     # Lebesgue Induction and Tonelli's Theorem in Coq

Lebesgue integration is a well-known mathematical tool, used for instance in probability theory, real analysis, and numerical mathematics. Thus its formalization in a proof assistant is to be designed to fit different goals and projects. Once Lebesgue integral is formally defined and the first lemmas are proved, the question of the convenience of the formalization naturally arises. To check it, a useful extension is the Tonelli theorem, stating that the (double) integral of a nonnegative measurable function of two variables can be computed by iterated integrals, and allowing to switch the order of integration. Therefore, we need to define and prove results on product spaces, hoping that they can easily derive from the existing ones on a single space. This article describes the formal definition and proof in Coq of product σ-algebras, product measures and their uniqueness, the construction of iterated integrals, up to the Tonelli theorem. We also advertise the Lebesgue induction principle provided by an inductive type for measurable functions.

04/12/2021

### A Coq Formalization of Lebesgue Integration of Nonnegative Functions

Integration, just as much as differentiation, is a fundamental calculus ...
02/04/2021

### Formalized Haar Measure

We describe the formalization of the existence and uniqueness of Haar me...
01/10/2022

### A Coq Formalization of the Bochner integral

The Bochner integral is a generalization of the Lebesgue integral, for f...
12/16/2020

### A Novice-Friendly Induction Tactic for Lean

In theorem provers based on dependent type theory such as Coq and Lean, ...
02/01/2022

### On a formula for moments of the multivariate normal distribution generalizing Stein's lemma and Isserlis theorem

We prove a formula for the evaluation of averages containing a scalar fu...
09/06/2022

### Measure Construction by Extension in Dependent Type Theory with Application to Integration

We report on an original formalization of measure and integration theory...
11/06/2014

### The Spaces of Data, Information, and Knowledge

We study the data space D of any given data set X and explain how functi...

## 1 Introduction

This work deals with the Coq formalization of the Lebesgue induction principle and the Tonelli theorem as a direct continuation of a previous work [BCF21]. Our long term objective is to formally prove in Coq scientific computing programs and the correctness of parts of a C++ library, such as FreeFEM++ or XLiFE++,

that implements the Finite Element Method (FEM), a widely used method for numerically solving Partial Differential Equations (PDEs) arising in different domains like engineering and mathematical modeling. With this work, we carry on with our goal: to provide a

Coq library usable by numerician people. It started with the first development of a real numbers library [May01], and then by the first complete experimentation of the formalization and proof of a numerical program, a small C program for the approximated resolution of the wave equation [BCF13]. More recently, the Lax–Milgram theorem [BCF17] (for the resolution of a class of PDEs), then Lebesgue integration of nonnegative measurable functions, the Beppo Levi (monotone convergence) theorem and Fatou’s lemma [BCF21], Bochner integration [BCL22] (a generalization of Lebesgue integration for functions taking their values in a Banach space), and the construction of the Lebesgue measure (yet unpublished) have also been formalized.

The proof of the Tonelli theorem is the next step. But, as a side result, it also allows us to validate our previous developments and in particular our definitions and results about the Lebesgue integral. The validation of a usable development is indeed important. It should allow us to carry on by confirming or not the choices of formalization. For example, as we work in Coq, the question of using classical or intuitionistic real analysis is a valid question. As explained in [BCF17] and [BCF21], our view on the question has evolved. In this work, we make the same choices as in the latter, namely we are completely classical.

The Lebesgue induction principle is a proof technique for properties about nonnegative measurable functions, and usually involving the integral. It reflects the three construction steps followed by Henri Lebesgue to build his integral [leb:lir:04]. The property is first established for indicator functions, then for nonnegative simple functions by checking that the property is compatible with positive linear operations, and finally for all nonnegative measurable functions by checking that it is compatible with the supremum. This technique is an important asset for the proof of the Tonelli theorem, and we provide it as a byproduct of an inductive type.

The Tonelli theorem provides a convenient way to ease the computation of multiple integrals by stating their equality with iterated integrals, each in a single dimension. The Tonelli theorem applies to nonnegative measurable functions. A similar result, the Fubini theorem, applies to integrable functions with arbitrary sign, or even taking their values in a Banach space when using the Bochner integral. Both theorems can be combined to ease the proof of integrability of the multi-variable function to integrate. This article focuses on the case of nonnegative functions, and as usual in mathematics, we are only interested in the case of two variables.

We aim to the construction of the full formal proof in Coq of the Tonelli theorem, stating that the (double) integral of a nonnegative measurable function of two variables can be computed by iterated integrals, and allowing to switch the order of integration. It can be expressed in a mathematical setting as follows. [Tonelli] Let and  be measure spaces. Assume that  and  are -finite. Let . Then, we have

 (1) (∀x1∈X1,fx1∈M+(X2,Σ2))∧∫X2fx1dμ2∈M+(X1,Σ1), (2) (∀x2∈X2,fx2∈M+(X1,Σ1))∧∫X1fx2dμ1∈M+(X2,Σ2), (3) ∫X1×X2fd(μ1⊗μ2)=∫X1(∫X2fx1dμ2)dμ1=∫X2(∫X1fx2dμ1)dμ2.

