in Section~\ref{sec:Prod}, the iterated integral
(right-hand side of~\eqref{eq:tonelli-eq1}) is built in three steps, see
Figure~\ref{fig:double-int}.
Firstly, $X_1$-sections of functions are proved to be $\Sigma_2$-measurable.
Then, the integral (in~$X_2$) of sections of functions is proved to be
$\Sigma_1$-measurable.
And the iterated integral is the integral (in~$X_1$) of the integral (in~$X_2$)
of the sections of functions.
Finally, Formula~\eqref{eq:tonelli-eq1} is first proved, and
then~\eqref{eq:tonelli-eq2} is deduced from the latter by a swap of variables
relying both on a change of measure and on the uniqueness of the product
measure.

The main argument for this proof is the {Lebesgue induction principle} (see Section~\ref{sec:LIP}).
It is used twice: to obtain the measurability of the integral of sections of
functions together with the first Tonelli formula, and for the
change-of-measure formula for the integral.

Section~\ref{sec:SecFun} is dedicated to sections of functions, and
Section~\ref{sec:TonelliTh1} to the iterated integral and the proof of the first
formula of the {\Tont}.
Finally, the full proof of the {\Tont} is obtained in
Section~\ref{sec:TonelliTh2}.

\begin{figure}[htb]
\begin{center}
\begin{tikzpicture}
\node[draw,rounded corners=3pt] (f) at (2,6.2)
  {$f\in\calM_+(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$};
\node[draw,rounded corners=3pt,fill=gray] (Secf) at (3.5,5.2)
  {$f_{x_1}\in\calM_+(X_2,\Sigma_2)$};
\node[draw,rounded corners=3pt,fill=lightgray] (If) at (3.5,4)
  {$I_f:=\left(x_1\longmapsto\int_{X_2}f_{x_1}\,d\mu_2\right)
      \in\calM_+(X_1,\Sigma_1)$};
\node[draw,rounded corners=3pt,fill=lightgray] (T1) at (3.5,2.7)
  {$\int_{X_1\times X_2}f\,d(\mu_1\otimes\mu_2)=\int_{X_1}I_f\,d\mu_1$};
\node[draw,rounded corners=3pt,fill=lightlightgray] (T2) at (3.5,1)
  {$\begin{array}{c}
      f^{x_2}\in\calM_+(X_1,\Sigma_1)\\
      J^f:=\left(x_2\longmapsto\int_{X_1}f^{x_2}\,d\mu_1\right)
      \in\calM_+(X_2,\Sigma_2)\\
      \int_{X_1\times X_2}f\,d(\mu_1\otimes\mu_2)=\int_{X_2}J^f\,d\mu_2
    \end{array}$};
\draw[->,>=latex,thick] (f) to (Secf);
\draw[->,>=latex,thick] (Secf) to (If);
\draw[->,>=latex,thick] (If) to (T1);
\draw[->,>=latex,thick] (T1) to (T2);
\draw[->,>=latex,thick] (f.south west) to [bend left=-45] (T1.west);
\node[draw] (LCS) at (10,5) {Lebesgue induction principle};
\node[draw] (Swap) at (10,3)
  {$\begin{array}{c}
      \mbox{Swap of variables}\\
      \mbox{Change of measure}
    \end{array}$};
\draw[->,>=latex,dashed] (LCS.south west) to (If.north east);
\draw[->,>=latex,dashed] (LCS.190) to [bend right=-20] (T1.east);
\draw[->,>=latex,dashed] (LCS) to (Swap);
\draw[->,>=latex,dashed] (Swap.south west) to (T2.north east);
\end{tikzpicture}
\end{center}
\caption{%
  Flowchart illustrating the construction of the iterated integrals on a
  product space.\protect\\
  The fill colors refer to sections:
  \ref{sec:SecFun} in {\colorbox{\colorB}{gray}},
  \ref{sec:TonelliTh1} in {\colorbox{\colorC}{light gray}}, and
  \ref{sec:TonelliTh2} in {\colorbox{\colorD}{lighter gray}}.\protect\\
  Dashed lines denote the use of the listed proof arguments, that were
  developed for the present work.}
\label{fig:double-int}
\end{figure}

\subsection{Section of Function}
\label{sec:SecFun}

Similarly to sections of subsets in Section~\ref{sec:Sect}, given a numeric
function~$f:X_1\times X_2\to\overline{\R}$ and{ a point}~$x_1\in X_1$, the
\emph{$X_1$-section of~$f$ at~$x_1$} is the partial application
$f_{x_1}:=(x_2\mapsto f(x_1,x_2))$.
\begin{lstlisting}
Definition section_fun : X1 -> (X1 * X2 -> Rbar) -> X2 -> Rbar := fun x1 f x2 => f (x1, x2).
\end{lstlisting}

