I'm trying to prove the following in Coq:
β B: Type, β a: B, β b: nat -> B -> B, β f: nat -> B, f 0 = a β§ β n: nat, f (S n) = b n (f n).
Which implies that a fairly general class of recursive functions exist. I know that I can construct that function using Fixpoint items or fix expressions, but I want to not use it, and instead use nat_ind defined with this type:
β P: nat β Prop, P 0 β (β n: nat, P n β P (S n)) β β n: nat, P n
I believe this is possible since nat_ind behaves like a recursion combinator. But I didn't figured it out how to prove it. The problem is that the induction variable is inside of β f guard, and I don't have access to it. I'm able to prove something like this:
β B: Type, β a: B, β b: nat -> B -> B, β m: nat,
β f: nat -> B, f 0 = a β§ β n: nat, n < m -> f (S n) = b n (f n)
But it doesn't help in proving the original one I think.
Is it possible to prove the original one without using fix directly? I'm ok with using double negation and other well-known axioms if needed. Using nat_rec and nat_rect is also fine, but only as an opaque axiom. Precisely, using those are fine:
Axiom nat_rec2: β P : nat β Set, P 0 β (β n : nat, P n β P (S n)) β β n : nat, P n.
Axiom nat_rect2: β P : nat β Type, P 0 β (β n : nat, P n β P (S n)) β β n : nat, P n.
The problem seems to be to obtain recursion from the following axiomatization of nat:
Parameter nat : Type.
Parameter O : nat.
Parameter S : nat -> nat.
Parameter disjoint_O_S : forall n, O <> S n.
Parameter injective_S : forall n n', S n = S n' -> n = n'.
Parameter nat_rect : forall P: nat -> Type, P O -> (forall n: nat, P n -> P (S n)) -> forall n : nat, P n.
Where the main issue is that the nat_rect axiom has no computational behavior, so although we might define a recursor B -> (nat -> B -> B) -> nat -> B as nat_rect (fun _ => B), we can't prove anything about it.
The solution is to first encode the graph of the desired recursive function f as a relation, and then use nat_rect to produce a dependent pair, of a value that is going to be f n with evidence that that value is in the graph of f.
Section Rec.
Context (B : Type) (a : B) (b : nat -> B -> B).
Inductive graph : nat -> B -> Prop :=
| recO : graph O a
| recS n y : graph n y -> graph (S n) (b n y)
.
Lemma graph_fun : forall n, { y | forall y', y = y' <-> graph n y' }.
Proof.
induction n as [ | n IH ] using nat_rect.
- exists a; split.
+ intros <-. constructor.
+ inversion 1; [ reflexivity | ]. contradiction (disjoint_O_S n); auto.
- destruct IH as [y IH]. exists (b n y); split.
+ intros <-. constructor. apply IH. auto.
+ inversion 1; subst. contradiction (disjoint_O_S n); auto.
apply injective_S in H0. subst.
apply IH in H1. subst; auto.
Qed.
Theorem nat_rec : exists (f : nat -> B), f O = a /\ forall n, f (S n) = b n (f n).
Proof.
exists (fun n => proj1_sig (graph_fun n)). split.
- apply (proj2_sig (graph_fun O)). constructor.
- intros n. apply (proj2_sig (graph_fun (S n))).
constructor. apply (proj2_sig (graph_fun n)).
reflexivity.
Qed.
End Rec.
If you have the Prop inductor nat_ind instead of nat_rect, that same technique can be adapted by also assuming the axiom constructive_indefinite_description (which actually lets you reconstruct nat_rect, but here you can more simply apply it at the beginning of graph_fun):
From Coq Require Import IndefiniteDescription.
About constructive_indefinite_description.
(*
constructive_indefinite_description :
forall (A : Type) (P : A->Prop),
(exists x, P x) -> { x : A | P x }.
*)
cong and injective allow you to apply and unapply functions to equalities:
cong : (f : a -> b) -> x = y -> f x = f y
injective : Injective f => f x = f y -> x = y
Both of these fail for indexed vectors with different lengths, for obvious reasons.
How can I prove that two equal vectors have the same length? I.e.
sameLen : {xs : Vect n a} -> {ys : Vect m b} -> xs = ys -> n = m
I can't just do
sameLen pf = cong length pf
because length on xs has type Vect n a -> Nat and length on ys has type Vect m b -> Nat. (In fact, I'm not even sure how to prove the same thing for two regular Lists, due to the differing type arguments, never mind with the added indices).
