Induction
COMP2600 Structural Formal Methods for Software Engineering
Ben Lippmeier Australian National University Semester 2, 2008
COMP 2600 Structural Induction
1
Structural Induction
What is covered in this topic.
Induction on the natural numbers. Structural induction over Lists. Structural induction over Trees. The principle that the structural induction rule for a particular data type
follows from its denition.
COMP 2600 Structural Induction
2
Natural Number Induction
This is the induction you already know. To prove a property P for all natural numbers:
Prove it for 0 Prove that, if it is true for n it is true for n + 1.
The principle is usually expressed as a rule of inference:
P(0) n. P(n) P(n + 1) n. P(n)
COMP 2600 Structural Induction
3
Why does it Work?
The natural numbers are an inductively dened set: 1. 0 is a natural number; 2. If n is a natural number, so is n+1; No object is a natural number unless justied by these clauses. From the assumptions:
P(0)
n. P(n) P(n + 1)
we get a sequence of deductions:
P(0), P(1), P(2), P(3), ...
justifying the conclusion.
COMP 2600 Structural Induction 4
Example of Mathematical Induction
Lets prove this property of natural numbers:
i=0
n
n (n + 1) i = 2
First the Base case P(0)
i=0
0
i =
0 (+1) 2
0 = 0
This is obviously true because both sides have the same form.
COMP 2600 Structural Induction
5
Now the Step case n. P(n) P(n + 1) Following the rules of natural deduction, we will rst prove P(a) P(a + 1) for a particular number a, then generalise. Assume P(a). This assumption is called the induction hypothesis.
a
i=0
i =
a . (a + 1) 2
Now prove P(a + 1)
a+1 i=0
i =
(a + 1) . ((a + 1) + 1) 2
(
COMP 2600 Structural Induction
a
i=0
a . (a + 1) + (a + 1) i) + (a + 1) = 2
6
Subtracting (a + 1) from both sides gives:
i=0
a
i =
a . (a + 1) 2
This is true because it has the same form as our assumption. Using (I) we have:
P(a) P(a + 1)
Generalising over a gives
n. P(n) P(n + 1)
We have now satised both premises of the induction rule. Theorem proved!
COMP 2600 Structural Induction
7
Induction on Lists
Like natural numbers, lists are also inductively dened. 1. [ ] :: [a] 2. If x :: a and xs :: [a] then (x : xs) :: [a] No object is a list of as unless justied by these clauses.
To prove a property for all lists (whos elements have type a)
Prove it for [ ] Prove that, whenever it is true for xs it is also true for x : xs.
COMP 2600 Structural Induction
8
Why does it Work?
Suppose we have proved:
The base case: P([ ]) The step case: x. xs. P(xs) P(x : xs)
We can use these facts to prove that P([4, 2, 6]) is true. 1. P([ ]) is given 2. P([6]) follows from P([]) by the inductive step 3. P([2, 6]) follows from P([6]) by the inductive step 4. P([4, 2, 6]) follows from P([2, 6]) by the inductive step QED
COMP 2600 Structural Induction 9
Thats Induction on Structure
The rule of Structural Induction for Lists is usually written as:
P([ ])
x. xs. P(xs) P(x : xs) xs. P(xs)
or, being fussy with types:
P([ ] :: [a])
(x :: a). (xs :: [a]). P(xs) P(x : xs) (xs :: [a]). P(xs)
COMP 2600 Structural Induction
10
Standard functions
Many of our examples will use some standard functions. We will use each line of the function denition as a rewrite rule.
length []
= 0
-- ( L1 ) -- ( L2 ) -- ( M1 ) -- ( M2 ) -- ( A1 ) -- ( A2 )
length ( x : xs ) = 1 + length xs map f [] map f ( x : xs ) [] ++ ys = [] = f x : map f xs = ys = x : ( xs ++ ys )
( x : xs ) ++ ys
COMP 2600 Structural Induction
11
length f (map xs) = length xs
Were doing induction over the list xs , so our rst step is to substitute [] for xs and prove the base case. Base Case: P([ ])
length ( map f [])
= length []
Now look for rewrite rules to make one side obviously equal to the other.
length []
Easy!
= length []
-- by ( M1 )
COMP 2600 Structural Induction
12
Step Case: x. xs. P(xs) P(x : xs) Once again, we prove this for a particular list a:as, then generalise. Assume P(as) length ( map f as ) Prove P(a : as) length ( map f ( a : as )) = length ( a : as ) -- by ( M2 , L2 ) -- by ( L2 ) -- by ( IH ) = length as -- ( IH )
length ( f a : map f as ) = 1 + length as 1 + length ( map f as ) 1 + length as = 1 + length as = 1 + length as
Now one side is equal to the other, so the nal statement is obviously true. Well skip the formal generalisation step and call our theorem proved.
COMP 2600 Structural Induction 13
What are we really doing here?
The statement S = S is always true. Our step case demonstrates that we can derive P(a : as) from S = S, though we do it in reverse.
a as
P(as) S=S
. . .
P(a : as) P(as) P(a : as) xs. P(xs) P(a : xs) x. xs. P(xs) P(x : xs)
COMP 2600 Structural Induction 14
length (xs ++ ys) = length xs + length ys
We do induction over one list only. When proving the above theorem, treat ys as a constant. Base Case: P([ ]) length ([] ++ ys ) = length [] + length ys length ys length ys = 0 = length ys + length ys -- by ( A1 , L1 ) -- by ( arith )
COMP 2600 Structural Induction
15
Step Case: x. xs. P(xs) P(x : xs)
Assume P(as) length ( as ++ ys ) Prove P(a : as) length (( a : as ) ++ ys ) = length ( a : as ) + length ys length ( a :( as ++ ys )) = 1 + length as + length ys -- by ( A2 , L2 ) 1 + length ( as ++ ys ) = 1 + length as + length ys -- by ( L2 ) 1 + length ( as ++ ys ) = 1 + length ( as ++ ys ) Both sides are now the same. Theorem proved! -- by ( IH ) = length as + length ys -- ( IH )
COMP 2600 Structural Induction
16
A few meta-points:
On the induction hypothesis:
The induction hypothesis ties the recursive knot in the proof. If you havent used the induction hypothesis the pro...