Documentation

LeanCert.Engine.RootFinding.MVTBounds

Root Finding: MVT-based bounds for Newton contraction proofs #

This file contains Mean Value Theorem-based lemmas used to prove Newton method correctness, particularly for showing that Newton contraction implies root existence.

Main lemmas #

MVT wrapper lemmas #

theorem LeanCert.Engine.mvt_lower_bound (e : Core.Expr) (hsupp : ExprSupported e) (_hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (C : ) (hC : ξI, C deriv (evalFunc1 e) ξ) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (x y : ) :
x Iy Ix yC * (y - x) evalFunc1 e y - evalFunc1 e x

MVT lower bound: if f' ≥ C on interval I, then f(y) - f(x) ≥ C * (y - x) for x ≤ y in I. This wraps Mathlib's Convex.mul_sub_le_image_sub_of_le_deriv for our use case.

theorem LeanCert.Engine.mvt_upper_bound (e : Core.Expr) (hsupp : ExprSupported e) (_hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (C : ) (hC : ξI, deriv (evalFunc1 e) ξ C) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (x y : ) :
x Iy Ix yevalFunc1 e y - evalFunc1 e x C * (y - x)

MVT upper bound: if f' ≤ C on interval I, then f(y) - f(x) ≤ C * (y - x) for x ≤ y in I. This wraps Mathlib's Convex.image_sub_le_mul_sub_of_deriv_le for our use case.

Contradiction lemmas for increasing functions #

theorem LeanCert.Engine.newton_positive_increasing_contradicts_contraction (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (_hI_nonsingleton : I.lo < I.hi) (hdI_lo_pos : 0 < (derivInterval e (fun (x : ) => I) 0).lo) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ilo_pos : 0 < evalFunc1 e I.lo) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; have fc := evalInterval1 e (Core.IntervalRat.singleton c); fc.hi / dI.lo hw

Contradiction lemma: If f > 0 at I.lo with f' ≥ dI.lo > 0 (increasing), then the Newton quotient Q.hi > hw, contradicting strict contraction Q.hi < hw.

Key argument:

  1. By MVT: f(c) - f(I.lo) ≥ dI.lo * hw, so f(c) ≥ f(I.lo) + dI.lo * hw > dI.lo * hw
  2. fc.hi ≥ f(c) > dI.lo * hw
  3. Q.hi = fc.hi / dI.lo > hw
  4. But contraction requires Q.hi < hw (from N.lo > I.lo)
  5. Contradiction
theorem LeanCert.Engine.newton_negative_increasing_contradicts_contraction (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (_hI_nonsingleton : I.lo < I.hi) (hdI_lo_pos : 0 < (derivInterval e (fun (x : ) => I) 0).lo) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ihi_neg : evalFunc1 e I.hi < 0) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; have fc := evalInterval1 e (Core.IntervalRat.singleton c); fc.lo / dI.lo -hw

Contradiction lemma: If f < 0 at I.hi with f' ≥ dI.lo > 0 (increasing), then the Newton quotient Q.lo < -hw, contradicting strict contraction Q.lo > -hw.

Key argument:

  1. By MVT: f(I.hi) - f(c) ≥ dI.lo * hw, so f(c) ≤ f(I.hi) - dI.lo * hw < -dI.lo * hw
  2. fc.lo ≤ f(c) < -dI.lo * hw
  3. Q.lo = fc.lo / dI.lo < -hw
  4. But contraction requires Q.lo > -hw (from N.hi < I.hi)
  5. Contradiction

Quotient bound lemmas #

When dI.lo > 0, the quotient Q has Q.hi ≥ fc.hi / dI.lo (regardless of fc signs). This is because the invNonzero of positive dI is [1/dI.hi, 1/dI.lo], and the max includes fc.hi * dI.lo⁻¹ as one of its corners.

When dI.lo > 0, the quotient Q has Q.lo ≤ fc.lo / dI.lo.

For negative dI, the quotient Q has Q.hi ≥ fc.lo / dI.hi. This is because fc.lo * dI.hi⁻¹ is one of the four corners in Q = fc * inv(dI), and Q.hi = max of all corners. This bound is used for Newton contraction contradiction when f < 0 at both endpoints.

For negative dI, the quotient Q has Q.lo ≤ fc.hi / dI.hi. This is because fc.hi * dI.hi⁻¹ is one of the four corners in Q = fc * inv(dI), and Q.lo = min of all corners. This bound is used for Newton contraction contradiction when f > 0 at both endpoints.

