David Delahaye CNAM, Paris, France Micaela Mayero Université Paris Nord, Villetaneuse, France

1. Quantifier Elimination over Algebraically Closed Fieldsin a Proof Assistant using a Computer Algebra System David Delahaye CNAM, Paris, France Micaela Mayero Université Paris Nord, Villetaneuse, France

2. Introduction • We focus on: • Theorem Proving • Computer Algebra • In a Deduction System (DS): •  hard to perform efficient computations. • In a Computer Algebra System (CAS): •  no notion of consistency.

3. Adams/Dunstan/Gottliebsen • Kelsey/Martin/Owre: • Maple/PVS (2001) • Colton: • Maple/Otter (2002) Approaches • CASs  dedicated to computations • DSs  dedicated to validation • Make them interact! • To import validation into CASs • To import computations into DSs • Believing approach • Skeptical approach • Autarkic approach • To build a system with both • Harrison/Théry: • HOL/Maple (1998) • Delahaye/Mayero: • Coq/Maple (2002) • Focal Team: • Focal system (1997…)

4. Contribution • When importing CAS computations into DSs: •  enhance the computational power of DSs. • Our contribution: • Use a CAS to enhance the power of automation of a DS. • Example: • Quant. Elimination proc. over alg. closed fields (ACFs) • In Coq using Maple • Quite simple (one variable, skeptical appr.) • Validation available (Maple mode & ring/field)

5. Algebraically Closed Fields • K is an ACF: • Fundamental theorem of Algebra (D’Alembert’s theorem): • Every non-constant pol. of K[X] has n roots. • Equation and inequation system: A method of quantifier elimination

6. Quantifier elimination Prop. 1: Q≠ 0. Φ ≡ “(S) has a sol.”: • n = 0, m > 0: left (prop. 1) • n > 0, m = 0: (prop. 2) • If P ≠ 1 then left (ACF) else right • n > 0, m > 0: • If P = 1 then right • else G = gcd(P, Q): • If G = 1: (prop. 3) • else P = GP’: (prop. 4) Prop. 2: P1 ≠ 0, P2 ≠ 0, G = gcd(P1, P2). Prop. 3: P ≠ 0, Q ≠ 0, gcd(P, Q) = 1. Prop. 4: P ≠ 0, Q ≠ 0, G = gcd(P, Q), P = GP1.

7. Extraction of an algorithm • Prop. 5: P ≠ 0, Q ≠ 0, G = gcd (P, Q), P = GP1. • If G ≠ 1 then deg(P1) < deg(P). • We proved that “the system (S) has solutions or not” constructively • and using well-founded induction schemes: •  the problem is decidable. • Heyting-Kolmogorov’s semantics: • we can extract an algorithm from the previous proof.

8. Algorithm • if n = 0 then go to III else compute • if m = 0 then apply prop. 1. Equivalent to • if P ≠ 1 then apply def. of ACF • else fail • if m ≠ 0: • compute • if n = 0 then apply prop. 2 • else equivalent to • if P = 1 then fail • else compute G = gcd(P, Q): • if G = 1 then apply prop. 3 • else apply prop. 4 and re-apply the algorithm.

9. Validation of computations • We have a skeptical approach. • Theorem (Bézout, converse): P ≠ 0, Q ≠ 0, G ≠ 0. • If G divides P and Q and if there exist A and B s.t. AP + BQ = G • then G = gcd(P, Q). • The CAS must provide the gcd G, the quotients P1 and Q1, • as well as the cofactors A and B. • The DS must verify: P = P1G, Q = Q1G and AP + BQ = G.

10. Integration in Coq using Maple • Why Coq and Maple? •  existence of a Maple mode for Coq (Delahaye & Mayero, 2002). • Work in Coq: • Theory of univariate polynomials • Theory of ACFs (proofs of prop.) • Systems of pol. with rational coefficients • Work in Maple: nothing to do (just use the gcd when needed).

11. Extension of the Maple mode for Coq • Initially: • Algebraic operations over a field • Validated automatically by the tactic field • Extension: • Import the gcd, the quotients and the cofactors • Verify the 3 equalities (divisors and Bézout’s relation): • carried out by the tactics ring (normalization) • and field (coefficients)

12. Interface between Coq and Maple Coq Maple quotation gcd(P, Q) Pm, Qm Gm = gcdm(Pm, Qm) with quot. P1, Q1 and cof. A, B prove: P = P1G, Q = Q1G and AP + BQ = G validation G is the gcd of P and Q!

13. A simple example • P = 3X 3 + 10X 2 + 5X + 6 • Q = 2X2 + 5X – 3 • We want to prove: • G = gcd(P, Q) = X + 3; equivalent to: (prop. 4), • where P = P’G. Re-apply the algorithm: • gcd(P’, G) = 1; equivalent to: (prop. 3), • proved by def. of ACF.

14. Running in Coq • Coq <Lemma lem1 :exists x : C, eval x P = C0 /\ eval x Q <> C0. • 1 subgoal • ============================ • exists x : C, eval x P = C0 /\ eval x Q <> C0 • lem1 <unfold P, Q. • 1 subgoal • ============================ • exists x : C, eval x (PList C ((cte 3, 3)::(cte 10, 2)::(cte 5, 1):: • (cte 6, 0):: nil) sorted_p)= C0 /\ eval x (PList C ((cte 2, 2):: • (cte 5, 1)::(cte (-3), 0):: nil) sorted_q)<> C0 • lem1 <qelim. • Proof completed.

15. Another example • quartic = X4 + X3 + X2 + X • cubic = X3 + X2 + X + 1 • line = X + 1 • Points on the two curves but not on the line? • i, -i and -1 satisfy quartic = 0 and cubic = 0; • -1 does not satisfy line ≠ 0 but i and -i do. Coq <Lemma lem2 :exists x : C, eval x quartic = C0 /\ eval x cubic = C0 /\ eval x line <> C0. lem2 <unfold quartic, cubic, line;qelim. Proof completed.

16. Conclusion • CASs can enhance the computational power of DSs: •  CASs can also enhance the power of automation of DSs. • The skeptical approach is a good way to benefit • both efficiency and soundness. • Extensions: • Multivariate polynomials: validation vs autarkic computations? • Real closed fields? • Interactions with other CASs: MuPAD, …