From measurability of sections of subsets, we deduce that, if~$f$ is
in~$\calM_+(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$, then its $X_1$-sections
are in $\calM_+(X_2,\Sigma_2)$ (the {{\nonnegativ}ity} property is obvious).
\begin{lstlisting}
Lemma section_fun_Mplus : \forall f x1, Mplus genX1xX2 f -> Mplus genX2 (section_fun x1 f).
\end{lstlisting}

Symmetrically, for any~$x_2\in X_2$, we introduce the
\emph{$X_2$-section of~$f$ at~$x_2$}, the partial application with respect to
the second variable, $f^{x_2}:=(x_1\mapsto f(x_1,x_2))$.

\subsection{Iterated Integral and the First Formula of the {Tonelli} Theorem}
\label{sec:TonelliTh1}

As sections of functions are {{\nonnegativ}e} and $\Sigma_2$-measurable (see
Section~\ref{sec:SecFun}), one can take their integral (in~$X_2$).
For any function $f\in\calM_+(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$, we
define
\begin{equation*}
  I_f := \left( x_1 \longmapsto \int_{X_2} f_{x_1} \, d\mu_2 \right).
\end{equation*}
\begin{lstlisting}
Definition LInt_p_section_fun : (X1 * X2 -> Rbar) -> X1 -> Rbar :=
  fun f x1 => LInt_p muX2 (section_fun x1 f).
\end{lstlisting}

The iterated integral corresponds to integrate once more (in~$X_1$), but one
must first establish that~$I_f\in\calM_+(X_1,\Sigma_1)$.
The {{\nonnegativ}ity} result directly follows from the {\monotony} of the
integral (see Section~\ref{sec:LInt_p}).
The general measurability result, together with the first Tonelli
formula~\eqref{eq:tonelli-eq1}, are proved by means of the {Lebesgue induction principle} of
Section~\ref{sec:LIP}.

\myskip

Let us first review the properties of the function $I:=(f\mapsto I_f)$.
From the properties of the integral, $I$~is monotone and positive linear.
In the case of indicator functions, for any~$x_1\in X_1$, the section reads
$(\charac{A})_{x_1}=\charac{s_{x_1}(A)}$, which yields the formula
$I_{\charac{A}}(x_1)=\mu_2(s_{x_1}(A))$.
And from the {\BLmct} (see Section~\ref{sec:LInt_p}),
$I$~commutes with the supremum:
for all {non\-decreasing} sequence~$(f_n)_{n\in\mathbb{N}}$
in~$\calM_+(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$, we have the equality
\mydisplaymaths{I_{\sup_{n\in\mathbb{N}}f_n}=\sup_{n\in\mathbb{N}}I_{f_n}}

\myskip

Let~\coqe{P0 f := Mplus genX1 (LInt_p_section_fun f)} be the predicate of the
{{\nonnegativ}ity} and measurability of~$I_f$, of type
\coqe{(E -> Rbar) -> Prop}.
Then, previous formulas and closedness properties of~$\calM_+$ (see
Section~\ref{sec:MeasFun}) provide the compatibility of~\coqe{P0} with
indicator functions, positive linearity, and the supremum of {non\-decreasing}
sequences.
For instance, we have
\begin{lstlisting}
Lemma LInt_p_section_fun_measurable_plus :
  \forall f g, Mplus genX1xX2 f -> Mplus genX1xX2 g ->
    P0 f -> P0 g -> P0 (fun x => Rbar_plus (f x) (g x)).
\end{lstlisting}

\myskip

Let us now define the predicate~\coqe{P} of the existence of the iterated
integral (granted by~\coqe{P0}) and the validity of the first Tonelli formula
of~\eqref{eq:tonelli-eq1}:
\begin{lstlisting}
Let P : (E -> Rbar) -> Prop :=
  fun f => P0 f /\ LInt_p meas_prod f = LInt_p muX1 (LInt_p_section_fun f).
\end{lstlisting}
where \coqe{meas_prod} is the product measure defined in
Section~\ref{sec:ProdMeas}.
Again, the compatibility of~\coqe{P} with indicator functions, positive
linearity, and the supremum is easily obtained from the previous results.
Namely, we have
\begin{lstlisting}
Lemma LInt_p_section_fun_meas_prod_charac :
  \forall A, measurable genX1xX2 A -> P (charac A).