The notations in this statement are specified in the remainder of this paper. Just note that many measures, including the Lebesgue measure, are -finite (defined in Section 4),  denotes the set of nonnegative measurable functions (see Section 2.2.3), and  and  are partial applications of  (see Section 5.1). Notice also that the properties (1) and (2) ensure the existence of all simple integrals, while the existence of the double integral is granted by the assumption on the function .

The mathematical definitions and proofs are taken from textbooks [mai:m2:14, gh:mip:13, cm:li:21], and the Coq code is available at (mainly in files Tonelli.v, LInt_p.v and Mp.v):

https://lipn.univ-paris13.fr/coq-num-analysis/tree/Tonelli.1.0/Lebesgue

where the tag Tonelli.1.0 corresponds to the code of this article from Coq 8.12.2.

The Tonelli theorem is known enough and useful enough to have been formalized before our work in several proof assistants. It has been done in PVS in the PVS-NASA library by Lester, probably as a follow-up of [Les07]. Some Fubini-like results are available in HOL Light [Har13]. More recently, the Tonelli theorem was formalized in Mizar by Endou [Endou2019].

The formalizations nearest to ours are in Isabelle/HOL and Lean. In Isabelle/HOL, Hölzl and Heller defined binary and iterated product measure before the Fubini theorem [HolHel11]. It cleverly relies on Isabelle type classes and locales. A more recent work extends it to the Bochner integral. In Lean, van Doorn defines products of measures and properties of the product space towards the Tonelli and Fubini theorems in a way very similar to ours [VanDoo21] with the same inductive definitions and the same proof path. Instead of Lebesgue integral, the Fubini theorem is proved with the more generic Bochner integral.

A very recent (unpublished to our knowledge) work in Coq has been developed for probability theory. Many definitions are similar to ours [BCF21]. The Tonelli and Fubini theorems are proved, but in a quite simpler setting than ours, as their goal is probability, where the measures are finite. The -finiteness as above is skipped, and this corresponds in the sequel to the first parts in proofs of Sections 4.3 and 4.4.

The Lebesgue induction principle is formalized in Lean [VanDoo21]. To our knowledge, no formalization is achieved starting from an inductive type.

For a comparison of Lebesgue integral in various proof assistants, we refer the reader to [BCF21, VanDoo21], and we refer to [BLM16] for a wider comparison of real analysis in proof assistants.

This paper is organized as follows. Section 2 gives a brief summary of prerequisites and the main concepts of measure and integration theories developed in previous works. The formalization of the Lebesgue induction principle is detailed in Section 3. Section 4 describes the construction of the product measure, while Section 5 is devoted to the construction of the iterated integrals and the full proof of the Tonelli theorem. Finally, Section 6 concludes and provides hints to future work.

## 2 Prerequisites

Our formalizations and proofs are conducted in Coq. In this section, we present the necessary prerequisites and libraries for our developments, from external packages to our own previous work.

### 2.1 The Coquelicot Library, ¯¯¯¯R and Logic

The Coquelicot library [BLM15] is a conservative extension of the standard Coq library of real numbers [Link_Coq_Ref, May01]. It provides the formalization of basic results in real analysis for Coq developments. Besides the fact that it is a classical library, a salient feature is that it provides total functions, e.g. for limit, derivative, and (Rieman) integral. This is consistent with classical logic, and it means a much simpler and natural way to write mathematical formulas and theorem statements. The library also provides a formalization of the extended real numbers equipped, among other operations, with Rbar_lub : (Rbar -¿ Prop) -¿ Rbar for the least-upper bound of subsets of , and Sup_seq : (nat -¿ Rbar) -¿ Rbar for the supremum of sequences.

As in the Coquelicot library, we use the full classical logic: total order on real numbers, propositional and functional extensionality axioms, excluded middle and choice axioms.

A more detailed description of what we need can be found in [BCF21, Section 2].

### 2.2 Lebesgue Integration Theory

The theory of integration is commonly built upon the measure theory. The first step defines the measurability of subsets, and then the measure associates a (possibly infinite) nonnegative number to each measurable subset. The second step defines the measurability of functions, and then the integral associates a (possibly infinite) nonnegative number to each nonnegative measurable function. The integral for functions with arbitrary sign is not relevant to the present work.

This section briefly reviews the main concepts of measure and integration theories that were presented in [BCF21] and are needed here. It includes the notion of generators of -algebra for measurability, and of adapted sequences to approximate from below measurable functions by simple functions.

