## 1 Introduction

This work deals with the Coq^{1}^{1}1https://coq.inria.fr/
formalization of the Lebesgue induction principle and the Tonelli theorem as a
direct continuation of a previous work [BCF21].
Our long term objective is to formally prove in Coq scientific computing
programs and the correctness of parts of a C++ library, such as
FreeFEM++^{2}^{2}2https://freefem.org/ or
XLiFE++,^{3}^{3}3https://uma.ensta-paris.fr/soft/XLiFE++/

that implements the Finite Element Method (FEM), a widely used method for numerically solving Partial Differential Equations (PDEs) arising in different domains like engineering and mathematical modeling. With this work, we carry on with our goal: to provide a

Coq library usable by numerician people. It started with the first development of a real numbers library [May01], and then by the first complete experimentation of the formalization and proof of a numerical program, a small C program for the approximated resolution of the wave equation [BCF13]. More recently, the Lax–Milgram theorem [BCF17] (for the resolution of a class of PDEs), then Lebesgue integration of nonnegative measurable functions, the Beppo Levi (monotone convergence) theorem and Fatou’s lemma [BCF21], Bochner integration [BCL22] (a generalization of Lebesgue integration for functions taking their values in a Banach space), and the construction of the Lebesgue measure^{4}

^{4}4https://lipn.univ-paris13.fr/coq-num-analysis/tree/Tonelli.1.0/Lebesgue/measure_R.v (yet unpublished) have also been formalized.

The proof of the Tonelli theorem is the next step. But, as a side result, it also allows us to validate our previous developments and in particular our definitions and results about the Lebesgue integral. The validation of a usable development is indeed important. It should allow us to carry on by confirming or not the choices of formalization. For example, as we work in Coq, the question of using classical or intuitionistic real analysis is a valid question. As explained in [BCF17] and [BCF21], our view on the question has evolved. In this work, we make the same choices as in the latter, namely we are completely classical.

The Lebesgue induction principle is a proof technique for properties about nonnegative measurable functions, and usually involving the integral. It reflects the three construction steps followed by Henri Lebesgue to build his integral [leb:lir:04]. The property is first established for indicator functions, then for nonnegative simple functions by checking that the property is compatible with positive linear operations, and finally for all nonnegative measurable functions by checking that it is compatible with the supremum. This technique is an important asset for the proof of the Tonelli theorem, and we provide it as a byproduct of an inductive type.

The Tonelli theorem provides a convenient way to ease the computation of multiple integrals by stating their equality with iterated integrals, each in a single dimension. The Tonelli theorem applies to nonnegative measurable functions. A similar result, the Fubini theorem, applies to integrable functions with arbitrary sign, or even taking their values in a Banach space when using the Bochner integral. Both theorems can be combined to ease the proof of integrability of the multi-variable function to integrate. This article focuses on the case of nonnegative functions, and as usual in mathematics, we are only interested in the case of two variables.

We aim to the construction of the full formal proof in Coq of the Tonelli theorem, stating that the (double) integral of a nonnegative measurable function of two variables can be computed by iterated integrals, and allowing to switch the order of integration. It can be expressed in a mathematical setting as follows. [Tonelli] Let and be measure spaces. Assume that and are -finite. Let . Then, we have

(1) | |||

(2) | |||

(3) |

The notations in this statement are specified in the remainder of this paper. Just note that many measures, including the Lebesgue measure, are -finite (defined in Section 4), denotes the set of nonnegative measurable functions (see Section 2.2.3), and and are partial applications of (see Section 5.1). Notice also that the properties (1) and (2) ensure the existence of all simple integrals, while the existence of the double integral is granted by the assumption on the function .

The mathematical definitions and proofs are taken from textbooks [mai:m2:14, gh:mip:13, cm:li:21], and the Coq code is available at (mainly in files Tonelli.v, LInt_p.v and Mp.v):

https://lipn.univ-paris13.fr/coq-num-analysis/tree/Tonelli.1.0/Lebesgue

where the tag Tonelli.1.0 corresponds to the code of this article from Coq 8.12.2.