Going the other way, how would I prove something like
data Rose a = V a | T (Vect n (Rose a))
Injective T where
injective Refl = Refl
unwrap : {xs : Vect n (Rose a)} -> {ys : Vect m (Rose b)} -> T xs = T ys -> xs = ys
Again, I can't just do
unwrap pf = injective pf
due to the differing types of T (one with m and one with n). And even if I had a proof m=n, how could I use that to convince Idris that the two applications of T are the same?
Got the answer from the Idris Discord - if you pattern match on Refl then it unifies a and b automatically:
sameLen : {xs : List a} -> {ys : List b} -> xs = ys -> length xs = length ys
sameLen Refl = Refl
sameLen' : {xs : Vect n a} -> {ys : Vect m b} -> xs = ys -> n = m
sameLen' Refl = Refl
Good Evening Fellows,
I am attempting to prove that insertionsort will perform <= 3 comparisons in a list of size 3 while sorting. Last part of my project and cannot make any headway on it. After spending fair amount of time pursuing an incorrect approach, my instructor informed me it may be accomplished by writing a helper function to assist. I unfortunately have not come up with any piece of code to help. If anyone can offer advice or assistance, any and all are appreciated. Code follows. Thanks!
insert : β β π β β π β Γ β
insert x (h :: t) = if h < x then (x :: h :: t , 1) else let r = insert
x t in h :: (fst r) , 1 + snd r
insert x [] = x :: [] , 0
insertionsort : π β β π β Γ β
insertionsort [] = [] , 0
insertionsort (h :: t) with insertionsort t
insertionsort (h :: t) | t' , c1 with insert h t'
insertionsort (h :: t) | t' , c1 | r , c2 = r , c1 + c2
exampleThm : β(x y z c : β)(r : π β) β insertionsort (x :: y :: z :: [])
β‘ r , c β c β€ 3 β‘ tt
exampleThm x y z = ?`
All the comparisons to be done in the course of insertionsort are actually done in the course of subordinate calls to insert. It may help to establish a useful fact about the comparison cost of insert. If you can bound the cost of each call to insert, you should be able to combine those bounded partial costs together to make a bounded total cost. In case your instructor is concerned that I am helping too much, let me summarize by saying that all I am saying is that the structure of the proof has to follow the structure of the program.
A general pattern when constructing proofs is to generalize them to make them easier. In this case I believe it is more clear to solve the generalized bound for the number of comparisons that insertion sort will do and then instantiate that to your particular input.
The structure of your proof will follow the structure of your program.
First we'll need to characterize the behavior of insert, since insertion sort is implemented in terms of it.
insert-bound : β x ys β projβ (insert x ys) β€ length ys
Then we'll use that to characterize the behavior of insertion sort
bound : β β β
bound 0 = 0
bound (suc n) = bound n + n
insertionsort-bound : β xs β projβ (insertionsort xs) β€ bound (length xs)
Using the general solution we can solve the specific case of a three element list
exampleThm : β x y z c r β insertionsort (x β· y β· z β· []) β‘ (r , c) β c β€ 3
exampleThm x y z ._ ._ refl = insertionsort-bound (x β· y β· z β· [])
Here's an implementation against the Agda standard library of your problem:
http://www.galois.com/~emertens/insertionsort-agda/Insertionsort.html
I am interested in how would one define f to the n in Coq:
Basically, as an exercise, I would like to write this definition and then confirm that my
algorithm implements this specification. Inductive definition seems appropriate here, but I was not able to make it clean as above. What would be a clean Coq implementation of the above?
With the pow_func function that gallais defined, you can state your specification as lemmas, such as:
Lemma pow_func0: forall (A:Type) (f: A -> A) (x: A), pow_fun f O x = f x.
and
Lemma pow_funcS: forall (n:nat) (A: Type) (f: A->A) (x:A), pow_fun f (S n) x = f (pow_fun f n x).
The proof should be trivial by unfolding the definition
Inductive is used to define types closed under some operations; this is not what you are looking for here. What you want to build is a recursive function iterating over n. This can be done using the Fixpoint keyword:
Fixpoint pow_func {A : Type} (f : A -> A) (n : nat) (a : A) : A :=
match n with
| O => f a
| S n => f (pow_func f n a)
end.