#### 2.2.1 Measurable Subsets

A measurable space  is made of a set , and the collection  of all its measurable subsets. The collection  is a subset of the power set of  called -algebra. It is closed under most subset operations, such as complement, countable union and countable intersection. A -algebra can be generated as the closure of a smaller collection of subsets with respect to some of the subset operations. In our Coq developments, the generators on X : Type are typically denoted genX, and a subset A : X -¿ Prop belongs to the -algebra generated by genX when the inductive property measurable genX A holds.

When the set  has a topological structure, it is convenient to consider its Borel -algebra that is generated by all the open subsets. The Borel -algebra of  can also be generated by the smaller collection of right closed rays of the form , denoted in Coq by gen_Rbar.

Given two measurable spaces  and , the product -algebra on  is the one generated by the products of measurable subsets of  and . Some details are provided in Section 4 where it is a major ingredient.

#### 2.2.2 Measure

In a measure space , there is in addition a measure : a function that is nonnegative, homogeneous (), and -additive. This is represented in Coq by a record collecting the support function and the three constitutive properties.

The properties of continuity from below and from above are useful in Section 4. For any measure , and for any sequence , they respectively state

 (4) (∀n∈N,An⊆An+1)⇒μ(⋃n∈NAn)=limn→∞μ(An)=supn∈Nμ(An), (5) (∀n∈N,An+1⊆An)∧(∃n0∈N,μ(An0)<∞)⇒μ(⋂n∈NAn)=infn∈Nμ(An)

Note that monotonicity of measures allows to replace the limit of a nondecreasing sequence by its supremum. This property of real numbers is repeatedly used in the sequel.

#### 2.2.3 Measurable Functions

Given two measurable spaces  and , a function  is said measurable when the preimage of every measurable subset is measurable:

Definition measurable_fun : (X -> Y) -> Prop :=
fun f => \forall B, measurable genY B -> measurable genX (fun x => B (f x)).

When , and usually  is its Borel -algebra, we may simply say that the function is -measurable, and we use the predicate measurable_fun_Rbar corresponding to genY := gen_Rbar. We denote the set of nonnegative measurable functions by . When there is no possible confusion in the context, we may drop the “” annotation. Among other operations,  is closed under nonnegative scalar multiplication, addition, and supremum. In Coq, we use the predicate Mplus genX : (X -¿ Rbar) -¿ Prop that encompasses nonnegativity and measurability, and Mplus_seq genX : (nat -¿ X -¿ Rbar) -¿ Prop means that all the elements of a sequence of functions belong to .

Two subsets of functions are of major interest for the construction of Lebesgue integration. Simple functions are functions with range of finite cardinal, and the set of nonnegative measurable simple functions is denoted . In Coq, we use the predicate SFplus genX : (X -¿ Rbar) -¿Prop, and any simple function  is canonically represented by the strictly sorted list  of its values, . Given any function , a simple algorithm allows to build an adapted sequence for , i.e. a nondecreasing sequence of simple functions such that . In [BCF21], the process, denoted mk_adapted_seq, is obtained via a fixed-point rounding downwards with a least significant bit of  relying on the Flocq library [BolMel11].

The set of measurable indicator functions is denoted . Note that an indicator function  is measurable whenever its support subset  belongs to . Simple functions in  are positive linear combinations of indicator functions in .

#### 2.2.4 Lebesgue Integral

The construction of the Lebesgue integral in  operates in three steps. The first stage is to integrate indicator functions in  by taking the measure of their support. Then, the second stage extends the integral to simple functions in  by positive linearity. And finally, the third stage extends it again to measurable functions in  by taking the supremum.

In the end, the integral of a function  is defined as the supremum of the integrals of all simple functions in  smaller than . It is formalized in [BCF21] as

Definition LInt_p : (X -> Rbar) -> Rbar :=
fun f => Rbar_lub (fun z => \exists (phi : X -> R) (Hphi : SF genX phi),
nonneg phi /\ (\forall x, Rbar_le (phi x) (f x)) /\ LInt_SFp mu phi Hphi = z).

The proof of the Tonelli theorem relies on several properties of the integral in , such as monotonicity, positive linearity, -additivity, and the Beppo Levi (monotone convergence) theorem. The latter states the compatibility with the supremum: for any nondecreasing sequence , the limit (which actually equals ) is also in , and the integral-limit exchange formula holds, .

## 3 Lebesgue Induction Principle

Let  be a measurable space. The properties of the function spaces , and  recalled in Section 2.2.3 suggest we may represent nonnegative measurable functions by an inductive type. Indeed, functions in  are the supremum of adapted sequences of nonnegative measurable simple functions, and functions in  are positive linear combinations of measurable indicator functions in . Moreover, the construction of the Lebesgue integral in Section 2.2.4 mimics the associated structural induction principle, and the same principle is a common proof technique for several results in Lebesgue integration theory, among which the Tonelli theorem as noted in [VanDoo21].