The Tonelli theorem is known enough and useful enough to have been formalized
before our work in several proof assistants.
It has been done in PVS in the PVS-NASA library^{5}^{5}5https://github.com/nasa/pvslib/blob/master/measure_integration/fubini_tonelli.pvs
by Lester, probably as a follow-up of [Les07].
Some Fubini-like results are available in HOL Light [Har13].
More recently, the Tonelli theorem was formalized in Mizar by
Endou [Endou2019].

The formalizations nearest to ours are in Isabelle/HOL and Lean.
In Isabelle/HOL, Hölzl and Heller defined binary and iterated product measure
before the Fubini theorem [HolHel11].
It cleverly relies on Isabelle type classes and locales.
A more recent work^{6}^{6}6https://isabelle.in.tum.de/library/HOL/HOL-Analysis/Bochner_Integration.html
extends it to the Bochner integral.
In Lean, van Doorn defines products of measures and properties of the
product space towards the Tonelli and Fubini theorems in a way very similar to
ours [VanDoo21] with the same inductive definitions and the same proof
path.
Instead of Lebesgue integral, the Fubini theorem is proved with the more generic
Bochner integral.

A very recent (unpublished to our knowledge) work in Coq has been developed
for probability theory.^{7}^{7}7https://github.com/jtassarotti/coq-proba
Many definitions are similar to ours [BCF21].
The Tonelli and Fubini theorems are proved, but in a quite simpler setting than
ours, as their goal is probability, where the measures are finite.
The -finiteness as above is skipped, and this corresponds in the sequel
to the first parts in proofs of Sections 4.3
and 4.4.

The Lebesgue induction principle is formalized in Lean [VanDoo21]. To our knowledge, no formalization is achieved starting from an inductive type.

For a comparison of Lebesgue integral in various proof assistants, we refer the reader to [BCF21, VanDoo21], and we refer to [BLM16] for a wider comparison of real analysis in proof assistants.

This paper is organized as follows. Section 2 gives a brief summary of prerequisites and the main concepts of measure and integration theories developed in previous works. The formalization of the Lebesgue induction principle is detailed in Section 3. Section 4 describes the construction of the product measure, while Section 5 is devoted to the construction of the iterated integrals and the full proof of the Tonelli theorem. Finally, Section 6 concludes and provides hints to future work.

## 2 Prerequisites

Our formalizations and proofs are conducted in Coq. In this section, we present the necessary prerequisites and libraries for our developments, from external packages to our own previous work.

### 2.1 The Coquelicot Library, and Logic

The Coquelicot^{8}^{8}8http://coquelicot.saclay.inria.fr/
library [BLM15] is a conservative extension of the standard Coq library
of real numbers [Link_Coq_Ref, May01].
It provides the formalization of basic results in real analysis for Coq
developments.
Besides the fact that it is a classical library, a salient feature is that it
provides total functions, e.g. for limit, derivative, and (Rieman) integral.
This is consistent with classical logic, and it means a much simpler and
natural way to write mathematical formulas and theorem statements.
The library also provides a formalization of the extended real numbers
equipped, among other operations, with
Rbar_lub : (Rbar -¿ Prop) -¿ Rbar for the least-upper bound of subsets
of , and Sup_seq : (nat -¿ Rbar) -¿ Rbar for the supremum of
sequences.

As in the Coquelicot library, we use the full classical logic: total order on real numbers, propositional and functional extensionality axioms, excluded middle and choice axioms.

A more detailed description of what we need can be found in [BCF21, Section 2].

### 2.2 Lebesgue Integration Theory

The theory of integration is commonly built upon the measure theory. The first step defines the measurability of subsets, and then the measure associates a (possibly infinite) nonnegative number to each measurable subset. The second step defines the measurability of functions, and then the integral associates a (possibly infinite) nonnegative number to each nonnegative measurable function. The integral for functions with arbitrary sign is not relevant to the present work.

This section briefly reviews the main concepts of measure and integration theories that were presented in [BCF21] and are needed here. It includes the notion of generators of -algebra for measurability, and of adapted sequences to approximate from below measurable functions by simple functions.