If you want a nicer syntax for this function, you can introduce a Notation:
Notation "f ^ n" := (pow_func f n).
However, note that this is not a well-behaved definition of a notion of power: if you compose f ^ m and f ^ n, you don't get f ^ (m + n) but rather f ^ (1 + m + n). To fix that, you should pick the base case f ^ 0 to be the neutral element for composition id rather than f itself. Which would give you:
Fixpoint pow_func' {A : Type} (f : A -> A) (n : nat) (a : A) : A :=
match n with
| O => a
| S n => f (pow_func' f n a)
end.
Suppose we define a function
f : N \to N
f 0 = 0
f (s n) = f (n/2) -- this / operator is implemented as floored division.
Agda will paint f in salmon because it cannot tell if n/2 is smaller than n. I don't know how to tell Agda's termination checker anything. I see in the standard library they have a floored division by 2 and a proof that n/2 < n. However, I still fail to see how to get the termination checker to realize that recursion has been made on a smaller subproblem.
Agda's termination checker only checks for structural recursion (i.e. calls that happen on structurally smaller arguments) and there's no way to establish that certain relation (such as _<_) implies that one of the arguments is structurally smaller.
Digression: Similar problem happens with positivity checker. Consider the standard fix-point data type:
data ΞΌ_ (F : Set β Set) : Set where
fix : F (ΞΌ F) β ΞΌ F
Agda rejects this because F may not be positive in its first argument. But we cannot restrict ΞΌ to only take positive type functions, or show that some particular type function is positive.
How do we normally show that a recursive functions terminates? For natural numbers, this is the fact that if the recursive call happens on strictly smaller number, we eventually have to reach zero and the recursion stops; for lists the same holds for its length; for sets we could use the strict subset relation; and so on. Notice that "strictly smaller number" doesn't work for integers.
The property that all these relations share is called well-foundedness. Informally speaking, a relation is well-founded if it doesn't have any infinite descending chains. For example, < on natural numbers is well founded, because for any number n:
n > n - 1 > ... > 2 > 1 > 0
That is, the length of such chain is limited by n + 1.
β€ on natural numbers, however, is not well-founded:
n β₯ n β₯ ... β₯ n β₯ ...
And neither is < on integers:
n > n - 1 > ... > 1 > 0 > -1 > ...
Does this help us? It turns out we can encode what it means for a relation to be well-founded in Agda and then use it to implement your function.
For simplicity, I'm going to bake the _<_ relation into the data type. First of all, we must define what it means for a number to be accessible: n is accessible if all m such that m < n are also accessible. This of course stops at n = 0, because there are no m so that m < 0 and this statement holds trivially.
data Acc (n : β) : Set where
acc : (β m β m < n β Acc m) β Acc n
Now, if we can show that all natural numbers are accessible, then we showed that < is well-founded. Why is that so? There must be a finite number of the acc constructors (i.e. no infinite descending chain) because Agda won't let us write infinite recursion. Now, it might seem as if we just pushed the problem back one step further, but writing the well-foundedness proof is actually structurally recursive!
So, with that in mind, here's the definition of < being well-founded:
WF : Set
WF = β n β Acc n
And the well-foundedness proof:
<-wf : WF
<-wf n = acc (go n)
where
go : β n m β m < n β Acc m
go zero m ()
go (suc n) zero _ = acc Ξ» _ ()
go (suc n) (suc m) (sβ€s m<n) = acc Ξ» o o<sm β go n o (trans o<sm m<n)
Notice that go is nicely structurally recursive. trans can be imported like this:
open import Data.Nat
open import Relation.Binary
open DecTotalOrder decTotalOrder
using (trans)
Next, we need a proof that β n /2β β€ n:
/2-less : β n β β n /2β β€ n
/2-less zero = zβ€n
/2-less (suc zero) = zβ€n
/2-less (suc (suc n)) = sβ€s (trans (/2-less n) (right _))
where
right : β n β n β€ suc n
right zero = zβ€n
right (suc n) = sβ€s (right n)
And finally, we can write your f function. Notice how it suddenly becomes structurally recursive thanks to Acc: the recursive calls happen on arguments with one acc constructor peeled off.
f : β β β
f n = go _ (<-wf n)
where
go : β n β Acc n β β
go zero _ = 0
go (suc n) (acc a) = go β n /2β (a _ (sβ€s (/2-less _)))
Now, having to work directly with Acc isn't very nice. And that's where Dominique's answer comes in. All this stuff I've written here has already been done in the standard library. It is more general (the Acc data type is actually parametrized over the relation) and it allows you to just use <-rec without having to worry about Acc.