In addition to Mplus recalled in Section 2.2.3, we now define an inductive type:

Inductive Mp : (X -> Rbar) -> Prop :=
| Mp_charac : \forall A, measurable genX A -> Mp (charac A)
| Mp_scal : \forall a f, 0 <== a -> Mp f -> Mp (fun x => Rbar_mult a (f x))
| Mp_plus : \forall f g, Mp f -> Mp g -> Mp (fun x => Rbar_plus (f x) (g x))
| Mp_sup : \forall f, incr_fun_seq f -> (\forall n, Mp (f n)) -> Mp (fun x => Sup_seq (fun n => f n x)).

where incr_fun_seq f stands for ∀x n, Rbar_le (f n x) (f (S n) x).

We also have an inductive type for  denoted by SFp, whose constructors are essentially the same as the first three of Mp. Several inductive types equivalent to Mp are defined in order to split the proof steps, for instance one is built over SFp. They are not given here for the sake of simplicity and brevity.

The important point is then the correctness of this definition, compared to the existing one. The only delicate part is to obtain that simple functions in  can actually be represented by such an inductive construction, stated in Lemma SFp_correct : ∀f, SFp f ¡-¿ SFplus gen f.

For that, from a simple function represented by a list of values of size , we need to construct a smaller simple function associated to a sublist of size . The tricky needed result is the following:

Lemma SF_aux_cons :
\forall (f : X -> R) v1 v2 l, nonneg f -> SF_aux genX f (v1 :: v2 :: l) ->
let g := fun x => f x + (v1 - v2) * charac (fun t => f t = v2) x in
nonneg g /\ SF_aux genX g (v1 :: l).

Given  and its associated canonical list , the lemma builds a new  canonically associated with the list  deprived from some item . This means that on the nonempty subset ,  must take one of the remaining values,  as shown in Figure 1, which also provides the property .

More precisely, let us assume that . Then, by setting , one has . Thus, with a smaller list of values, and with . This is tricky for two reasons. First, we cannot set  to zero on  (as it may be a new value, defeating the point of reducing the size of the value list); thus, the initial list must contain at least two values. Second, by proceeding the other way around and setting  to  on , we cannot write  as the sum of  and a nonnegative value times an indicator function, as needed by the constructor SFp_scal, similar to Mp_scal.

Now, we have all the ingredients to check that the definition of Mp is satisfactory, that is to say that Mp represents  as Mplus already does. This correctness lemma is stated as

Lemma Mp_correct : \forall f, Mp genX f <-> Mplus genX f.

The proof is mainly based on inductions, the construction of adapted sequences mk_adapted_seq (see Section 2.2.3), and the previous lemma.

This gives us for free an induction lemma corresponding to the Mp inductive:

Mp_ind : \forall P : (E -> Rbar) -> Prop,
(\forall A, measurable gen A -> P (charac A)) ->
(\forall a f, 0 <== a -> Mp f -> P f -> P (fun x => Rbar_mult a (f x))) ->
(\forall f g, Mp f -> P f -> Mp g -> P g -> P (fun x => Rbar_plus (f x) (g x))) ->
(\forall f, incr_fun_seq f -> (\forall n, Mp (f n)) -> (\forall n, P (f n)) -> P (fun x => Sup_seq (fun n => f n x))) ->
\forall f, Mp f -> P f.

The corresponding mathematical statement is the following [Lebesgue induction principle] Let  be a measurable space. Let  be a predicate on functions from  to . Assume that  holds on , and that it is compatible on  with positive linear operations and with the supremum of nondecreasing sequences:

 (6) ∀A, A∈Σ⇒P(1A), (7) ∀a∈R+,∀f∈M+, P(f)⇒P(af), (8) ∀f,g∈M+, P(f)∧P(g)⇒P(f+g), (9) ∀(fn)n∈N∈M+, (∀n∈N,fn⩽fn+1∧P(fn))⇒P(supn∈Nfn).

Then,  holds on .

There are a few alternative statements of the Lebesgue induction principle. For instance, we choose to have  in  and not in  in Equation (7), as it makes an equivalent, but simpler to use lemma. Moreover, as noted in the Lean source code, it is possible to sharpen the premises of the constructors. For instance, it may be sufficient to have in (8) simple functions that do not share the same image value, except 0, or with disjoint supports.

## 4 Product Measure on a Product Space

In this section, we build the product measure for the measurable subsets of a product space. This allows to integrate numeric functions defined on such a product space in Section 5.

Given two measure spaces  and , a product measure on the measurable space induced by  and  is a measure  defined on the product -algebra (defined in Section 4.1) satisfying the box property:

 (10) ∀A1∈Σ1,∀A2∈Σ2,μ(A1×A2)=μ1(A1)μ2(A2).

