Obfuscation of Abstract Data-Types - Rowan

APPENDIX D. PROVING A TREE ASSERTION 173
False
= {definition of elem}
elem p [ ]
Step Case Now, consider a list xs. For the induction hypothesis, we suppose
that (D.1) is true (∀ts) • |ts| < |xs|. Let (ys, (z : zs)) = splitAt n xs
member p (mktree xs)
= {definition of mktree}
member p (Fork (mktree ys) z (mktree zs))
= {definition of member}
z == p ∨ member p (mktree ys) ∨ member p (mktree zs)
= {induction hypothesis, using (D.4)}
z == p ∨ elem p ys ∨ elem p zs
= {commutativity and associativity of ∨}
elem p ys ∨ (z == p ∨ elem p zs)
= {definition of elem}
elem p ys ∨ elem p (z : zs)
= {Equation (D.5)}
elem p (ys + (z : zs))
= {definition of xs, Equation (D.3)}
elem p xs
(D.1)
Base
Step
mktree
mktree
member
member
elem
IH (D.4)
∨
elem
(D.5)
xs (D.3)
For this tree it seems that we only use (D.3) once. But in fact, we use it
twice: once in the tree above and once in the proof of (D.4). This means that
we must declare (D.3) as a lemma and so we obtain
C (D.1) = 10 + C (D.4) + C (D.5) = 34
H (D.1) = 4 + max(H (D.4), 3 + H (D.5), 4 + H (D.3)) = 13