Taking a more closer look, we are actually pretty close to the generic solution. Let's see what we get when we parametrize over the relation. For simplicity I'm not dealing with universe polymorphism.
A relation on A is just a function taking two As and returning Set (we could call it binary predicate):
Rel : Set β Setβ
Rel A = A β A β Set
We can easily generalize Acc by changing the hardcoded _<_ : β β β β Set to an arbitrary relation over some type A:
data Acc {A} (_<_ : Rel A) (x : A) : Set where
acc : (β y β y < x β Acc _<_ y) β Acc _<_ x
The definition of well-foundedness changes accordingly:
WellFounded : β {A} β Rel A β Set
WellFounded _<_ = β x β Acc _<_ x
Now, since Acc is an inductive data type like any other, we should be able to write its eliminator. For inductive types, this is a fold (much like foldr is eliminator for lists) - we tell the eliminator what to do with each constructor case and the eliminator applies this to the whole structure.
In this case, we'll do just fine with the simple variant:
foldAccSimple : β {A} {_<_ : Rel A} {R : Set} β
(β x β (β y β y < x β R) β R) β
β z β Acc _<_ z β R
foldAccSimple {R = R} accβ² = go
where
go : β z β Acc _ z β R
go z (acc a) = accβ² z Ξ» y y<z β go y (a y y<z)
If we know that _<_ is well-founded, we can skip the Acc _<_ z argument completly, so let's write small convenience wrapper:
recSimple : β {A} {_<_ : Rel A} β WellFounded _<_ β {R : Set} β
(β x β (β y β y < x β R) β R) β
A β R
recSimple wf accβ² z = foldAccSimple accβ² z (wf z)
And finally:
<-wf : WellFounded _<_
<-wf = {- same definition -}
<-rec = recSimple <-wf
f : β β β
f = <-rec go
where
go : β n β (β m β m < n β β) β β
go zero _ = 0
go (suc n) r = r β n /2β (sβ€s (/2-less _))
And indeed, this looks (and works) almost like the one in the standard library!
Here's the fully dependent version in case you are wondering:
foldAcc : β {A} {_<_ : Rel A} (P : A β Set) β
(β x β (β y β y < x β P y) β P x) β
β z β Acc _<_ z β P z
foldAcc P accβ² = go
where
go : β z β Acc _ z β P z
go _ (acc a) = accβ² _ Ξ» _ y<z β go _ (a _ y<z)
rec : β {A} {_<_ : Rel A} β WellFounded _<_ β
(P : A β Set) β (β x β (β y β y < x β P y) β P x) β
β z β P z
rec wf P accβ² z = foldAcc P accβ² _ (wf z)
I would like to offer a slightly different answer than the ones given above. In particular, I want to suggest that instead of trying to somehow convince the termination checker that actually, no, this recursion is perfectly fine, we should instead try to reify the well-founded-ness so that the recursion is manifestly fine in virtue of being structural.
The idea here is that the problem comes from being unable to see that n / 2 is somehow a "part" of n. Structural recursion wants to break a thing into its immediate parts, but the way that n / 2 is a "part" of n is that we drop every other suc. But it's not obvious up front how many to drop, we have to look around and try to line things up. What would be nice is if we had some type that had constructors for "multiple" sucs.
To make the problem slightly more interesting, let's instead try to define the function that behaves like
f : β β β
f 0 = 0
f (suc n) = 1 + (f (n / 2))
that is to say, it should be the case that
f n = β logβ (n + 1) β
Now naturally the above definition won't work, for the same reasons your f won't. But let's pretend that it did, and let's explore the "path", so to speak, that the argument would take through the natural numbers. Suppose we look at n = 8:
f 8 = 1 + f 4 = 1 + 1 + f 2 = 1 + 1 + 1 + f 1 = 1 + 1 + 1 + 1 + f 0 = 1 + 1 + 1 + 1 + 0 = 4
so the "path" is 8 -> 4 -> 2 -> 1 -> 0. What about, say, 11?
f 11 = 1 + f 5 = 1 + 1 + f 2 = ... = 4
so the "path" is 11 -> 5 -> 2 -> 1 -> 0.