To ensure existence and uniqueness of such a product measure, we assume that  and  are -finite measures, i.e. that the full sets  and  are (possibly nondecreasing) unions of subsets of finite measure (see a detailed definition in Section 4.3).

A candidate product measure is first built in three steps, see Figure 2. Firstly, -sections (or “vertical” cuttings) of subsets are proved to be -measurable. Then, the measure of sections is proved to be -measurable. The candidate is the integral of the measure of sections. Then, this candidate is proved to be a product measure, and the product measure is guaranteed to be unique. The main argument for this construction is the monotone class theorem, whose quite heavy proof is not detailed here. It is used twice: for the measurability of the measure of sections, and for the uniqueness of the product measure.

The definition of the product -algebra is first reviewed in Section 4.1. Then, Section 4.2 is dedicated to sections, and Section 4.3 to the measure of sections. Finally, existence and uniqueness of the product measure is obtained in Section 4.4.

### 4.1 Product σ-algebra

Let us detail the notion of product -algebra that was introduced in [BCF21]. Given two measurable spaces  and , the product -algebra on  is the -algebra  generated by the products of measurable subsets:

 Σ1⊗Σ2:= σ-algebra generated by Σ1¯¯¯¯×Σ2:={A1×A2|A1∈Σ1∧A2∈Σ2} (⊊Σ1⊗Σ2).

Given generators genX1 and genX2 for  and , the generator  is denoted in Coq by Product_Sigma_algebra genX1 genX2. It is proven in [BCF21, Sec. 4.3] that is also the -algebra generated by

 {A1×A2|A1∈gen(Σ1)∪{X1}∧A2∈gen(Σ2)∪{X2}}.

This smaller generator is denoted in Coq by Gen_Product genX1 genX2, and simply denoted in the sequel by genX1xX2. Symmetrically, genX2xX1 represents Gen_Product genX2 genX1.

### 4.2 Section of Subset

The notion of section consists in keeping one of the variables fixed. Given  and , the -section of  at  is the subset of  defined by (see Figure 3). The Coq translation is straightforward.

Definition section : X1 -> (X1 * X2 -> Prop) -> X2 -> Prop := fun x1 A x2 => A (x1, x2).

Sections commute with most subset operations. For example, they are compatible with the empty set (), the complement (), countable union and intersection, and are monotone. Sections also satisfy the following box property: for all subsets , , and point ,

 (11) x1∈A1⇒sx1(A1×A2)=A2andx1∉A1⇒sx1(A1×A2)=∅.

Then, we prove that, if a subset  is -measurable, then its -sections at any point in  are -measurable. As measurability is an inductive type, the proof is a simple induction on the hypothesis.

Lemma section_measurable : \forall A x1, measurable genX1xX2 A -> measurable genX2 (section x1 A).

### 4.3 Measurability of Measure of Section

As sections are measurable (see Section 4.2), one can take their measure. In Section 4.4, the product measure is defined as the integral of the measure of sections, but before that, we have to prove the and nonnegativity and measurability of these functions. More precisely, that for all -measurable subset , the function belongs to .

The nonnegativity property directly follows from that of measures. The proof of measurability goes in two stages. Firstly when the measure  is assumed to be finite (i.e. when  is finite), and then in the more general -finite case. The first stage is quite high-level, it relies on the monotone class theorem. The second stage extends the first one by means of restricted measures.

After having defined the measure of sections, represented in Coq by the total function

Definition meas_section : (X1 * X2 -> Prop) -> X1 -> Rbar := fun A x1 => muX2 (section x1 A).

the first stage of the proof is stated in Coq as

Lemma meas_section_Mplus_finite :
\forall A, is_finite_measure muX2 -> measurable genX1xX2 A -> Mplus genX1 (meas_section A).

Let  be the set of measurable subsets satisfying the property to prove,

 S:={A∈Σ1⊗Σ2|(x1⟼μ2(sx1(A)))∈M+(X1,Σ1)}.

It suffices to show that . Firstly,  is proved to contain the generator of  (see Section 4.1). Then, it is proved to contain the algebra of sets generated by  (where an algebra of sets contains the empty set and is closed under complement and finite union). Then,  is also proved to be a monotone class, i.e. closed under monotone countable union and intersection. This step uses the finiteness assumption on , and continuity from below and from above (see Equations (4) and (5)). And finally, we conclude by applying the following monotone class theorem with X := X1 * X2, P := S, and genX := ¯Σ.

Theorem monotone_class_Prop :
\forall P : (X -> Prop) -> Prop, is_Monotone_class P ->
Incl (Algebra genX) P -> Incl (Sigma_algebra genX) P.

Note that Incl denotes the inclusion for subsets of the power set of .