#### 2.2.1 Measurable Subsets

A measurable space is made of a set , and the
collection of all its measurable subsets.
The collection is a subset of the power set of called
*-algebra*.
It is closed under most subset operations, such as complement, countable union
and countable intersection.
A -algebra can be *generated* as the closure of a smaller
collection of subsets with respect to some of the subset operations.
In our Coq developments, the generators on X : Type are typically
denoted genX, and a subset A : X -¿ Prop belongs to the
-algebra generated by genX when the inductive property
measurable genX A holds.

When the set has a topological structure, it is convenient to consider its
*Borel -algebra* that is generated by all the open subsets.
The Borel -algebra of can also be generated by the smaller
collection of right closed rays of the form , denoted in Coq
by gen_Rbar.

Given two measurable spaces and , the
*product -algebra on * is the one generated by the
products of measurable subsets of and .
Some details are provided in Section 4 where it is a major
ingredient.

#### 2.2.2 Measure

In a measure space , there is in addition a
*measure* : a function that is nonnegative,
homogeneous (), and -additive.
This is represented in Coq by a record collecting the support function and
the three constitutive properties.

The properties of *continuity from below* and *from above* are useful
in Section 4.
For any measure , and for any sequence , they
respectively state

(4) | |||

(5) |

Note that monotonicity of measures allows to replace the limit of a nondecreasing sequence by its supremum. This property of real numbers is repeatedly used in the sequel.

#### 2.2.3 Measurable Functions

Given two measurable spaces and , a function
is said *measurable* when the preimage of every measurable subset is
measurable:

When , and usually is its Borel -algebra, we may
simply say that the function is *-measurable*, and we use the
predicate measurable_fun_Rbar corresponding to genY := gen_Rbar.
We denote the *set of nonnegative measurable functions*
by .
When there is no possible confusion in the context, we may drop the
“” annotation.
Among other operations, is closed under nonnegative scalar
multiplication, addition, and supremum.
In Coq, we use the predicate Mplus genX : (X -¿ Rbar) -¿ Prop that
encompasses nonnegativity and measurability, and
Mplus_seq genX : (nat -¿ X -¿ Rbar) -¿ Prop means that all the elements
of a sequence of functions belong to .

Two subsets of functions are of major interest for the construction of Lebesgue
integration.
*Simple functions* are functions with range of finite cardinal, and the
*set of nonnegative measurable simple functions* is
denoted .
In Coq, we use the predicate
SFplus genX : (X -¿ Rbar) -¿Prop,
and any simple function is canonically represented by the strictly sorted
list of its values, .
Given any function , a simple algorithm allows to build an
*adapted sequence for *, i.e. a nondecreasing sequence of simple
functions such that
.
In [BCF21], the process, denoted mk_adapted_seq, is obtained
via a fixed-point rounding downwards with a least significant bit of
relying on the Flocq library [BolMel11].

The *set of measurable indicator functions* is denoted .
Note that an indicator function is measurable whenever its support
subset belongs to .
Simple functions in are positive linear combinations of indicator
functions in .

#### 2.2.4 Lebesgue Integral

The construction of the Lebesgue integral in operates in three steps. The first stage is to integrate indicator functions in by taking the measure of their support. Then, the second stage extends the integral to simple functions in by positive linearity. And finally, the third stage extends it again to measurable functions in by taking the supremum.

In the end, the *integral of a function * is defined as the
supremum of the integrals of all simple functions in smaller
than .
It is formalized in [BCF21] as

The proof of the Tonelli theorem relies on several properties of the integral in , such as monotonicity, positive linearity, -additivity, and the Beppo Levi (monotone convergence) theorem. The latter states the compatibility with the supremum: for any nondecreasing sequence , the limit (which actually equals ) is also in , and the integral-limit exchange formula holds, .

## 3 Lebesgue Induction Principle

Let be a measurable space. The properties of the function spaces , and recalled in Section 2.2.3 suggest we may represent nonnegative measurable functions by an inductive type. Indeed, functions in are the supremum of adapted sequences of nonnegative measurable simple functions, and functions in are positive linear combinations of measurable indicator functions in . Moreover, the construction of the Lebesgue integral in Section 2.2.4 mimics the associated structural induction principle, and the same principle is a common proof technique for several results in Lebesgue integration theory, among which the Tonelli theorem as noted in [VanDoo21].

