Induction | A Polyglot Database Client for Mac OS X

You can prove your lemma in recursive manner. You can refer https://www.rise4fun.com/Dafny/tutorialcontent/Lemmas#h25 for detailed explanation. It also has an example which happens to be very similar to your problem.

*_tac are built-in tactics used in apply-scripts. In particular, case_tac and induct_tac have been basically superseded by the cases and induction proof methods in Isabelle/Isar. As you mentioned, case_tac and induct_tac can handle ⋀-bound variables. However, this is quite fragile, since their names are often generated automatically and may change when Isabelle changes (of course, you could use rename_tac to choose fixed names). That's one of the reasons why nowadays structured proof methods are preferred to unstructured tactic scripts. Now, back to your example: In order to be able to use cases, you can introduce a structured block as follows:

time.time() has a limited resolution. Your "efficient append" timings are fast enough that they usually finish before a single tick of time.time()'s resolution. Note how exactly two times show up in your yellow graph: 0 ticks, and 1 tick. The 1-tick times are more frequent on the right of the graph, because even when the times are shorter than a single tick, a longer time means a higher probability that the tick will happen during the runtime. If you ran with larger inputs, you would eventually see 2-tick times and higher. (Also note that 100000 doesn't have enough 0s in it, so your timings are off by a factor of 10.)

… then i will be assigned INT_MAX+1, which would overflow to an undefined value such as between 0 and INT_MAX.

No, that is not correct. That is written as if the rule were:

• If ++i overflows, then i will be given some int value, although it is not specified which one.

However, the rule is:

• If ++i overflows, the entire behavior of the program is undefined by the C standard.

That is, if ++i overflows, the C standard allows any of these things to happen:

• i stays at INT_MAX.
• i changes to INT_MIN.
• i changes to zero.
• i changes to 37.
• The processor generates a trap, and the operating system terminates your process.
• Some other variable changes value.
• Program control jumps out of the loop, as if it had ended normally.
• Anything.

Now consider this assumption used in optimization by the compiler:

… the compiler can assume that the loop will iterate exactly N+1 times…

If ++i can only set i to some int value, then the loop will not terminate, as you conclude. On the other hand, if the compiler generates code that assumes the loop will iterate exactly N+1 times, then something else will happen in the case when ++i overflows. Exactly what happens depends on the contents of the loop and what the compiler does with them. But it does not matter what: Generating this code is allowed by the C standard because whatever happens when ++i overflows is allowed by the C standard.

I found a solution. Problem is with the precompiled binaries! If I get the latest development sources from the GitHub and then compile, everything works.

This is how to properly do it:

After some tips from user9716869, it's clear that my main problem was the lack of knowledge about the arbitrary option in induction. Using (induction _ arbitrary: _) and (cases _) (see the reference manual for details), the proofs are quite straight forward.

Since these are made for educational purposes, the following proofs are not meant to be concise, but to make every step very clear. Most of these could be vastly reduced if more automation is desired, and some can be done in one line (which I left as a comment below the lemma).

Note: In these proofs, we are using an implicit lemma about inductive types, their injectivity (which implies (Succ a = Succ b) ≡ (a = b) and Zero ≠ Succ a). Furthermore, (Succ a < Succ b) ≡ (a < b) by definition.

First, we prove 2 useful lemmas:

• a < b ⟹ b ≠ Zero
• b ≠ Zero ⟷ (∃ b'. b = Succ b')

The Master Theorem does indeed give a bound of Θ(n log n), which means that it says the runtime is both O(n log n) and Ω(n log n). In that sense, it's giving you what you proved using the substitution method, plus a matching lower bound. You could, of course, also prove that matching lower bound using the substitution method and induction, so in that sense the Master Theorem isn't giving you anything that you couldn't previously prove with substitution and induction. In fact, the typical way that you prove the Master Theorem is to essentially find general forms of what substitution/induction would work out to, then doing the math once to prove the general case.

Any assumptions that you need to be part of the induction need to be part of the proof state when you call induct. In particular, that should be all assumptions that contain the thing you do the induction over (i.e. all the ones that contain n in your case).

You should therefore do a using assms before the proof. Then 0 ≥ m will be available to you in the base case, under the name "0.prems" (or just 0 for all of these plus the induction hypothesis, which in this case doesn't exist).