In the second stage, the measure  is supposed to be -finite. Thus, there exists a nondecreasing sequence such that , and  is finite for all . Then, for each , the restricted measure

 μn2:=(A2∈Σ2⟼μ2(A2∩Bn)∈¯¯¯¯R+)

is proved to be a finite measure. Thus, the previous result applies,

 ∀A∈Σ1⊗Σ2,(x1⟼μn2(sx1(A)))∈M+(X1,Σ1).

Moreover, from the properties of sections (see Section 4.2) and from the continuity from below of , for all and ,

 μ2(sx1(A)) =supn∈Nμ2(sx1(A)∩Bn)=supn∈Nμn2(sx1(A)).

Finally, the closedness of  under supremum (see Section 2.2.3) concludes the proof. Thus, the lemma in the -finite case holds,

Lemma meas_section_Mplus_sigma_finite :
\forall A, is_sigma_finite_measure muX2 -> measurable genX1xX2 A -> Mplus genX1 (meas_section A).

Note that from (11), the measure of the section of a box reads

 (12) ∀A1∈Σ1,∀A2∈Σ2,(x1⟼μ2(sx1(A1×A2)))=μ2(A2)1A1.

### 4.4 Existence and Uniqueness of the Product Measure

As the measures of sections are nonnegative and measurable (see Section 4.3), one can take their integral. The candidate product measure is the function defined on the product -algebra  (see Section 4.1) by

 (13) (μ1⊗μ2)(A):=∫X1μ2(sx1(A))dμ1,

again represented in Coq by a total function,

Definition meas_prod_meas : (X1 * X2 -> Prop) -> Rbar :=
fun A => LInt_p muX1 (meas_section muX2 A).

We easily deduce that this candidate function is both nonnegative and equal to zero on the empty set. The -additivity property is obtained by means of -additivity of the integral (see Section 2.2.4), and of the measure . This proves that the candidate is a measure, and that we can instantiate the record defining the product measure meas_prod as an object of type measure (see Section 2.2.2), so all the proved results on measures are available.

Moreover, Equation (12), and the positive linearity of the integral ensure the box property (10), thus making meas_prod a product measure.

Product measures are proved to keep the finiteness, or -finiteness, property of the initial measures  and : for all measure  on satisfying the box property (10), we have  and  finite finite, and  and  -finite -finite.

Then, the proof of uniqueness of the product measure follows exactly the same path as the one for the measurability of measure of sections (see Section 4.3). Firstly, when the measures  and  are finite, we introduce two (finite) product measures  and  induced by  and  (i.e. both satisfying (10)). The set is proved to contain  using monotone_class_Prop, which shows uniqueness. Then, the result is again extended to -finite measures by means of restricted measures.

## 5 The Tonelli Theorem

With the product measure built in Section 4, we can now consider the integration of nonnegative measurable functions on a product space. As in Section 4, we assume that the measures are -finite, which ensures existence and uniqueness of the product measure.

More precisely, this section deals with the proof of the Tonelli theorem that allows to compute a double integral on a product space by integrating successively with respect to each variable, either way. Besides the following formulas, the theorem also states measurability properties that ensure legitimacy of all integrals (see Theorem 1):

 (14) ∫X1×X2f(x1,x2)d(μ1⊗μ2)(x1,x2) =∫X1(∫X2f(x1,x2)dμ2(x2))dμ1(x1) (15) =∫X2(∫X1f(x1,x2)dμ1(x1))dμ2(x2).

Similarly to the process used in Section 4, the iterated integral (right-hand side of (14)) is built in three steps, see Figure 4. Firstly, -sections of functions are proved to be -measurable. Then, the integral (in ) of sections of functions is proved to be -measurable. And the iterated integral is the integral (in ) of the integral (in ) of the sections of functions. Finally, Formula (14) is first proved, and then (15) is deduced from the latter by a swap of variables relying both on a change of measure and on the uniqueness of the product measure.

The main argument for this proof is the Lebesgue induction principle (see Section 3). It is used twice: to obtain the measurability of the integral of sections of functions together with the first Tonelli formula, and for the change-of-measure formula for the integral.

Section 5.1 is dedicated to sections of functions, and Section 5.2 to the iterated integral and the proof of the first formula of the Tonelli theorem. Finally, the full proof of the Tonelli theorem is obtained in Section 5.3.

### 5.1 Section of Function

Similarly to sections of subsets in Section 4.2, given a numeric function  and a point , the -section of  at  is the partial application .

Definition section_fun : X1 -> (X1 * X2 -> Rbar) -> X2 -> Rbar := fun x1 f x2 => f (x1, x2).

From measurability of sections of subsets, we deduce that, if  is in , then its -sections are in (the nonnegativity property is obvious).

Lemma section_fun_Mplus : \forall f x1, Mplus genX1xX2 f -> Mplus genX2 (section_fun x1 f).

Symmetrically, for any , we introduce the -section of  at , the partial application with respect to the second variable, .