In addition to Mplus recalled in Section 2.2.3, we now define an inductive type:

where incr_fun_seq f stands for ∀x n, Rbar_le (f n x) (f (S n) x).

We also have an inductive type for denoted by SFp, whose constructors are essentially the same as the first three of Mp. Several inductive types equivalent to Mp are defined in order to split the proof steps, for instance one is built over SFp. They are not given here for the sake of simplicity and brevity.

The important point is then the correctness of this definition, compared to the existing one. The only delicate part is to obtain that simple functions in can actually be represented by such an inductive construction, stated in Lemma SFp_correct : ∀f, SFp f ¡-¿ SFplus gen f.

For that, from a simple function represented by a list of values of size , we need to construct a smaller simple function associated to a sublist of size . The tricky needed result is the following:

Given and its associated canonical list , the lemma builds a new canonically associated with the list deprived from some item . This means that on the nonempty subset , must take one of the remaining values, as shown in Figure 1, which also provides the property .

More precisely, let us assume that
.
Then, by setting , one
has .
Thus, with a smaller list of values, and
with .
This is tricky for two reasons.
First, we cannot set to zero on (as it may be a new
value, defeating the point of reducing the size of the value list); thus, the
initial list must contain at least two values.
Second, by proceeding the other way around and setting to
on , we cannot write as the sum of and a
*nonnegative* value times an indicator function, as needed by the
constructor SFp_scal, similar to Mp_scal.

Now, we have all the ingredients to check that the definition of Mp is satisfactory, that is to say that Mp represents as Mplus already does. This correctness lemma is stated as

The proof is mainly based on inductions, the construction of adapted sequences mk_adapted_seq (see Section 2.2.3), and the previous lemma.

This gives us for free an induction lemma corresponding to the Mp inductive:

The corresponding mathematical statement is the following [Lebesgue induction principle] Let be a measurable space. Let be a predicate on functions from to . Assume that holds on , and that it is compatible on with positive linear operations and with the supremum of nondecreasing sequences:

(6) | ||||

(7) | ||||

(8) | ||||

(9) |

Then, holds on .

There are a few alternative statements of the Lebesgue induction principle.
For instance, we choose to have in and not in in
Equation (7), as it makes an equivalent, but simpler to use lemma.
Moreover, as noted in the Lean source code,^{9}^{9}9https://leanprover-community.github.io/mathlib_docs/measure_theory/integral/lebesgue.html#measurable.ennreal_induction.
it is possible to sharpen the premises of the constructors.
For instance, it may be sufficient to have in (8) simple functions
that do not share the same image value, except 0, or with disjoint supports.

## 4 Product Measure on a Product Space

In this section, we build the product measure for the measurable subsets of a product space. This allows to integrate numeric functions defined on such a product space in Section 5.

Given two measure spaces and , a
*product measure on the measurable space
induced by and * is
a measure defined on the product
-algebra (defined in
Section 4.1) satisfying the *box property*:

(10) |

To ensure existence and uniqueness of such a product measure, we assume
that and are *-finite* measures, i.e. that the
full sets and are (possibly nondecreasing) unions of subsets of
finite measure (see a detailed definition in Section 4.3).

A candidate product measure is first built in three steps, see
Figure 2.
Firstly, *-sections* (or *“vertical” cuttings*) of subsets are
proved to be -measurable.
Then, the measure of sections is proved to be -measurable.
The candidate is the integral of the measure of sections.
Then, this candidate is proved to be a product measure, and the product measure
is guaranteed to be unique.
The main argument for this construction is the monotone class theorem, whose quite
heavy proof is not detailed here.
It is used twice: for the measurability of the measure of sections, and for the
uniqueness of the product measure.

The definition of the product -algebra is first reviewed in Section 4.1. Then, Section 4.2 is dedicated to sections, and Section 4.3 to the measure of sections. Finally, existence and uniqueness of the product measure is obtained in Section 4.4.