Well naturally what's going on here is that at each step we're either dividing by 2, or subtracting one and dividing by 2. Every naturally number greater than 0 can be decomposed uniquely in this fashion. If it's even, divide by two and proceed, if it's odd, subtract one and divide by two and proceed.
So now we can see exactly what our data type should look like. We need a type that has a constructor that means "twice as many suc's" and another that means "twice as many suc's plus one", as well as of course a constructor that means "zero sucs":
data Decomp : β β Set where
zero : Decomp zero
2*_ : β {n} β Decomp n β Decomp (n * 2)
2*_+1 : β {n} β Decomp n β Decomp (suc (n * 2))
We can now define the function that decomposes a natural number into the Decomp that corresponds to it:
decomp : (n : β) β Decomp n
decomp zero = zero
decomp (suc n) = decomp n +1
It helps to define +1 for Decomps:
_+1 : {n : β} β Decomp n β Decomp (suc n)
zero +1 = 2* zero +1
(2* d) +1 = 2* d +1
(2* d +1) +1 = 2* (d +1)
Given a Decomp, we can flatten it down into a natural number that ignores the distinctions between 2*_ and 2*_+1:
flatten : {n : β} β Decomp n β β
flatten zero = zero
flatten (2* p) = suc (flatten p)
flatten (2* p +1 = suc (flatten p)
And now it's trivial to define f:
f : β β β
f n = flatten (decomp n)
This happily passes the termination checker with no trouble, because we're never actually recursing on the problematic n / 2. Instead, we convert the number into a format that directly represents its path through the number space in a structurally recursive way.
Edit It occurred to me only a little while ago that Decomp is a little-endian representation of binary numbers. 2*_ is "append 0 to the end/shift left 1 bit" and 2*_+1 is "append 1 to the end/shift left 1 bit and add one". So the above code is really about showing that binary numbers are structurally recursive wrt dividing by 2, which they ought to be! That makes it much easier to understand, I think, but I don't want to change what I wrote already, so we could instead do some renaming here: Decomp ~> Binary, 2*_ ~> _,zero, 2*_+1 ~> _,one, decomp ~> natToBin, flatten ~> countBits.
After accepting Vitus' answer, I discovered a different way to accomplish the goal of proving a function terminates in Agda, namely using "sized types." I am providing my answer here because it seems acceptable, and also for critique of any weak points of this answer.
Sized types are described:
http://arxiv.org/pdf/1012.4896.pdf
They are implemented in Agda, not only MiniAgda; see here: http://www2.tcs.ifi.lmu.de/~abel/talkAIM2008Sendai.pdf.
The idea is to augment the data type with a size that allows the typechecker to more easily prove termination. Size is defined in the standard library.
open import Size
We define sized natural numbers:
data Nat : {i : Size} \to Set where
zero : {i : Size} \to Nat {\up i}
succ : {i : Size} \to Nat {i} \to Nat {\up i}
Next, we define predecessor and subtraction (monus):
pred : {i : Size} β Nat {i} β Nat {i}
pred .{β i} (zero {i}) = zero {i}
pred .{β i} (succ {i} n) = n
sub : {i : Size} β Nat {i} β Nat {β} β Nat {i}
sub .{β i} (zero {i}) n = zero {i}
sub .{β i} (succ {i} m) zero = succ {i} m
sub .{β i} (succ {i} m) (succ n) = sub {i} m n
Now, we may define division via Euclid's algorithm:
div : {i : Size} β Nat {i} β Nat β Nat {i}
div .{β i} (zero {i}) n = zero {i}
div .{β i} (succ {i} m) n = succ {i} (div {i} (sub {i} m n) n)
data β₯ : Set where
record β€ : Set where
notZero : Nat β Set
notZero zero = β₯
notZero _ = β€
We give division for nonzero denominators.