### 5.2 Iterated Integral and the First Formula of the Tonelli Theorem

As sections of functions are nonnegative and -measurable (see Section 5.1), one can take their integral (in ). For any function , we define

 If:=(x1⟼∫X2fx1dμ2).
Definition LInt_p_section_fun : (X1 * X2 -> Rbar) -> X1 -> Rbar :=
fun f x1 => LInt_p muX2 (section_fun x1 f).

The iterated integral corresponds to integrate once more (in ), but one must first establish that . The nonnegativity result directly follows from the monotonicity of the integral (see Section 2.2.4). The general measurability result, together with the first Tonelli formula (14), are proved by means of the Lebesgue induction principle of Section 3.

Let us first review the properties of the function . From the properties of the integral,  is monotone and positive linear. In the case of indicator functions, for any , the section reads , which yields the formula . And from the Beppo Levi (monotone convergence) theorem (see Section 2.2.4),  commutes with the supremum: for all nondecreasing sequence  in , we have the equality

 Isupn∈Nfn=supn∈NIfn.

Let P0 f := Mplus genX1 (LInt_p_section_fun f) be the predicate of the nonnegativity and measurability of , of type (E -¿ Rbar) -¿ Prop. Then, previous formulas and closedness properties of  (see Section 2.2.3) provide the compatibility of P0 with indicator functions, positive linearity, and the supremum of nondecreasing sequences. For instance, we have

Lemma LInt_p_section_fun_measurable_plus :
\forall f g, Mplus genX1xX2 f -> Mplus genX1xX2 g ->
P0 f -> P0 g -> P0 (fun x => Rbar_plus (f x) (g x)).

Let us now define the predicate P of the existence of the iterated integral (granted by P0) and the validity of the first Tonelli formula of (14):

Let P : (E -> Rbar) -> Prop :=
fun f => P0 f /\ LInt_p meas_prod f = LInt_p muX1 (LInt_p_section_fun f).

where meas_prod is the product measure defined in Section 4.4. Again, the compatibility of P with indicator functions, positive linearity, and the supremum is easily obtained from the previous results. Namely, we have

Lemma LInt_p_section_fun_meas_prod_charac :
\forall A, measurable genX1xX2 A -> P (charac A).
Lemma LInt_p_section_fun_meas_prod_scal :
\forall a f, 0 <== a -> Mplus genX1xX2 f -> P f -> P (fun x => Rbar_mult a (f x)).
Lemma LInt_p_section_fun_meas_prod_plus :
\forall f g, Mplus genX1xX2 f -> Mplus genX1xX2 g -> P f -> P g -> P (fun x => Rbar_plus (f x) (g x)).
Lemma LInt_p_section_fun_meas_prod_Sup_seq :
\forall f, incr_fun_seq f -> Mplus_seq genX1xX2 f ->
(\forall n, P (f n)) -> P (fun x => Sup_seq (fun n => f n x)).

Now, the first part of the Tonelli theorem can be stated in Coq as

Lemma Tonelli_aux1 :
\forall f, Mplus genX1xX2 f ->
Mplus genX1 (LInt_p_section_fun f) /\
LInt_p meas_prod f = LInt_p muX1 (LInt_p_section_fun f).

And its proof is a direct application of the Lebesgue induction principle (see Section 3) with the predicate P, as all the premises corresponds to the previous lemmas.

### 5.3 Change of Measure, Second Formula, and the Tonelli Theorem

There is no doubt that the second formula (15) can be proved using the same path as the first claim: use sections with respect to the second variable, define  (see Figure 4), prove  and the equality by the Lebesgue induction principle. This would be easy, but pretty long and redundant. Instead, we have exploited the “symmetry” between the right-hand sides of both formulas. The first idea is a simple exchange of the roles of the two variables that expresses the previous result for functions of type X2 * X1 -¿ Rbar. And then, the difficult part is a change of measure that brings back to the target type X1 * X2 -¿ Rbar.

In the framework of the Lebesgue integral, the change of measure is an application of the concept of image measure (e.g. see [mai:m2:14]), also called pushforward measure as the measure is transported between -algebras, here from  to .

#### 5.3.1 Change of measure

Let  and  be measurable spaces. Let  be a function and Mh be a proof of its measurability. Let  be a measure on . The image measure of  by  is the measure on  defined by , and denoted in Coq by meas_image h Mh mu. The proof that it is indeed a measure directly follows from the measure properties of , and Mh.

Now, given , the compatibility of measurability with the composition of functions provides , and one has the following change-of-measure formula,

 (16) ∫Ygd(h\raisebox{1.25pt}{{\tiny\#}}μ)=∫Xg∘hdμ.
Lemma LInt_p_change_meas :
\forall g, Mplus genY g -> LInt_p (meas_image h Mh mu) g = LInt_p mu (fun x => g (h x)).