### 4.1 Product -algebra

Let us detail the notion of product -algebra that was introduced
in [BCF21].
Given two measurable spaces and , the
*product -algebra on * is the
-algebra generated by the products of
measurable subsets:

Given generators genX1 and genX2 for and , the generator is denoted in Coq by Product_Sigma_algebra genX1 genX2. It is proven in [BCF21, Sec. 4.3] that is also the -algebra generated by

This smaller generator is denoted in Coq by Gen_Product genX1 genX2, and simply denoted in the sequel by genX1xX2. Symmetrically, genX2xX1 represents Gen_Product genX2 genX1.

### 4.2 Section of Subset

The notion of *section* consists in keeping one of the variables fixed.
Given and , the
*-section of at * is the subset of defined by
(see Figure 3).
The Coq translation is straightforward.

Sections commute with most subset operations. For example, they are compatible with the empty set (), the complement (), countable union and intersection, and are monotone. Sections also satisfy the following box property: for all subsets , , and point ,

(11) |

Then, we prove that, if a subset is -measurable, then its -sections at any point in are -measurable. As measurability is an inductive type, the proof is a simple induction on the hypothesis.

### 4.3 Measurability of Measure of Section

As sections are measurable (see Section 4.2), one can take their measure. In Section 4.4, the product measure is defined as the integral of the measure of sections, but before that, we have to prove the and nonnegativity and measurability of these functions. More precisely, that for all -measurable subset , the function belongs to .

The nonnegativity property directly follows from that of measures.
The proof of measurability goes in two stages.
Firstly when the measure is assumed to be *finite* (i.e.
when is finite), and then in the more general -finite
case.
The first stage is quite high-level, it relies on the monotone class theorem.
The second stage extends the first one by means of restricted measures.

After having defined the measure of sections, represented in Coq by the total function

the first stage of the proof is stated in Coq as

Let be the set of measurable subsets satisfying the property to prove,

It suffices to show that . Firstly, is proved to contain the generator of (see Section 4.1). Then, it is proved to contain the algebra of sets generated by (where an algebra of sets contains the empty set and is closed under complement and finite union). Then, is also proved to be a monotone class, i.e. closed under monotone countable union and intersection. This step uses the finiteness assumption on , and continuity from below and from above (see Equations (4) and (5)). And finally, we conclude by applying the following monotone class theorem with X := X1 * X2, P := S, and genX := ¯Σ.

Note that Incl denotes the inclusion for subsets of the power set of .

In the second stage, the measure is supposed to be -finite.
Thus, there exists a nondecreasing sequence such
that , and is finite for all .
Then, for each , the *restricted measure*

is proved to be a finite measure. Thus, the previous result applies,

Moreover, from the properties of sections (see Section 4.2) and from the continuity from below of , for all and ,

Finally, the closedness of under supremum (see Section 2.2.3) concludes the proof. Thus, the lemma in the -finite case holds,

Note that from (11), the measure of the section of a box reads

(12) |

### 4.4 Existence and Uniqueness of the Product Measure

As the measures of sections are nonnegative and measurable (see Section 4.3), one can take their integral. The candidate product measure is the function defined on the product -algebra (see Section 4.1) by

(13) |

again represented in Coq by a total function,

We easily deduce that this candidate function is both nonnegative and equal to zero on the empty set. The -additivity property is obtained by means of -additivity of the integral (see Section 2.2.4), and of the measure . This proves that the candidate is a measure, and that we can instantiate the record defining the product measure meas_prod as an object of type measure (see Section 2.2.2), so all the proved results on measures are available.

Moreover, Equation (12), and the positive linearity of the integral ensure the box property (10), thus making meas_prod a product measure.

Product measures are proved to keep the finiteness, or -finiteness, property of the initial measures and : for all measure on satisfying the box property (10), we have and finite finite, and and -finite -finite.

Then, the proof of uniqueness of the product measure follows exactly the same path as the one for the measurability of measure of sections (see Section 4.3). Firstly, when the measures and are finite, we introduce two (finite) product measures and induced by and (i.e. both satisfying (10)). The set is proved to contain using monotone_class_Prop, which shows uniqueness. Then, the result is again extended to -finite measures by means of restricted measures.