Generic contraction contradiction lemmas #

These lemmas abstract the Newton step structure to work with any interval fc that contains f(c). This allows them to be used with both newtonStepSimple (where fc = evalInterval1 e (singleton c)) and newtonStepTM (where fc = TaylorModel.valueAtCenterInterval tm).

theorem LeanCert.Engine.generic_contraction_absurd_hi {e : Core.Expr} (I : Core.IntervalRat) (c : ) (fc dI N : Core.IntervalRat) (hc_eq : c = I.midpoint) (hdI_nonzero : ¬dI.containsZero) (hdI_pos : 0 < dI.lo) (hfc_correct : evalFunc1 e c fc) (hN_lo_eq : N.lo = max I.lo (c - (fc.mul (Core.IntervalRat.invNonzero { toIntervalRat := dI, nonzero := hdI_nonzero })).hi)) (hContract : N.lo > I.lo) (hMVT : evalFunc1 e c > dI.lo * ↑((I.hi - I.lo) / 2)) :

Generic contradiction: if Q is computed from fc/dI with dI.lo > 0, contraction holds, and f(c) > dI.lo * hw, then False.

This abstracts the key Newton contraction argument:

  1. Contraction implies Q.hi < hw (since N.lo > I.lo means c - Q.hi > I.lo)
  2. f(c) > dI.lo * hw implies fc.hi > dI.lo * hw (since fc.hi ≥ f(c))
  3. quotient_hi_lower_bound says Q.hi ≥ fc.hi / dI.lo > hw
  4. Contradiction: Q.hi < hw and Q.hi > hw
theorem LeanCert.Engine.generic_contraction_absurd_lo {e : Core.Expr} (I : Core.IntervalRat) (c : ) (fc dI N : Core.IntervalRat) (hc_eq : c = I.midpoint) (hdI_nonzero : ¬dI.containsZero) (hdI_pos : 0 < dI.lo) (hfc_correct : evalFunc1 e c fc) (hN_hi_eq : N.hi = min I.hi (c - (fc.mul (Core.IntervalRat.invNonzero { toIntervalRat := dI, nonzero := hdI_nonzero })).lo)) (hContract : N.hi < I.hi) (hMVT : evalFunc1 e c < -(dI.lo * ↑((I.hi - I.lo) / 2))) :

Generic contradiction for Q.lo case with dI.lo > 0.

theorem LeanCert.Engine.generic_contraction_absurd_hi_neg {e : Core.Expr} (I : Core.IntervalRat) (c : ) (fc dI N : Core.IntervalRat) (hc_eq : c = I.midpoint) (hdI_nonzero : ¬dI.containsZero) (hdI_neg : dI.hi < 0) (hfc_correct : evalFunc1 e c fc) (hN_lo_eq : N.lo = max I.lo (c - (fc.mul (Core.IntervalRat.invNonzero { toIntervalRat := dI, nonzero := hdI_nonzero })).hi)) (hContract : N.lo > I.lo) (hMVT : evalFunc1 e c < dI.hi * ↑((I.hi - I.lo) / 2)) :

Generic contradiction for Q.hi case with dI.hi < 0 (decreasing function).

theorem LeanCert.Engine.generic_contraction_absurd_lo_neg {e : Core.Expr} (I : Core.IntervalRat) (c : ) (fc dI N : Core.IntervalRat) (hc_eq : c = I.midpoint) (hdI_nonzero : ¬dI.containsZero) (hdI_neg : dI.hi < 0) (hfc_correct : evalFunc1 e c fc) (hN_hi_eq : N.hi = min I.hi (c - (fc.mul (Core.IntervalRat.invNonzero { toIntervalRat := dI, nonzero := hdI_nonzero })).lo)) (hContract : N.hi < I.hi) (hMVT : evalFunc1 e c > -(dI.hi * ↑((I.hi - I.lo) / 2))) :

Generic contradiction for Q.lo case with dI.hi < 0 (decreasing function).

Simple step contradiction lemmas (using generic lemmas) #

theorem LeanCert.Engine.newtonStepSimple_contraction_absurd_hi (e : Core.Expr) (I N : Core.IntervalRat) (hSimple : newtonStepSimple e I 0 = some N) (hContract : N.lo > I.lo N.hi < I.hi) (hdI_pos : 0 < (derivInterval e (fun (x : ) => I) 0).lo) (hMVT : (evalInterval1 e (Core.IntervalRat.singleton I.midpoint)).hi / (derivInterval e (fun (x : ) => I) 0).lo (I.hi - I.lo) / 2) :

Key contradiction: if newtonStepSimple contracts AND fc.hi/dI.lo ≥ hw (with dI.lo > 0), then False.

theorem LeanCert.Engine.newtonStepSimple_contraction_absurd_lo (e : Core.Expr) (I N : Core.IntervalRat) (hSimple : newtonStepSimple e I 0 = some N) (hContract : N.lo > I.lo N.hi < I.hi) (hdI_pos : 0 < (derivInterval e (fun (x : ) => I) 0).lo) (hMVT : (evalInterval1 e (Core.IntervalRat.singleton I.midpoint)).lo / (derivInterval e (fun (x : ) => I) 0).lo -((I.hi - I.lo) / 2)) :

Key contradiction: if newtonStepSimple contracts AND fc.lo/dI.lo ≤ -hw (with dI.lo > 0), then False.