If the denominator is nonzero, then it is of the form, b+1. We then do
divPos a (b+1) = div a b
Since div a b returns ceiling (a/(b+1)).
divPos : {i : Size} β Nat {i} β (m : Nat) β (notZero m) β Nat {i}
divPos a (succ b) p = div a b
divPos a zero ()
As auxiliary:
div2 : {i : Size} β Nat {i} β Nat {i}
div2 n = divPos n (succ (succ zero)) (record {})
Now we can define a divide and conquer method for computing the n-th Fibonacci number.
fibd : {i : Size} β Nat {i} β Nat
fibd zero = zero
fibd (succ zero) = succ zero
fibd (succ (succ zero)) = succ zero
fibd (succ n) with even (succ n)
fibd .{β i} (succ {i} n) | true =
let
-- When m=n+1, the input, is even, we set k = m/2
-- Note, ceil(m/2) = ceil(n/2)
k = div2 {i} n
fib[k-1] = fibd {i} (pred {i} k)
fib[k] = fibd {i} k
fib[k+1] = fib[k-1] + fib[k]
in
(fib[k+1] * fib[k]) + (fib[k] * fib[k-1])
fibd .{β i} (succ {i} n) | false =
let
-- When m=n+1, the input, is odd, we set k = n/2 = (m-1)/2.
k = div2 {i} n
fib[k-1] = fibd {i} (pred {i} k)
fib[k] = fibd {i} k
fib[k+1] = fib[k-1] + fib[k]
in
(fib[k+1] * fib[k+1]) + (fib[k] * fib[k])
You cannot do this directly: Agda's termination checker only considers recursion ok on arguments that are syntactically smaller. However, the Agda standard library provides a few modules for proving termination using a well-founded order between the arguments of the functions. The standard order on natural numbers is such an order and can be used here.
Using the code in Induction.*, you can write your function as follows:
open import Data.Nat
open import Induction.WellFounded
open import Induction.Nat
sβ€β²s : β {n m} β n β€β² m β suc n β€β² suc m
sβ€β²s β€β²-refl = β€β²-refl
sβ€β²s (β€β²-step lt) = β€β²-step (sβ€β²s lt)
proof : β n β β n /2β β€β² n
proof 0 = β€β²-refl
proof 1 = β€β²-step (proof zero)
proof (suc (suc n)) = β€β²-step (sβ€β²s (proof n))
f : β β β
f = <-rec (Ξ» _ β β) helper
where
helper : (n : β) β (β y β y <β² n β β) β β
helper 0 rec = 0
helper (suc n) rec = rec β n /2β (sβ€β²s (proof n))
I found an article with some explanation here. But there may be better references out there.
A similar question appeared on the Agda mailing-list a few weeks ago and the consensus seemed to be to inject the Data.Nat element into Data.Bin and then use structural recursion on this representation which is well-suited for the job at hand.
You can find the whole thread here : http://comments.gmane.org/gmane.comp.lang.agda/5690
You can avoid using well-founded recursion. Let's say you want a function, that applies β_/2β to a number, until it reaches 0, and collects the results. With the {-# TERMINATING #-} pragma it can be defined like this:
{-# TERMINATING #-}
β_/2βs : β -> List β
β_/2βs 0 = []
β_/2βs n = n β· β β n /2β /2βs
The second clause is equivalent to
β_/2βs n = n β· β n βΈ (n βΈ β n /2β) /2βs
It's possible to make β_/2βs structurally recursive by inlining this substraction:
β_/2βs : β -> List β
β_/2βs = go 0 where
go : β -> β -> List β
go _ 0 = []
go 0 (suc n) = suc n β· go (n βΈ β n /2β) n
go (suc i) (suc n) = go i n
go (n βΈ β n /2β) n is a simplified version of go (suc n βΈ β suc n /2β βΈ 1) n
Some tests:
test-5 : β 5 /2βs β‘ 5 β· 2 β· 1 β· []
test-5 = refl
test-25 : β 25 /2βs β‘ 25 β· 12 β· 6 β· 3 β· 1 β· []
test-25 = refl
Now let's say you want a function, that applies β_/2β to a number, until it reaches 0, and sums the results. It's simply
β_/2βsum : β -> β
β n /2βsum = go β n /2βs where
go : List β -> β
go [] = 0
go (n β· ns) = n + go ns
So we can just run our recursion on a list, that contains values, produced by the β_/2βs function.