## 5 The Tonelli Theorem

With the product measure built in Section 4, we can now consider the integration of nonnegative measurable functions on a product space. As in Section 4, we assume that the measures are -finite, which ensures existence and uniqueness of the product measure.

More precisely, this section deals with the proof of the Tonelli theorem that allows to compute a double integral on a product space by integrating successively with respect to each variable, either way. Besides the following formulas, the theorem also states measurability properties that ensure legitimacy of all integrals (see Theorem 1):

(14) | ||||

(15) |

Similarly to the process used in Section 4, the iterated integral (right-hand side of (14)) is built in three steps, see Figure 4. Firstly, -sections of functions are proved to be -measurable. Then, the integral (in ) of sections of functions is proved to be -measurable. And the iterated integral is the integral (in ) of the integral (in ) of the sections of functions. Finally, Formula (14) is first proved, and then (15) is deduced from the latter by a swap of variables relying both on a change of measure and on the uniqueness of the product measure.

The main argument for this proof is the Lebesgue induction principle (see Section 3). It is used twice: to obtain the measurability of the integral of sections of functions together with the first Tonelli formula, and for the change-of-measure formula for the integral.

Section 5.1 is dedicated to sections of functions, and Section 5.2 to the iterated integral and the proof of the first formula of the Tonelli theorem. Finally, the full proof of the Tonelli theorem is obtained in Section 5.3.

### 5.1 Section of Function

Similarly to sections of subsets in Section 4.2, given a numeric
function and a point , the
*-section of at * is the partial application
.

From measurability of sections of subsets, we deduce that, if is in , then its -sections are in (the nonnegativity property is obvious).

Symmetrically, for any , we introduce the
*-section of at *, the partial application with respect to
the second variable, .

### 5.2 Iterated Integral and the First Formula of the Tonelli Theorem

As sections of functions are nonnegative and -measurable (see Section 5.1), one can take their integral (in ). For any function , we define

The iterated integral corresponds to integrate once more (in ), but one must first establish that . The nonnegativity result directly follows from the monotonicity of the integral (see Section 2.2.4). The general measurability result, together with the first Tonelli formula (14), are proved by means of the Lebesgue induction principle of Section 3.

Let us first review the properties of the function . From the properties of the integral, is monotone and positive linear. In the case of indicator functions, for any , the section reads , which yields the formula . And from the Beppo Levi (monotone convergence) theorem (see Section 2.2.4), commutes with the supremum: for all nondecreasing sequence in , we have the equality

Let P0 f := Mplus genX1 (LInt_p_section_fun f) be the predicate of the nonnegativity and measurability of , of type (E -¿ Rbar) -¿ Prop. Then, previous formulas and closedness properties of (see Section 2.2.3) provide the compatibility of P0 with indicator functions, positive linearity, and the supremum of nondecreasing sequences. For instance, we have

Let us now define the predicate P of the existence of the iterated integral (granted by P0) and the validity of the first Tonelli formula of (14):

where meas_prod is the product measure defined in Section 4.4. Again, the compatibility of P with indicator functions, positive linearity, and the supremum is easily obtained from the previous results. Namely, we have

Now, the first part of the Tonelli theorem can be stated in Coq as

And its proof is a direct application of the Lebesgue induction principle (see Section 3) with the predicate P, as all the premises corresponds to the previous lemmas.

### 5.3 Change of Measure, Second Formula, and the Tonelli Theorem

There is no doubt that the second formula (15) can be proved using the same path as the first claim: use sections with respect to the second variable, define (see Figure 4), prove and the equality by the Lebesgue induction principle. This would be easy, but pretty long and redundant. Instead, we have exploited the “symmetry” between the right-hand sides of both formulas. The first idea is a simple exchange of the roles of the two variables that expresses the previous result for functions of type X2 * X1 -¿ Rbar. And then, the difficult part is a change of measure that brings back to the target type X1 * X2 -¿ Rbar.

In the framework of the Lebesgue integral, the change of measure is an
application of the concept of *image measure* (e.g.
see [mai:m2:14]), also called *pushforward measure* as the measure is
transported between -algebras, here from
to .