The proof follows the Lebesgue induction principle with the predicate P’ corresponding to (16). Once again, the compatibility of P’ with indicator functions, positive linearity, and the supremum directly follows from properties of the integral, such as positive linearity and the Beppo Levi (monotone convergence) theorem.

#### 5.3.2 Swap and Second Formula

Using Section 4.4, let  be the product measure induced by  and  on the product space . In Coq, muX1xX2 := meas_prod muX1 muX2. By exchanging the two spaces, let  be the product measure induced by  and  on . In Coq, muX2xX1 := meas_prod muX2 muX1.

Let  be the swap of variables. We construct the proof Mh of its measurability. The image measure  is defined on the measurable space . In Coq, meas_prod_swap := meas_image h Mh muX2xX1. The proof that it is a product measure induced by  and  is straightforward.

Now, let . One has , and using the section with respect to the second variable (see Section 5.1), we have

 (17) ∀x2∈X2,fx2:=(x1⟼f(x1,x2))=(x1⟼f∘h(x2,x1))=(f∘h)x2.

We then deduce the second part of the Tonelli theorem (15) from the previous ingredients:

 ∫X1×X2fdμ12 (a)=∫X1×X2fd(h\raisebox{1.25pt}{{\tiny\#}}μ21)(b)=∫X2×X1f∘hdμ21 (c)=∫X2(∫X1(f∘h)x2dμ1)dμ2(d)=∫X2(∫X1fx2dμ1)dμ2.

Uniqueness of the product measure of Section 4.4 yields , and thus gives (a). The above change-of-measure formula (16) gives (b). The first formula of the Tonelli theorem (14) applied to  gives (c). The above Equation (17) gives (d).

This second part of Tonelli theorem can be stated in Coq as

Lemma Tonelli_aux2 :
\forall f, Mplus genX1xX2 f ->
Mplus genX2 (LInt_p_section_fun muX1 (swap f)) /\
LInt_p meas_prod_swap f = LInt_p muX2 (LInt_p_section_fun muX1 (swap f)).

where swap f denotes .

#### 5.3.3 Statement of the Tonelli Theorem

Finally, we formalize the Tonelli theorem that gathers the two equalities (14) and (15). We assume that  and  are nonempty and that  and  are -finite measures. Then,

Lemma Tonelli_formulas :
\forall f, Mplus genX1xX2 f ->
LInt_p muX1xX2 f = LInt_p muX1 (LInt_p_section_fun muX2 f) /\
LInt_p muX1xX2 f = LInt_p muX2 (LInt_p_section_fun muX1 (swap f)).

where muX1xX2 stands for the product measure. We also provide a more comprehensive but less readable theorem Tonelli that moreover ensures the legitimacy of all integrals.

## 6 Conclusion and perspectives

In this paper, we present the formalization and the construction of the full formal proof of the Tonelli theorem. We have constructed the product measure of two -finite measures, built the two iterated integrals, and proved they are equal to the double integral on the product measure space. A key point is the definition of nonnegative measurable functions as an inductive type. It has been proved equivalent to the common mathematical definition and has led to a very useful induction scheme. Although the induction principle is present in some formalizations, building it from an inductive type is an original point of view we have not seen in the literature.

To achieve the proof of the Tonelli theorem, we have also formalized in Coq common generic results and constructions such as the monotone class theorem, the restricted measure, the image measure, and a change-of-measure formula for the integral. The latter, combined with a swap of variables, has prevented redundancies in our proofs.

This work confirms the fact that the library we are developing, in line with the choices of the Coquelicot library, is rather comprehensive and usable. First, this work has led to few additions in the core of the library, except for the inductive definition for  that is related to the needed Lebesgue induction principle. Second, the library seems easy to learn. One co-author of this article and this Coq development was a novice who did not actually participate in the previous developments.

The natural extension after the Tonelli theorem on nonnegative measurable functions is the Fubini theorem that provides the same formulas for integrable functions with arbitrary sign. But we would rather directly consider the version using the Bochner integral [BCL22] that applies to functions taking their values in a Banach space, such as the Euclidean spaces  and the Hermitian spaces . For that, we can take inspiration from the work by van Doorn in Lean [VanDoo21], and in particular with the concept of “marginal integral” that seems to be an elegant way to handle integrals on a finitary Cartesian product.

Our long-term purpose is to formally prove the correctness of parts of a library implementing the Finite Element Method (FEM), which is used to compute approximated solutions of Partial Differential Equations (PDEs). We already formalized the Lax–Milgram theorem [BCF21], one of the key ingredient to numerically solve PDEs, and we need to build suitable Hilbert functional spaces on which to apply it. The target candidates are the Sobolev spaces such as , that represents square integrable functions with square integrable first derivatives. Of course, this will involve the formalization of the

Lebesgue spaces as complete normed vector spaces, and parts of the distribution theory

[sch:td:66].