More concise version is
β n /2βsum = foldr _+_ 0 β n /2βs
And back to the well-foundness.
open import Function
open import Relation.Nullary
open import Relation.Binary
open import Induction.WellFounded
open import Induction.Nat
calls : β {a b β} {A : Set a} {_<_ : Rel A β} {guarded : A -> Set b}
-> (f : A -> A)
-> Well-founded _<_
-> (β {x} -> guarded x -> f x < x)
-> (β x -> Dec (guarded x))
-> A
-> List A
calls {A = A} {_<_} f wf smaller dec-guarded x = go (wf x) where
go : β {x} -> Acc _<_ x -> List A
go {x} (acc r) with dec-guarded x
... | no _ = []
... | yes g = x β· go (r (f x) (smaller g))
This function does the same as the β_/2βs function, i.e. produces values for recursive calls, but for any function, that satisfies certain conditions.
Look at the definition of go. If x is not guarded, then return []. Otherwise prepend x and call go on f x (we could write go {x = f x} ...), which is structurally smaller.
We can redefine β_/2βs in terms of calls:
β_/2βs : β -> List β
β_/2βs = calls {guarded = ?} β_/2β ? ? ?
β n /2βs returns [], only when n is 0, so guarded = Ξ» n -> n > 0.
Our well-founded relation is based on _<β²_ and defined in the Induction.Nat module as <-well-founded.
So we have
β_/2βs = calls {guarded = Ξ» n -> n > 0} β_/2β <-well-founded {!!} {!!}
The type of the next hole is {x : β} β x > 0 β β x /2β <β² x
We can easily prove this proposition:
open import Data.Nat.Properties
suc-β/2β-β€β² : β n -> β suc n /2β β€β² n
suc-β/2β-β€β² 0 = β€β²-refl
suc-β/2β-β€β² (suc n) = sβ€β²s (βn/2ββ€β²n n)
>0-β/2β-<β² : β {n} -> n > 0 -> β n /2β <β² n
>0-β/2β-<β² {suc n} (sβ€s zβ€n) = sβ€β²s (suc-β/2β-β€β² n)
The type of the last hole is (x : β) β Dec (x > 0), we can fill it by _β€?_ 1.
And the final definition is
β_/2βs : β -> List β
β_/2βs = calls β_/2β <-well-founded >0-β/2β-<β² (_β€?_ 1)
Now you can recurse on a list, produced by β_/2βs, without any termination issues.
I encountered this sort of problem when trying to write a quick sort function in Agda.
While other answers seem to explain the problem and solutions more generally, coming from a CS background, I think the following wording would be more accessible for certain readers:
The problem of working with the Agda termination checker comes down to how we can internalize the termination checking process.
Suppose we want to define a function
func : Some-Recursively-Defined-Type β A
func non-recursive-case = some-a
func (recursive-case n) = some-other-func (func (f n)) (func (g n)) ...
In many of the cases, we the writers know f n and g n are going to be smaller than recursive-case n. Furthermore, it is not like the proofs for these being smaller are super difficult. The problem is more about how we can communicate this knowledge to Agda.
It turns out we can do this by adding a timer argument to the definition.
Timer : Type
Timer = Nat
measure : Some-Recursively-Defined-Type β Timer
-- this function returns an upper-bound of how many steps left to terminate
-- the estimate should be tight enough for the non-recursive cases that
-- given those estimates,
-- pattern matching on recursive cases is obviously impossible
measure = {! !}
func-aux :
(timer : Timer) -- the timer,
(actual-arguments : Some-Recursively-Defined-Type)
(timer-bounding : measure actual-arguments β€ timer)
β A
func-aux zero non-recursive-case prf = a
-- the prf should force args to only pattern match to the non-recursive cases
func-aux (succ t) non-recursive-case prf = a
func-aux (succ t) (recursive-case n) prf =
some-other-func (func-aux t (f n) prf') (func-aux t (g n) prf'') ... where
prf' : measure (f n) β€ t
prf' = {! !}
prf'' : measure (g n) β€ t
prf'' = {! !}
With these at hand, we can define the function we want as something like the following :
func : Some-Recursively-Defined-Type β A
func x with measure x
func x | n = func-aux n x (β€-is-reflexive n)
Caveat
I have not taken into account anything about whether the computation would be efficient.
While Timer type is not restricted to be Nat (but for all types with which we have a strong enough order relation to work with), I think it is pretty safe to say we don't gain much even if we consider such generality.