Lemma LInt_p_section_fun_meas_prod_scal :
  \forall a f, 0 <== a -> Mplus genX1xX2 f -> P f -> P (fun x => Rbar_mult a (f x)).

Lemma LInt_p_section_fun_meas_prod_plus :
  \forall f g, Mplus genX1xX2 f -> Mplus genX1xX2 g -> P f -> P g -> P (fun x => Rbar_plus (f x) (g x)).

Lemma LInt_p_section_fun_meas_prod_Sup_seq :
  \forall f, incr_fun_seq f -> Mplus_seq genX1xX2 f ->
    (\forall n, P (f n)) -> P (fun x => Sup_seq (fun n => f n x)).
\end{lstlisting}

\myskip

Now, the first part of the {\Tont} can be stated in {\soft{Coq}} as
\begin{lstlisting}
Lemma Tonelli_aux1 :
  \forall f, Mplus genX1xX2 f ->
    Mplus genX1 (LInt_p_section_fun f) /\
    LInt_p meas_prod f = LInt_p muX1 (LInt_p_section_fun f).
\end{lstlisting}
And its proof is a direct application of the {Lebesgue induction principle} (see Section~\ref{sec:LIP})
with the predicate~\coqe{P}, as all the premises corresponds to the previous
lemmas.

\subsection{Change of Measure, Second Formula, and the {Tonelli} Theorem}
\label{sec:TonelliTh2}

There is no doubt that the second formula~\eqref{eq:tonelli-eq2} can be proved
using the same path as the first claim: use sections with respect to the second
variable, define~$J^f$ (see Figure~\ref{fig:double-int}),
prove~$J^f\in\calM_+$ and the equality by the {Lebesgue induction principle}.
This would be easy, but pretty long and redundant.
Instead, we have exploited the ``symmetry'' between the right-hand sides of
both formulas.
The first idea is a simple exchange of the roles of the two variables that
expresses the previous result for functions of type \coqe{X2 * X1 -> Rbar}.
And then, the difficult part is a change of measure that brings back to the
target type \coqe{X1 * X2 -> Rbar}.

In the framework of the Lebesgue integral, the change of measure is an
application of the concept of \emph{image measure} ({e.g.}
see~\cite{mai:m2:14}), also called \emph{pushforward measure} as the measure is
transported between $\sigma$-algebras, here from~$\Sigma_2\otimes\Sigma_1$
to~$\Sigma_1\otimes\Sigma_2$.

\subsubsection{Change of measure}
\label{sec:ChgMeas}

Let~$(X,\Sigma)$ and~$(Y,\mathcal{T})$ be measurable spaces.
Let~$h:X\to Y$~be a function and~\coqe{Mh} be a proof of its measurability.
Let~$\mu$ be a measure on~$(X,\Sigma)$.
The \emph{image measure of~$\mu$ by~$h$} is the measure on~$(Y,\mathcal{T})$ defined
by~$h \text{\raisebox{.125em}{{\tiny \#}}} \mu:=\mu\circ h^{-1}$, and denoted in {\soft{Coq}} by
\coqe{meas_image h Mh mu}.
The proof that it is indeed a measure directly follows from the measure
properties of~$\mu$, and~\coqe{Mh}.

Now, given $g\in\calM_+(Y,\mathcal{T})$, the compatibility of measurability with
the composition of functions provides $g\circ h\in\calM_+(X,\Sigma)$, and one
has the following change-of-measure formula,
\begin{equation}
  \label{eq:change-meas}
  \int_Y g \, d(h \text{\raisebox{.125em}{{\tiny \#}}} \mu) = \int_X g \circ h \, d\mu.
\end{equation}
\begin{lstlisting}
Lemma LInt_p_change_meas :
  \forall g, Mplus genY g -> LInt_p (meas_image h Mh mu) g = LInt_p mu (fun x => g (h x)).
\end{lstlisting}
The proof follows the {Lebesgue induction principle} with the predicate~\coqe{P'} corresponding
to~\eqref{eq:change-meas}.
Once again, the compatibility of~\coqe{P'} with indicator functions, positive
linearity, and the supremum directly follows from properties of the integral,
such as positive linearity and the {\BLmct}.