Contradiction lemmas for decreasing functions #

theorem LeanCert.Engine.newton_positive_decreasing_contradicts_contraction (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (hI_nonsingleton : I.lo < I.hi) (hdI_hi_neg : (derivInterval e (fun (x : ) => I) 0).hi < 0) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ihi_pos : 0 < evalFunc1 e I.hi) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; have fc := evalInterval1 e (Core.IntervalRat.singleton c); fc.hi / dI.hi -hw

Contradiction lemma for decreasing function: If f > 0 at I.hi with f' ≤ dI.hi < 0 (decreasing), then the Newton quotient Q.lo = fc.hi/dI.hi ≤ -hw, contradicting strict contraction Q.lo > -hw.

theorem LeanCert.Engine.newton_negative_decreasing_contradicts_contraction (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (hI_nonsingleton : I.lo < I.hi) (hdI_hi_neg : (derivInterval e (fun (x : ) => I) 0).hi < 0) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ilo_neg : evalFunc1 e I.lo < 0) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; have fc := evalInterval1 e (Core.IntervalRat.singleton c); fc.lo / dI.hi hw

Contradiction lemma for decreasing function: If f < 0 at I.lo with f' ≤ dI.hi < 0 (decreasing), then the Newton quotient violates contraction bounds.

Generic MVT bounds on f(c) #

These lemmas give bounds on evalFunc1 e c (the true function value at the midpoint) rather than on interval enclosures. This allows them to be used with any interval that contains f(c), whether from evalInterval1 or TaylorModel.valueAtCenterInterval.

theorem LeanCert.Engine.mvt_fc_lower_bound_pos_increasing (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (_hdI_lo_pos : 0 < (derivInterval e (fun (x : ) => I) 0).lo) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ilo_pos : 0 < evalFunc1 e I.lo) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; evalFunc1 e c > dI.lo * hw

Generic MVT bound: If f' ≥ dI.lo > 0 (increasing) and f(I.lo) > 0, then f(c) > dI.lo * hw where c = midpoint and hw = half-width. This is the core analytic fact used for Newton contraction contradictions.

theorem LeanCert.Engine.mvt_fc_upper_bound_pos_increasing (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (_hdI_lo_pos : 0 < (derivInterval e (fun (x : ) => I) 0).lo) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ihi_neg : evalFunc1 e I.hi < 0) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; evalFunc1 e c < -(dI.lo * hw)

Generic MVT bound: If f' ≥ dI.lo > 0 (increasing) and f(I.hi) < 0, then f(c) < -dI.lo * hw where c = midpoint and hw = half-width.

theorem LeanCert.Engine.mvt_fc_upper_bound_neg_decreasing (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (_hI_nonsingleton : I.lo < I.hi) (_hdI_hi_neg : (derivInterval e (fun (x : ) => I) 0).hi < 0) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ilo_neg : evalFunc1 e I.lo < 0) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; evalFunc1 e c < dI.hi * hw

Generic MVT bound: If f' ≤ dI.hi < 0 (decreasing) and f(I.lo) < 0, then f(c) < dI.hi * hw where c = midpoint and hw = half-width. Since dI.hi < 0 and hw > 0, we have dI.hi * hw < 0, so f(c) < 0.

theorem LeanCert.Engine.mvt_fc_lower_bound_neg_decreasing (e : Core.Expr) (hsupp : ExprSupported e) (hvar0 : UsesOnlyVar0 e) (I : Core.IntervalRat) (hI_nonsingleton : I.lo < I.hi) (hdI_hi_neg : (derivInterval e (fun (x : ) => I) 0).hi < 0) (hCont : ContinuousOn (evalFunc1 e) (Set.Icc I.lo I.hi)) (hf_Ihi_pos : 0 < evalFunc1 e I.hi) :
have c := I.midpoint; have hw := (I.hi - I.lo) / 2; have dI := derivInterval e (fun (x : ) => I) 0; evalFunc1 e c > -(dI.hi * hw)

Generic MVT bound: If f' ≤ dI.hi < 0 (decreasing) and f(I.hi) > 0, then f(c) > -dI.hi * hw where c = midpoint and hw = half-width.