#### 5.3.1 Change of measure

Let and be measurable spaces.
Let be a function and Mh be a proof of its measurability.
Let be a measure on .
The *image measure of by * is the measure on defined
by , and denoted in Coq by
meas_image h Mh mu.
The proof that it is indeed a measure directly follows from the measure
properties of , and Mh.

Now, given , the compatibility of measurability with the composition of functions provides , and one has the following change-of-measure formula,

(16) |

The proof follows the Lebesgue induction principle with the predicate P’ corresponding to (16). Once again, the compatibility of P’ with indicator functions, positive linearity, and the supremum directly follows from properties of the integral, such as positive linearity and the Beppo Levi (monotone convergence) theorem.

#### 5.3.2 Swap and Second Formula

Using Section 4.4, let be the product measure induced by and on the product space . In Coq, muX1xX2 := meas_prod muX1 muX2. By exchanging the two spaces, let be the product measure induced by and on . In Coq, muX2xX1 := meas_prod muX2 muX1.

Let be the swap of variables. We construct the proof Mh of its measurability. The image measure is defined on the measurable space . In Coq, meas_prod_swap := meas_image h Mh muX2xX1. The proof that it is a product measure induced by and is straightforward.

Now, let . One has , and using the section with respect to the second variable (see Section 5.1), we have

(17) |

We then deduce the second part of the Tonelli theorem (15) from the previous ingredients:

Uniqueness of the product measure of Section 4.4 yields , and thus gives (a). The above change-of-measure formula (16) gives (b). The first formula of the Tonelli theorem (14) applied to gives (c). The above Equation (17) gives (d).

This second part of Tonelli theorem can be stated in Coq as

where swap f denotes .

#### 5.3.3 Statement of the Tonelli Theorem

Finally, we formalize the Tonelli theorem that gathers the two equalities (14) and (15). We assume that and are nonempty and that and are -finite measures. Then,

where muX1xX2 stands for the product measure. We also provide a more comprehensive but less readable theorem Tonelli that moreover ensures the legitimacy of all integrals.

## 6 Conclusion and perspectives

In this paper, we present the formalization and the construction of the full formal proof of the Tonelli theorem. We have constructed the product measure of two -finite measures, built the two iterated integrals, and proved they are equal to the double integral on the product measure space. A key point is the definition of nonnegative measurable functions as an inductive type. It has been proved equivalent to the common mathematical definition and has led to a very useful induction scheme. Although the induction principle is present in some formalizations, building it from an inductive type is an original point of view we have not seen in the literature.

To achieve the proof of the Tonelli theorem, we have also formalized in Coq common generic results and constructions such as the monotone class theorem, the restricted measure, the image measure, and a change-of-measure formula for the integral. The latter, combined with a swap of variables, has prevented redundancies in our proofs.

This work confirms the fact that the library we are developing, in line with the choices of the Coquelicot library, is rather comprehensive and usable. First, this work has led to few additions in the core of the library, except for the inductive definition for that is related to the needed Lebesgue induction principle. Second, the library seems easy to learn. One co-author of this article and this Coq development was a novice who did not actually participate in the previous developments.

The natural extension after the Tonelli theorem on nonnegative measurable functions is the Fubini theorem that provides the same formulas for integrable functions with arbitrary sign. But we would rather directly consider the version using the Bochner integral [BCL22] that applies to functions taking their values in a Banach space, such as the Euclidean spaces and the Hermitian spaces . For that, we can take inspiration from the work by van Doorn in Lean [VanDoo21], and in particular with the concept of “marginal integral” that seems to be an elegant way to handle integrals on a finitary Cartesian product.

Our long-term purpose is to formally prove the correctness of parts of a library implementing the Finite Element Method (FEM), which is used to compute approximated solutions of Partial Differential Equations (PDEs). We already formalized the Lax–Milgram theorem [BCF21], one of the key ingredient to numerically solve PDEs, and we need to build suitable Hilbert functional spaces on which to apply it. The target candidates are the Sobolev spaces such as , that represents square integrable functions with square integrable first derivatives. Of course, this will involve the formalization of the

Lebesgue spaces as complete normed vector spaces, and parts of the distribution theory

[sch:td:66].