\subsubsection{Swap and Second Formula}
\label{sec:Swap}

Using Section~\ref{sec:ProdMeas}, let~$\mu_{12}:=\mu_1\otimes\mu_2$ be the
product measure induced by~$\mu_1$ and~$\mu_2$ on the product
space~$(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$.
In {\soft{Coq}}, \coqe{muX1xX2 := meas_prod muX1 muX2}.
By exchanging the two spaces, let~$\mu_{21}:=\mu_2\otimes\mu_1$ be the product
measure induced by~$\mu_2$ and~$\mu_1$
on~$(X,\Sigma):=(X_2\times X_1,\Sigma_2\otimes\Sigma_1)$.
In {\soft{Coq}}, \coqe{muX2xX1 := meas_prod muX2 muX1}.

Let~$h:(x_2,x_1)\in X_2\times X_1\mapsto(x_1,x_2)\in X_1\times X_2$ be the swap
of variables.
We construct the proof~\coqe{Mh} of its measurability.
The image measure~$h \text{\raisebox{.125em}{{\tiny \#}}} \mu_{21}$ is defined on the measurable
space $(Y,\mathcal{T}):=(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$.
In {\soft{Coq}}, \coqe{meas_prod_swap := meas_image h Mh muX2xX1}.
The proof that it is a product measure induced by~$\mu_1$ and~$\mu_2$ is
straightforward.

Now, let $f\in\calM_+(X_1\times X_2,\Sigma_1\otimes\Sigma_2)$.
One has~$f\circ h\in\calM_+(X_2\times X_1,\Sigma_2\otimes\Sigma_1)$, and
using the section with respect to the second variable (see
Section~\ref{sec:SecFun}), we have
\begin{equation}
  \label{eq:tonelli-blop}
  \forall x_2 \in X_2,\quad
  f^{x_2}
  := (x_1 \longmapsto f (x_1, x_2))
  = (x_1 \longmapsto f \circ h (x_2, x_1))
  = (f \circ h)_{x_2}.
\end{equation}

We then deduce the second part of the {\Tont}~\eqref{eq:tonelli-eq2} from
the previous ingredients:
\begin{align*}
  \int_{X_1 \times X_2} f \, d\mu_{12}
  &\stackrel{(a)}{=} \int_{X_1 \times X_2} f \, d(h \text{\raisebox{.125em}{{\tiny \#}}} \mu_{21})
  \stackrel{(b)}{=} \int_{X_2 \times X_1} f \circ h \, d\mu_{21}\\
  &\stackrel{(c)}{=} \int_{X_2} \left( \int_{X_1} (f \circ h)_{x_2} \, d\mu_1 \right) \, d\mu_2
  \stackrel{(d)}{=} \int_{X_2} \left( \int_{X_1} f^{x_2} \, d\mu_1 \right) \, d\mu_2.
\end{align*}
Uniqueness of the product measure of Section~\ref{sec:ProdMeas}
yields~$h\text{\raisebox{.125em}{{\tiny \#}}}\mu_{21}=\mu_{12}$, and thus gives~(a).
The above change-of-measure formula~\eqref{eq:change-meas} gives~(b).
The first formula of the {\Tont}~\eqref{eq:tonelli-eq1} applied
to~$X_2 \times X_1$ gives~(c).
The above Equation~\eqref{eq:tonelli-blop} gives~(d).

This second part of {\Tont} can be stated in {\soft{Coq}} as
\begin{lstlisting}
Lemma Tonelli_aux2 :
  \forall f, Mplus genX1xX2 f ->
  Mplus genX2 (LInt_p_section_fun muX1 (swap f)) /\
  LInt_p meas_prod_swap f = LInt_p muX2 (LInt_p_section_fun muX1 (swap f)).
\end{lstlisting}
where \coqe{swap f} denotes~$f\circ h$.

\subsubsection{Statement of the {Tonelli} Theorem}
\label{sec:ProofTon}

Finally, we formalize the {\Tont} that gathers the two
equalities~\eqref{eq:tonelli-eq1} and~\eqref{eq:tonelli-eq2}.
We assume that~$X_1$ and~$X_2$ are {non\-empty} and that~$\mu_1$ and~$\mu_2$ are
$\sigma$-finite measures.
Then,
\begin{lstlisting}
Lemma Tonelli_formulas :
  \forall f, Mplus genX1xX2 f ->
    LInt_p muX1xX2 f = LInt_p muX1 (LInt_p_section_fun muX2 f) /\
    LInt_p muX1xX2 f = LInt_p muX2 (LInt_p_section_fun muX1 (swap f)).
\end{lstlisting}
where \coqe{muX1xX2} stands for the product measure.
We also provide a more comprehensive but less readable theorem \coqe{Tonelli}
that moreover ensures the legitimacy of all integrals.

Logic in Computer Science (cs.LO); Functional Analysis (math.FA)