(* author: Jean-Christophe Filliâtre *)
(** Correctness proof of Floyd's cycle-finding algorithm, also known as the "tortoise and the hare"-algorithm (see http://en.wikipedia.org/wiki/Floyd's_cycle-finding_algorithm)  If $f:A\rightarrow A$ is a function over a finite set $A$, then the iterations of $f$ from $x_0\in A$ will ultimately cycle. The following code finds out an integer $m$ such that $f^m(x_0)=f^{2m}(x_0)$ : << let rec race m x y = if x = y then m else race (m+1) (f x) (f (f y)) in race 1 (f x0) (f (f x0)) >> The difficulty is to prove $f$'s termination. *)
Require Export Arith.
Require Export Omega.
Open Scope nat_scope.
(** Let [f] be a function over a set [A] *)
Parameter A : Set.
Parameter eq_A_dec : forall (x y:A), {x=y}+{~x=y}.
Parameter f : A -> A.
Parameter x0 : A.
(** We consider the sequence $x_i = f^i(x_0)$ *)
Fixpoint x (i:nat) { struct i } : A := match i with
| O => x0
| S j => f (x j)
end.
(** We assume this sequence cycles after [lambda+mu] iterations, [mu] being the length of the cycle (we actually don't require [lambda] and [mu] to be minimal, because it is not needed for the remaining of the proof *)
Parameter lambda : nat.
Parameter mu : nat.
(** Hilbert's epsilon operator. *)
Parameter epsilon : (nat -> Prop) -> nat.
(** The distance between [x (2m)] and [x m] defined using [epsilon] *)
Definition sep_x2m_xm m i := x (2*m+i) = x m.
Definition min P i := P i /\ forall j, P j -> i <= j.
Definition dist_x2m_xm m := epsilon (min (sep_x2m_xm m)).
(** Existence of this distance whenever [lambda <= m] *)
(** Variant to prove the termination of Floyd's algorithm: - either [x m] has not entered the loop yet and [lambda-m] is decreasing - or bot [x m] and [x (2m)] are inside the loop and the distance between [x (2m)] and [x m] is decreasing Thus we use a lexicographic order. *)
Definition variant m := (lambda - m, dist_x2m_xm m).
Definition lex x y := fst x < fst y \/ (fst x = fst y /\ snd x < snd y).
(** Correctness proof *)

Theorem rec_call_is_wf :
forall m, x m <> x (2*m) -> lex (variant (S m)) (variant m).